joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlNlsCodePage
push 0x80000002
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4019c0
xor eax, eax
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.OEMCP
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4019f6
xor eax, eax
pop esi
add esp, 0x28
ret
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esp + 0xc]
push edx
push 0x47c530
call esi
test eax, eax
jne 0x401a11
pop esi
add esp, 0x28
ret
lea eax, [esp + 0xc]
push eax
push 0x47c52c
call esi
test eax, eax
jne 0x401a2b
mov eax, 1
pop esi
add esp, 0x28
ret
lea ecx, [esp + 0xc]
push ecx
push 0x47c528
call esi
neg eax
sbb eax, eax
pop esi
and al, 0xfe
add eax, 2
add esp, 0x28
ret
Function at 0x4035f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x51c
cmp al, 0x20
push ebx
push ebp
push esi
push edi
jae 0x403732
mov ecx, dword [esp + 0x538]
and eax, 0xff
push ecx
mov ecx, eax
shl ecx, 6
lea edx, [esp + 0x42c]
add ecx, eax
push edx
lea edx, [ecx*4 + 0x4d6e7c]
push edx
call fcn.00403900
add esp, 0xc
test al, al
je 0x403732
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMMountedDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403732
xor ebp, ebp
lea ecx, [ebp + 0x41]
lea edx, [esp + 0x11c]
push ecx
push str.DosDevices_c:
push edx
mov dword [esp + 0x1c], 0x104
call fcn.0040661c
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x324]
lea edx, [esp + 0x11c]
push eax
mov eax, dword [esp + 0x18]
push ecx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x220]
push ecx
lea eax, [esp + 0x328]
push edx
push eax
call fcn.00401880
lea ecx, [esp + 0x24]
lea edx, [esp + 0x22c]
push ecx
push edx
call fcn.00403b00
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, 1
jg 0x4036ec
mov byte [esp + ecx + 0x18], bl
jmp 0x4036f0
mov byte [esp + ecx + 0x15], bl
lea esi, [esp + 0x428]
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40371f
cmp cl, bl
je 0x40371b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40371f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4036fb
xor eax, eax
jmp 0x403724
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40373f
inc ebp
cmp ebp, 0x1a
jl 0x403661
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x51c
ret
mov eax, dword [esp + 0x534]
add ebp, 0x41
push ebp
push 0x47c64c
push eax
call fcn.0040661c
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x51c
ret
Function at 0x403770
Capabilities:
Get disk information

