joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421411
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
mov eax, 1
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], esi
mov word [ecx], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x28], eax
jmp 0x404a62
xor esi, esi
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x24]
lea ecx, [ebp - 0x20]
add edi, 0x400
call edx
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x4c]
push edi
lea ecx, [ebp - 0x20]
call edx
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x404a8c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
mov ecx, 8
cmp dword [ebp + 0x1c], ecx
jae 0x404a9c
lea esi, [ebp + 8]
mov edx, dword [ebp + 0x40]
cmp dword [ebp + 0x54], ecx
jae 0x404aa7
lea edx, [ebp + 0x40]
cmp dword [ebp + 0x38], ecx
mov ecx, dword [ebp + 0x24]
jae 0x404ab2
lea ecx, [ebp + 0x24]
push esi
push edi
push eax
push 0x424c88
push edx
push ecx
call ebx
lea ecx, [edi - 1]
lea edx, [ecx - 1]
cmp eax, edx
je 0x404a60
cmp eax, ecx
je 0x404a60
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x404ad4
sub ecx, esi
mov esi, dword [ebp - 0x24]
sar ecx, 1
push ecx
call fcn.004016a0
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
xor edi, edi
cmp eax, edi
je 0x404b13
push eax
lea ecx, [ebp - 0x20]
call dword [0x425a34]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov ebx, 8
mov dword [ebp - 0x20], vtable.ES_CMN_FUNCS::BUFFER::IESBuffer.0
cmp dword [ebp + 0x1c], ebx
jb 0x404b31
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.mfc100u.dll_delete]
add esp, 4
xor ecx, ecx
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], edi
mov word [ebp + 8], cx
cmp dword [ebp + 0x38], ebx
jb 0x404b53
mov edx, dword [ebp + 0x24]
push edx
call dword [sym.imp.mfc100u.dll_delete]
add esp, 4
xor eax, eax
mov dword [ebp + 0x38], 7
mov dword [ebp + 0x34], edi
mov word [ebp + 0x24], ax
cmp dword [ebp + 0x54], ebx
jb 0x404b75
mov ecx, dword [ebp + 0x40]
push ecx
call dword [sym.imp.mfc100u.dll_delete]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405580
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4213b1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x42e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov eax, 1
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
jae 0x4055db
lea eax, [ebp + 8]
push ebx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
je 0x40567a
xor ecx, ecx
mov edx, 2
mul edx
seto cl
mov byte [ebp - 4], 2
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.mfc100u.dll_new__]
add esp, 4
cmp dword [ebp + 0x1c], 8
mov ebx, eax
mov eax, dword [ebp + 8]
jae 0x405619
lea eax, [ebp + 8]
push ebx
push edi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x405665
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
push str.StringFileInfo000004b0FileVersion
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x405665
mov eax, dword [ebp - 0x14]
mov ecx, eax
lea edi, [ecx + 2]
jmp 0x405650
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x405650
sub ecx, edi
sar ecx, 1
push ecx
call fcn.004016a0
push ebx
call dword [sym.imp.mfc100u.dll_delete__]
add esp, 4
jmp 0x40567a
cmp dword [ebp + 0x1c], 8
jb 0x40568d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.mfc100u.dll_delete]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x406240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421369
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call dword [0x425a08]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x4c]
push 0x20a
lea ecx, [ebp - 0x28]
call eax
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x406378
push 1
push 0x23
mov eax, 0x20a
push edi
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [ebp - 0x24]
cmp eax, 1
jne 0x40632f
cmp edi, ebx
je 0x4062fe
lea esi, [ebp - 0x10]
mov edx, edi
call fcn.004045c0
mov esi, dword [ebp + 8]
cmp eax, ebx
jge 0x406307
xor ecx, ecx
jmp 0x40630a
mov eax, 0x80070057
xor ecx, ecx
jmp 0x40630a
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x406312
cmp ecx, ebx
jne 0x40632f
cmp edi, ebx
je 0x406378
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x406378
cmp edi, ebx
je 0x406378
mov eax, edi
lea edx, [eax + 2]
jmp 0x406340
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406340
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.004016a0
mov edi, dword [ebp - 0x24]
cmp edi, ebx
je 0x406375
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], ebx
je 0x40638e
push 0x11
mov eax, str.EPSONEPSONSCAN2
mov ecx, esi
call fcn.00408650
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov dword [ebp - 4], 2
cmp edi, ebx
je 0x4063aa
push edi
lea ecx, [ebp - 0x28]
call dword [0x425a34]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420713
