joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a20
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x248
mov eax, dword [str._q_]
xor eax, esp
push ebp
push esi
mov esi, dword [esp + 0x254]
push esi
mov dword [esp + 0x250], eax
lea eax, [esp + 0x14c]
push str._s.
push eax
call fcn.0040f6f9
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
test ebp, ebp
je 0x402bd6
cmp ebp, 0xffffffff
je 0x402bd6
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor ebx, ebx
lea eax, [esp + 0x3c]
push 0x41b968
push eax
call fcn.0040f281
add esp, 8
test eax, eax
je 0x402b1c
lea ecx, [esp + 0x3c]
push 0x41b964
push ecx
call fcn.0040f281
add esp, 8
test eax, eax
je 0x402b1c
lea edx, [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x158]
push str._s_s
push eax
call fcn.0040f6f9
mov eax, dword [esp + 0x20]
add esp, 0x10
test al, 1
je 0x402ae8
and eax, 0xfffffffe
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x402b02
lea edx, [esp + 0x150]
push edx
call fcn.00402a20
add esp, 4
test eax, eax
je 0x402b1c
jmp 0x402b1a
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402b1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402a83
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
test al, 1
je 0x402b46
and eax, 0xfffffffe
push eax
push esi
call edi
push esi
call fcn.0040f847
add esp, 4
test eax, eax
je 0x402bbb
call fcn.0040fa23
cmp dword [eax], 0x29
jne 0x402b7d
mov ebx, 0x91
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0040f175
add esp, 0x248
ret
call fcn.0040fa23
cmp dword [eax], 2
jne 0x402ba7
mov ebx, 3
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0040f175
add esp, 0x248
ret
call fcn.0040fa23
mov esi, dword [eax]
xor ebx, ebx
cmp esi, 0xd
setne bl
dec ebx
and ebx, 6
dec ebx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0040f175
add esp, 0x248
ret
mov ecx, dword [esp + 0x24c]
pop esi
pop ebp
xor ecx, esp
mov eax, 3
call fcn.0040f175
add esp, 0x248
ret

Function at 0x402d00
Capabilities:
Persist via run registry key

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
lea eax, [esp + 4]
push eax
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov dword [esp + 0x14], 0
call fcn.00401cc0
add esp, 0x10
test eax, eax
jne 0x402d4a
mov esi, dword [esp + 4]
test esi, esi
je 0x402d4a
push edi
push esi
call fcn.00401aa0
push esi
mov edi, eax
call fcn.0040f5cf
add esp, 8
mov eax, edi
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ecx
ret
Function at 0x402d60
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x402d92
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
push esi
push 0x2c
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x402dbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
je 0x402ec8
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x402df5
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
cmp eax, 3
jne 0x402e46
lea ebx, [ebx]
mov eax, dword [esp + 0x2c]
cmp eax, 0x2710
jae 0x402e10
mov eax, 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
je 0x402ec8
cmp dword [esp + 0x18], 1
je 0x402ddf
call ebp
sub eax, dword [esp + 0x10]
cmp eax, 0xea60
ja 0x402ed2
cmp dword [esp + 0x18], 3
je 0x402e00
push esi
push ebx
call fcn.004012b0
add esp, 8
lea eax, [esp + 0x14]
push eax
push 1
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x402e76
call ebp
mov edi, eax
test edi, edi
jne 0x402efa
cmp dword [esp + 0x18], 1
je 0x402efa
lea ecx, [ecx]
mov eax, dword [esp + 0x2c]
cmp eax, 0x2710
jae 0x402e90
mov eax, 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x402eeb
cmp dword [esp + 0x18], 1
je 0x402ef1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0xea60
ja 0x402ef5
cmp dword [esp + 0x18], 1
jne 0x402e80
jmp 0x402efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x402efa
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, 0x41d
pop ebx
add esp, 0x20
ret
call ebp
mov edi, eax
jmp 0x402efa
xor edi, edi
jmp 0x402efa
mov edi, 0x41d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x403740
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x41a298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call section..text
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0xa
cmp eax, edi
mov dword [esp + 0x30], edi
je 0x403798
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.00403290
jmp 0x4037a7
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00403570
add esp, 8
test eax, eax
je 0x4037b6
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
xor ebx, ebx
cmp eax, edi
jle 0x403861
mov ecx, dword [ebp + ebx*4]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403890
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4037f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4037fb
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x403852
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
je 0x40384e
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40384e
push str.WTSTerminateProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403843
mov edx, dword [ebp + ebx*4]
push edi
push edx
push edi
call eax
test eax, eax
je 0x403843
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x403852
inc dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
inc ebx
xor edi, edi
cmp ebx, eax
jl 0x4037c8
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, edi
setle al
cmp ebp, edi
mov esi, eax
je 0x40387b
push ebp
call fcn.0040f5cf
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403806
Function at 0x403960
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x41a2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xa
mov dword [esp + 0x40], ebx
call section..text
test eax, eax
je 0x4039b0
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00403290
jmp 0x4039c3
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.00403570
mov ebp, dword [esp + 0x50]
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x403ae9
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4039f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0xa
mov edx, dword [eax + ecx*4]
lea eax, [esp + 0x24]
push eax
push 0x4036e0
mov dword [esp + 0x2c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x403abd
nop
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + ebx*4]
push 0
push 0xf060
push 0x112
push edx
call esi
push 0x32
call edi
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + ebx*4]
push ecx
call ebp
test eax, eax
je 0x403a6c
mov edx, dword [esp + 0x28]
mov eax, dword [edx + ebx*4]
push 0
push 0
push 0x10
push eax
call esi
push 0x32
call edi
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + ebx*4]
push edx
call ebp
test eax, eax
je 0x403a8e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + ebx*4]
push 0
push 0
push 2
push ecx
call esi
push 0x32
call edi
mov edx, dword [esp + 0x28]
mov eax, dword [edx + ebx*4]
push eax
call ebp
test eax, eax
je 0x403ab0
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + ebx*4]
push 0
push 0
push 0x12
push edx
call esi
push 0x32
call edi
mov eax, dword [esp + 0x2c]
inc ebx
cmp ebx, eax
jl 0x403a30
mov eax, dword [esp + 0x28]
test eax, eax
je 0x403ace
push eax
call fcn.0040f5cf
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
xor ebx, ebx
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4039f0
mov ebp, dword [esp + 0x48]
xor esi, esi
jmp 0x403af0
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], ebx
call fcn.004038a0
add esp, 8
test eax, eax
jne 0x403b0c
cmp dword [esp + 0x10], ebx
je 0x403b51
push 0x1f4
call edi
inc esi
cmp esi, 0xa
jl 0x403af0
push ebp
call fcn.00403740
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
neg esi
dec esi
cmp eax, ebx
je 0x403b3c
push eax
call fcn.0040f5cf
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x403b62
push eax
call fcn.0040f5cf
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x403b80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [str._q_]
xor eax, ebp
mov dword [esp + 0x1b0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x10], eax
mov byte [esp + 0xb0], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xb1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], 0xffffffff
stosb byte es:[edi], al
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403c10
cmp dword [esp + 0x28], 2
jne 0x403c10
cmp dword [esp + 0x1c], 5
jb 0x403c10
mov edx, dword [str.Global_]
mov eax, dword [0x41ba68]
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], eax
lea edi, [esp + 0xb0]
dec edi
test esi, esi
je 0x403c70
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c20
mov ecx, dword [str.KUsrTskExit]
mov edx, dword [0x41ba5c]
mov eax, dword [0x41ba60]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c45
lea edi, [esp + 0xb0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403c56
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x403cad
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c70
mov ecx, dword [str.KaUsrTaskExitEvent]
mov edx, dword [0x41ba48]
mov eax, dword [0x41ba4c]
mov dword [edi], ecx
mov ecx, dword [0x41ba50]
mov dword [edi + 4], edx
mov dx, word [0x41ba54]
mov dword [edi + 8], eax
mov al, byte [0x41ba56]
mov dword [edi + 0xc], ecx
mov word [edi + 0x10], dx
mov byte [edi + 0x12], al
lea ecx, [esp + 0xb0]
push ecx
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebx, eax
test ebx, ebx
je 0x403d15
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x3e8
call edi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.004038a0
add esp, 8
test eax, eax
jne 0x403cfc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d08
inc esi
cmp esi, 0x1e
jl 0x403cd7
mov esi, dword [esp + 0x14]
jmp 0x403d0a
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x403d68
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.004038a0
add esp, 8
test eax, eax
jne 0x403d4a
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x403d4a
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, ebp
call fcn.0040f175
mov esp, ebp
pop ebp
ret
push esi
call fcn.00403960
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, ebp
call fcn.0040f175
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1bc]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f175
mov esp, ebp
pop ebp
ret
Function at 0x404210
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x514
mov eax, dword [str._q_]
xor eax, esp
mov dword [esp + 0x510], eax
mov eax, dword [ecx + 0x54]
push edi
xor edi, edi
test eax, eax
je 0x4042bb
lea eax, [esp + 8]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40438a
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x14]
push eax
push edi
push str.KaseyaAgent
push ecx
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40428b
cmp eax, 0xea
jne 0x404298
mov eax, dword [esp + 4]
test eax, eax
jbe 0x404298
mov edi, 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0040f175
add esp, 0x514
ret
push esi
push 0x80000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4042fe
push ebx
push 0x80000000
push str.KaseyaAgent
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x4042f5
push eax
mov edi, 1
call ebx
push esi
call ebx
pop ebx
jmp 0x404389
push str.KaseyaAgent
push str.SystemCurrentControlSetServices
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.0040f6f9
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404389
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.ImagePath
push eax
mov dword [esp + 0x24], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404371
cmp eax, 0xea
jne 0x40437e
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x40437e
mov edi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x514]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040f175