Disassembly:
sub esp, 0x86c
push ebx
push ebp
push esi
push edi
mov ecx, 0x210
mov esi, 0x4dc1c0
lea edi, [esp + 0x3c]
mov byte [esp + 0x10], 2
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
mov eax, edi
and eax, 0xff
lea esi, [eax + 0x41]
push esi
push 0x47c64c
push ecx
call fcn.0040661c
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4038ad
push esi
lea eax, [esp + 0x20]
push str.._c:
push eax
call fcn.0040661c
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x17]
mov ebp, eax
push edx
push ebp
call fcn.00402a60
add esp, 8
test al, al
push ebp
jne 0x403811
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4038ad
call fcn.00402db0
push 1
mov dword [0x47bb7c], ebp
call fcn.00402450
add esp, 8
call fcn.00404560
test al, al
jne 0x403838
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4038ad
push 0xffffffffffffffff
push 0
call fcn.004046c0
mov bl, al
add esp, 8
test bl, bl
je 0x40388e
xor dl, dl
mov byte [esp + 0x18], dl
mov ecx, dword [esp + 0x18]
and ecx, 0xff
mov eax, ecx
shl eax, 5
add eax, ecx
mov ecx, 0x84
shl eax, 4
lea edi, [eax + 0x4dc1c0]
lea esi, [esp + eax + 0x3c]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x403884
inc dl
cmp dl, 4
mov byte [esp + 0x18], dl
jb 0x403850
mov edi, dword [esp + 0x10]
cmp dl, 4
setae bl
push 0
call fcn.00402450
add esp, 4
mov dword [0x47bb7c], 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4038cc
mov al, byte [esp + 0x10]
inc al
cmp al, 0x1a
mov byte [esp + 0x10], al
jb 0x40378f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x86c
ret
mov ecx, dword [esp + 0x884]
and edi, 0xff
add edi, 0x41
push edi
push 0x47c64c
push ecx
call fcn.0040661c
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x86c
ret
Function at 0x403900
Capabilities:
Enumerate pe sections
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x228]
mov ebp, dword [esp + 0x230]
mov byte [esp + 0x13], 0
mov byte [esp + 0x23], 0
lea eax, [edi + 0xc]
mov esi, str.sfloppy
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov dx, word [eax + 4]
mov word [esp + 0x20], dx
mov al, byte [eax + 6]
mov byte [ebp], 0
mov byte [esp + 0x22], al
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403970
test cl, cl
je 0x40396c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403970
add eax, 2
add esi, 2
test cl, cl
jne 0x403948
xor eax, eax
jmp 0x403975
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403982
mov byte [esp + 0x13], 1
mov byte [ebp], 1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov eax, ecx
mov esi, edi
mov edi, edx
xor ebp, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
or edx, 0xffffffff
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor esi, esi
mov ebx, dword [esp + 0x22c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x403a0c
mov al, byte [esp + esi + 0x1c]
cmp al, 0x7b
je 0x403a0c
cmp al, 0x23
jne 0x4039d5
mov byte [esp + esi + 0x1c], 0x5c
inc ebp
cmp byte [esp + 0x13], 1
jne 0x4039f9
cmp ebp, 2
jne 0x4039f4
cmp edx, 0xffffffff
jne 0x4039ea
xor edx, edx
jmp 0x4039f9
mov cl, byte [esp + esi + 0x1c]
mov byte [edx + ebx], cl
inc edx
jmp 0x4039f9
cmp ebp, 3
je 0x403a61
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x4039c3
lea eax, [esi - 4]
lea esi, [esp + 0x20]
mov ecx, eax
lea edi, [esp + 0x120]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [esp + eax + 0x120], 0
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnum_
push 0x80000002
call esi
test eax, eax
je 0x403a72
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret
pop edi
pop esi
mov byte [edx + ebx], 0
pop ebp
mov al, 1
pop ebx
add esp, 0x214
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
lea edx, [esp + 0x128]
push 0
push edx
push eax
call esi
test eax, eax
je 0x403aa9
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebx
push 0
push 0
push str.ParentIdPrefix
push eax
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403ae7
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x214
ret
Function at 0x408721
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x47cdc0
cmp edx, dword [eax]
je 0x408743
add eax, 8
inc ecx
cmp eax, 0x47ce50
jl 0x408734
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x47cdc0]
jne 0x408871
mov eax, dword [0x7ff934]
cmp eax, 1
je 0x40884b
test eax, eax
jne 0x408774
cmp dword [0x47ca58], 1
je 0x40884b
cmp edx, 0xfc
je 0x408871
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087ab
lea eax, [ebp - 0x1a4]
push 0x40e4b8
push eax
call fcn.0040add0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040abf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4087ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040abf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40e4b4
push edi
call fcn.0040b6e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x40e498
push eax
call fcn.0040add0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040ade0
lea eax, [ebp - 0xa0]
push 0x40e494
push eax
call fcn.0040ade0
push dword [esi + 0x47cdc4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040ade0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40e46c
push eax
call fcn.0040b648
add esp, 0x2c
pop edi
jmp 0x408871
lea eax, [ebp + 8]
lea esi, [esi + 0x47cdc4]
push 0
push eax
push dword [esi]
call fcn.0040abf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x409de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0x40
call dword [0x9e7004]
mov ebx, eax
xor esi, esi
mov byte [ebx + edi], 0
test edi, edi
je 0x409e3e
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 4], eax
lea ebx, [ebx]
mov ecx, dword [ebp + 0xc]
push ecx
lea edi, [esi + ebx]
call dword [0x9e70c8]
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov eax, dword [ebp + 0xc]
inc esi
add esp, 4
mov cl, byte [edx + eax]
mov edx, dword [ebp - 4]
xor cl, byte [edx + edi]
mov byte [edi], cl
cmp esi, dword [ebp + 0x10]
jb 0x409e10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp dword [eax + 4], 0x40
push ebx
mov ebx, dword [ebp + 8]
jb 0x40bdc5
mov eax, dword [eax]
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov ecx, 0x40
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x5a4d
cmp word [ebx], cx
jne 0x40be0d
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x40be0d
mov ecx, dword [ebp + 0xc]
lea esi, [eax + 0xf8]
lea edx, [ebx + 0x40]
mov dword [ebp - 8], edx
cmp esi, dword [ecx + 4]
ja 0x40bdcf
mov ecx, dword [ecx]
add ecx, eax
mov dword [ebp - 4], ecx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov ecx, 0xf8
rep movsb byte es:[edi], byte [esi]
cmp dword [edx], 0x4550
jne 0x40be0d
mov edx, 0x10b
cmp word [ebx + 0x58], dx
jne 0x40be0d
movzx eax, word [ebx + 0x46]
test ax, ax
je 0x40be0d
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [ebx + 0x140], eax
call dword [0xbf007c]
push eax
call dword [0xbf0014]
mov dword [ebx + 0x138], eax
test eax, eax
jne 0x40bddb
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, word [ebx + 0x54]
mov edx, dword [ebx + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebx + 0x140]
push edx
push ecx
push eax
mov dword [ebx + 0x13c], ecx
call fcn.0040c410
add esp, 0x10
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea eax, [edi + 1]
mov dword [esi + 8], edi
call fcn.00403250
mov dword [esi], eax
cmp eax, edi
je 0x422f0b
push 0x9e9b92
push eax
call dword [0xbf00bc]
mov esi, dword [0xbefa98]
xor eax, eax
cmp byte [esi], al
je 0x422f1e
inc eax
cmp byte [esi + eax], 0
jne 0x422f17
inc eax
call fcn.00403250
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x422f35
push esi
push ebx
call dword [0xbf00bc]
lea eax, [ebp - 0x24]
push eax
call dword [0xbeffd0]
mov eax, dword [ebp - 0x16]
lea esi, [eax + eax*4]
mov word [0xbefe80], si
cmp dword [ebp + 0xc], edi
jle 0x422fa9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
lea esp, [esp]
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0xbefe84], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x422f60
mov word [0xbefe80], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x423021
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x422ff1
cmp dword [ecx], 0
je 0x422ff1
cmp dword [0xbf0120], ecx
jne 0x422fdb
mov dword [0xbf0120], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x422ff1
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x423021
cmp dword [ecx], 0
je 0x423021
cmp dword [0xbf0120], eax
jne 0x42300b
mov dword [0xbf0120], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x423021
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4236e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0xbf0068]
test esi, esi
jne 0x4236f8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4236f1
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x4236f1
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x42375a
jmp 0x423740
mov eax, dword [ebx + edi*4]
mov ecx, dword [0xbefbd8]
add eax, esi
call fcn.00422e80
test eax, eax
je 0x423763
inc edi
cmp edi, dword [ebp - 4]
jb 0x423740
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401b6b
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x401b78
xor eax, eax
pop edi
ret
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00403802
test esi, esi
pop ecx
jle 0x401ba4
mov ecx, eax
sub edi, eax
mov edx, esi
push ebx
mov bl, byte [edi + ecx]
xor bl, 0x5b
mov byte [ecx], bl
inc ecx
dec edx
jne 0x401b97
pop ebx
mov byte [eax + esi], 0
pop esi
pop edi
ret

