joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
mov cl, 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.100259b6
inc edx
jno 0x10025c53
mov ecx, 0xfd5ce8a7
invalid
lea eax, [ebp - 0x58]
push eax
call fcn.100259c6
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1002597b
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10025ca4
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100259b6
mov dword [0x8da0f9d8], eax
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x10025da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100259c6
push eax
push esi
push dword [ebp + 8]
call fcn.1002597b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100259c6
push eax
push esi
push dword [ebp + 8]
call fcn.1002597b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100259b6
add eax, 0x88beb363
popfd
jl 0x10025e3b
invalid
invalid
Function at 0x4126ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4126dd
pop dword [ebp - 0x18]
mov eax, 0x7a14a165
sub eax, 0x79d37a88
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x408bf
push 0
mov eax, 0x92e8a508
add eax, 0x6d594d08
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x51bf
mov esi, eax
mov edi, 0xda3958f4
sub edi, 0xd9f5d6f4
add edi, dword [ebp - 0x18]
mov ebx, 0x4eb97cff
sub ebx, 0xab2f9294
add dword [ebp - 0x10], esi
mov edx, dword [edi]
sub dword [ebp - 0x10], 0x86c0abd2
sub edx, ebx
xor dword [ebp - 8], esi
mov dword [esi], edx
sub dword [ebp - 0x10], 0xfa4ada8b
add esi, 4
add edi, 0xf68c8e6b
add edi, 0x9737199
loop 0x412736
add eax, 0xc5ab16cc
add eax, 0x3a562303
mov ebx, eax
add eax, 0xe3780497
sub eax, 0xe3780492
mov ecx, 0xa710ca82
add ecx, 0x592f357e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4013e0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, 0x47c5e4
cmp dword [esi], 0
jne 0x401426
push 0x644
push 0
call sub.KERNEL32.DLL_WriteFile
mov ecx, eax
test ecx, ecx
jne 0x401403
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x47c5e0]
mov dword [ecx], eax
mov dword [0x47c5e0], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401412
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x47c5c0], 0
je 0x401c0d
xor edx, edx
push ebp
push 0x401c06
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x47c049], 0
je 0x401b62
push 0x47c5c8
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x47c5c0], 0
mov eax, dword [0x47c620]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
xor eax, eax
mov dword [0x47c620], eax
mov ebx, dword [0x47c5e8]
jmp 0x401b95
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x47c5e8
jne 0x401b83
mov eax, 0x47c5e8
call fcn.00401430
mov eax, 0x47c5f8
call fcn.00401430
mov eax, 0x47c624
call fcn.00401430
mov eax, dword [0x47c5e0]
test eax, eax
je 0x401bdb
mov edx, dword [eax]
mov dword [0x47c5e0], edx
push eax
call sub.KERNEL32.DLL_lstrcmpiA
mov eax, dword [0x47c5e0]
test eax, eax
jne 0x401bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c0d
cmp byte [0x47c049], 0
je 0x401bfb
push 0x47c5c8
call sub.KERNEL32.DLL_TlsSetValue
push 0x47c5c8
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402158
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x47c5c0], 0
jne 0x402175
call fcn.00401a6c
test al, al
je 0x40217d
cmp ebx, 0x7ffffff8
jle 0x402187
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022db
xor ecx, ecx
push ebp
push 0x4022d4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47c049], 0
je 0x4021a8
push 0x47c5c8
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021b8
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402257
mov eax, ebx
test eax, eax
jns 0x4021cd
add eax, 3
sar eax, 2
mov edx, dword [0x47c620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402257
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402208
mov eax, ebx
test eax, eax
jns 0x4021f7
add eax, 3
sar eax, 2
mov ecx, dword [0x47c620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40222e
mov ecx, ebx
test ecx, ecx
jns 0x402211
add ecx, 3
sar ecx, 2
mov edi, dword [0x47c620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47c5b0]
sub ebx, 4
add dword [0x47c5b4], ebx
call fcn.00404178
jmp 0x4022db
cmp ebx, dword [0x47c618]
jg 0x4022a9
sub dword [0x47c618], ebx
cmp dword [0x47c618], 0xc
jge 0x40227b
add ebx, dword [0x47c618]
xor eax, eax
mov dword [0x47c618], eax
mov eax, dword [0x47c61c]
add dword [0x47c61c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47c5b0]
sub ebx, 4
add dword [0x47c5b4], ebx
call fcn.00404178
jmp 0x4022db
mov eax, ebx
call fcn.00402064
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022db
cmp byte [0x47c049], 0
je 0x4022d3
push 0x47c5c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022e8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x47c5c4], eax
cmp byte [0x47c5c0], 0
jne 0x402320
call fcn.00401a6c
test al, al
jne 0x402320
mov dword [0x47c5c4], 8
mov dword [ebp - 4], 8
jmp 0x402481
xor ecx, ecx
push ebp
push 0x40247a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47c049], 0
je 0x402341
push 0x47c5c8
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40235c
mov dword [0x47c5c4], 9
jmp 0x402451
dec dword [0x47c5b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x47c5b4], eax
test bl, 1
je 0x4023bc
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40238c
test edx, 0x80000003
je 0x40239b
mov dword [0x47c5c4], 0xa
jmp 0x402451
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023b3
mov dword [0x47c5c4], 0xa
jmp 0x402451
add ebx, edx
mov esi, eax
call fcn.00401c10
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x47c61c]
jne 0x4023fc
sub dword [0x47c61c], ebx
add dword [0x47c618], ebx
cmp dword [0x47c618], 0x3c00
jle 0x4023ed
call fcn.00401f00
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00404178
jmp 0x402481
mov edx, dword [eax]
test dl, 2
je 0x40241f
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40241a
mov dword [0x47c5c4], 0xb
jmp 0x402451
or dword [eax], 1
jmp 0x402448
mov eax, edi
cmp dword [eax + 4], 0
je 0x402432
cmp dword [eax], 0
je 0x402432
cmp dword [eax + 8], 0xc
jge 0x40243e
mov dword [0x47c5c4], 0xb
jmp 0x402451
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c10
mov edx, ebx
mov eax, esi
call fcn.00401e78
mov eax, dword [0x47c5c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402481
cmp byte [0x47c049], 0
je 0x402479
push 0x47c5c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402bc4
Capabilities:
Create process on windows

