joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407843
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4078e0
push ebx
push esi
call fcn.0040780c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004077a0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40788d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4078df
push edi
push eax
call fcn.00408460
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4078ad
call fcn.00406301
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4078de
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004077a0
add esp, 0x20
test eax, eax
jne 0x4078cc
push edi
call fcn.00406301
jmp 0x4078d4
push ebx
call fcn.00406301
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408bdd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fe8
push 0x410fe0
push str.FlsAlloc
push 0x1f
call fcn.00408a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c11
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f11c]
call esi
jmp 0x408c17
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408c5b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410ff8
push 0x410ff0
push str.FlsGetValue
push 0x21
call fcn.00408a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c92
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f11c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408c9a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411000
push 0x410ff8
push str.FlsSetValue
push 0x22
call fcn.00408a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408cd4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f11c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e15d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e15d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x403506
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x23
pop edi
push edi
push 4
call fcn.00409a80
pop ecx
pop ecx
mov esi, 0xd2
test al, al
je 0x403556
push 0x42b91c
call fcn.00408be0
mov ebx, eax
push ebx
push 0x6f0
push esi
push edi
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00405d37
xor ebx, ebx
pop ecx
inc ebx
pop ecx
test al, al
jne 0x4035b0
push edi
push ebx
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4035a9
push 0x42b748
call fcn.00408be0
push eax
push 0x6f5
push esi
push edi
push ebx
mov dword [ebp - 0x10c], eax
call fcn.004094a0
push dword [ebp - 0x10c]
call fcn.004141bd
add esp, 0x1c
mov eax, ebx
jmp 0x403719
push ebx
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x403618
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push ebx
mov edi, eax
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x403609
push edi
push 0x42b720
call fcn.00408be0
push eax
push 0x6ff
push esi
push 0x23
push ebx
mov dword [ebp - 0x10c], eax
call fcn.004094a0
push dword [ebp - 0x10c]
call fcn.004141bd
add esp, 0x20
test edi, edi
jne 0x403717
mov edi, ebx
jmp 0x403717
push 0x60014
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x110], eax
test eax, eax
jne 0x403685
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push ebx
mov edi, eax
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x403679
push edi
push 0x42b6f8
call fcn.00408be0
push eax
push 0x70e
push esi
push 0x23
push ebx
mov dword [ebp - 0x110], eax
call fcn.004094a0
push dword [ebp - 0x110]
call fcn.004141bd
add esp, 0x20
test edi, edi
jne 0x403702
mov edi, ebx
jmp 0x403702
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4036ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x4036a2
mov edi, ebx
cmp edi, 0x420
jne 0x4036ae
xor edi, edi
jmp 0x4036ea
push 0x23
push ebx
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4036ea
push edi
push 0x42b8f4
call fcn.00408be0
push eax
push 0x726
push esi
push 0x23
push ebx
mov dword [ebp - 0x114], eax
call fcn.004094a0
push dword [ebp - 0x114]
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x110]
call fcn.004022f8
pop ecx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x10c], 0
je 0x403717
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416261
leave
ret
Function at 0x4054a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x42c288
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004170e2
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 8], edi
cmp edi, ebx
je 0x405539
push esi
push 2
push ebx
push edi
call fcn.00416faa
push edi
call fcn.00416ebb
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x40552f
push ebx
push ebx
push edi
call fcn.00416faa
push 0x87
lea eax, [esi + 1]
push str.service.cpp
push eax
call fcn.00414105
push dword [ebp - 8]
mov edi, eax
push esi
push 1
push edi
call fcn.00416d0a
add esp, 0x28
cmp eax, esi
jne 0x405528
push edi
mov byte [edi + esi], bl
call fcn.00416ab5
pop ecx
push 0x1e
mov dword [ebp - 4], eax
pop ecx
cmp eax, ebx
jl 0x405525
cmp eax, ecx
jle 0x405528
mov dword [ebp - 4], ecx
push edi
call fcn.004141bd
pop ecx
push dword [ebp - 8]
call fcn.00416a2b
pop ecx
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x40716c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x6b
push 4
pop esi
push esi
call fcn.00409a80
pop ecx
pop ecx
mov edi, 0xd3
test al, al
je 0x4071bc
push 0x42d4ec
call fcn.00408be0
mov ebx, eax
push ebx
push 0x786
push edi
push 0x6b
push esi
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00405d37
pop ecx
pop ecx
test al, al
je 0x4073a2
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x110], eax
test eax, eax
je 0x407369
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x60000
lea ecx, [ebp - 0x108]
push ecx
push eax
call ebx
mov dword [ebp - 0x10c], eax
test eax, eax
je 0x40725a
mov ecx, dword [0x43c180]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
push 1
push 0x10022
push 0x42b6dc
mov dword [ebp - 0x114], eax
call fcn.004087f7
pop ecx
mov ecx, dword [ebp - 0x114]
push eax
push dword [ebp - 0x10c]
call dword [esi + 0x178]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 4
pop esi
push 0xf01ff
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call ebx
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x40729a
push 0xf0000
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call ebx
mov dword [ebp - 0x10c], eax
test eax, eax
je 0x407322
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x6b
push esi
test eax, eax
je 0x4072de
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407314
push 0x42d4d4
call fcn.00408be0
mov ebx, eax
push ebx
push 0x7a6
push edi
push 0x6b
push esi
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
jmp 0x407314
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407314
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42d4a8
call fcn.00408be0
mov ebx, eax
push ebx
push 0x7aa
push edi
push 0x6b
push esi
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40735b
push 0x6b
push esi
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x40735b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42d480
call fcn.00408be0
mov ebx, eax
push ebx
push 0x7b2
push edi
push 0x6b
push esi
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4073a2
push 0x6b
push esi
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4073a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42d450
call fcn.00408be0
mov ebx, eax
push ebx
push 0x7b9
push edi
push 0x6b
push esi
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416261
leave
ret
Function at 0x4087f7
Capabilities:
Check mutex on windows

Disassembly:
push 0x2c
mov eax, 0x428136
call fcn.0041630f
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], edi
xor esi, esi
cmp edi, esi
jne 0x408816
xor eax, eax
jmp 0x408937
mov dword [ebp - 0x1c], 0x87878787
mov dword [ebp - 0x18], 0x87878787
push 8
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.00417219
add esp, 0xc
test eax, eax
jne 0x408935
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], esi
mov eax, dword [0x43a7b8]
cmp eax, esi
jne 0x40885e
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x43a7b8], eax
mov dword [0x43a7bc], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x24], eax
push 8
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.00417219
add esp, 0xc
test eax, eax
jne 0x408907
push edi
call fcn.004167a0
pop ecx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x28]
push ecx
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x408907
mov ecx, edi
lea ebx, [edi + 8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], ebx
mov al, byte [ebx]
test al, al
je 0x4088d9
mov dl, al
sar dl, 4
and dl, 0xf
movsx dx, dl
movzx edx, dx
and al, 0xf
cbw
movzx esi, ax
movsx eax, si
shl eax, 4
or eax, edx
mov byte [ecx], al
inc ecx
inc ebx
jmp 0x4088a9
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 8
jge 0x4088ef
mov eax, dword [ebp - 0x20]
mov byte [eax + ecx], 0
inc dword [ebp - 0x20]
jmp 0x4088dd
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
or dword [ebp - 4], 0xffffffff
jmp 0x40891a
cmp dword [ebp - 0x24], 0
je 0x408929
cmp dword [ebp - 0x24], 0x80
jne 0x408935
push dword [0x43a7b8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
call fcn.0041636b
ret
Function at 0x408971
Capabilities:
Check mutex on windows

Disassembly:
push 0x34
mov eax, 0x42815b
call fcn.0041630f
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], ebx
mov eax, 0x87
mov ecx, eax
mov word [ebp - 0x24], cx
mov word [ebp - 0x22], cx
mov word [ebp - 0x20], cx
mov word [ebp - 0x1e], cx
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], cx
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], ax
push 8
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.0040893d
add esp, 0xc
test eax, eax
jne 0x408ace
or dword [ebp - 0x2c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x43a7b8]
cmp eax, ecx
jne 0x4089e6
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x43a7b8], eax
mov dword [0x43a7bc], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2c], eax
push 8
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.0040893d
add esp, 0xc
test eax, eax
jne 0x408aa0
push ebx
call fcn.00418ec2
pop ecx
mov edi, eax
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [edi + edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x408aa0
mov esi, ebx
mov dword [ebp - 0x34], esi
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x40], ecx
cmp word [ecx], 0
je 0x408a71
mov al, byte [ecx]
mov dl, al
sar dl, 4
and dl, 0xf
movsx dx, dl
movzx edx, dx
and al, 0xf
cbw
movzx edi, ax
movsx eax, di
shl eax, 4
or eax, edx
mov byte [esi], al
inc esi
mov dword [ebp - 0x34], esi
inc ecx
mov dword [ebp - 0x40], ecx
mov edi, dword [ebp - 0x3c]
jmp 0x408a3c
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0x10
jge 0x408a87
mov eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
inc dword [ebp - 0x28]
jmp 0x408a75
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
lea eax, [edi + edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
or dword [ebp - 4], 0xffffffff
jmp 0x408ab3
cmp dword [ebp - 0x2c], 0
je 0x408ac2
cmp dword [ebp - 0x2c], 0x80
jne 0x408ace
push dword [0x43a7b8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
call fcn.0041636b
ret
Function at 0x409540
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x42df08
call fcn.004087f7
push eax
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0041687f
push 0x42decc
call fcn.004087f7
push eax
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0041687f
push 0x94
lea edx, [ebp - 0x898]
push 0
push edx
call fcn.00416670
add esp, 0x2c
lea eax, [ebp - 0x898]
push eax
mov dword [ebp - 0x898], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x894], 6
jb 0x409600
push 0x42deb4
call fcn.004087f7
push eax
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.0041995b
push 0x42deb4
call fcn.004087f7
push eax
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0041995b
add esp, 0x20
test edi, edi
jne 0x409615
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416261
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
add edi, 4
push edi
push 1
lea eax, [ebp - 0x404]
push eax
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
jne 0x4096c8
push 0x21
push 4
call fcn.00409a80
add esp, 8
test al, al
je 0x409677
push ebx
push 0x42de60
call fcn.00408be0
mov esi, eax
push esi
push 0x11a
push 0x28d
push 0x21
push 4
call fcn.004094a0
push esi
call fcn.00414179
add esp, 0x20
push 0
push edi
push 1
lea ecx, [ebp - 0x804]
push ecx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
mov esi, eax
test esi, esi
jne 0x4096c8
push 0x21
push 4
call fcn.00409a80
add esp, 8
test al, al
je 0x4096c8
push ebx
push 0x42de08
call fcn.00408be0
mov edi, eax
push edi
push 0x12a
push 0x28d
push 0x21
push 4
call fcn.004094a0
push edi
call fcn.00414179
add esp, 0x20
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00416261
mov esp, ebp
pop ebp
ret
Function at 0x409840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428235
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x43c104], 0
jne 0x409a5c
call fcn.004096e0
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0xc
call fcn.00409540
add esp, 4
test eax, eax
je 0x409a5c
push 0x42dfd0
call fcn.004087f7
add esp, 4
push eax
push 0
push 0
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x43c104], eax
test eax, eax
je 0x409a5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409a5c
push 0x43a7c0
push 0
push 0
push 0x408ed0
push 0
push 0
mov dword [0x43c0fc], 1
call fcn.00419706
add esp, 0x18
lea ecx, [ebp - 0x138]
mov dword [0x43c100], eax
call fcn.00409af0
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], 0
call fcn.00409f20
test eax, eax
je 0x409980
push 8
call fcn.00413fcd
mov esi, eax
add esp, 4
mov dword [ebp - 0x118], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40996c
call fcn.004197a6
add eax, 0x40
push eax
mov ecx, esi
call fcn.0040a1f0
jmp 0x40996e
xor eax, eax
mov dword [0x43c10c], eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
mov byte [ebp - 4], 0
call eax
push 0x103
lea ecx, [ebp - 0x113]
push 0
push ecx
mov byte [ebp - 0x114], 0
call fcn.00416670
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.00409db0
test eax, eax
je 0x409a06
push 0x104
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x138]
call fcn.00409e20
test eax, eax
je 0x409a06
push 0x108
call fcn.00413fcd
add esp, 4
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4099f2
lea ecx, [ebp - 0x114]
push ecx
mov ecx, eax
call fcn.0040a090
jmp 0x4099f4
xor eax, eax
mov dword [0x43c108], eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
mov byte [ebp - 4], 0
call eax
lea ecx, [ebp - 0x138]
call fcn.00409eb0
test eax, eax
je 0x409a4a
push 4
call fcn.00413fcd
add esp, 4
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x409a36
mov ecx, eax
call fcn.0040a280
jmp 0x409a38
xor eax, eax
mov dword [0x43c110], eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
mov byte [ebp - 4], 0
call eax
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], 0xffffffff
call fcn.0040a290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416261
mov esp, ebp
pop ebp
ret
Function at 0x409c60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.00409b30
test eax, eax
jne 0x409c8d
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
lea ecx, [ebp + 8]
push ecx
push 0x20019
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409c84
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push edi
push edi
push esi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x409d29
mov eax, dword [esi]
cmp eax, edi
je 0x409d29
mov ecx, dword [ebp + 0x1c]
cmp ecx, edi
jbe 0x409cdd
cmp eax, ecx
jbe 0x409cdd
mov dword [esi], ecx
mov edx, dword [esi]
push edx
call fcn.00413fcd
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 4
push esi
push eax
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409d14
mov eax, dword [edi]
push eax
call fcn.00414179
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x40a0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 4], 0
lea eax, [ecx + 4]
je 0x40a164
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40a163
cmp byte [edi], 0
je 0x40a163
push esi
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a162
push 2
push 0
push 0
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a143
push 0
lea ecx, [ebp + 8]
push ecx
sub eax, edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
ret 4

Function at 0x40a170
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 4], 0
push esi
lea esi, [ecx + 4]
je 0x40a1d3
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0041687f
push 0x42fc60
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.0041995b
add esp, 0x18
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416261
mov esp, ebp
pop ebp
ret