joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4318
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d447c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0
je 0x4d4466
mov eax, dword [ebp - 8]
cmp dword [eax + 0x24], 0x1000
jge 0x4d4435
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d436e
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1ff
jl 0x4d43c6
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x1ff
mov edx, 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00405690
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d43aa
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x14]
mov edx, 0x200
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00405690
jmp 0x4d43df
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
call fcn.00405230
mov eax, dword [ebp - 8]
add eax, 0x1c
call fcn.00405198
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d43f6
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
add dword [edx + 0x24], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x24], 0x1000
jl 0x4d4423
lea eax, [ebp - 0xc]
mov edx, 0x4d4490
call fcn.00405464
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, dword [ebp - 4]
call fcn.004d4044
jmp 0x4d4466
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d445c
cmp eax, 0xbb8
jb 0x4d4466
jmp 0x4d445e
jl 0x4d4466
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4483
lea eax, [ebp - 0xc]
call fcn.00405198
ret
Function at 0x4d7868
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd04
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2f8], edx
mov dword [ebp - 0x2fc], edx
mov dword [ebp - 0x2f0], edx
mov dword [ebp - 0x2f4], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405618
xor eax, eax
push ebp
push 0x4d7a91
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4d7a5e
xor eax, eax
push ebp
push 0x4d7a54
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040c858
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0xa]
lea edx, [ebp - 8]
lea eax, [ebp - 6]
call fcn.0040c810
call fcn.0040c884
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x12]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0xe]
lea eax, [ebp - 0xc]
call fcn.0040c530
mov eax, dword [0x4e4674]
push dword [eax]
lea edx, [ebp - 0x2f0]
movzx eax, word [ebp - 6]
call fcn.0040a0e0
push dword [ebp - 0x2f0]
push 0x4d7aa8
push ebp
lea edx, [ebp - 0x2f4]
movzx eax, word [ebp - 8]
call fcn.004d77ec
pop ecx
push dword [ebp - 0x2f4]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040552c
mov eax, dword [0x4e4674]
mov eax, dword [eax]
call fcn.0040a724
test al, al
jne 0x4d7973
mov edx, dword [0x4e4674]
mov edx, dword [edx]
lea eax, [ebp - 0x11c]
call fcn.0040aaa4
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [ebp - 0x18]
call fcn.0040a724
test al, al
jne 0x4d799b
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
call fcn.0040aaa4
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_CreateDirectoryA
push dword [ebp - 0x18]
push 0x4d7ab4
lea edx, [ebp - 0x2f8]
movzx eax, word [ebp - 8]
call fcn.0040a0e0
push dword [ebp - 0x2f8]
push 0x4d7aa8
push ebp
lea edx, [ebp - 0x2fc]
movzx eax, word [ebp - 0xa]
call fcn.004d77ec
pop ecx
push dword [ebp - 0x2fc]
push 0x4d7ac0
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0040552c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2e8]
call fcn.00403744
mov eax, dword [ebp - 0x1c]
call fcn.0040a6dc
test al, al
jne 0x4d7a12
lea eax, [ebp - 0x2e8]
call fcn.004034d4
call fcn.004030d0
jmp 0x4d7a22
lea eax, [ebp - 0x2e8]
call fcn.004034e0
call fcn.004030d0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e8]
call fcn.00405948
call fcn.00403ca0
call fcn.004030d0
lea eax, [ebp - 0x2e8]
call fcn.0040380c
call fcn.004030d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d7a5e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7a98
lea eax, [ebp - 0x2fc]
mov edx, 4
call fcn.004051bc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004051bc
lea eax, [ebp - 4]
call fcn.00405198
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2a397c39
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5bee315e
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40a380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x409015
lea edi, [esi - 0x8015]
push edi
or ebp, 0xffffffff
jmp 0x40a3a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a3a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a398
mov eax, 1
add ebx, ebx
jne 0x40a3bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a3b0
jne 0x40a3cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a3b0
xor ecx, ecx
sub eax, 3
jb 0x40a3e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a452
mov ebp, eax
add ebx, ebx
jne 0x40a3eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a3f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a41c
inc ecx
add ebx, ebx
jne 0x40a408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a3fd
jne 0x40a419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a3fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a43c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a42d
jmp 0x40a39e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a43c
add edi, ecx
jmp 0x40a39e
pop esi
mov edi, esi
mov ecx, 0x1729
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x40a477
cmp byte [edi], 1
jne 0x40a45c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x40a45a
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a4bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa058]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a47d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa060]
or eax, eax
je 0x40a4b9
mov dword [ebx], eax
add ebx, 4
jmp 0x40a49a
call dword [esi + 0xa05c]
mov ebp, dword [esi + 0xa064]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xa51a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a50b
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x40256f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x469400], esi
push edi
jne 0x40258f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4693fc], esi
mov byte [0x4693f8], al
jne 0x4025f5
mov ecx, dword [0x469928]
test ecx, ecx
je 0x4025d6
mov eax, dword [0x469924]
sub eax, 4
cmp eax, ecx
jmp 0x4025cf
mov eax, dword [eax]
test eax, eax
je 0x4025c1
call eax
mov eax, dword [0x469924]
sub eax, 4
cmp eax, dword [0x469928]
mov dword [0x469924], eax
jae 0x4025b9
mov eax, 0x40801c
mov esi, 0x408020
cmp eax, esi
mov edi, eax
jae 0x4025f5
mov eax, dword [edi]
test eax, eax
je 0x4025ee
call eax
add edi, 4
cmp edi, esi
jb 0x4025e6
mov eax, 0x408024
mov esi, 0x408028
cmp eax, esi
mov edi, eax
jae 0x402614
mov eax, dword [edi]
test eax, eax
je 0x40260d
call eax
add edi, 4
cmp edi, esi
jb 0x402605
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x40262e
push dword [ebp + 8]
mov dword [0x469400], 1
call fcn.004024d5
pop ebp
ret

Function at 0x4030cd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x46951c], ebx
push esi
push edi
jne 0x40314d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x403188
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x46951c], eax
je 0x403188
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x469520], eax
call esi
cmp dword [0x4693c0], 2
mov dword [0x469524], eax
jne 0x40314d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x46952c], eax
je 0x40314d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x469528], eax
mov eax, dword [0x469528]
test eax, eax
je 0x403192
call eax
test eax, eax
je 0x403179
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x46952c]
test eax, eax
je 0x403179
test byte [ebp - 8], 1
jne 0x403192
cmp dword [0x4693cc], 4
jb 0x40318c
or byte [ebp + 0x12], 0x20
jmp 0x4031b1
xor eax, eax
jmp 0x4031c1
or byte [ebp + 0x12], 4
jmp 0x4031b1
mov eax, dword [0x469520]
test eax, eax
je 0x4031b1
call eax
mov ebx, eax
test ebx, ebx
je 0x4031b1
mov eax, dword [0x469524]
test eax, eax
je 0x4031b1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x46951c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41151b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov word [ebp - 0xe], 0
mov word [ebp - 0x10], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, al
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
shr ax, 8
movzx eax, al
mov word [ebp - 0x10], ax
cmp word [ebp - 0xe], 5
setbe al
movzx eax, al
leave
ret

Function at 0x411583
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x20019
call fcn.00411563
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersion
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x41164e
mov dword [ebp - 0x14], 0xf6a
mov dword [ebp - 0x14], 0x1000
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], str.XXXX
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProgramFilesDir
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.XXXX
call sub.msvcrt.dll_strlen
add eax, str.XXXX
mov dword [eax], 0x666f535c
mov dword [eax + 4], 0x45646966
mov dword [eax + 8], 0x4f5353
mov eax, str.XXXX
jmp 0x411653
mov eax, 0
leave
ret
Function at 0x411655
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44c
mov eax, dword [0x4670dc]
test eax, eax
jne 0x4116e0
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x41c]
add eax, edx
mov dword [eax], 0x7a616d5c
mov dword [eax + 4], 0x65676e69
mov dword [eax + 8], 0x6e692d72
mov dword [eax + 0xc], 0x6c617473
mov dword [eax + 0x10], 0x6f6c2e6c
mov word [eax + 0x14], 0x67
mov dword [esp + 4], 0x447ae6
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [0x4670dc], eax
mov eax, dword [0x4670dc]
test eax, eax
je 0x4117db
mov eax, dword [0x4670dc]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_setbuf
lea eax, [ebp - 0x420]
mov dword [esp], eax
call fcn.00411480
lea eax, [ebp - 0x420]
mov dword [esp], eax
call fcn.00411495
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
add eax, 0x76c
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
lea edi, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [0x4670dc]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x42c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], str._d__02d__04d__02d:_02d:_02d_INSTALL
mov dword [esp], eax
call fcn.00431910
lea eax, [ebp + 0xc]
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
mov eax, dword [0x4670dc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00431970
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
je 0x4117db
mov eax, dword [0x4670dc]
mov dword [esp + 4], 0x447b0d
mov dword [esp], eax
call fcn.00431910
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41333e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x447a81
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesEventLogApplicationMazinger
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
test eax, eax
sete al
test al, al
je 0x413544
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.CategoryCount
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 9]
mov ecx, eax
call fcn.00436750
call fcn.00411583
mov edx, eax
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 9]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call fcn.0043d460
sub esp, 8
lea eax, [ebp - 9]
mov ecx, eax
call fcn.00436780
lea eax, [ebp - 0x2c]
mov dword [esp], str.mazinger.exe
mov ecx, eax
call fcn.0043bd60
sub esp, 4
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.00435080
mov ebx, eax
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.004350a0
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.CategoryMessageFile
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.00435080
mov ebx, eax
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.004350a0
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.EventMessageFile
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], 0xf
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.TypesSupported
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.Registered_Event_log
call fcn.00411655
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.0043dfb0
jmp 0x413544
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x415665
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x10b4
call fcn.00424e30
sub esp, eax
mov eax, dword [ebp + 8]
mov byte [ebp - 0x107c], al
lea eax, [ebp - 9]
mov ecx, eax
call fcn.00436750
lea eax, [ebp - 0x24]
lea edx, [ebp - 9]
mov dword [esp + 4], edx
mov dword [esp], str.rundll32__
mov ecx, eax
call fcn.0043d460
sub esp, 8
lea eax, [ebp - 9]
mov ecx, eax
call fcn.00436780
call fcn.00411583
mov edx, eax
lea eax, [ebp - 0x24]
mov dword [esp], edx
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
cmp byte [ebp - 0x107c], 0
je 0x4156e3
lea eax, [ebp - 0x24]
mov dword [esp], str._sayakaCP32.dll
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
jmp 0x4156f7
lea eax, [ebp - 0x24]
mov dword [esp], str._sayakaCP.dll
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
lea eax, [ebp - 0x24]
mov dword [esp], str.__Register
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], eax
lea eax, [ebp - 0x1078]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x78], 0x44
mov word [ebp - 0x48], 1
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], eax
mov dword [esp], str.Executing__s
call fcn.00411655
lea eax, [ebp - 0x34]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x78]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x1078]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
sete al
test al, al
je 0x4157ea
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], eax
mov dword [esp], str.Error_executing__s
call fcn.00411655
call fcn.00411b5a
lea eax, [ebp - 0x24]
mov ecx, eax
call fcn.0043dfb0
jmp 0x415822
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4169b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1034
call fcn.00424e30
sub esp, eax
mov byte [ebp - 9], 0
mov dword [esp], 0x20019
call fcn.00411563
mov ebx, eax
mov ecx, 0x467064
call fcn.004350a0
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x416aac
mov dword [ebp - 0x1014], 0x1000
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x1014]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1010]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1018]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.MazingerVersion
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x416a96
mov eax, dword [ebp - 0x1014]
mov byte [ebp + eax - 0x1010], 0
mov dword [esp + 4], str.3.4.2_enterprise
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x416a9a
mov byte [ebp - 9], 1
jmp 0x416a9a
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x416ab0
mov byte [ebp - 9], 1
movzx eax, byte [ebp - 9]
mov ebx, dword [ebp - 4]
leave
ret