joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028d7a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10028de9
cmp byte [0x1003cdfb], 0
jne 0x10028d97
cmp byte [0x1003cdfa], 0
je 0x10028dd0
push edi
lea eax, [esi + 4]
mov edi, 0x1003e5f8
push eax
push str.ASM_LocalFree__s
push edi
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028dbf
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028dcf
push edi
call fcn.10005eb0
pop ecx
pop edi
push esi
call fcn.10028dec
push esi
push dword [esi + 0x50]
call fcn.1001ca56
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
pop esi
pop ebp
ret
Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1001ca56
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1001ca56
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.1001ca56
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.1001ca56
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1001ca56
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.1001ca56
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x415fa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x415fb2
pop dword [ebp - 0x48]
mov eax, 0x415fb2
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3eba0
push 0
mov eax, 0xf5ab807b
sub eax, 0xf5692e63
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x1628582
add ecx, 0xfe9dc612
mov edx, eax
mov ebx, 0xb978808
sub ebx, 0xb543408
add ebx, dword [ebp - 0x48]
mov esi, 0x29c57f71
sub esi, 0xe0fff66c
mov dword [ebp - 0x10], 0x3e113b50
mov edi, dword [ebx]
sub dword [ebp - 0x3c], ecx
add edi, esi
xor dword [ebp - 0x10], edx
mov dword [edx], edi
add dword [ebp - 0x3c], eax
add edx, 0xb34d338
sub edx, 0xb34d334
add ebx, 0xace0b15f
sub ebx, 0xace0b15b
loop 0x41600c
add eax, 0xcc36a245
sub eax, 0xcc358122
mov ebx, eax
add eax, 0x3e0c1fe5
add eax, 0xc1f3e020
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100024cd
pop dword [ebp - 8]
mov eax, 0x8664b175
add eax, 0x899b7358
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x211c6141
add dword [ebp - 0x18], 0x2d35e40a
mov dword [ebp - 0x14], 0x86a2296f
add dword [ebp - 0x14], 0xab9122d6
mov dword [ebp - 0x10], 0x5ab63ec9
add dword [ebp - 0x10], 0xf1960565
mov dword [ebp - 0xc], 0x60d6790c
add dword [ebp - 0xc], 0x9f2986f4
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x811a2a1d
sub dword [ebp - 0x18], 0xca7c0c7
mov dword [ebp - 0x14], 0x710e78c4
sub dword [ebp - 0x14], 0x2fa2174f
mov dword [ebp - 0x10], 0x4697e66
sub dword [ebp - 0x10], 0xa0fa11fa
mov dword [ebp - 0xc], 0xea2e0cb7
add dword [ebp - 0xc], 0x15d1f349
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x297a7e77
sub eax, 0x197a3dfb
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3643b
push 0
call eax
mov ecx, 0x46d9
xor esi, esi
add esi, eax
mov edx, 0x923adf2e
add edx, 0x7dc5b6d2
add edx, dword [ebp - 8]
mov ebx, 0x93d886c4
add ebx, 0x5eedd4ac
sub dword [ebp - 4], 0xe9e08ca7
mov edi, dword [edx]
xor dword [ebp - 4], 0xb7e5b6ca
add edi, ebx
add dword [ebp - 4], ebx
mov dword [esi], edi
sub dword [ebp - 4], eax
add esi, 4
add edx, 4
loop 0x100025e6
add eax, 0x64022d50
sub eax, 0x64011f19
xor ebx, ebx
add ebx, eax
add eax, 0xc091db9d
add eax, 0x3f6e2468
mov ecx, 0xc9be9e5b
add ecx, 0x464161a5
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x100032c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007040]
jne 0x100032d2
repz ret
jmp fcn.100036ab
Function at 0x4027c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a6c
test esi, esi
jne 0x4027f6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b5c
jmp 0x402814
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402664
mov edi, eax
test esi, esi
je 0x402814
cmp dword [ebx], 0
je 0x402814
dec esi
jmp 0x4027fd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402fec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40f010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403084
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403064
xor eax, eax
push ebp
push 0x40305d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403064
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x40f010]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40f010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4038ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x410034], 0
je 0x40394d
cmp word [0x410208], 0xd7b2
jne 0x403915
cmp dword [0x410210], 0
jbe 0x403915
mov eax, 0x410204
call dword [0x410220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40f05c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403974
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40f01c], 0
jne 0x403969
push 0
push 0x40f054
push 0x40f05c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404680
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4046e6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403bd8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ee0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4046d0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4046ed
lea eax, [ebp - 0x10]
call fcn.00403a6c
ret
Function at 0x40526c
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403de0
xor eax, eax
push ebp
push 0x4052c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00403df0
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052c7
lea eax, [ebp - 4]
call fcn.00403a6c
ret

Function at 0x4052d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403de0
mov eax, dword [ebp - 8]
call fcn.00403de0
xor eax, eax
push ebp
push 0x40533e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403df0
push eax
mov eax, dword [ebp - 4]
call fcn.00403df0
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405345
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a90
ret

Function at 0x405d78
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403de0
xor eax, eax
push ebp
push 0x405e16
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov ecx, esi
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00405cb0
test al, al
je 0x405e00
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
call fcn.00403df0
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateMailslotA
mov dword [0x490ac0], eax
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov dword [0x490ac4], eax
cmp dword [0x490ac0], 0xffffffff
je 0x405dfa
cmp dword [0x490ac4], 0xffffffff
jne 0x405dfe
xor ebx, ebx
jmp 0x405e00
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e1d
lea eax, [ebp - 4]
call fcn.00403a6c
ret
Function at 0x40a727
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp 0x40a727
cmp dword [esp + 8], 2
je 0x40a7c4
push ebp
mov ebp, esp
sub esp, 4
push edi
push esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [fcn.00405e6d]
lea ecx, [0x40a727]
sub ecx, eax
push ecx
lea eax, [fcn.00405e6d]
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [0x405e74]
mov ecx, dword [0x490cd0]
mov dword [eax], ecx
call fcn.00405e6d
mov ebx, eax
mov edi, 5
lea esi, [0x40649d]
push esi
pop esi
lodsd eax, dword [esi]
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov edx, eax
lodsd eax, dword [esi]
mov dword [eax], edx
lodsd eax, dword [esi]
mov ecx, eax
lodsd eax, dword [esi]
push esi
mov esi, eax
push ecx
push edx
lodsd eax, dword [esi]
add eax, ebx
push eax
push edx
call sub.kernel32.dll_GetProcAddress
mov ecx, eax
lodsd eax, dword [esi]
mov dword [eax], ecx
pop edx
pop ecx
loop 0x40a793
dec edi
jne 0x40a77d
pop esi
call fcn.00405e6d
mov ebx, eax
push 2
push dword [ebp + 8]
call fcn.00408f98
pop ebx
pop esi
pop edi
leave
ret 8
push ebp
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405e6d
mov ebx, eax
push dword [ebp + 8]
call fcn.00409428
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x40acb4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40adff
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x490cd0], eax
mov esi, fcn.00405e64
xor ebx, ebx
lea ecx, [ebp - 4]
mov edx, 0xd
mov al, 0x20
call fcn.00403f34
jmp 0x40ad21
lea eax, [ebp - 4]
call fcn.00403e40
mov ecx, 0xd
mov edx, esi
call fcn.00404be8
mov eax, dword [ebp - 4]
mov edx, 0x40ae14
call fcn.00403d3c
sete bl
test bl, bl
je 0x40ad20
mov eax, esi
sub eax, 0x2c
mov dword [0x490cd0], eax
inc esi
test bl, bl
je 0x40acee
sub esi, 0x26
push 0x1c
lea eax, [ebp - 0x24]
push eax
push fcn.00405e64
call sub.kernel32.dll_VirtualQuery
lea eax, [ebp - 8]
push eax
push 0x40
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40ade9
mov eax, dword [0x492c90]
call fcn.00403bf0
push eax
mov eax, 0x492c90
call fcn.00403e40
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404be8
add esi, 0x21
mov eax, 0x40ae2c
call fcn.0040abac
test eax, eax
jne 0x40ad88
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esi], eax
xor ebx, ebx
lea ecx, [ebp - 4]
mov edx, 0x19
mov al, 0x20
call fcn.00403f34
jmp 0x40ade5
lea eax, [ebp - 4]
call fcn.00403e40
mov ecx, 0x19
mov edx, esi
call fcn.00404be8
mov eax, dword [ebp - 4]
mov edx, 0x40ae3c
call fcn.00403d3c
sete bl
test bl, bl
je 0x40ade4
mov eax, dword [0x492c94]
call fcn.00403bf0
push eax
mov eax, 0x492c94
call fcn.00403e40
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404be8
inc esi
test bl, bl
je 0x40ad9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ae06
lea eax, [ebp - 4]
call fcn.00403a6c
ret
Function at 0x40af38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
push 0x3f1
pop ebx
mov eax, 0xfa230000
mov edx, 0x633af89e
mov edi, 0x3481a3c1
pop esi
push esi
push 8
pop ecx
lodsw ax, word [esi]
shl eax, 3
add eax, edi
xor edx, eax
add dh, cl
sete al
inc al
add edi, eax
loop 0x40af5c
add edx, edi
dec ebx
jne 0x40af57
mov eax, edx
pop esi
pop esi
pop ebx
pop edi
pop ebp
ret 4

Function at 0x40c884
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
add esp, 0xfffffff4
push esp
push 1
push 0
push 0x40c918
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
push 0
push 0
push 0
push 0
push 0x40c970
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
jne 0x40c911
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40c984
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
push 0x40c970
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0xc
pop ebx
ret

Function at 0x40c9dc
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call 0x404af0
test eax, eax
je 0x40ca5e
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x40ca0e
cmp dword [esp + 8], 1
jb 0x40ca0a
mov bl, 9
jmp 0x40ca5e
mov bl, 7
jmp 0x40ca5e
cmp eax, 3
jbe 0x40ca5c
cmp dword [esp + 0x10], 2
je 0x40ca58
and dword [esp + 0xc], 0xffff
mov eax, dword [esp + 8]
cmp eax, 0x5a
jae 0x40ca54
cmp eax, 0xa
jb 0x40ca42
cmp dword [esp + 0xc], 0x8ae
jb 0x40ca3e
mov bl, 6
jmp 0x40ca5e
mov bl, 5
jmp 0x40ca5e
cmp dword [esp + 0xc], 0x3e8
jb 0x40ca50
mov bl, 4
jmp 0x40ca5e
mov bl, 3
jmp 0x40ca5e
mov bl, 8
jmp 0x40ca5e
mov bl, 2
jmp 0x40ca5e
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x40caf0
Capabilities:
Get common file path
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor eax, eax
mov dword [ebp - 0x10c], eax
mov ebx, 0x492cc4
xor eax, eax
push ebp
push 0x40cc87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x40cc9c
call fcn.00403ac0
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c08
push 0x105
lea eax, [ebp - 0x105]
push eax
push 0x40cca4
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebx + 4]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bd8
lea eax, [ebx + 8]
mov edx, 0x40ccb4
call fcn.00403ac0
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 4]
call fcn.004053c0
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0xc]
call fcn.00403ac0
lea eax, [ebx + 0xc]
call fcn.00405590
lea eax, [ebx + 0x10]
mov edx, 0x40ccc8
call fcn.00403ac0
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c08
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebx + 0x14]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bd8
lea eax, [ebx + 0x14]
call fcn.00405590
lea eax, [ebx + 0x18]
mov edx, 0x40ccdc
call fcn.00403ac0
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c08
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebx + 0x1c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bd8
lea eax, [ebx + 0x1c]
call fcn.00405590
lea eax, [ebx + 0x20]
mov edx, 0x40ccf0
call fcn.00403ac0
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c08
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebx + 0x24]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bd8
lea eax, [ebx + 0x24]
call fcn.00405590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc8e
lea eax, [ebp - 0x10c]
call fcn.00403a6c
ret
Function at 0x40d18c
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xffffffe4
mov eax, dword [0x40d29c]
mov dword [esp + 0x14], eax
mov eax, dword [0x40d2a0]
mov dword [esp + 0x18], eax
mov ebx, 8
push esp
push 0xf003f
push 0
push 0x40d2a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x40d2d0
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x40d2d8
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [0x492c7c]
call fcn.00403df0
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.advapi32.dll_RegCreateKeyExA
push ebx
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.advapi32.dll_RegSetValueExA
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [0x492c7c]
call fcn.00403df0
push eax
mov eax, dword [esp + 0x28]
push eax
call sub.advapi32.dll_RegCreateKeyExA
push ebx
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x1c
pop ebx
ret

Function at 0x40d2e0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x40d345
push ebx
call sub.advapi32.dll_LockServiceDatabase
mov edi, eax
push 0xf01ff
push esi
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x40d339
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
cmp dword [esp + 4], 4
jne 0x40d32d
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
push esi
call sub.advapi32.dll_DeleteService
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_UnlockServiceDatabase
add esp, 0x1c
pop edi
pop esi
pop ebx
ret