Disassembly:
add esp, 0xfffffff8
push esp
call sub.KERNEL32.DLL_WideCharToMultiByte
test eax, eax
je 0x402bdc
mov eax, dword [esp]
mov dword [0x476008], eax
pop ecx
pop edx
ret
call sub.KERNEL32.DLL_WinExec
mov dword [0x476008], eax
pop ecx
pop edx
ret

Function at 0x4031fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x476008], 0x8088405
inc edx
mov dword [ebx + 0x476008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403348
Capabilities:
Move file

Disassembly:
mov ecx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b1
cmp eax, 2
ja 0x403371
push 0
mov eax, dword [ecx + 8]
mul edx
push 0
push eax
push dword [ecx]
call sub.KERNEL32.DLL_MoveFileA
inc eax
je fcn.004028c4
ret
mov eax, 0x67
jmp fcn.004028b4
Function at 0x4045a0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x47c634
mov esi, section.DATA
mov edi, 0x47c044
cmp byte [ebx + 0x28], 0
jne 0x4045cf
cmp dword [edi], 0
je 0x4045cf
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4045be
cmp dword [0x476004], 0
je 0x4045e9
call fcn.00404488
call fcn.00404514
xor eax, eax
mov dword [0x476004], eax
cmp byte [ebx + 0x28], 2
jne 0x4045f9
cmp dword [esi], 0
jne 0x4045f9
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00404318
cmp byte [ebx + 0x28], 1
jbe 0x404609
cmp dword [esi], 0
je 0x40462a
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40462a
call fcn.00405fbc
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x40462a
test eax, eax
je 0x40462a
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.004042f0
cmp byte [ebx + 0x28], 1
jne 0x404638
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x404643
call fcn.004044e4
cmp dword [ebx], 0
jne 0x40465f
cmp dword [0x47c024], 0
je 0x404657
call dword [0x47c024]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4045e9
Function at 0x405a98
Capabilities:
Delete directory
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405c2c
call sub.KERNEL32.DLL_SetNamedPipeHandleState
mov esi, eax
test esi, esi
je 0x405b00
push 0x405c3c
push esi
call sub.KERNEL32.DLL_SetThreadContext
mov ebx, eax
test ebx, ebx
je 0x405b00
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405b00
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
jmp 0x405c22
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405b40
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405c22
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405a84
mov esi, eax
cmp byte [esi], 0
je 0x405c22
lea eax, [esi + 1]
call fcn.00405a84
mov esi, eax
cmp byte [esi], 0
je 0x405c22
jmp 0x405b46
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SuspendThread
jmp 0x405c05
lea eax, [esi + 1]
call fcn.00405a84
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405c22
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SuspendThread
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
cmp esi, 0xffffffff
je 0x405c22
push esi
call sub.KERNEL32.DLL_RemoveDirectoryA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_TerminateProcess
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405c22
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SuspendThread
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_TerminateProcess
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405b64
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405c50
Capabilities:
Set file attributes
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetFilePointer
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e80
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405cd3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e80
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405cd3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e9c
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x405d5c
xor eax, eax
push ebp
push 0x405d55
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405a98
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x405d3a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ebc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x405d3a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d5c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SuspendThread
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetThreadPriority
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e76
cmp byte [ebp - 0xd], 0
jne 0x405da3
cmp byte [ebp - 0x12], 0
je 0x405e76
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405dbc
dec ebx
cmp byte [ebx], 0x2e
je 0x405dcb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405dbb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e76
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e08
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
test esi, esi
jne 0x405e76
cmp byte [ebp - 0xd], 0
je 0x405e76
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
test esi, esi
jne 0x405e76
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406548
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065ae
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404984
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040337c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406598
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065b5
lea eax, [ebp - 0x10]
call fcn.00404714
ret

