joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x408b90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x408bbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c610
add esp, 4
or eax, 0xffffffff
jmp 0x408bea
mov ecx, dword [ebp - 4]
and ecx, 1
test ecx, ecx
je 0x408be8
mov edx, dword [ebp + 0xc]
and edx, 2
test edx, edx
je 0x408be8
mov dword [0x42a5f0], 0xd
mov dword [0x42a5f4], 5
or eax, 0xffffffff
jmp 0x408bea
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407339
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x407377
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40734d
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x407348
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4073a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407385
not eax
pop ebp
ret 0xc
Function at 0x402027
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 7
push 0x45e98c
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
lea eax, [ebp - 0x110]
push eax
call fcn.004525f0
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x110]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
lea eax, [ebp - 0x110]
push eax
push 2
push 0
push str.EventMessageFile
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.TypesSupported
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4020e8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x210], 1
push 0x45ea08
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x22a
jne 0x402139
push 0x45ea24
push str._s_has_been_started_in_debug_mode
lea eax, [ebp - 0x20c]
push eax
call fcn.004525f0
add esp, 0xc
jmp 0x402199
cmp dword [ebp + 8], 0x22b
jne 0x402164
push 0x45ea64
push str._s_has_been_started
lea eax, [ebp - 0x20c]
push eax
call fcn.004525f0
add esp, 0xc
jmp 0x402199
cmp dword [ebp + 8], 0x22c
jne 0x40218f
push 0x45ea94
push str._s_has_been_stopped
lea eax, [ebp - 0x20c]
push eax
call fcn.004525f0
add esp, 0xc
jmp 0x402199
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x4021d4
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402c52
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402e08
push 0xf01ff
push 0x45f774
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402dd9
push 0xb67760
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402d81
mov dword [0x4622c8], 1
mov dword [0x462120], 0
mov dword [0x462094], 0
push 0x45f790
push str._n_rStopping__s.
call fcn.00452380
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x462120], 0
mov dword [0x462094], 0
push 0xb67760
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x402d4b
cmp dword [0xb67764], 3
jne 0x402d41
push 0x45f7c8
call fcn.00452380
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402d46
jmp 0x402d4b
jmp 0x402d00
cmp dword [0xb67764], 1
jne 0x402d6f
push 0x45f7cc
push str._n_s_stopped._n
call fcn.00452380
add esp, 8
jmp 0x402d81
push 0x45f804
push str._n_s_failed_to_stop._n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x402daa
push 0x45f844
push str._s_removed._n
call fcn.00452380
add esp, 8
jmp 0x402dca
push 0x100
push 0xb614a0
call fcn.00403677
add esp, 8
push eax
push str.DeleteService_failed____s_n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402df9
push 0x100
push 0xb614a0
call fcn.00403677
add esp, 8
push eax
push str.OpenService_failed____s_n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402e28
push 0x100
push 0xb614a0
call fcn.00403677
add esp, 8
push eax
push str.OpenSCManager_failed____s_n
call fcn.00452380
add esp, 8
call fcn.00428484
test eax, eax
jne 0x402e42
push str._nRegistry_Key_was_Deleted.
call fcn.00452380
add esp, 4
call fcn.00427b09
push str._nLegacy_Keys_removed.