add esp, 0x514
ret
Function at 0x4043b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x234
mov eax, dword [str._q_]
xor eax, esp
push ebp
push esi
push str.KaseyaAgent
push str.SystemCurrentControlSetServices
mov dword [esp + 0x240], eax
lea eax, [esp + 0x38]
xor esi, esi
push str._s_s
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call fcn.0040f6f9
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push esi
lea edx, [esp + 0x3c]
push edx
push 0x80000002
call ebp
test eax, eax
jne 0x404420
mov eax, dword [esp + 8]
push eax
mov dword [esp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
push ecx
push 0x20019
push esi
push str.SOFTWAREKaseyaAgent
push 0x80000002
call ebp
test eax, eax
jne 0x404532
push esi
push esi
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x1c]
push esi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x30]
push eax
push esi
push esi
push esi
push ecx
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x404527
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, 0x104
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x150]
push eax
push esi
push ecx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x404518
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x20019
push eax
lea eax, [esp + 0x148]
push eax
push ecx
call ebp
test eax, eax
jne 0x404518
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push str.Path
push edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x30], edi
call ebx
test eax, eax
jne 0x40450d
cmp dword [esp + 0x24], 1
jne 0x40450d
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40450d
inc dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jb 0x404486
pop edi
pop ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x238]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
xor ecx, esp
call fcn.0040f175
add esp, 0x234
ret
Function at 0x404550
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [str._q_]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x418]
push esi
mov dword [esp + 0x414], eax
mov esi, ecx
mov eax, dword [esi + 0x54]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x400
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
jne 0x404597
mov eax, str.SYSTEMCurrentControlSetServicesKaseyaAgent
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404639
cmp dword [esi + 0x54], edi
mov eax, str.KaseyaAgent
jne 0x4045c5
mov eax, str.ImagePath
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40462e
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x4045f3
cmp eax, 2
jne 0x40462e
cmp dword [esp + 0x14], edi
jbe 0x40462e
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.0040f216
add esp, 8
cmp eax, edi
je 0x40462e
mov byte [eax], 0
cmp byte [esp + 0x18], 0x22
lea eax, [esp + 0x19]
je 0x40461e
lea eax, [esp + 0x18]
push eax
call fcn.00410113
add esp, 4
mov dword [ebx], eax
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x418]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040f175
add esp, 0x410
ret 4
Function at 0x406ae0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [str._q_]
push ebx
push esi
xor eax, ebp
push edi
mov dword [esp + 0x124], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREWinSock2Kaseya_Agent_LSP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406bd3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
cmp eax, 0x103
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
je 0x406ba5
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call ebx
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
cmp eax, 0x103
jne 0x406b62
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREWinSock2Kaseya_Agent_LSP
push 0x80000002
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.0040f175
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040f175
mov esp, ebp
pop ebp
ret
Function at 0x408db0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x201c
call fcn.0040fae0
mov eax, dword [str._q_]
mov ecx, dword [esp + 0x2028]
mov edx, dword [esp + 0x202c]
xor eax, esp
push esi
mov esi, dword [esp + 0x2028]
mov dword [esp + 0x201c], eax
mov eax, dword [esp + 0x2024]
push edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x2038]
xor edi, edi
test esi, esi
mov dword [esp + 8], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jne 0x408e0a
push 0x57
jmp 0x408f12
test eax, eax
je 0x408f10
cmp eax, 0xffffffff
je 0x408f10
push ebx
mov ebx, dword [esi + 4]
push ebp
add ebx, 4
push ebx
call fcn.0040f6e7
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x408ef5
mov edx, dword [esi]
mov dword [ebp], edx
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
mov eax, ecx
shr ecx, 2
lea edi, [ebp + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov dword [esp + 0x10], eax
je 0x408ee8
push 0
lea edx, [esp + 0x18]
push edx
push 0x2000
lea eax, [esp + 0x34]
push eax
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0x10], eax
je 0x408ee8
cmp dword [esp + 0x14], 4
jb 0x408ee8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x408eab
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov esi, dword [esp + 0x18]
test esi, esi
je 0x408eb9
mov edx, dword [esp + 0x2c]
mov dword [esi], edx
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x408ee8
mov eax, dword [esi]
push eax
call fcn.0040f6e7
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x408ee8
mov ecx, dword [esi]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x30]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.0040f5cf
mov edi, dword [esp + 0x14]
add esp, 4
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.0040f175
add esp, 0x201c
ret
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x2020]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040f175
add esp, 0x201c
ret