joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12304280
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x123506d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x91c
push esi
push edi
mov esi, dword [esp + 0x938]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x126]
mov word [esp + 0x124], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x123b8c6c]
test esi, esi
je 0x1230436c
test eax, eax
jne 0x1230432b
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x123b8c6c], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x1230431f
cmp dword [esp + 0x14], 5
jb 0x1230431f
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x123b8c70], ecx
jmp 0x1230432b
mov edx, dword [0x123a3694]
mov dword [0x123b8c70], edx
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x123a3694]
jne 0x12304340
mov eax, dword [0x123b8c70]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0x134]
push str._s__s__08x__08x
push eax
call fcn.122cb738
add esp, 0x18
jmp 0x123043fb
test eax, eax
jne 0x123043c0
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x123b8c6c], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x123043b6
cmp dword [esp + 0x14], 5
jb 0x123043b6
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x123b8c70], edx
jmp 0x123043c0
mov eax, dword [0x123a3694]
mov dword [0x123b8c70], eax
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x123a3694]
jne 0x123043d5
mov eax, dword [0x123b8c70]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push eax
lea eax, [esp + 0x130]
push str._s___08x__08x
push eax
call fcn.122cb738
add esp, 0x14
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xc]
call fcn.122b55a0
mov esi, dword [esp + 0x934]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x930], 1
call fcn.122b5340
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x92c], 0
call fcn.122b5d40
mov ecx, dword [esp + 0x924]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x928
ret
Function at 0x12306ba0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x12306c28
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x12306c02
mov ecx, dword [esi + 0x18]
xor eax, eax
mov dword [esp + 9], eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x11], ax
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x17], al
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
lea edx, [esp + 0xc]
push 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push edx
push 0xd
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
pop edi
jge 0x12306c02
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0xc]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x12307100
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x123b8cec]
push esi
test eax, eax
jne 0x123071ea
mov ecx, dword [0x123b8ce8]
cmp ecx, 3
ja 0x123071ea
mov edx, ecx
inc edx
mov dword [0x123b8ce8], edx
call fcn.122ff170
test eax, eax
je 0x1230713c
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x12307147
push 0x123a3804
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1230714f
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetSpecialFolderLocation
push esi
call edi
push str.SHGetSpecialFolderPathW
push esi
mov dword [0x123b8cbc], eax
call edi
push str.SHGetKnownFolderPath
push esi
mov dword [0x123b8cc0], eax
call edi
push str.SHGetFolderLocation
push esi
mov dword [0x123b8cc4], eax
call edi
push str.SHFormatDrive
push esi
mov dword [0x123b8cc8], eax
call edi
push 2
push esi
mov dword [0x123b8ccc], eax
call edi
push 4
push esi
mov dword [0x123b8cd0], eax
call edi
push str.SHCreateDirectoryExW
push esi
mov dword [0x123b8cd4], eax
call edi
push str.PathRemoveFileSpecW
push esi
mov dword [0x123b8cd8], eax
call edi
push str.SHFileOperationA
push esi
mov dword [0x123b8cdc], eax
call edi
push str.SHFileOperationW
push esi
mov dword [0x123b8ce0], eax
call edi
mov dword [0x123b8ce4], eax
mov eax, 1
mov dword [0x123b8cec], eax
pop edi
pop esi
ret
Function at 0x123088e0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x12350de8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x12354004
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x12308921
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.122bb670
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.122bb670
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.122b5d40
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.122b5d40
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.122b5d40
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.122b5d40
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.122b5d40
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.122b5d40
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.122b5d40
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12309f80
Capabilities:
Delete service

Disassembly:
sub esp, 0x20
push edi
call fcn.122ff0f0
test eax, eax
je 0x12309f9e
mov dword [0x123b8f80], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x12309fb9
mov dword [0x123b8f80], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
push esi
push 0xf003f
push edi
push edi
mov dword [0x123b8f80], edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x12309fee
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x12309ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp esi, edi
je 0x1230a01b
mov eax, dword [esp + 0x34]
push 0xf01ff
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x1230a06e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x1230a088
jne 0x1230a06e
test esi, esi
jne 0x1230a053
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x1230a047
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x1230a04f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x1230a06e
mov ecx, dword [esp + 0x34]
push 0xf01ff
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x1230a06e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
test ebp, ebp
jne 0x1230a0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x123b8f80], eax
jmp 0x1230a08c
mov ebp, dword [esp + 0x10]
mov eax, dword [0x123b8f80]
test eax, eax
jne 0x1230a0ac
test ebx, ebx
je 0x1230a0a1
mov dword [0x123b8f80], ebx
jmp 0x1230a0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x123b8f80], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1230a0b9
push edi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1230a0c8
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test esi, esi
je 0x1230a0cf
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x1230a0e0
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.122ff0f0
test eax, eax
je 0x1230a0fe
mov dword [0x123b8f80], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x1230a119
mov dword [0x123b8f80], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push esi
push 2
push edi
push edi
mov dword [0x123b8f80], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x1230a148
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
je 0x1230a16a
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1230a1a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x1230a1df
jne 0x1230a1a8
test esi, esi
jne 0x1230a18e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x1230a18e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x1230a1a8
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1230a1a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x1230a1ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x123b8f80], eax
jne 0x1230a1e8
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x1230a1ff
mov eax, dword [0x123b8f80]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x1230a1ff
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1230a1fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x123b8f80], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1230a20c
push edi
call ebx
test esi, esi
je 0x1230a213
