joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d2a
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x42c628], 0x4c554e
mov edi, 0x400
mov ebp, 0x42c628
je 0x405d76
push 1
push 0
push esi
call fcn.00405c54
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405e95
cmp eax, edi
jg 0x405e95
mov esi, 0x42ca28
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405e95
cmp eax, edi
jg 0x405e95
push esi
push ebp
push str._s_s_r_n
push 0x42c228
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42f434]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004060dd
push 4
push 0xc0000000
push esi
call fcn.00405c54
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405e95
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405e8e
push edi
push esi
push ebp
call fcn.00405ccc
test eax, eax
je 0x405e8e
push str._Rename__r_n
push esi
call fcn.00405bb9
test eax, eax
jne 0x405e2c
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405e61
add eax, 0xa
push 0x40a3d0
push eax
call fcn.00405bb9
mov ebp, eax
test ebp, ebp
je 0x405e5d
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405e4e
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405e48
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405e63
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x42c228
push eax
call fcn.00405c0f
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405cfb
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405e9a
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405ebd
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405d2a
pop ecx
pop ecx
inc dword [0x42f4d0]
ret 8

Function at 0x405fa2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x400
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405f41
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x406011
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [esi + 0x3ff], 0
test edi, edi
pop edi
jne 0x406011
cmp dword [ebp + 0xc], 1
je 0x406014
cmp dword [ebp + 0xc], 2
je 0x406014
and byte [esi], 0
pop esi
leave
ret 0x14
Function at 0x4063e5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406409
xor eax, eax
test eax, eax
je 0x40641b
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40641b
xor ecx, ecx
jmp 0x40641e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40650a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ce2c], 0
push esi
jne 0x406541
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40651b
mov dword [ecx*4 + 0x42ce28], eax
inc ecx
cmp ecx, 0x100
jl 0x406516
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406572
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ce28]
xor eax, esi
inc ecx
dec edx
jne 0x406554
pop edi
not eax
pop esi
ret 0xc

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x4a8173a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x19c274da
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1192601c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6d5f2311
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x484cf8
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x484a08
or ebx, ecx
sub ecx, ecx
add ebx, 0x1c348031
call fcn.00484d40
inc ebx
mov ebx, 0x3e7a92a8
xor dword [esi], edi
mov ebx, ebx
sub ecx, ebx
sub ecx, ecx
add esi, 2
add ecx, 0xa528cffc
and ebx, ebx
mov ebx, 0xfa4ab607
cmp esi, edx
jl fcn.00484cf8
dec ecx
mov ecx, 0xf4de4e0
ret
Function at 0x4010d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x438928]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dl, 1
lea ebx, [ebx]
movzx eax, dl
mov cl, dl
and cl, 0x80
mov byte [ebp + eax - 0x104], bl
mov byte [ebp + ebx - 0x204], dl
inc ebx
neg cl
sbb cl, cl
mov al, dl
and cl, 0x1b
add al, al
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x4010f0
mov cl, 1
mov edx, 0x473b60
movzx eax, cl
shl eax, 0x18
mov dword [edx], eax
mov al, cl
and al, 0x80
add edx, 4
neg al
sbb al, al
and al, 0x1b
add cl, cl
xor cl, al
cmp edx, 0x473b88
jl 0x401125
mov dword [0x4743a0], 0x63
mov dword [0x4714ec], 0
mov edx, 1
nop
movzx eax, byte [ebp + edx - 0x104]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov al, byte [ecx]
mov cl, al
rol cl, 1
xor al, cl
rol cl, 1
xor al, cl
rol cl, 1
xor al, cl
rol cl, 1
xor cl, al
xor cl, 0x63
movzx eax, cl
mov dword [edx*4 + 0x4743a0], eax
mov dword [eax*4 + 0x471360], edx
inc edx
cmp edx, 0x100
jl 0x401160
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x20c], ebx
mov edi, edi
mov dl, byte [esi + 0x4743a0]
mov cl, dl
mov al, dl
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
xor cl, al
movzx eax, cl
movzx ecx, dl
mov edx, eax
shl edx, 8
xor edx, ecx
shl edx, 8
xor edx, ecx
shl edx, 8
xor edx, eax
mov al, byte [esi + 0x471360]
xor edx, ecx
mov dword [esi + 0x471760], edx
ror edx, 8
mov dword [esi + 0x471b60], edx
ror edx, 8
mov dword [esi + 0x471f60], edx
ror edx, 8
mov dword [esi + 0x472360], edx
test al, al
je 0x401278
movzx eax, al
movzx ecx, byte [ebp + eax - 0x104]
movzx eax, byte [ebp - 0xf9]
add eax, ecx
cdq
idiv ebx
movzx eax, byte [ebp - 0xf7]
add eax, ecx
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv ebx
movzx eax, byte [ebp - 0xfb]
add eax, ecx
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv dword [ebp - 0x20c]
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp - 0xf6]
add eax, ecx
cdq
mov ecx, 0xff
idiv ecx
movzx eax, byte [ebp + edx - 0x204]
jmp 0x401284
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x208], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x208]
add esi, 4
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edi
mov dword [esi + 0x47275c], eax
ror eax, 8
mov dword [esi + 0x472b5c], eax
mov ebx, 0xff
ror eax, 8
mov dword [esi + 0x473b9c], eax
ror eax, 8
mov dword [esi + 0x473f9c], eax
cmp esi, 0x400
jl 0x4011b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c49
mov esp, ebp
pop ebp
ret
Function at 0x4061c0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4360d8
push 0x41bf70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x438928]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x40626d
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x28]
jmp 0x40626d
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413c49
mov esp, ebp
pop ebp
ret

Function at 0x406290
Capabilities:
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4360f8
push 0x41bf70
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x438928]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.00416250
add esp, 0xc
mov dword [ebp - 0x12c], 0x104
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x406369
mov edx, 6
mov dword [ebp - 0x130], edx
lea esi, [ebp - 0x120]
or ecx, 0xffffffff
mov dword [ebp - 0x124], esi
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
je 0x406349
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4347a8]
inc esi
jmp 0x40631f
not ecx
xor ebx, ebx
cmp ecx, 0x39b5d60d
sete bl
jmp 0x406363
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413c49
mov esp, ebp
pop ebp
ret
Function at 0x407290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4072a9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4072e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4072e0
lea ebx, [ebx]
cmp esi, edx
jae 0x4072e4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4072d0
cmp esi, edx
jb 0x4072eb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ab40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ccbb
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x438928]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x30], ecx
xor edi, edi
mov edx, 0x439c58
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.0040d600
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], edi
je 0x40aca1
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
push ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040d1f0
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x40ac93
test esi, esi
je 0x40ac9e
sub esp, 8
lea ecx, [ebp - 0xf0]
call fcn.0040b2b0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 3
call fcn.0040cbb0
mov edx, ebx
mov ecx, eax
call fcn.0040ce70
mov ecx, eax
call fcn.0040cbb0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.0040b3e0
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
lea edx, [ebp - 0x2c]
cmp edi, 8
cmovae edx, ebx
lea ecx, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40ac10
sub edx, ecx
sar edx, 1
lea ecx, [ebp - 0x2c]
lea eax, [edx*2 + 2]
push eax
cmp edi, 8
cmovae ecx, ebx
push ecx
push 2
push 0
push dword [ebp - 0x30]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp - 0x18], 8
jb 0x40ac57
push dword [ebp - 0x2c]
call fcn.00413c44
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 2
call fcn.0040b360
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x434f00
call fcn.004137b8
add esp, 4
test esi, esi
je 0x40ac9e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40acd1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40acd1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413c49
mov esp, ebp
pop ebp
ret
Function at 0x40d280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x438928]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x434f0c
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x434f1c
push str.Shlwapi.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
mov esi, eax
test edi, edi
je 0x40d3c8
test esi, esi
je 0x40d3c8
push 0x40
lea eax, [ebp - 0x66c]
push 0
push eax
call fcn.00416250
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x640], ax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x620], eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x670], 0x44
movq qword [ebp - 0x628], xmm0
call fcn.00416250
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x434f40
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.00416250
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.__s__start___s_
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.00414a5c
add esp, 0x20
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c49
mov esp, ebp
pop ebp
ret
Function at 0x40d3e0
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd30
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x438928]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
xor edi, edi
mov edx, 0x43a078
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
call fcn.0040d600
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], esi
je 0x40d517
push 5
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x40d517
push 0x17
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], eax
test esi, esi
je 0x40d50e
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40d4fa
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x11]
push ecx
push eax
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x30], 0
call fcn.004079a0
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x34]
sub eax, ebx
cmp eax, dword [ebp - 0x18]
jne 0x40d4f2
test ebx, ebx
je 0x40d4f2
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x40d4f2
cmp dword [ebx + 4], 2
je 0x40d4f2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebx + 8]
push 2
push dword [ebx]
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0x34]
call fcn.004078a0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40d546
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40d546
test esi, esi
je 0x40d551
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x40d55c
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e690
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, 0x43a290
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040d600
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40e74e
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e740
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40e701
lea eax, [edx + 0xd]
jmp 0x40e72e
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e706
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x43505c
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40e740
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40e6c0
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40e768
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cde7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x438928]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x43500c
mov dword [edi + 0x60], 0x435050
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], 0x434ec0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00411aa0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x435000
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00411b50
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], 0x434fc4
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x46fe9c]
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4