call fcn.00452380
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403721
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40384a
push 0xf01ff
push str.TermService
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4037ae
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x20], 4
jne 0x403792
mov dword [ebp - 4], 1
jmp 0x40379f
push str._nTerminal_Services_are_NOT_running_on_this_machine
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4037bb
push str._nTerminal_Services_are_NOT_installed_on_this_machine
call fcn.00452380
add esp, 4
cmp dword [ebp - 4], 0
jne 0x403840
push 0xf01ff
push str.UxSms
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403833
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x20], 4
jne 0x403817
mov dword [ebp - 4], 1
push str._nDesktop_Session_Manager_is_running_on_this_machine
call fcn.00452380
add esp, 4
jmp 0x403824
push str._nDesktop_Session_Manager_is_NOT_running_on_this_machine
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403840
push str._nDesktop_Session_Manager_is_NOT_installed_on_this_machine
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 4], 0
jne 0x40385c
call fcn.00437477
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x403864
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403869
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4038ef
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4038e5
mov dword [ebp - 4], 2
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x20], 4
jne 0x4038db
mov dword [ebp - 4], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
jmp 0x4038f7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cd6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc74
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0xbdc], eax
dec dword [ebp - 0xbdc]
mov eax, 0x4600b0
mov ecx, 0x4600b4
mov edx, dword [ebp - 0xbdc]
mov ebx, dword [ebp + 8]
movsx edx, byte [edx + ebx]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
mov eax, dword [ebp + 8]
push eax
push str._s_sSTLWA_NT.EXE
push 0x200
lea eax, [ebp - 0xbd4]
push eax
call fcn.00452660
add esp, 0x14
lea eax, [ebp - 0x9d4]
push eax
push 0x9cf
push 0
lea eax, [ebp - 0xbd4]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0xbd8], 0
jne 0x403da4
cmp dword [0x45e03c], 0
je 0x403d9f
lea eax, [ebp - 0xbd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4600cc
call fcn.00452380
add esp, 0xc
jmp 0x403ec6
mov dword [ebp - 0xc64], 0
lea eax, [ebp - 0xc64]
push eax
lea eax, [ebp - 0xc70]
push eax
push 0x460100
lea eax, [ebp - 0x9d4]
push eax
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0xc6c], 0
jmp 0x403de2
inc dword [ebp - 0xc6c]
mov eax, dword [ebp - 0xc64]
shr eax, 2
cmp eax, dword [ebp - 0xc6c]
jbe 0x403ec6
mov eax, dword [ebp - 0xc6c]
mov ecx, dword [ebp - 0xc70]
xor edx, edx
mov dx, word [ecx + eax*4 + 2]
push edx
mov eax, dword [ebp - 0xc6c]
mov ecx, dword [ebp - 0xc70]
xor edx, edx
mov dx, word [ecx + eax*4]
push edx
push 0x46011c
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x9d4]
push eax
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0xbe0], eax
cmp dword [ebp - 4], 0
je 0x403e6f
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc74], eax
jmp 0x403e79
mov dword [ebp - 0xc74], 0x460144
mov eax, dword [ebp - 0xc74]
push eax
mov eax, dword [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc60]
push eax
mov eax, dword [ebp - 0xbe0]
push eax
push str._r_nMY_FILE_VERSION__VerQuery__d__of___s___size_d___s_
call fcn.00452380
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x403ec1
push 0x10
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00452940
add esp, 0xc
mov dword [0x45e044], eax
jmp 0x403ddc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40587a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x46c], 0
lea edi, [ebp - 0x454]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x468]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [ebp - 0x424], 0
mov eax, dword [ebp + 8]
push eax
push 0x460aa4
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x454]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405ead
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x9d8]
push eax
push 0x9cf
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 0
jne 0x405f1d
cmp dword [0x45e03c], 0
je 0x405f16
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nINITSS3:_ABORTING_ERROR_OBTAINING_VERSION__d___s_
call fcn.00452380
add esp, 0xc
xor eax, eax
jmp 0x40608b
mov dword [ebp - 0xa68], 0
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xa74]
push eax
push str.VarFileInfoTranslation
lea eax, [ebp - 0x9d8]
push eax
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0xa70], 0
jmp 0x405f5b
inc dword [ebp - 0xa70]