Function at 0x401bab
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x401bcc
mov eax, dword [esp + 4]
add eax, ecx
mov edx, dword [eax]
xor edx, dword [esp + 0xc]
add edx, ecx
add ecx, 4
cmp ecx, dword [esp + 8]
mov dword [eax], edx
jb 0x401bb3
ret

Function at 0x401bcd
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x401bee
mov eax, dword [esp + 4]
add eax, ecx
mov edx, dword [eax]
sub edx, ecx
xor edx, dword [esp + 0xc]
add ecx, 4
cmp ecx, dword [esp + 8]
mov dword [eax], edx
jb 0x401bd5
ret

Function at 0x40218b
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.00402148
pop ecx
pop ecx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x402222
cmp eax, 0xffffffff
je 0x402222
push ebx
push esi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 8]
mov esi, 0xf01ff
push 1
push 1
push 1
push esi
lea ecx, [ebp - 0x44]
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
cmp ebx, edi
je 0x4021e8
cmp ebx, 0xffffffff
jne 0x4021fe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x40220e
xor edi, edi
inc edi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 4]
call esi
pop esi
mov eax, edi
pop ebx
jmp 0x402224
xor eax, eax
pop edi
leave
ret

Function at 0x402227
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push edi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
call fcn.00402148
pop ecx
pop ecx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
je 0x4022a0
cmp ebx, 0xffffffff
je 0x4022a0
push esi
push 0xf01ff
lea eax, [ebp - 0x5c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, edi
je 0x402294
cmp esi, 0xffffffff
je 0x402294
lea eax, [ebp - 0x1c]
push eax
inc edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40228d
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop esi
jmp 0x4022a2
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4023b5
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
push 0x7d0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
sub eax, edi
cmp eax, 0x5dc
pop edi
pop esi
ja 0x4023e1
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
xor eax, eax
ret

Function at 0x4026cc
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00403d55
pop ecx
mov esi, str.ws2_32.dll
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.WSAStartup
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea ecx, [ebp - 0x194]
push ecx
push 2
call eax
push 0xa365
push 0x232
push 0x10
push 0
push str.__srvmgr32
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, str.ZwQueryService
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402530
test eax, eax
je 0x40276b
call fcn.0040319d
test eax, eax
jne 0x402772
xor eax, eax
jmp 0x402819
call fcn.004032c8
push dword [0x406060]
call fcn.0040218b
mov dword [esp], 0x40103d
push 0xbb8
push 0x161
push dword [0x40606c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00403477
test eax, eax
jne 0x4027ad
call fcn.004034fd
call fcn.00401b50
call fcn.00401b36
push 0x5c
push dword [0x406060]
call fcn.0040382a
push eax
call fcn.00402337
push 0x5c
push dword [0x406064]
call fcn.0040382a
push eax
call fcn.00402337
push 0x5c
push dword [0x406068]
call fcn.0040382a
push eax
call fcn.00402337
call fcn.00402329
push esi
call fcn.00402352
push 0x5c
push dword [0x406064]
call fcn.0040382a
push eax
call fcn.00402352
add esp, 0x34
call fcn.004026ac
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x4032c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0x80000000
push dword [0x406064]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4032ef
xor eax, eax
jmp 0x4033d0
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00403802
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [0x40603c]
push ebx
call dword [0x40604c]
push edi
push esi
call fcn.00403292
test eax, eax
pop ecx
pop ecx
je 0x4033af
mov edx, dword [eax + esi + 4]
lea edi, [eax + esi]
mov ecx, dword [edi]
push ecx
push edx
lea eax, [eax + esi + 8]
push eax
call fcn.00403265
add esp, 0xc
mov dword [edi], eax
push dword [0x406064]
call dword [0x406040]
mov edi, 0x40000000
push edi
push dword [0x406064]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x406064]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x406064]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
xor eax, eax
jmp 0x4033ce
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [0x406050]
push ebx
call dword [0x40604c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4033d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.qmopt.dll
lea eax, [ebp - 0x100]
push eax
push str._s_system32_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
leave
ret

Function at 0x403df1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
lea ecx, [ebp - 8]
call fcn.00401ec3
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403e7d
push 0x7f
pop ecx
mov byte [ebp - 0x214], al
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x405448
push dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push ecx
lea eax, [ebp - 0x214]
mov ecx, esp
push eax
call fcn.00401f14
lea ecx, [ebp - 8]
call fcn.00402064
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401ee4
lea ecx, [ebp - 8]
call fcn.00401f45
mov eax, dword [ebp + 8]
pop edi
leave
ret
Function at 0x404020
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebp, str.System32_
push ebp
call edi
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 0x14], eax
call fcn.00403802
pop ecx
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push ebx
call edi
sub esi, dword [esp + 0x10]
cmp eax, esi
jg 0x40406d
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push ebx
call fcn.00403816
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret