joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce28
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004078bb
mov dword [ebp - 0x14], eax
cmp dword [0x43f338], esi
jne 0x40cf1b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cffb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cffb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cffb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43f338], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43f33c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43f340], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f348], eax
test eax, eax
je 0x40cf18
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f344], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cf40
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cf33
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cf55
push 4
pop eax
jmp 0x40cffd
cmp dword [ebp - 0x14], esi
je 0x40cf55
push dword [0x43f338]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cf3a
mov eax, dword [0x43f344]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cfb3
cmp dword [0x43f348], edi
je 0x40cfb3
push eax
call ebx
push dword [0x43f348]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cfb3
test eax, eax
je 0x40cfb3
call ecx
test eax, eax
je 0x40cfa8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cfa8
test byte [ebp - 8], 1
jne 0x40cfb3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cfe3
mov eax, dword [0x43f33c]
cmp eax, edi
je 0x40cfe0
push eax
call ebx
test eax, eax
je 0x40cfe0
call eax
mov esi, eax
test esi, esi
je 0x40cfe0
mov eax, dword [0x43f340]
cmp eax, edi
je 0x40cfe0
push eax
call ebx
test eax, eax
je 0x40cfe0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43f338]
call ebx
test eax, eax
je 0x40cffb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cffd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041dc
mov esp, ebp
pop ebp
ret
Function at 0x401c40
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [ecx + 4]
mov dword [ebp - 4], 0xc6ef3720
mov dword [ebp + 8], 0x20
mov eax, dword [ecx]
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov edi, eax
shr esi, 5
shl edi, 4
xor esi, edi
mov edi, dword [ebp - 4]
shr edi, 0xb
and edi, 3
add esi, eax
mov edi, dword [ebx + edi*4]
add edi, dword [ebp - 4]
add dword [ebp - 4], 0x61c88647
xor esi, edi
sub edx, esi
mov esi, edx
mov edi, edx
shr esi, 5
shl edi, 4
xor esi, edi
mov edi, dword [ebp - 4]
and edi, 3
mov dword [ecx + 4], edx
add esi, edx
mov edi, dword [ebx + edi*4]
add edi, dword [ebp - 4]
xor esi, edi
sub eax, esi
dec dword [ebp + 8]
mov dword [ecx], eax
jne 0x401c5b
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret

Function at 0x401e97
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x8c]
dec eax
je 0x401f82
dec eax
jne 0x401fc0
and dword [0x4176ec], 0
cmp dword [ebp - 0x98], 4
ja 0x401edf
push 3
jmp 0x401f02
push 5
pop eax
cmp dword [ebp - 0x98], eax
jne 0x401f48
cmp dword [ebp - 0x94], 0
je 0x401fc2
cmp dword [ebp - 0x94], 1
jne 0x401f05
push 7
pop eax
leave
ret
cmp dword [ebp - 0x94], 2
jne 0x401fc0
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401f36
lea ecx, [ebp - 0xc0]
push ecx
call eax
xor eax, eax
cmp word [ebp - 0xc0], 9
sete al
add eax, 8
leave
ret
cmp dword [ebp - 0x98], 6
jne 0x401fc0
cmp dword [ebp - 0x94], 0
mov al, byte [ebp - 2]
jne 0x401f6b
dec al
neg al
sbb eax, eax
and eax, 2
add eax, 0xa
leave
ret
cmp dword [ebp - 0x94], 1
jne 0x401fc0
xor ecx, ecx
cmp al, 1
setne cl
add ecx, 0xb
mov eax, ecx
leave
ret
push 4
mov dword [0x4176ec], 1
pop eax
cmp dword [ebp - 0x98], eax
jb 0x401fc0
cmp dword [ebp - 0x94], 0
jne 0x401fa7
push 2
jmp 0x401f02
cmp dword [ebp - 0x94], 0xa
je 0x401fc2
cmp dword [ebp - 0x94], 0x5a
jne 0x401fc0
push 6
jmp 0x401f02
xor eax, eax
leave
ret
Function at 0x402a55
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0040a4b0
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push esi
push ecx
call fcn.0040a470
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jl 0x402ac9
jg 0x402ac7
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jb 0x402ac9
jmp 0x402acb
jmp 0x402a99
pop esi
leave
ret 4
Function at 0x402c04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x41429c], esi
push edi
mov dword [ebp - 0x10], esi
jne 0x402c21
xor ax, ax
jmp 0x402dc0
or word [0x41813a], 0xffff
cmp dword [0x414560], esi
mov dword [ebp - 8], esi
jne 0x402c4f
movsx eax, word [ebp + 0xc]
push eax
call fcn.00406b9a
cmp ax, si
jl 0x402dc0
push 1
pop edi
mov dword [ebp - 0x10], edi
jmp 0x402c52
push 1
pop edi
mov ax, word [0x41813a]
push eax
mov ax, word [0x418138]
push eax
call fcn.00402f73
call fcn.00402ff6
cmp dword [0x417710], esi
jne 0x402c7e
push 0x4d
call fcn.00402dc6
mov dword [0x417710], eax
push ebx
call fcn.004034fa
test ax, ax
je 0x402d86
mov dword [ebp - 8], esi
call fcn.0040307b
push esi
push edi
push 0x35
call fcn.004031e3
test eax, eax
jne 0x402ca6
or dword [ebp - 8], 0xffffffff
push esi
push esi
call fcn.00403290
push esi
push esi
mov byte [ebp - 1], al
call fcn.00403290
mov bl, al
mov byte [ebp - 2], bl
call fcn.0040315c
cmp byte [0x417719], 0x15
mov dword [0x414404], edi
jb 0x402d86
call fcn.0040307b
push esi
push edi
push 0x49
call fcn.004031e3
test eax, eax
jne 0x402cea
or dword [ebp - 8], 0xffffffff
cmp word [ebp - 8], 0xffff
je 0x402d2b
lea esi, [ebp + 8]
mov dword [ebp - 0xc], 4
not bl
mov al, byte [esi]
push edi
xor al, byte [ebp - 1]
push edi
inc esi
add al, bl
push eax
call fcn.004031e3
dec dword [ebp - 0xc]
jne 0x402cfd
push dword [0x414404]
push 0
call fcn.00403290
mov bl, al
add bl, byte [ebp - 2]
inc bl
xor bl, byte [ebp - 1]
jmp 0x402d2e
mov bl, byte [ebp + 0xf]
call fcn.0040315c
cmp word [ebp - 8], 0
jne 0x402d84
cmp bl, 1
jne 0x402d84
call fcn.0040307b
push dword [0x414404]
push edi
push 0x4c
call fcn.004031e3
test eax, eax
je 0x402d79
push 8
mov esi, 0x418140
pop edi
push dword [0x414404]
push 0
call fcn.00403290
add al, byte [ebp - 2]
inc al
xor al, byte [ebp - 1]
mov byte [esi], al
inc esi
dec edi
jne 0x402d5e
call fcn.0040315c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
xor esi, esi
call fcn.00404edb
call fcn.00402f00
mov ax, word [0x41813a]
push eax
mov ax, word [0x418138]
push eax
call fcn.00402fb3
cmp dword [ebp - 0x10], esi
pop ebx
je 0x402db3
movsx eax, word [ebp + 0xc]
push eax
call fcn.00406de9
cmp word [ebp - 8], si
jge 0x402dbc
mov dword [ebp - 8], esi
mov ax, word [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x402dc6
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x4176f0], 0
push esi
push edi
jne 0x402ee5
lea eax, [ebp - 0x94]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x94]
push 0x414414
push eax
call esi
lea eax, [ebp - 0x94]
push str.MATRIX.INI
push eax
call esi
lea eax, [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
and dword [0x417714], 0
push eax
lea eax, [ebp - 0x40]
push 0x1f
push eax
push 0x414420
push str.HiRes
push 0x41442c
call esi
cmp byte [ebp - 0x40], 0x4e
je 0x402e8f
cmp byte [ebp - 0x40], 0x6e
je 0x402e8f
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x414434
push str.hrwert
push 0x414440
call esi
lea eax, [ebp - 0x20]
push eax
call fcn.0040a5e0
pop ecx
mov edi, eax
call fcn.00402a3b
test ax, ax
jle 0x402e8f
test edi, edi
mov dword [0x417714], 1
jne 0x402e8b
push 1
pop edi
mov eax, edi
jmp 0x402ee7
