joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4342b0
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x10]
push str.CommonFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
add esp, 0xc
ret

Function at 0x4342c0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434340
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x434340
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434335
sub eax, edx
jne 0x43435f
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Program_Files
mov ecx, 0x104
mov byte [edi + 2], 0
call fcn.00402040
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x434600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push 0x104
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x104
mov byte [esp + 0x18], 0
call fcn.0043d080
mov esi, dword [esi]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
test eax, eax
je 0x434680
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00437bf9
add esp, 0x114
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x434666
mov ecx, dword [esp + 0x11c]
push ecx
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.00437bf9
add esp, 0x114
ret 4
Function at 0x434710
Capabilities:
Delete file
Get disk information
Read .ini file

Disassembly:
sub esp, 0x220
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
push 0x104
push eax
lea ecx, [esp + 0x12d]
push ecx
mov byte [esp + 0x1c], 0
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
mov byte [esp + 0x130], al
call fcn.0043d080
add esp, 0xc
lea edx, [esp + 0x124]
push edx
push 0x105
xor esi, esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp ebp, dword [esp + 0x18]
jge 0x434845
cmp byte [esp + ebp + 0x124], 0
jne 0x43483b
push 3
lea eax, [esp + ebp + 0x125]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0043ac90
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 3
jne 0x43483b
push 0x104
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call fcn.0043d080
lea ecx, [esp + 0x1c]
push ecx
push str._sRsTest.ini
mov eax, 0x105
lea edi, [esp + 0x30]
call fcn.00401e00
add esp, 0x14
mov edx, edi
push edx
push 0x454154
push 0x454158
push 0x45415c
call ebx
mov eax, edi
push eax
push 0
push 0x454158
push 0x45415c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x434823
lea esi, [eax + 5]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call ebx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc ebp
cmp esi, 3
jne 0x434781
mov eax, dword [esp + 0x14]
test eax, eax
je 0x434867
cmp esi, 3
jne 0x434867
push 0x103
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.0043ac90
add esp, 0xc
jmp 0x43486c
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437bf9
add esp, 0x220
ret 4
Function at 0x434950
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
lea eax, [esp + 0x10]
push eax
mov esi, ecx
mov dword [esp + 8], 0x208
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x4349b0
mov eax, dword [esp + 4]
call fcn.00434ea0
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00437bf9
add esp, 0xa4
ret
lea ecx, [esp + 8]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4349f8
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
push str.Programs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x434a29
mov eax, dword [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 4]
cmp ecx, 0x7fffffff
ja 0x434a29
push edi
push str.Start_MenuPrograms
mov edi, esi
call fcn.00402040
pop edi
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00437bf9
add esp, 0xa4
ret
Function at 0x434cc0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push 0x104
lea eax, [esp + 0x15]
push 0
push eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x104
mov byte [esp + 0x1c], 0
call fcn.0043d080
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x434d4d
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push str.AppData
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
test eax, eax
setg dl
dec edx
test esi, edx
pop esi
je 0x434dad
push 0x208
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x105
lea eax, [esp + 0xc]
mov edi, edi
cmp byte [eax], 0
je 0x434d8d
inc eax
sub ecx, 1
jne 0x434d80
jmp 0x434dad
test ecx, ecx
je 0x434dad
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0xc]
mov eax, str.Application_Data
call fcn.00402000
mov ecx, 0x105
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x434dc3
inc eax
sub ecx, 1
jne 0x434db6
jmp 0x434de3
test ecx, ecx
je 0x434de3
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0xc]
mov eax, str.MicrosoftInternet_ExplorerQuick_Launch
call fcn.00402000
push 0x208
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.00437bf9
add esp, 0x118
ret

Function at 0x434e10
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434e6e
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.Common_Programs
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x434e6e
cmp byte [edi], 0
jne 0x434e93
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x434e7f
pop edi
add esp, 0xc
ret
cmp ebx, 0x7fffffff
ja 0x434e93
push str.ProfilesAll_UsersStart_MenuPrograms
mov ecx, ebx
call fcn.00402040
mov eax, 1
pop edi
add esp, 0xc
ret
Function at 0x434ea0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434ef4
mov ecx, dword [esp]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.Common_Programs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, 1
add esp, 0xc
ret
Function at 0x435050
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x27c
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, dword [esp + 0x284]
push ebx
mov ebx, dword [esp + 0x284]
push ebp
push esi
push edi
mov edi, edx
push edi
push str._WinSessionThread_CreateProcess_begin_dwSessionID___d_
push 0x80
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call fcn.004025a0
add esp, 0xc
cmp dword [ebx + 0x108], 0
jne 0x4350a3
xor eax, eax
jmp 0x435226
call fcn.00435410
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x43509c
push str.Userenv.DLL
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, edi
je 0x4351fb
push 0x44
lea edx, [esp + 0x34]
push edi
push edx
mov dword [esp + 0x1c], edi
call fcn.0043d080
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push str.CreateEnvironmentBlock
push ebp
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x40], 0x454314
call ebx
push str.DestroyEnvironmentBlock
push ebp
mov edi, eax
call ebx
push str.WinSessionThread_CreateProcess_SetTokenInformation_return_value:4
push 0x40
mov ebx, eax
call fcn.004025a0
add esp, 8
test edi, edi
je 0x4351df
test ebx, ebx
je 0x4351df
push 0x207
lea eax, [esp + 0x7d]
push 0
push eax
mov byte [esp + 0x84], 0
call fcn.0043d080
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 0x208
push ecx
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push esi
lea eax, [esp + 0x18]
push eax
call edi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
push eax
push ecx
push 0x400
push 0
push 0
push 0
lea edx, [esp + 0x98]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x2c]
push eax
push str._WinSessionThread_CreateProcess_pid___d__CreateProcessAsUser__err___d__
push 0x80
call fcn.004025a0
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
call ebx
test edi, edi
je 0x4351ee
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x14]
jmp 0x43520a
push str._WinSessionThread_CreateProcess_LoadLibrary__GetProcAddress_err__
push 1
call fcn.004025a0
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x14]
jmp 0x43520a
push str._WinSessionThread_CreateProcess_LoadLibrary__Userenv_err__
push 1
call fcn.004025a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str._WinSessionThread_CreateProcess_ret___d_end___
push 0x80
call fcn.004025a0
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437bf9
add esp, 0x27c
ret 8
Function at 0x435970
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
test edi, edi
je 0x4359a4
cmp byte [edi], 0
je 0x4359a4
test esi, esi
je 0x4359a4
cmp byte [esi], 0
je 0x4359a4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4359aa
push edi
push str.Source_Not_Exist__s
push 0x80
call fcn.004025a0
add esp, 0xc
xor eax, eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, esi
call fcn.00435c70
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call ebp
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push esi
mov ebx, eax
call ebp
push ebx
push esi
push edi
push str.RsInstallFile_from__s_to__s_Return__d
push 0x80
call fcn.004025a0
add esp, 0x14
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x435c70
Capabilities:
Create directory

Disassembly:
sub esp, 0x10c
mov eax, dword [0x45d2b0]
xor eax, esp
mov dword [esp + 0x108], eax
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x435ca4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00437bf9
add esp, 0x10c
ret
push esi
push 0x104
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.0043d080
lea eax, [esp + 0x14]
mov edx, edi
mov ecx, eax
add esp, 0xc
mov esi, 0x105
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [edx + eax]
test cl, cl
je 0x435ce1
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x435cd0
jmp 0x435ce5
test esi, esi
jne 0x435ce6
dec eax
push ebx
lea edx, [esp + 0xc]
push 0x5c
push edx
mov byte [eax], 0
call fcn.00437e1e
mov esi, eax
add esp, 8
test esi, esi
je 0x435d45
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435d10
push 0
lea eax, [esp + 0x10]
push eax
mov byte [esi], 0
call ebx
test eax, eax
jne 0x435d30
call edi
cmp eax, 0xb7
je 0x435d30
call edi
cmp eax, 5
jne 0x435d62
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.00437e1e
mov esi, eax
add esp, 8
test esi, esi
jne 0x435d10
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00437bf9
add esp, 0x10c
ret
mov ecx, dword [esp + 0x114]
pop ebx
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.00437bf9
add esp, 0x10c
ret

Function at 0x436280
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor esi, esi
push edi
cmp ecx, esi
jne 0x436294
xor edi, edi
jmp 0x43629b
call fcn.00436000
mov edi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], esi
cmp edi, esi
je 0x436367
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436360
mov edx, dword [esp + 0x1c]
push ebx
push edx
call fcn.004376db
mov ebx, eax
mov eax, dword [esp + 0x24]
push eax
push esi
push ebx
call fcn.0043d080
add esp, 0x10
test ebx, ebx
je 0x43635f
lea ecx, [esp + 0x20]
push ecx
push ebx
lea edx, [esp + 0x18]
push edx
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436356
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push 0xf003f
push eax
push eax
push eax
push str.Backup
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x436356
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
push ebx
push ecx
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
push eax
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00438e02
add esp, 4
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x436380
Capabilities:
Create service
Modify service

Disassembly:
push ecx
cmp byte [edi], 0
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
je 0x4363cb
push edi
push str.RsInstallService__s_
push 0x80
call fcn.004025a0
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4363d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_Failed__Err_Code:__d
push 4
call fcn.004025a0
add esp, 0xc
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret 0x1c
push 0xf01ff
push edi
push ebx
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x43643c
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x28]
push esi
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ebp
push eax
push ecx
push 0xf01ff
push edx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x43648a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_Failed__Err_Code:__d
push 4
call fcn.004025a0
add esp, 0xc
jmp 0x436495
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x2c]
push 0
push edx
mov edx, dword [esp + 0x30]
push eax
push ebp
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x43648a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig_Failed__Err_Code:__d
push 4
call fcn.004025a0
add esp, 0xc
mov dword [esp + 0x2c], 0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x2c]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
push str.RsInstallService__s__Return:__d
push 0x80
call fcn.004025a0
add esp, 0x10
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x1c
Function at 0x437bf9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d2b0]
jne 0x437c03
repz ret
jmp fcn.0043d2ec

Function at 0x447221
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043db47
and dword [ebp - 4], 0
cmp dword [0x4607b8], 0
mov ebx, eax
jne 0x4472d2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x447383
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4506f8
push edi
call esi
test eax, eax
je 0x447383
push eax
call fcn.0043dad5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4607b8], eax
call esi
push eax
call fcn.0043dad5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4607bc], eax
call esi
push eax
call fcn.0043dad5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4607c0], eax
call esi
push eax
call fcn.0043dad5
pop ecx
mov dword [0x4607c8], eax
test eax, eax
je 0x4472d2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043dad5
pop ecx
mov dword [0x4607c4], eax
mov eax, dword [0x4607c4]
cmp eax, ebx
je 0x44732a
cmp dword [0x4607c8], ebx
je 0x44732a
push eax
call fcn.0043db50
push dword [0x4607c8]
mov esi, eax
call fcn.0043db50
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44732a
test edi, edi
je 0x44732a
call esi
test eax, eax
je 0x447321
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447321
test byte [ebp - 0xc], 1
jne 0x44732a
or dword [ebp + 0x10], 0x200000
jmp 0x447363
mov eax, dword [0x4607bc]
cmp eax, ebx
je 0x447363
push eax
call fcn.0043db50
pop ecx
test eax, eax
je 0x447363
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x447363
mov eax, dword [0x4607c0]
cmp eax, ebx
je 0x447363
push eax
call fcn.0043db50
pop ecx
test eax, eax
je 0x447363
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4607b8]
call fcn.0043db50
pop ecx
test eax, eax
je 0x447383
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447385
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402b10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x4c
push esi
push 0x30
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00430eb0
mov esi, dword [esp + 0x60]
add esp, 0xc
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x402d10
push 0x7f00
push 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], 0
call fcn.0040cde0
add esp, 4
mov dword [esp + 0x40], eax
push 0
push 0x20
push 0x20
push 1
push 0x328
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x4c], 0x43a420
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x402bcf
push 0x10
push 0x43a42c
push str._RegisterClassEx_Failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop esi
add esp, 0x4c
ret 0x10
push str.Msftedit.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x402bfd
push 0x10
push 0x43a460
push str._Msftedit.dll_not_found_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop esi
add esp, 0x4c
ret 0x10
push 0
push esi
push 0
push 0
push 0x16f
push 0x163
push connect
push connect
push 0xa0000
push 0x43a433
push dword [esp + 0x70]
push 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x402c5a
push 0x10
push str.Error_
push str._Window_creation_failed_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi + 1]
pop esi
add esp, 0x4c
ret 0x10
push esi
call fcn.0040d1f0
push 0x43a4a8
call fcn.00417a3f
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [esp + 0xc]
add esp, 8
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x402cb3
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xc]
push eax
call edi
lea eax, [esp + 0xc]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
jne 0x402c92
pop edi
pop ebx
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x4c
ret 0x10

Function at 0x402cc0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0040d640
call fcn.0040e380
push esi
call fcn.0040d330
push esi
call fcn.0040d500
push 1
call fcn.0040d8b0
add esp, 0x10
call fcn.00404330
pop esi
test eax, eax
jne 0x402d00
push eax
push eax
push eax
push 0x4043b0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret