joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407730
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x130]
xor ebx, ebx
push 0xff
lea eax, [esp + 0x29]
push ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
mov byte [esp + 0x30], bl
call fcn.0041c150
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push edi
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407866
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x407866
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push ebp
mov ebp, 0x100
lea ecx, [ecx]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x54], ebx
call edi
test eax, eax
jne 0x407818
cmp dword [esp + 0x10], ebx
je 0x407818
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x407818
cmp dword [esp + 0x10], ebx
jbe 0x407818
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00407730
push ebp
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.0041c150
add esp, 0x14
jmp 0x4077b0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x40785b
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0041310b
add esp, 0x11c
ret
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x407842
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041310b
add esp, 0x11c
ret

Function at 0x407880
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
mov esi, eax
test esi, esi
jne 0x40788b
pop esi
pop ecx
ret
push edi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREISA
push closesocket
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4078da
mov eax, dword [esp + 8]
test eax, eax
mov edi, eax
je 0x4078da
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4078da
pop edi
lea eax, [esi + 1]
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4078e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARELcDebug
push closesocket
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40794d
push esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.LogFile
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x407948
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x407955
mov eax, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
add esp, 0xc
ret

Function at 0x407960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
test esi, esi
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 8], htonl
mov dword [esp + 4], 0
jne 0x407983
xor eax, eax
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4079a7
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40797c
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push esi
push eax
call edi
test eax, eax
jne 0x407a26
test ebp, ebp
jne 0x4079d1
add dword [esp + 0xc], 1
jmp 0x407a26
mov ebx, dword [esp + 0x20]
add ebx, 0xffffffff
cmp dword [esp + 0xc], ebx
jbe 0x4079e2
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push ebp
push 0
push 0
push esi
push edx
call edi
cmp eax, 0xea
jne 0x407a1a
cmp dword [esp + 0x18], 0
je 0x407a11
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407a11
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
pop ebp
add esp, 8
ret
test eax, eax
je 0x407a26
mov dword [esp + 0xc], 0
cmp dword [esp + 0x18], 0
je 0x407a3c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407a3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x407a50
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor ebx, ebx
test ebp, ebp
push edi
mov edi, eax
je 0x407aeb
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x407aeb
cmp edi, 0xffffffff
jne 0x407a84
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407a76
sub eax, edi
lea edi, [eax + 1]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x407ac3
call fcn.00407700
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
je 0x407ada
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push edi
push eax
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
call ebx
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407ad6
mov eax, dword [esp + 0x20]
push edi
push esi
push eax
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
jne 0x407ae4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x407b70
Capabilities:
Create service
Persist via windows service

Disassembly:
push edi
push 0x10000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x407b88
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
mov ecx, dword [esp + 0x14]
push ebp
push esi
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push ecx
push 0xf01ff
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
xor ebx, ebx
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ebp, eax
je 0x407bd2
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
ret

Function at 0x407bf0
Capabilities:
Delete service

Disassembly:
push ecx
push edi
push 0x10000000
push 0
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x407c12
pop edi
pop ecx
ret
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x407c37
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
je 0x407c4c
push esi
call ebp
push edi
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x407c60
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x28
push ebx
push edi
xor edi, edi
push 0x10000000
push edi
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0xc], ebx
jne 0x407c8a
pop edi
xor eax, eax
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x34]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, edi
je 0x407caf
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0xc], edi
mov dword [esp + 0x14], eax
je 0x407cf9
cmp dword [esp + 0x3c], edi
je 0x407cf9
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x64
call ebx
lea ecx, [esp + 0x1c]
push ecx
push esi
add edi, 1
call ebp
test eax, eax
je 0x407cf4
cmp dword [esp + 0x20], 2
jne 0x407cf4
cmp edi, 0xbb8
jb 0x407cd2
mov ebx, dword [esp + 0x14]
pop ebp
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x407d06
push esi
call edi
push ebx
call edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x28
ret

Function at 0x407d20
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x24
push ebx
push ebp
push 0x10000000
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x407d44
pop ebp
pop ebx
add esp, 0x24
ret
push esi
push edi
push 0xf01ff
push str.themes
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x407d6d
lea eax, [esp + 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
mov dword [esp + 0x14], eax
je 0x407da5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x1f4
call edi
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
test eax, eax
je 0x407da1
cmp dword [esp + 0x1c], 3
je 0x407d87
mov ebx, dword [esp + 0x10]
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x407db2
push esi
call edi
push ebx
call edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x407dd0
Capabilities:
Modify service

Disassembly:
push ebp
push edi
push 0x10000000
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x407dea
pop edi
pop ebp
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x407e20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ebx, eax
je 0x407e33
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
ret

Function at 0x407e50
Capabilities:
Query service configuration

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push closesocket
xor ebp, ebp
push ebp
push ebp
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x407e78
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
push 1
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x407f20
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407ec7
push 0x147
push str.cutil_service_GetConfig
push 0x1000
push esi
mov ecx, str..Cutil_Service.c
call fcn.00408090
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x1000
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x407f03
test edi, edi
je 0x407efe
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x407efe
mov edx, edi
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x407ef0
mov ebp, 1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x407f20
push esi
call fcn.00408470
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
je 0x407f35
push ebx
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x407f50
Capabilities:
Query service status

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push edi
push closesocket
push 0
push 0
mov ebx, eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x407f80
pop edi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x3c]
push esi
push 4
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x407fcb
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x407fcb
test ebx, ebx
je 0x407fb8
mov eax, dword [esp + 0x1c]
mov dword [ebx], eax
test ebp, ebp
je 0x407fc3
mov ecx, dword [esp + 0x34]
mov dword [ebp], ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
je 0x407fe0
push esi
call ebp
push edi
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x408680
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov esi, eax
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x408709
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jle 0x408709
push 0x42602c
push esi
call fcn.00413bf6
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x408711
push esi
push str.open_xml_file__s
push 0x72
push str..Cutil_Xml.c
push 1
mov ecx, str.cutil_xml_import_from_file_fre
call fcn.00405d70
add esp, 0x14
push esi
push str.open_xml_file__s
push 0x72
push str..Cutil_Xml.c
push 1
mov ecx, str.cutil_xml_import_from_file_fre
call fcn.00405a90
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [ebp + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push 1
mov edi, eax
push ebp
push edi
call fcn.00414cb9
push ebx
call fcn.00413ab6
add esp, 0x14
push edi
call fcn.00408630
add esp, 4
mov esi, eax
call fcn.00408020
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40a270
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x2c
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x40a8c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a94b
push 0x8ef8
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, str.127.0.0.1
mov word [esp + 0xa], ax
call fcn.0040ab70
push eax
call sub.WS2_32.dll_htonl
push 0x10
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40a965
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call sub.WS2_32.dll_closesocket
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.0041310b
add esp, 0x1ac
ret
mov ecx, dword [esp + 0x1ac]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041310b
add esp, 0x1ac
ret

Function at 0x40ab70
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1b0
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, ecx
push ebx
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ac01
lea eax, [esp + 0x18]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40abe9
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0041d360
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0041310b
add esp, 0x1b0
ret
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0041310b
add esp, 0x1b0
ret
call fcn.0040a980
mov ecx, dword [esp + 0x1ac]
pop ebx
xor ecx, esp
call fcn.0041310b
add esp, 0x1b0
ret

Function at 0x40ac20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor ecx, ecx
xor esi, esi
test ebp, ebp
jbe 0x40ac61
push ebx
nop
mov bl, byte [ecx + edi]
mov al, bl
shl al, 4
shr bl, 4
add al, bl
mov byte [ecx + edi], al
mov dl, byte [esi + str.Infogo]
xor dl, al
mov byte [ecx + edi], dl
lea eax, [esi + 1]
xor edx, edx
mov esi, 6
div esi
add ecx, 1
cmp ecx, ebp
mov esi, edx
jb 0x40ac30
pop ebx
pop esi
mov eax, edi
pop ebp
ret
Function at 0x40b3a0
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
push str.IsWow64Process
push str.kernel32
mov esi, eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40b3d8
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [esp + 8], 0
push 0x104
push esi
jne 0x40b3ef
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esi, 0xffffffff
mov ecx, esi
lea ebx, [ebx]
mov dl, byte [ecx + 1]
add ecx, 1
test dl, dl
jne 0x40b400
mov edx, dword [str.SysWOW64]
mov dword [ecx], edx
mov edx, dword [0x4264f0]
mov dword [ecx + 4], edx
mov dx, word [0x4264f4]
pop edi
mov word [ecx + 8], dx
add eax, 9
pop esi
pop ecx
ret
Function at 0x40bb40
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x28
push esi
lea eax, [esp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bb7d
lea ecx, [esp + 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40bb84
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x28
ret

Function at 0x40bc90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push ebp
push esi
push 0x40
push 0x101000
xor ebp, ebp
push edi
push ebp
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebp
je 0x40bd11
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [esp + 0xc]
push eax
push 0x40
push edi
push esi
push ebx
call ebp
test eax, eax
je 0x40bd11
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edi
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40bd02
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push ecx
push edi
push esi
push ebx
call ebp
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
push edi
push esi
push ebx
call ebp
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x40bd20
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push eax
push 0
push 0x1f0fff
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40bdf4
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40bd50
sub eax, edx
lea edi, [eax + 1]
push esi
call fcn.0040bc90
mov esi, eax
add esp, 4
test esi, esi
je 0x40bded
push str.kernel32
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x426590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push eax
push 0
lea edx, [esp + 0x24]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x40bded
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x40be00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0x128
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0041c150
add esp, 0xc
push edi
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40be7b
lea esp, [esp]
lea edx, [esp + 0x2c]
push str.svchost.exe
push edx
call fcn.004157a3
add esp, 8
test eax, eax
je 0x40be77
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40be50
jmp 0x40be7b
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40bec1
call fcn.0040bc30
test eax, eax
je 0x40bec1
call fcn.0040bb40
mov ecx, ebx
mov eax, edi
call fcn.0040bd20
mov esi, eax
call fcn.0040bbe0
test esi, esi
je 0x40bec1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0041310b
add esp, 0x134
ret
mov ecx, dword [esp + 0x134]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0041310b
add esp, 0x134
ret