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x414448
push str.wert
push str.DELAY
call esi
lea eax, [ebp - 0x20]
push eax
call fcn.0040a5e0
test eax, eax
pop ecx
jg 0x402ee7
mov esi, 0x640
cmp word [ebp + 8], 0x4d
jne 0x402ece
call fcn.004034fa
jmp 0x402ed5
push 1
call fcn.00403312
test ax, ax
jne 0x402eed
add esi, 0x64
cmp esi, 0x1b58
jle 0x402ec0
xor eax, eax
pop edi
pop esi
leave
ret 4
call fcn.00404edb
call fcn.00402f00
lea eax, [esi + esi*2 + 0x3e8]
jmp 0x402ee7

Function at 0x4031e3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push 8
pop esi
test byte [esp + 8], 1
je 0x4031f5
call fcn.0040317f
jmp 0x4031fa
call fcn.0040308f
call fcn.004031b1
call fcn.004031b1
shr byte [esp + 8], 1
call fcn.00403128
dec esi
jne 0x4031e7
cmp dword [esp + 0xc], 0
je 0x40326a
push ebx
push edi
call fcn.00402f00
call fcn.004031b1
call fcn.00402f00
cmp dword [esp + 0x18], 0
je 0x403254
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x32
ja 0x40324f
call fcn.00403271
test eax, eax
jne 0x40325b
jmp 0x40323b
push 1
pop ebx
jmp 0x40325b
call fcn.00403271
mov ebx, eax
call fcn.00403128
pop edi
test ebx, ebx
pop ebx
je 0x40326a
xor eax, eax
jmp 0x40326d
push 1
pop eax
pop esi
ret 0xc

Function at 0x403290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
call fcn.0040317f
push 8
xor ebx, ebx
pop esi
call fcn.004031b1
sar ebx, 1
and ebx, 0x7f
call fcn.00403271
test eax, eax
je 0x4032b2
or bl, 0x80
call fcn.00403128
dec esi
jne 0x40329c
cmp dword [esp + 0xc], 0
je 0x4032c8
call fcn.0040317f
jmp 0x4032cd
call fcn.0040308f
call fcn.00402f00
call fcn.004031b1
call fcn.00402f00
cmp dword [esp + 0x10], 0
je 0x403301
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call fcn.00403271
test eax, eax
jne 0x403300
call esi
sub eax, edi
cmp eax, 0x32
jb 0x4032ee
pop edi
call fcn.00403128
call fcn.0040317f
mov al, bl
pop esi
pop ebx
ret 8
Function at 0x403806
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word [0x41813a]
push esi
push edi
push 2
pop edi
xor esi, esi
push edi
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
test al, 1
jne 0x40383f
mov ax, word [0x41813a]
push esi
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
and al, 7
cmp al, 7
jge 0x403842
push 1
pop esi
mov ax, word [0x41813a]
push 0
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
or al, 7
push eax
mov ax, word [0x41813a]
push 0
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f10
mov ax, word [0x41813a]
push edi
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
and ax, 0xde
push eax
mov ax, word [0x41813a]
push edi
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f10
test esi, esi
je 0x4038e8
mov ax, word [0x41813a]
push 0
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
mov word [0x41770a], ax
mov ax, word [0x41813a]
push edi
push eax
mov ax, word [0x418138]
push eax
call fcn.00406f4a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [0x417708], ax
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x78
jb 0x4038df
pop edi
pop esi
ret

Function at 0x405444
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x405465
movsx ecx, word [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
add dl, byte [ebp + 0x10]
inc dl
xor dl, byte [ebp + 0x14]
mov byte [eax], dl
inc eax
dec ecx
jne 0x405455
pop ebp
ret 0x10

Function at 0x4054f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x40551c
mov cl, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
movsx esi, word [ebp + 0xc]
not cl
mov dl, byte [eax]
xor dl, byte [ebp + 0x14]
add dl, cl
mov byte [eax], dl
inc eax
dec esi
jne 0x40550e
pop esi
pop ebp
ret 0x10

Function at 0x4064c4
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
lea eax, [ebp - 0xa4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa4]
push 0x4145ac
push eax
call esi
mov edi, str.IWPORT
lea eax, [ebp - 0xa4]
push edi
push eax
call esi
lea eax, [ebp - 0xa4]
push 0x4145c0
push eax
call esi
xor esi, esi
lea eax, [ebp - 0xa4]
push esi
push esi
push str.Parallel_arbitrator
push esi
push str.Extended_base
push eax
push 1
push 2
push 1
push 0xf01ff
push edi
push edi
push dword [0x41455c]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
cmp edi, esi
jne 0x406554
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x406557
push 1
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x406564
Capabilities:
Get common file path
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push edi
mov edi, str.IWPORT
push 0xf01ff
push edi
xor ebx, ebx
push dword [0x41455c]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x406622
push esi
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
push 0x80
neg eax
sbb eax, eax
inc eax
or dword [ebp - 4], eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xac]
push 0x4145ac
push eax
call esi
lea eax, [ebp - 0xac]
push edi
push eax
call esi
lea eax, [ebp - 0xac]
push 0x4145c0
push eax
call esi
push edi
push ebx
push ebx
push str.Parallel_arbitrator
push ebx
lea eax, [ebp - 0xac]
push str.Extended_base
push eax
push 1
push 2
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x406629
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x41455c], eax
je 0x406681
push esi
push edi
push 0xf01ff
push str.IWPORT
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x406677
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov ebx, eax
call edi
push dword [0x41455c]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x4066e7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [0x4176ec], ebx
lea eax, [ebp - 0x16c]
push 0x4145d0
push eax
je 0x406752
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x16c]
push str..VXD
push eax
call esi
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x414550], eax
jmp 0x40686a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
mov eax, dword [ebp + 8]
inc eax
push eax
lea eax, [ebp - 8]
push 0x4145d8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
push 1
mov edi, 0x80
pop eax
push ebx
push edi
push 3
mov dword [0x414554], eax
mov dword [0x414558], eax
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x414550], eax
jne 0x40686a
lea eax, [ebp - 0x6c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x6c]
push 0x4145ac
push eax
call esi
lea eax, [ebp - 0x6c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x6c]
push 0x4145c0
push eax
call esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040a9e3
pop ecx
test eax, eax
pop ecx
jne 0x40686a
push 0xf003f
push ebx
push ebx
mov dword [0x414558], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x41455c], eax
je 0x40686a
call fcn.00406564
test eax, eax
jne 0x406841
mov dword [0x414554], ebx
call fcn.004064c4
test eax, eax
je 0x40685e
call fcn.00406564
test eax, eax
je 0x40685e
push ebx
push edi
push 3
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x414550], eax
push dword [0x41455c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x408289
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test ax, ax
jne 0x4082b9
and dword [ebp - 4], 0
and byte [ebp - 0x148], al
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test ax, ax
jne 0x4082da
and dword [ebp - 8], 0
and byte [ebp - 0x18], al
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.004083dd
test ax, ax
jle 0x408373
mov ecx, dword [ebp + 0xc]
movsx edx, cx
movsx eax, ax
dec edx
cmp eax, edx
jle 0x408306
lea eax, [ecx - 1]
movsx eax, ax
and byte [ebp + eax - 0x34], 0
mov edx, dword [ebp - 4]
lea esi, [ecx - 1]
lea edx, [eax + edx + 1]
cmp edx, esi
jle 0x40834a
sub ecx, eax
sub ecx, 2
mov dword [ebp - 4], ecx
jns 0x408323
xor ecx, ecx
mov dword [ebp - 4], ecx
and byte [ebp + ecx - 0x148], 0
lea eax, [ebp + ecx - 0x148]
cmp ecx, 3
jle 0x40834a
push 3
add eax, 0xfffffffd
push 0x4145ec
push eax
call fcn.0040aa30
add esp, 0xc
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x408364
lea eax, [ebp - 0x148]
push 0x4145f0
push eax
call esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x148]
push eax
call esi
jmp 0x4083c8
mov esi, dword [ebp + 0xc]
push ebx
lea ebx, [esi - 1]
cmp dword [ebp - 4], ebx
jge 0x4083ae
cmp dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x4083a0
cmp dword [ebp - 8], 0
jle 0x4083a0
lea eax, [ebp - 0x148]
push 0x4145f4
push eax
call edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x148]
push eax
call edi
pop edi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
pop ebx
jle 0x4083c8
and byte [ebp + esi - 0x149], 0
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
leave
ret 8
Function at 0x4090d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0xa8]
xor edi, edi
push 0x80
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa8]
push str.SYSTEM32DRIVERS_
push eax
call esi
cmp dword [0x418148], 9
jne 0x40911a
push str.IWUSB_X64
jmp 0x40911f
push str.IWUSB
lea eax, [ebp - 0xa8]
push eax
call esi
lea eax, [ebp - 0xa8]
push str..SYS
push eax
call esi
push str.VERSION.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
call fcn.00401d8b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeA
push ebx
call esi
lea ecx, [ebp - 0x10]
mov dword [0x417a88], eax
push ecx
lea ecx, [ebp - 0xa8]
push ecx
call eax
cmp eax, edi
mov dword [ebp - 4], eax
je 0x40926f
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push str.GetFileVersionInfoA
push ebx
mov edi, eax
call esi
push edi
lea ecx, [ebp - 0xa8]
push dword [ebp - 4]
mov dword [0x417a8c], eax
push dword [ebp - 0x10]
push ecx
call eax
push 0x4147dc
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x417a90], eax
push ecx
lea ecx, [ebp - 0x24]
push ecx
push str.VarFileInfoTranslation
push edi
call eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
movzx eax, word [eax]
shr ecx, 0x10
push ecx
push eax
lea eax, [ebp - 0x10c]
push str.StringFileInfo_04hX_04hXFileVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.VerQueryValueA
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x417a90], eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push edi
call eax
test eax, eax
jne 0x40920b
xor edi, edi
jmp 0x409256
and byte [ebp - 0x20], 0
and byte [ebp - 0x18], 0
push 1
lea eax, [ebp - 0x20]
push dword [ebp - 0xc]
push eax
call fcn.0040b0d0
mov eax, dword [ebp - 0xc]
push 2
add eax, 2
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b0d0
lea eax, [ebp - 0x20]
push eax
call fcn.0040a66b
xor edx, edx
mov dh, al
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], edx
call fcn.0040a66b
mov ecx, dword [ebp - 4]
add esp, 0x20
or ecx, eax
mov edi, ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401e10
mov ax, di
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a9e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40aa03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040dbf8
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40aa26
test byte [esp + 8], 2
je 0x40aa26
call fcn.0040dc6b
mov dword [eax], 0xd
call fcn.0040dc74
mov dword [eax], 5
jmp 0x40a9ff
xor eax, eax
ret
Function at 0x438ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438add
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret