joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a7c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x406ac9
cmp dword [ebx + 4], 0x10000
jge 0x406abf
push 0x400
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
mov eax, dword [eax]
call fcn.00405fc4
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047e4
jmp 0x406ac9
mov eax, esi
mov edx, dword [ebx + 4]
call fcn.004048e4
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x40928c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x41e9c8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
call fcn.00406e74
mov edx, dword [0x4a575c]
cmp eax, dword [edx]
je 0x41ea09
call fcn.00406e74
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x4a5538]
mov dl, 1
mov eax, dword [0x414d74]
call fcn.0040c180
call fcn.004040b0
cmp byte [0x4a6a04], 0
je 0x41eae5
push 0x4a6a08
call fcn.00406dec
xor eax, eax
push ebp
push 0x41eade
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a3510], 0
je 0x41ea42
mov eax, dword [0x4a3510]
cmp dword [eax + 8], 0
jg 0x41ea46
xor eax, eax
jmp 0x41ea48
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41eac6
jmp 0x41eab4
xor edx, edx
mov eax, dword [0x4a3510]
call fcn.0041686c
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [0x4a3510]
call fcn.0041675c
xor eax, eax
push ebp
push 0x41ea91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0x24]
call dword [ebx + 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41eaa8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, dword [0x4a3510]
cmp dword [eax + 8], 0
jg 0x41ea53
mov byte [0x4a6a04], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41eae9
push 0x4a6a08
call sub.KERNEL32.DLL_lstrcpynA
ret
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421638
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42163e
ret
Function at 0x4339a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x433a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004333f0
call fcn.00406f14
mov ebx, eax
push 0
call sub.KERNEL32.DLL_CreateThread
call fcn.00406f14
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4339c9
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00433048
cmp dword [ebp - 4], 0
je 0x433a0b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404ba4
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call fcn.004077bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433a28
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x465f30
Capabilities:
Create thread

Disassembly:
push eax
call sub.KERNEL32.DLL_CreateThread
ret
Function at 0x47c5ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47c5da
mov eax, ebx
call fcn.0047d064
cmp dword [ebx + 0x3c], 0
je 0x47c5d3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47c64b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x47c63d
cmp dword [ebx + 8], 0
je 0x47c5fc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x47c60e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47c63d
cmp dword [ebx + 8], 0
je 0x47c5ef
cmp eax, 3
je 0x47c621
dec eax
jne 0x47c5ef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47c5ef
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x47c5ef
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47c669
cmp dword [ebx + 0x10], 0xcc
je 0x47c669
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047c674
pop ebx
ret

Function at 0x4914a4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0x5f
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4914c5
mov bl, 1
jmp 0x4914c7
xor ebx, ebx
xor eax, eax
push ebp
push 0x4914df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4914eb
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4921d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4923c6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
mov eax, esi
call fcn.00404ba4
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4923a3
mov eax, dword [ebp - 8]
inc eax
call fcn.00402794
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49239c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49236e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4923d8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49236e
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.004077e0
mov word [ebp - 0x14], ax
mov byte [ebp - 0x21], 1
mov eax, 0x4a50a8
mov dword [ebp - 0x2c], eax
mov eax, 0x4a50ac
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x12]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
lea edx, [ebp - 0x48]
mov ecx, 2
mov eax, 0x4923fc
call fcn.00409e90
xor eax, eax
push ebp
push 0x492353
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00404ba4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x492349
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, 0x492420
call fcn.00404af0
jne 0x492349
mov eax, dword [ebp - 0x30]
push dword [eax]
push 0x492430
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x1c]
call fcn.004048e4
push dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404a6c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49235d
add dword [ebp - 0x30], 4
add dword [ebp - 0x2c], 4
dec byte [ebp - 0x21]
jne 0x4922a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4923a3
mov edx, dword [ebp - 8]
inc edx
mov eax, dword [ebp - 0x10]
call fcn.004027b4
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x54], 0
setne bl
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4923cd
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00404718
lea eax, [ebp - 0x20]
call fcn.004046f4
ret
Function at 0x4925f4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov edi, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, edi
call fcn.004046f4
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x492660
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x492654
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00409914
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00409914
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x492633
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x430a1f
pop dword [ebp - 0x4c]
mov eax, 0x61325c0
add eax, 0xfa2fe45f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3a1ff
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x45b6
mov edi, eax
mov esi, 0xd9fefd1d
sub esi, 0xd9ba371d
add esi, dword [ebp - 0x4c]
mov ebx, 0xc9d62b4a
sub ebx, 0xe15d0708
mov edx, dword [esi]
mov dword [ebp - 0x1c], 0x3e902942
xor edx, ebx
mov dword [ebp - 8], 0xc249ad04
mov dword [edi], edx
xor dword [ebp - 0x3c], esi
add edi, 0x672aa29
sub edi, 0x672aa25
add esi, 0xee7f331
add esi, 0xf1180cd3
loop 0x430a73
add eax, 0x98a80868
add eax, 0x67590143
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x5d9b21b8
Capabilities:
Encode data using xor

Disassembly:
push ss
and dword [ebp + 0x54], esi
xchg ebx, eax
push ss
pop edi
sub dl, cl
mov bh, 0x98
push edx
pop es
fmul qword [ebx]
sal dword [ecx*8 + 0x564745f1], cl
sbb dword [ebp + eax + 0x51], edi

Function at 0x5d9b2bf8
Capabilities:
Encode data using xor

Disassembly:
out 0xe3, eax
inc ebp
xor eax, 0x73f4ad57
mov edx, 0x251bdc99
stosd dword es:[edi], eax
adc al, 0x8e
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041a810
mov eax, dword [0x424018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x2004]
push 0x2000
push edx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004199f6
mov esp, ebp
pop ebp
ret

Function at 0x401540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp + 0xc]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x401593
cmp eax, 0x3e5
je 0x401593
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x4015d3
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4015b1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov dword [ebp - 4], 0
jmp 0x4015da
push 1
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x4015da
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4015e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4015f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp + 8]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x1000
push edx
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x401644
cmp eax, 0x3e5
je 0x401644
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401684
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401662
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0
jmp 0x40168b
push 1
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40168b
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x401696
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x206
mov dword [ebp - 0xc], 1
test edi, edi
je 0x402696
test esi, esi
je 0x402696
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402696
lea ecx, [ebp - 4]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402696
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [esi + eax*2], 0
je 0x40269c
xor ecx, ecx
mov word [esi + eax*2], cx
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4026b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test esi, esi
je 0x40270b
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40270b
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.JHI_LOG
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402711
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40d550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x40d58f
mov eax, dword [ebp - 4]
push 0
and eax, 0xffff02ff
lea ecx, [ebp - 8]
push ecx
or eax, 0x2ff
push 4
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d598
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0040d5d0
test al, al
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40d5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a8f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x424018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, edx
xor ecx, ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], ecx
cmp ebx, ecx
je 0x40d681
mov eax, dword [edi + 0x10]
cmp eax, ecx
je 0x40d681
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
mov eax, dword [edi + 0x10]
add esp, 4
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, dword [edi + 0x10]
mov edi, dword [edi + 0xc]
add esp, 0xc
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d673
cmp byte [esi + 3], 0
jne 0x40d673
movzx edx, word [esi + 6]
mov word [ebx], dx
mov ax, word [esi + 4]
mov word [ebx + 2], ax
mov cx, word [esi + 0xa]
mov word [ebx + 4], cx
movzx edx, word [esi + 8]
mov word [ebx + 6], dx
mov byte [ebp - 0x11], 1
test esi, esi
je 0x40d681
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d6a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x424018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
mov byte [ebp - 0x15], bl
cmp dword [ebp + 8], ebx
je 0x40d774
cmp dword [esi + 0x10], ebx
je 0x40d774
and ecx, 0xff00001d
or ecx, 0x1d
push ebx
mov dword [ebp - 0x24], ecx
and eax, 0xffff0203
lea ecx, [ebp - 0x20]
push ecx
or eax, 0x203
push 8
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d791
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, dword [esi + 0x10]
add esp, 4
push ecx
mov edi, eax
push ebx
push edi
call sub.MSVCR100.dll_memset
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
add esp, 0xc
push ebx
lea edx, [ebp - 0x1c]
push edx
push eax
push edi
push esi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d766
cmp byte [edi + 3], bl
jne 0x40d766
mov eax, dword [edi + 9]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ebp - 0x15], 1
cmp edi, ebx
je 0x40d774
push edi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d774
Function at 0x40e300
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41c68e
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x424018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x424018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
test byte [0x424c0c], 1
jne 0x40e369
or dword [0x424c0c], 1
mov dword [esp + 0x70], 0
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov dword [esp + 0x70], 0xffffffff
cmp byte [0x424c14], 0
je 0x40e379
xor eax, eax
jmp 0x40e4ff
call fcn.00417440
test al, al
jne 0x40e3c0
push 0x41eee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e3b6
push 0
push 0
push 0
push 0
push 0
push 0xc0000005
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 0x300
jmp 0x40e4ff
call fcn.0040deb0
test eax, eax
jne 0x40e4ff
call fcn.00403df0
cmp byte [eax + 5], 0
je 0x40e3f6
push 0x1010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
lea esi, [esp + 0x48]
call fcn.0040e2a0
test al, al
jne 0x40e41c
push 0xc0000005
push 1
call fcn.0040c6e0
add esp, 8
mov eax, 0x300
jmp 0x40e4ff
call fcn.00403df0
mov esi, eax
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x18
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x74]
push 0x18
push edx
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov eax, dword [esi]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edi, [esp + 0x48]
lea esi, [esp + 0x14]
call fcn.00415660
mov edi, eax
test edi, edi
jne 0x40e4d3
call fcn.00403df0
mov ebx, eax
mov ecx, dword [ebx]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebx]
lea edi, [ebx + 0x40]
mov ecx, 0xd
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x44]
push eax
call dword [esp + 0x18]
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e4d3
call fcn.004090b0
mov edi, eax
call fcn.00402990
test al, al
jne 0x40e4ae
mov edi, 0x601
jmp 0x40e4d3
call fcn.0040ac00
mov ecx, eax
call fcn.0040cae0
mov edi, eax
test edi, edi
jne 0x40e4d3
call fcn.0040fdc0
push 1
call fcn.00403df0
mov esi, eax
call fcn.0040de80
call fcn.00403df0
cmp byte [eax + 5], 0
je 0x40e4fd
push edi
push 0x1011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, edi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004199f6
mov esp, ebp
pop ebp
ret