Function at 0x409128
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.00404bd4
push eax
call sub.user32.dll_GetClipboardData
cmp eax, 0xffffffff
je 0x409181
push eax
call sub.user32.dll_GetClientRect
test byte [ebp - 0x14c], 0x10
jne 0x409181
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.user32.dll_GetClassInfoA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetCapture
test eax, eax
jne 0x409188
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40934c
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, eax
not edx
and edx, 0x1e
mov dword [ebx + 0x10], edx
lea eax, [ebx + 0x18]
push eax
mov eax, edi
call fcn.00404bd4
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
mov dword [ebx + 0x14], esi
cmp esi, 0xffffffff
je 0x40938c
mov eax, ebx
call fcn.004092e8
mov esi, eax
test esi, esi
je 0x409393
mov eax, ebx
call fcn.004093c0
jmp 0x409393
call sub.user32.dll_GetPropA
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x40cfb8
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x40d01f
mov eax, dword [esp + 0x10]
mov dword [0x4760ec], eax
mov eax, dword [esp + 4]
mov dword [0x4760f0], eax
mov eax, dword [esp + 8]
mov dword [0x4760f4], eax
cmp dword [0x4760ec], 1
jne 0x40d003
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x4760f8], eax
jmp 0x40d00c
mov eax, dword [esp + 0xc]
mov dword [0x4760f8], eax
mov eax, 0x4760fc
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00404984
add esp, 0x94
ret
Function at 0x40d048
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d11e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004047ac
lea eax, [ebp - 8]
call fcn.00404c24
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404bd4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d108
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d101
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404bd4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0eb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d130
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d0eb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d108
mov eax, dword [ebp - 0x10]
call fcn.0040274c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d125
lea eax, [ebp - 8]
call fcn.00404714
ret

Function at 0x40d694
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d6f8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.user32.dll_GetScrollPos
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404984
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
mov edx, eax
pop eax
call fcn.00408ddc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d6ff
lea eax, [ebp - 0xc]
call fcn.00404714
ret

Function at 0x40d708
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
mov eax, dword [0x47c744]
call fcn.0040d694
push eax
call sub.user32.dll_GetKeyState
xor esi, esi
jmp 0x40d753
mov al, byte [edi + esi + 6]
mov bl, byte [edi + esi + 7]
sub bl, al
jb 0x40d750
inc ebx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
and eax, 0xff
bts dword [0x476134], eax
inc byte [ebp - 1]
dec bl
jne 0x40d73a
add esi, 2
cmp esi, 0xc
jge 0x40d762
mov al, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x40d72a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40fb88
Capabilities:
Delete service
Query service configuration
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
test byte [eax + 1], 0x20
jne 0x40fbb0
mov eax, 0x80070057
call fcn.0040fa54
mov eax, dword [ebp - 0x304]
mov ax, word [eax]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x40fcec
mov edx, dword [ebp - 0x304]
test ah, 0x40
je 0x40fbe8
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
jmp 0x40fbf7
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40fc7c
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.advapi32.dll_OpenServiceA
call fcn.0040fa54
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.advapi32.dll_QueryServiceConfigA
call fcn.0040fa54
mov eax, dword [ebp - 0x318]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x318]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x40fc1a
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40fca1
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x40fc94
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0040fafc
pop ecx
test al, al
je 0x40fcdf
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.advapi32.dll_QueryServiceStatus
call fcn.0040fa54
mov eax, dword [ebp - 0x314]
call fcn.0040fd80
push ebp
mov eax, ebx
call fcn.0040fb2c
pop ecx
test al, al
jne 0x40fca1
mov eax, dword [ebp - 0x304]
push eax
call sub.advapi32.dll_DeleteService
call fcn.0040fa54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret