joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51cab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004e3750
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x94df5c
call fcn.004eaa38
mov ecx, dword [0x8e8b34]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.004e0ac0
mov esi, 0x8e8b8c
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4e33f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e33ee
cmp al, 0xff
je 0x4e33ee
dec al
mov byte [ecx], al
jmp 0x4e33f7
push ecx
call fcn.0050b95d
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00506d30
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x4e343d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e3434
cmp al, 0xff
je 0x4e3434
dec al
mov byte [ecx], al
jmp 0x4e343d
push ecx
call fcn.0050b95d
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004eaabf
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x501380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51db30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004f6295
mov eax, dword [0x8ebe58]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004f61c7
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00501e70
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x501427
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50141e
cmp al, 0xff
je 0x50141e
dec al
mov byte [ecx], al
jmp 0x501427
push ecx
call fcn.0050b95d
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x501458
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50144f
cmp al, 0xff
je 0x50144f
dec al
mov byte [ecx], al
jmp 0x501458
push ecx
call fcn.0050b95d
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x497b7fa3
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
mov ecx, 0x7c73694e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5808483e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x62d874e4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x401049
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00405062
add esp, 0x118
ret
jne 0x401056
mov eax, 1
cmp dword [esp + 8], eax
jae 0x401058
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00405062
add esp, 0x118
ret

Function at 0x401180
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
push esi
push edi
lea eax, [esp + 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x415d98
lea edx, [esp + 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [esp + 0x10]
push edx
push 0x419b18
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edi, edi
cmp dword [str.UsbEntPROService.exe], edi
je 0x401262
xor eax, eax
mov esi, 0x41900c
mov eax, dword [eax + 0x419024]
mov ebx, dword [esi]
push eax
call fcn.00402700
add esp, 4
test eax, eax
je 0x40127c
mov ecx, dword [esi]
push ecx
push 0x419b18
push 0x415da0
lea edx, [esp + 0x224]
call fcn.00402400
lea edx, [esp + 0x224]
add esp, 0xc
push edx
mov eax, edx
push eax
call fcn.00403220
add esp, 8
test eax, eax
je 0x40127c
inc edi
lea eax, [edi*4]
cmp dword [eax + 0x41900c], 0
lea esi, [eax + 0x41900c]
jne 0x401203
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.00405062
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00405062
mov esp, ebp
pop ebp
ret

Function at 0x4012a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push eax
push 0x419b18
lea eax, [esp + 8]
push 0x415da0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00405062
add esp, 0x20c
ret

Function at 0x401300
Capabilities:
Delete directory

Disassembly:
mov eax, dword [str.UsbEntPROService.exe]
push esi
xor esi, esi
test eax, eax
je 0x401325
lea esp, [esp]
push eax
call fcn.004012a0
mov eax, dword [esi*4 + 0x419010]
inc esi
add esp, 4
test eax, eax
jne 0x401310
push 0x419b18
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
ret
Function at 0x401420
Capabilities:
Create thread

Disassembly:
sub esp, 0xa14
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0xa10], eax
mov eax, dword [esp + 0xa20]
push ebx
push esi
mov esi, dword [esp + 0xa20]
push eax
call fcn.00401340
add esp, 4
push 0x66
push esi
mov dword [0x419d30], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xffffff
mov dword [0x419d2c], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x419d20], eax
call fcn.004026f0
push eax
push 0x40
push 0x419d38
call fcn.004062e9
push 0x415db4
push 0x40
push 0x419d38
call fcn.0040626c
push 0x415db8
push 0x40
push 0x419d38
call fcn.0040626c
xor ebx, ebx
add esp, 0x24
cmp dword [0x419db8], ebx
jne 0x401539
push str.UsbEntPROService_v1
push str.SystemCurrentControlSetServices_s
lea edx, [esp + 0x18]
call fcn.00402400
add esp, 8
lea eax, [esp + 8]
push eax
push 0xf003f
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 0x80000002
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401539
call fcn.004026f0
push eax
lea ecx, [ebx + 0x6a]
call fcn.00401070
push eax
lea edx, [esp + 0x220]
call fcn.00402420
add esp, 8
push 0x40010
call fcn.004026f0
push eax
lea edx, [esp + 0x220]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40161c
call fcn.00401180
test eax, eax
jne 0x401563
push 0x40010
push 0x419d38
lea ecx, [eax + 0x68]
call fcn.00401070
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40161c
cmp dword [0x419db8], ebx
je 0x4015d4
call fcn.00402d50
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push 0x401640
push ebx
push ebx
call fcn.00405df6
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4015cb
cmp dword [esp + 8], ebx
jne 0x4015c7
push 0x40010
push 0x419d38
mov ecx, 0x68
call fcn.00401070
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4015fe
push edi
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x4015fd
push ebx
push 0x402350
push ebx
push 0x65
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, dword [0x419d20]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
mov ecx, dword [0x419d24]
push ecx
call esi
call fcn.00401300
mov eax, ebx
mov ecx, dword [esp + 0xa18]
pop esi
pop ebx
xor ecx, esp
call fcn.00405062
add esp, 0xa14
ret 0x10
Function at 0x402080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ac
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00401000
test eax, eax
je 0x4020b1
push 6
push esi
call dword [sym.imp.UxTheme.dll_EnableThemeDialogTexture]
push esi
call fcn.00401b30
mov eax, dword [0x419d2c]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push eax
push 1
push 0x80
push esi
call edi
mov ecx, dword [0x419d2c]
push ecx
push 0
push 0x80
push esi
call edi
push 0x419d38
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
push 0x31
push esi
call edi
lea edx, [esp + 0x48]
push edx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x48]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
lea ecx, [esp + 0x48]
add eax, edx
push ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x5c], 0x2bc
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push eax
push 0x30
push 0x3e9
push esi
mov dword [0x419d24], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call edi
push 1
call fcn.00401c40
add esp, 4
push str.license.rtf
push 0x419b18
lea edx, [esp + 0xb0]
push 0x415da0
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xbc]
push ecx
call fcn.0040570f
push 0x4161a4
lea edx, [esp + 0xc4]
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0
call fcn.00405137
add esp, 0x24
test eax, eax
jne 0x402243
cmp dword [esp + 0x10], eax
je 0x402243
mov ecx, dword [esp + 0x2c]
inc ecx
push ecx
call fcn.0040546c
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402236
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push edx
push 1
push eax
push ebx
call fcn.00406146
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push 0x3ed
push esi
mov byte [ecx + ebx], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4161ac
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push ebx
push 0
push 0xc2
push edx
call edi
mov eax, dword [esp + 0x14]
push 0
push 0
push 0xb1
push eax
call edi
push ebx
call fcn.0040538f
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004063cf
add esp, 4
push 0
push 1
push 0xf1
push 0x3ee
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call edi
mov ecx, dword [esp + 0x2b4]
pop edi
mov dword [0x419d28], esi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00405062
mov esp, ebp
pop ebp
ret
Function at 0x402280
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
push 0x401640
push 0
push 0
call fcn.00405df6
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
cmp eax, 0x3ec
push esi
mov esi, ecx
jg 0x4022e5
je 0x4022b2
sub eax, 2
je 0x4022da
sub eax, 0x3e9
jne 0x40232c
mov eax, dword [0x419008]
dec eax
push eax
mov dword [0x419008], eax
call fcn.00401c40
add esp, 4
pop esi
ret
mov eax, dword [0x419008]
cmp eax, 4
jge 0x4022da
inc eax
push eax
mov dword [0x419008], eax
call fcn.00401c40
add esp, 4
cmp dword [0x419008], 4
jne 0x40232c
pop esi
jmp 0x401b00
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
ret
cmp eax, 0x3ee
jl 0x40232c
cmp eax, 0x3ef
jg 0x40232c
cmp dword [0x419008], 2
jne 0x40232c
cmp dword [esp + 8], 0
jne 0x40232c
push 0x3ef
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x402317
push eax
jmp 0x402319
push 0
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret

Function at 0x402440
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x804
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
push esi
push edi
push 2
xor esi, esi
push esi
push esi
mov ebx, ecx
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40249d
push esi
push esi
push esi
push esi
push esi
push ebx
push 1
push 2
push 0x10
push 0xf01ff
push 0x419d38
push str.UsbEntPROService_v1
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x40249d
mov ebp, 1
jmp 0x4024d3
push 0
push 0x400
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4024e0
push esi
call ebx
test edi, edi
je 0x4024e7
push edi
call ebx
mov ecx, dword [esp + 0x810]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00405062
add esp, 0x804
ret
Function at 0x402510
Capabilities:
Start service

Disassembly:
sub esp, 0x804
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
push esi
push edi
push 0x400f003f
xor esi, esi
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40256a
push 0xf01ff
push str.UsbEntPROService_v1
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40256a
push ebp
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40256a
mov ebp, 1
jmp 0x4025a0
push 0
push 0x400
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4025ad
push esi
call ebx
test edi, edi
je 0x4025b4
push edi
call ebx
mov ecx, dword [esp + 0x810]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00405062
add esp, 0x804
ret

Function at 0x4025d0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x828
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
push esi
push edi
push 2
xor esi, esi
push esi
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x402670
push 0xf01ff
push str.UsbEntPROService_v1
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x402670
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
je 0x402670
mov ebp, dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402640
cmp dword [esp + 0x1c], 1
je 0x4026d7
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call ebp
test eax, eax
je 0x40266c
push 0x1f4
call edi
lea edx, [esp + 0x18]
push edx
push esi
call ebx
test eax, eax
jne 0x402640
mov ebp, dword [esp + 0x14]
push 0
push 0x400
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4026b3
push esi
call edi
test ebp, ebp
je 0x4026ba
push ebp
call edi
mov ecx, dword [esp + 0x834]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405062
add esp, 0x828
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40266c
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], 1
jmp 0x4026a6
Function at 0x402700
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push esi
push edi
push str.MODULE
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402820
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x402806
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402806
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402806
mov eax, 0x419b18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402772
sub eax, edx
sar eax, 1
cmp word [eax*2 + 0x419b16], 0x5c
push ebx
push 0x419b18
jne 0x40279e
push str._s_s
lea eax, [esp + 0x1c]
push eax
jmp 0x4027a8
push 0x415da0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x4161cc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], edi
call fcn.00405137
add esp, 0xc
test eax, eax
jne 0x402806
mov ecx, dword [esp + 0xc]
push ecx
push 1
push ebp
push esi
call fcn.00406662
add esp, 0x10
test eax, eax
je 0x4027ea
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call fcn.004063cf
add esp, 4
test edi, edi
jne 0x402806
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebp
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00405062
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00405062
add esp, 0x210
ret
Function at 0x402840
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
mov eax, 0x1020
call fcn.00411a60
mov eax, dword [0x418010]
xor eax, esp
mov dword [esp + 0x101c], eax
mov eax, dword [esp + 0x1024]
push esi
lea ecx, [esp + 4]
push ecx
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402993
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebp
push edi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x834]
push ecx
mov ecx, dword [esp + 0x1c]
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
mov ebp, 0x400
push ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
call ebx
mov edi, eax
mov eax, str.KASHU_UsbEntPROService
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4028d6
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x30]
push str.KASHU_UsbEntPROService
push edx
call fcn.004067ce
add esp, 0xc
test eax, eax
je 0x402967
lea esp, [esp]
cmp edi, 0x103
je 0x402981
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x834]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x40]
push ecx
inc esi
push esi
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
call ebx
mov edi, eax
mov eax, str.KASHU_UsbEntPROService
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402941
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
push str.KASHU_UsbEntPROService
push eax
call fcn.004067ce
add esp, 0xc
test eax, eax
jne 0x402900
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push ecx
push ebp
push edx
call fcn.004062e9
add esp, 0xc
mov esi, 1
jmp 0x402985
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1020]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00405062
add esp, 0x1020
ret