mov eax, dword [ebp - 0xa68]
shr eax, 2
cmp eax, dword [ebp - 0xa70]
jbe 0x406083
mov eax, dword [ebp - 0xa70]
mov ecx, dword [ebp - 0xa74]
xor edx, edx
mov dx, word [ecx + eax*4 + 2]
push edx
mov eax, dword [ebp - 0xa70]
mov ecx, dword [ebp - 0xa74]
xor edx, edx
mov dx, word [ecx + eax*4]
push edx
push str.StringFileInfo_04x_04xSpecialBuild
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xa6c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa64]
push eax
lea eax, [ebp - 0x9d8]
push eax
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 4], 0
je 0x405fe8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa78], eax
jmp 0x405ff2
mov dword [ebp - 0xa78], str._no_buffer_
mov eax, dword [ebp - 0xa78]
push eax
mov eax, dword [ebp - 0xa6c]
push eax
lea eax, [ebp - 0xa64]
push eax
mov eax, dword [ebp - 0x9e4]
push eax
push str._r_nVerQuery__d__of___s___size_d___s_
call fcn.00452380
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x40607e
push 0x10
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00452940
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [0x45e044]
cmp dword [ebp - 8], eax
jne 0x406052
mov dword [ebp - 8], 0
jmp 0x406067
mov eax, dword [0x45e044]
cmp dword [ebp - 8], eax
jae 0x406067
mov dword [ebp - 8], 0
mov eax, dword [0x45e044]
push eax
mov eax, dword [ebp - 8]
push eax
push str._r_nPOST_REVIEW_MVX__X_____MY_LWA_BUILD_VER__X_
call fcn.00452380
add esp, 0xc
jmp 0x405f55
mov eax, dword [ebp - 8]
jmp 0x40608b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4068aa
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 0x4610b4
push str.IDR_V321
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4068da
jmp 0x4069c1
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4068f8
jmp 0x4069c1
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x406916
jmp 0x4069c1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406932
jmp 0x4069c1
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x218]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4610c4
lea edi, [ebp - 0x218]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4069c1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4069c6
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push esi
push edi
lea eax, [ebp - 0x444]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x200
lea eax, [ebp - 0x444]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movsx eax, byte [ebp - 0x444]
test eax, eax
je 0x406a75
lea edi, [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x406a75
dec dword [ebp - 0x448]
mov eax, dword [ebp - 0x448]
movsx eax, byte [ebp + eax - 0x444]
cmp eax, 0x5c
jne 0x406a70
inc dword [ebp - 0x448]
mov eax, dword [ebp - 0x448]
mov byte [ebp + eax - 0x444], 0
mov dword [ebp - 0x448], 0
jmp 0x406a28
mov esi, str.STLWA_NT.servername
lea edi, [ebp - 0x444]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
push 0
push bind
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x406bab
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jae 0x406b28
lea edi, [ebp - 0x240]
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x240]
push eax
call fcn.0042b5e1
add esp, 4
lea eax, [ebp - 0x240]
push eax
call fcn.0042b68d
add esp, 4
jmp 0x406b41
mov eax, dword [ebp - 4]
push eax
push str.__NAME_TOO_BIG___d___
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x240]
push eax
push str.FETCHED_NEW_SERVER_NAME___s__FROM__s
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call fcn.004097a0
add esp, 4
cmp dword [0x45e03c], 0
je 0x406bab
lea eax, [ebp - 0x208]
push eax
push 0x46112c
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407034
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
mov dword [ebp - 0xe0], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4071b6
mov dword [ebp - 8], 0
mov dword [ebp - 0xe0], 0
cmp dword [ebp - 8], 0
jne 0x4071ac
mov byte [ebp - 0x1ac], 0
mov dword [ebp - 4], pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 8], eax
inc dword [ebp - 0xe0]
cmp dword [ebp - 8], 0
jne 0x4071a7
lea eax, [ebp - 0xdc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4071a7
mov dword [ebp - 0xe4], 0xc7
mov byte [ebp - 0xd8], 0
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0
push 0
push str.NetCfgInstanceId
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40719a
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x40719a
mov dword [ebp - 0xe4], pe_nt_image_headers32
lea eax, [ebp - 0xe4]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push str.DriverDesc
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4071bd
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407083
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4071bd
pop edi
pop esi
pop ebx
leave
ret