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x42e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor edi, edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x400
mov byte [ebp - 4], 1
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
cmp dword [esi + 0x18], edi
jne 0x411812
push 0x14
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
cmp eax, edi
je 0x41180a
mov dword [eax], edi
mov dword [eax + 4], 0x10000
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x41180c
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f822
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e028]
jne 0x41f82c
repz ret
jmp fcn.0041fd64
Function at 0x4010c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
lea ebx, [ebx]
movzx edx, al
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x4010e0
mov al, 1
mov ecx, 0x45e280
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x45e2a8
jl 0x401115
mov dword [0x45d680], 0x63
mov dword [0x46084c], 0
mov edx, 1
jmp 0x401160
movzx eax, byte [ebp + edx - 0x104]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x45d680], eax
mov dword [eax*4 + 0x4606c0], edx
inc edx
cmp edx, 0x100
jl 0x401160
xor ecx, ecx
mov dl, byte [ecx + 0x45d680]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x4602c0], eax
ror eax, 8
mov dword [ecx + 0x45fec0], eax
ror eax, 8
mov dword [ecx + 0x45fac0], eax
ror eax, 8
mov dword [ecx + 0x45f6c0], eax
mov al, byte [ecx + 0x4606c0]
test al, al
je 0x40126f
movzx edx, al
movzx esi, byte [ebp + edx - 0x104]
movzx eax, byte [ebp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [ebp - 0xfb]
add eax, esi
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv edi
movzx eax, byte [ebp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv esi
movzx eax, byte [ebp + edx - 0x204]
mov edx, dword [ebp - 0x208]
jmp 0x401277
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [ecx + 0x45f2c0], eax
ror eax, 8
mov dword [ecx + 0x45eec0], eax
ror eax, 8
mov dword [ecx + 0x45de80], eax
ror eax, 8
mov dword [ecx + 0x45da80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x4011a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413878
mov esp, ebp
pop ebp
ret
Function at 0x405ee0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42b8c8
push 0x419cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x42e618]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x405f7b
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x405f61
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x28]
jmp 0x405f7b
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413878
mov esp, ebp
pop ebp
ret

Function at 0x405fa0
Capabilities:
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42ba08
push 0x419cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x42e618]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
mov byte [ebp - 0x120], al
push 0x103
push eax
lea eax, [ebp - 0x11f]
push eax
call fcn.004158b0
add esp, 0xc
mov dword [ebp - 0x12c], 0x104
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40607d
mov edx, 6
mov dword [ebp - 0x130], edx
lea ecx, [ebp - 0x120]
or eax, 0xffffffff
mov dword [ebp - 0x124], ecx
mov esi, edx
dec edx
mov dword [ebp - 0x130], edx
test esi, esi
je 0x40605c
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42a1b8]
inc ecx
jmp 0x406031
not eax
xor ecx, ecx
cmp eax, 0x39b5d60d
sete cl
mov esi, ecx
jmp 0x406077
mov dword [ebp - 0x128], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413878
mov esp, ebp
pop ebp
ret
Function at 0x406d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x45b480
call fcn.004122ab
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x406e24
test esi, esi
jne 0x406e24
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x406e08
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406e02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406e02
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x406df1
cmp esi, eax
jae 0x406df5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406de3
cmp esi, eax
jb 0x406df9
xor eax, eax
jmp 0x406e02
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x406e2d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x45b480
call fcn.004122ab
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x406d95
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406f48
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406f7a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x406f76
cmp esi, eax
jae 0x406f7a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406f68
cmp esi, eax
jb 0x406f80
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x40a4e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4267ab
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x38]
push 0x45ac90
xor ebx, ebx
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.0040c790
add esp, 8
mov edi, dword [ebp - 0x38]
cmp dword [edi - 0xc], ebx
je 0x40a638
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
lea ebx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0040c390
mov edi, dword [ebp - 0x44]
test eax, eax
jne 0x40a62b
test edi, edi
je 0x40a636
lea eax, [ebp - 0xf0]
push eax
call fcn.0040aba0
lea ecx, [ebp - 0xe0]
push ecx
mov byte [ebp - 4], 3
call fcn.0040be20
mov edx, dword [ebp - 0x48]
add esp, 4
push edx
push eax
call fcn.0040c0d0
add esp, 8
push eax
call fcn.0040be20
add esp, 4
lea esi, [ebp - 0x30]
lea eax, [ebp - 0xf0]
call fcn.0040ac40
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp esi, 8
jae 0x40a5b7
lea eax, [ebp - 0x30]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a5c0
mov ecx, dword [ebp - 0x30]
sub eax, edx
sar eax, 1
cmp esi, 8
jae 0x40a5da
lea ecx, [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
push ecx
mov ecx, dword [ebp - 0x34]
push 2
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x1c], 8
jb 0x40a608
mov edx, dword [ebp - 0x30]
push edx
call fcn.0041386d
add esp, 4
xor eax, eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 2
call fcn.0040a690
test edi, edi
je 0x40a636
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a66c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40a66c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413878
mov esp, ebp
pop ebp
ret
Function at 0x40b940
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42624b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42e618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], 0x42a6f4
call fcn.00413404
push 4
mov dword [ebp - 4], 0
call fcn.00413d57
mov edi, eax
add esp, 4
test edi, edi
je 0x40b9bc
call fcn.00412a94
mov dword [edi], eax
call fcn.00412853
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00412788
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40b9b2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004127b0
jmp 0x40b9be
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c460
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x40
lea eax, [ebp - 0x66c]
push 0
push eax
call fcn.004158b0
xor eax, eax
xor edx, edx
push 0x206
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], eax
xor ecx, ecx
push edx
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x670], 0x44
mov word [ebp - 0x640], cx
mov dword [ebp - 0x62c], ecx
mov word [ebp - 0x20c], dx
call fcn.004158b0
add esp, 0x18
push 0
push 0x25
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x42a7f8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
xor ecx, ecx
push 0x40e
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.004158b0
push esi
lea eax, [ebp - 0x20c]
push eax
push str.__s__start___s_
lea ecx, [ebp - 0x61c]
push 0x208
push ecx
call fcn.004142b1
add esp, 0x20
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x670]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413878
mov esp, ebp
pop ebp
ret
Function at 0x40c590
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426320
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42e618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x20]
xor esi, esi
push 0x45a37c
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], esi
call fcn.0040c790
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp dword [ecx - 0xc], esi
je 0x40c6ba
push 5
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x40c6ba
mov edx, dword [ebp - 0x20]
push 0x17
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], eax
cmp ebx, esi
je 0x40c6b0
lea eax, [ebp - 0x18]
push eax
push esi
push esi
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
push ebx
call esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, ecx
je 0x40c69c
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
push eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x11]
lea edi, [ebp - 0x34]
mov byte [ebp - 0x11], cl
call fcn.00407540
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
sub eax, edi
cmp eax, dword [ebp - 0x18]
jne 0x40c68f
test edi, edi
je 0x40c68f
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push ebx
call esi
test eax, eax
je 0x40c68f
cmp dword [edi + 4], 2
je 0x40c68f
mov edx, dword [edi + 8]
mov eax, dword [edi]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 2
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea esi, [ebp - 0x34]
call fcn.00407510
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
push ecx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c6ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40c6ea
cmp ebx, esi
je 0x40c6f5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x40c703
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret