joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ebc4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45ebd6
add esp, 0xfffffff0
call fcn.00403a2c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423b14
mov eax, dword [0x4bf544]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ef68
mov eax, dword [0x4bf558]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ef74
mov eax, ebx
call fcn.0045ef80
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b1d4]
call fcn.004036c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b1d4]
call fcn.004036c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b1d4]
call fcn.004036c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b1d4]
call fcn.004036c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b1d4]
call fcn.004036c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45b398
push eax
push 0
push 0
mov eax, dword [0x4bf764]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x427730]
call fcn.00428df0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x427730]
call fcn.00428df0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x427730]
call fcn.00428df0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045f3d0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f298
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f298
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f298
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ed13
call fcn.00403a84
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45f07c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f227
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45f208
mov dl, 1
mov eax, dword [0x41b838]
call fcn.004036c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404580
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45f1f7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004529ac
test al, al
je 0x45f1ea
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45f238
lea eax, [ebp - 0x254]
call fcn.00409e2c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f1ea
xor eax, eax
push ebp
push 0x45f1e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45f270
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45f1cc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047f0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45f1cc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f1ea
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45f0ed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041fc70
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f22e
lea eax, [ebp - 0x260]
call fcn.00404580
ret

Function at 0x45fb70
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4c0bb4]
cmp byte [eax + 0xa5], 0
jne 0x45fbe1
cmp dword [0x4c0bcc], 0
jne 0x45fba2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45fb2c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4c0bcc], eax
cmp dword [0x4c0bc8], 0
jne 0x45fbbd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4c0bc8], eax
cmp dword [0x4c0bd0], 0
jne 0x45fbe1
push esp
push 0
push 0
push 0x45fad0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4c0bd0], eax
pop edx
ret
Function at 0x460274
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c0bb4]
cmp dword [eax + 0x30], 0
je 0x46031e
cmp dword [ebx + 0x94], 0
jne 0x460318
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460204
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460318
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4602de
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460318
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d8c0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4602ed
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460e7c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460eb1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404670
jmp 0x460ebe
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x462078
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4620b9
mov eax, esi
call fcn.0044df00
test al, al
je 0x4620b9
mov eax, dword [ebx + 0x84]
call fcn.0044dbfc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4620b9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044dbfc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x462954
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a30
xor eax, eax
push ebp
push 0x462a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x58af0f04
mov dword [ebp - 8], 0x3983711f
mov dword [ebp - 0xc], 0x51dccb69
mov eax, edi
call fcn.00404580
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, 0x462a58
call fcn.00462a5c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404618
mov eax, dword [ebp - 4]
call fcn.00404840
test al, al
jbe 0x462a08
mov byte [ebp - 0xd], al
mov bl, 1
lea eax, [ebp - 0x18]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 3
xor dl, cl
call fcn.00404768
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404848
xor eax, eax
mov al, bl
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp - 0xc]
inc ebx
dec byte [ebp - 0xd]
jne 0x4629c9
lea edx, [ebp - 0x1c]
mov eax, dword [edi]
call fcn.00408d2c
mov edx, dword [ebp - 0x1c]
mov eax, edi
call fcn.004045d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a46
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004045a4
lea eax, [ebp - 4]
call fcn.00404580
ret

Function at 0x47ef6c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x47ef91
cmp dword [esp + 4], 5
jb 0x47ef91
mov al, 1
jmp 0x47ef93
xor eax, eax
add esp, 0x94
ret
Function at 0x494e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00429ecc
cmp ebx, dword [ebp - 8]
jge 0x494ee3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a204
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a204
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a230
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x494ea9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x494eec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00429ecc
cmp ebx, dword [ebp - 8]
jge 0x494f4f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a204
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a204
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a230
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x494f15
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4ad2f8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4c0cf4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4ad31a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad31c
shr eax, 1
dec edx
jne 0x4ad308
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4ad301
mov byte [0x4c10f4], 1
pop esi
pop ebx
ret