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x1230adf0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x12350f3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.122bb660
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x1230ae37
push eax
lea ecx, [esp + 0x18]
call fcn.122bb8b0
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x1230ae4c
push eax
lea ecx, [esp + 0x18]
call fcn.122bb8b0
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x1230aeb7
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.122c0d30
add esp, 0x10
test eax, eax
jne 0x1230aeb0
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.122bb670
xor eax, eax
jmp 0x1230af85
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x1230af6e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x1230af6e
test esi, esi
je 0x1230af6e
call fcn.122a5030
mov eax, dword [0x123b109c]
test eax, eax
je 0x1230af6e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.122bf930
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x123b109c]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.122bb670
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x1230b7c0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x1230b7dd
cmp edi, 4
jbe 0x1230b7dd
mov dword [0x123b8f84], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x1230b7fc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.122c42a0
cmp edi, 0xffffffff
je 0x1230b810
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.122c42a0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x1230b828
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.122c42a0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1230b83e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.122c4450
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1230b855
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.122c4450
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1230b87d
push edi
call fcn.122ca717
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1230b894
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.122c4450
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1230b8ab
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.122c48e0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1230b8c1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.122c48e0
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x1230c770
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x12351148
push eax
mov dword fs:[0], esp
sub esp, 8
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x1230c7a3
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
call fcn.122ca717
add esp, 4
test eax, eax
jne 0x1230c7c0
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
lea ecx, [esp + 8]
xor esi, esi
call fcn.122c3010
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], esi
call fcn.122c3180
test eax, eax
je 0x1230c806
push edi
lea ecx, [esp + 0xc]
call fcn.122c54c0
lea ecx, [esp + 8]
mov esi, eax
call fcn.122c31d0
test esi, esi
jne 0x1230c839
mov ecx, dword [str.SystemCurrentControlSetServicesVxD]
push 0x2001f
push ecx
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x14]
call fcn.122c3180
test eax, eax
je 0x1230c839
push edi
lea ecx, [esp + 0xc]
call fcn.122c54c0
lea ecx, [esp + 8]
mov esi, eax
call fcn.122c31d0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.122c3100
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1230c860
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x12351180
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1230c893
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x1230c8ab
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.122c3010
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.122c3180
test eax, eax
je 0x1230c957
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.122c5680
test eax, eax
jne 0x1230c90c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.122c3100
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1230c93f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.122c37b0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.122b5ed0
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.122b5d40
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1230ca1e
mov dword [eax], 0x10
jmp 0x1230ca1e
mov edx, dword [0x1235298c]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x1239dca0
push ecx
mov byte [esp + 0x24], 2
call fcn.122b8cc0
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.WS2_32.dll_bind
call fcn.122c3180
test eax, eax
jne 0x1230c9cb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.122b5d40
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.122c3100
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1230ca02
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.122c37b0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.122b5ed0
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.122b5d40
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1230ca10
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.122b5d40
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.122c3100
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1230ca50
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x123511a8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1230cb61
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1230cb61
cmp word [edi], bx
je 0x1230cb61
cmp word [esi], bx
je 0x1230cb61
lea ecx, [esp + 0xc]
call fcn.122c3010
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1230caff
cmp eax, 1
je 0x1230caff
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x18]
call fcn.122c3180
test eax, eax
jne 0x1230caed
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x18]
call fcn.122c31f0
test eax, eax
je 0x1230cb50
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.122c4450
mov esi, eax
jmp 0x1230cbe6
mov edx, dword [0x1235298c]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x1239dca0
push ecx
mov byte [esp + 0x2c], 1
call fcn.122b8cc0
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.WS2_32.dll_bind
call fcn.122c3180
test eax, eax
jne 0x1230cb75
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.122b5d40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.122c3100
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x1235298c]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.122cac99
add esp, 8
cmp eax, ebx
je 0x1230cb9f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.122b5fc0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1230cbb8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.122b5d40
jmp 0x1230cb43
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.122c4450
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.122b5d40
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.122b5d40
lea ecx, [esp + 0xc]
call fcn.122c31d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.122c3100
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1230da80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1230da8b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x1230db8d
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x12354008]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x12354008]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x12354008]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x12354008]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x12354008]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x12354008]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x12354008]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x12354008]
xor eax, edx
inc ecx
dec edi
jne 0x1230daa6
test esi, esi
je 0x1230dbaf
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x12354008]
xor eax, edx
inc ecx
dec esi
jne 0x1230db91
pop edi
pop esi
not eax
pop ebx
ret