Function at 0x4ad338
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4c10f4], 0
jne 0x4ad34f
call fcn.004ad2f8
mov eax, edi
dec eax
test eax, eax
jl 0x4ad378
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c0cf4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4ad359
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4b01c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4b01f5
dec al
je 0x4b0231
dec al
je 0x4b0275
dec al
je 0x4b02e0
jmp 0x4b036a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4b036a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4b0205
jmp 0x4b036a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b036a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4b0241
jmp 0x4b036a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b036a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4b02a3
xor ebp, ebp
jmp 0x4b02b4
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4b02bd
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4b0285
jmp 0x4b036a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b036a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4b0338
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004ad380
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4b02f4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b4688
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x4b46cb
cmp dword [ebp - 0x90], 5
ja 0x4b46cf
cmp dword [ebp - 0x90], 5
jne 0x4b46cb
cmp dword [ebp - 0x8c], 1
jae 0x4b46cf
xor eax, eax
jmp 0x4b46d1
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0xc], 0x104
push ecx
push edx
sub ecx, eax
test esi, ecx
xor cl, ch
cmp dh, 0x74
or ch, 0x3d
cmp dl, bl
test ecx, 0x5962
or cx, bx
or edx, eax
cmp ch, cl
pop edx
pop ecx
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x401048
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0x104
jle 0x401068
mov ax, ax
mov cx, cx
jg 0x401068
aaa
jecxz 0x400fe4
hlt
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x401099
mov esp, ebp
pop ebp
ret
push ecx
push edx
sub ecx, eax
test esi, ecx
xor cl, ch
cmp dh, 0x74
or ch, 0x3d
cmp dl, bl
test ecx, 0x5962
or cx, bx
or edx, eax
cmp ch, cl
pop edx
pop ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x4010d1
mov esp, ebp
pop ebp
ret
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401100
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jbe 0x401131
xchg ecx, ecx
xchg dl, dl
ja 0x401131
pop eax
cmp dword [ebp - 0x90], 5
jne 0x401143
mov eax, 1
mov esp, ebp
pop ebp
ret
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
cmp dword [ebp - 0x90], 6
jne 0x401177
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x401177
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x10b]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pushal
inc si
dec dh
cmp al, bl
and ah, 0x4d
or dl, 0x4d
sub si, si
popal
call fcn.00404870
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 0
call fcn.00401f90
mov esi, eax
call fcn.00401f90
mov edi, eax
call fcn.00401f90
push esi
mov esi, dword [ebp + 0x10]
push esi
mov ebx, eax
call fcn.00404930
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00404930
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00404930
add esp, 0x18
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x314]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
push 0x40602c
push edx
call esi
lea eax, [ebp - 0x314]
push eax
call fcn.004012e0
add esp, 0x14
test eax, eax
je 0x4012a0
lea ecx, [ebp - 0x10c]
push edi
push ecx
lea edx, [ebp - 0x210]
push 0x406038
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.004012e0
add esp, 0x14
test eax, eax
je 0x4012a0
lea ecx, [ebp - 0x10c]
push ebx
push ecx
lea edx, [ebp - 0x210]
push 0x406038
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.004012e0
add esp, 0x14
test eax, eax
jne 0x4012b5
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x4011e9
mov esi, dword [ebp - 8]
jmp 0x4012ba
mov esi, 1
mov ecx, dword [ebp + 0x14]
push 4
push ecx
call fcn.00404930
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401330
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40137b
pop ebp
ret
jb 0x401393
push di
pop di
jae 0x401393
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0x10187305
test byte [eax + ebx - 0x7f], 0x4b
lea edx, [eax - 1]
adc eax, sym.imp.ADVAPI32.dll_CloseServiceHandle
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop ebp
ret
Function at 0x4014c0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
pushal
test cx, ax
inc ax
popal
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4014eb
pop edi
pop esi
pop ebx
pop ebp
ret
jl 0x401500
xchg ecx, ecx
xchg ch, ch
jge 0x401500
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x6adf84
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401537
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x401537
call edi
cmp eax, 0x422
je 0x401537
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x4015a1
jne 0x4015a1
inc ebx
jbe 0x4015e6
aaa
sub dword [eax + 0x2a], ebx
inc esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x40602c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
or dword [ecx + 0x5b], ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00401dc0
js 0x40160b
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x40160b
adc eax, 0xfc458b2f
mov eax, dword [ebp - 4]
push eax
call fcn.004016a0
add esp, 0xc
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x40604c
push eax
call fcn.004035e0
add esp, 0x10
test eax, eax
jne 0x40165e
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x401675
mov dx, dx
nop
xchg cx, cx
jno 0x401675
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0x8d8d5d21
hlt
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.00402140
add esp, 8
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4016a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x4016cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
and bx, cx
pop ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push ebx
test bl, 0x4d
pop ebx
cmp dword [ecx], 0x4550
je 0x4016ed
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x4016fb
mov di, di
xchg edi, edi
ja 0x4016fb
and eax, 0xe2f4cc58
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x40170b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x40
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
jle 0x401748
mov ax, ax
mov cx, cx
jg 0x401748
aaa
jecxz 0x4016c4
hlt
cmp dword [eax + 0x3c], 0x80
ja 0x40175a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
cmp eax, 0xc0
jae 0x401784
lea esi, [eax - 0x80]
jbe 0x401792
mov di, di
xchg edi, edi
ja 0x401792
and eax, 0xe2f4cc58
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebp - 4], edx
jne 0x4017ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
xor edi, edi
test esi, esi
jbe 0x4017f6
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
jle 0x4017de
mov ax, ax
mov cx, cx
jg 0x4017de
aaa
jecxz 0x40175a
hlt
call ebx
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 4]
inc edi
cmp edi, esi
mov byte [edi + eax - 1], dl
jb 0x4017cc
mov edx, eax
push ebx
test bl, 0x4d
pop ebx
mov eax, dword [ebp + 8]
mov ecx, esi
mov esi, edx
lea edi, [eax + 0x80]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret