joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x40990a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + 2]
sub ecx, eax
lea edx, [eax + 2]
add ecx, 0xfffffffe
lea eax, [edi - 1]
mov dword [ebp + 0x14], edx
shr eax, 3
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
push ecx
push dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
call fcn.00408aa0
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [ebp + 0x14]
add esp, 0xc
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x14], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 4], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 8]
jne 0x409840
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40e360
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x40e3cc
cmp byte [esi + 1], 0
je 0x40e3cc
push ebx
push edi
call fcn.00411f80
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp edi, 0x14
jl 0x40e38d
cmp byte [esi + 3], 0
je 0x40e39d
cmp byte [esi + 2], 0
jne 0x40e3a1
push 0x1f4
inc edi
call ebx
jmp 0x40e382
cmp byte [esi + 2], 0
pop edi
pop ebx
jne 0x40e3cc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40e3da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df216
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x840]
push eax
call int.0045572d
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x828], ax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0x840]
mov dword [ebp - 0x814], 7
push eax
mov dword [ebp - 0x818], 0
call fcn.00402530
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.004830b0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x413f06
mov esi, dword [esi]
cmp dword [ebp - 0x82c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp - 0x840]
cmovae eax, dword [ebp - 0x840]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x413f3e
xor ecx, ecx
jmp 0x413f56
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413f47
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00402650
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00486908
mov ecx, dword [ebp - 0x814]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x413fa6
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
cmp eax, 8
jb 0x413fe1
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00402750
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 0xc
Function at 0x414980
Capabilities:
Encode data using xor
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0047337c
test al, al
je 0x4149b6
cmp cl, cl
les edi, [ebx + 0x4a8a01cf]
jb 0x4149d9
imul edx, eax, 0xd6731e5b
fcmovu st(0), st(6)
mov edx, 0x18477a1f
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4149e1
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
add eax, 0x5de58b00
ret 4
push 0xf01ff
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4149cc
xlatb
call fcn.00473856
test al, al
je 0x414a1d
add eax, 0x74c08400
pop ds
dec ebp
dec esp
xor al, 0x1c
jg 0x4149f4
push edi
rcl cl, cl
fcmovne st(0), st(7)
enter 0xffffffffffffa2d7, 2
dec esi
sub byte [edi], ch
jne 0x414a5c
popfd
stosd dword es:[edi], eax
bound esi, qword [edi]
jne 0x414a2e
xchg esp, eax
sub al, 0x15
jmp 0xc0c54a29
call fcn.00473337
test al, al
je 0x414a42
invalid
int 0x43
je 0x4149f8
dec ecx
enter 0x389e, 0xffffffffffffffce
push ecx
sub al, 0x92
sub eax, 0xcf5325a2
mov ah, 0x2f
call fcn.004133bf
add eax, 0x74c08400
push ss
call fcn.004733c1
test al, al
je 0x414a61
mov edx, 0x870189ab
outsb dx, byte [esi]
out dx, eax
adc dword [ebx - 0x7c], edx
pop es
mov bh, 0x3c
fcom qword [ebp - 0x5f]
xchg esi, eax
scasb al, byte es:[edi]
sti
mov edi, 0x8ddc758b
inc ebp
loopne 0x414ab8
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x414a82
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.0047337c
test al, al
je 0x414aa8
fstpnce st(6), st(0)
arpl word [edx], si
cdq
or dh, cl
mov al, byte [0x17617f47]
add ah, byte [edi - 0x319254e8]
sti
lahf
add cl, byte [eax - 0xa8fe065]
mov esi, dword [ebp - 0x24]
call fcn.004736b8
test al, al
je 0x414ac2
shl edx, 1
not byte [edx + 0x520c46d4]
or al, 0x52
lcall 0x4e69, 0x2becc1ed
pop edx
call fcn.00473742
test al, al
je 0x414ae2
mov al, byte [0x3ce57d58]
pop edi
int 0x33
xor edx, esi
aaa
pop ebx
lodsd eax, dword [esi]
cld
lcall 0xb159, 0xfa5eeee4
push edx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
Function at 0x414b10
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
call fcn.00414980
test al, al
jne 0x414b58
push ebx
push 0x7d
call fcn.004755bf
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
call fcn.0047337c
test al, al
je 0x414b7f
adc dword [edx], edx
jp 0x414b28
push ds
push esi
int 0xe5
sub cl, byte [eax]
sbb eax, 0x3ad0f822
pop ecx
adc dl, al
pop edi
and esp, dword [0x570c77b]
jmp 0x414bbd
call fcn.0047351a
test al, al
je 0x414b9a
xor cl, ch
mov ch, 0xe5
neg dword [esi + ebp - 0x33]
test dl, 0x25
imul edi, dword [esi + 0x522d8a10], 0xdc758b51
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
push esi
call fcn.00414180
test al, al
jne 0x414bca
push esi
push 0x7e
call fcn.004755bf
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
call fcn.004732ad
test al, al
je 0x414bec
pop esi
das
mov es, word [edx + 0x41]
test ch, ch
lcall 0xeed0, 0x6de72b82
push 0x52
cmp eax, 0xce45e35a
or ebx, dword [edi + ecx*8 - 0x7f]
call fcn.00473742
test al, al
je 0x414c0c
in eax, 0x99
popfd
pop eax
popfd
add byte [eax + ebx], ch
invalid
call fcn.004732ad
test al, al
je 0x414c2c
xlatb
mov esp, 0x527f1e92
pop esp
or eax, 0xc1ccf512
hlt
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414c7e
push str.LocalWorkSvc
lea ecx, [ebp - 0x1c]
call fcn.00403b30
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.00448f80
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
Function at 0x41a220
Capabilities:
Delete registry key
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004732f2
test al, al
je 0x41a245
xor esi, ebx
push ecx
mov eax, dword [0x8e0c919a]
retf 0xaa4a
call fcn.004738e0
test al, al
je 0x41a264
mov ah, 0xad
sbb edx, dword [edx]
insd dword es:[edi], dx
dec eax
jle 0x41a27e
cmp byte [esi - 0x50], 0xa1
nop
sub ebp, ebp
cmpsd dword [esi], dword es:[edi]
pop ds
rcr byte [edx - 0x7210b98f], 1
inc ebp
cld
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0xc]
push 0xf003f
neg eax
push 0
sbb eax, eax
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a2a7
sub byte [edi + 0x205005e], ah
add byte [eax], al
adc byte [eax - 1], 0x15
or al, 0x80
pop esi
add byte [ebp - 0xea8a40], al
jne 0x41a29d
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
add bh, bh
jne 0x41a29d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473742
test al, al
je 0x41a2c8
adc ecx, dword [esi]
salc
pop esp
and eax, 0xa5cceb95
aaa
arpl bp, sp
aas
adc byte [esi - 0x67e7aa6c], bl
and al, 0xdc
call fcn.004733c1
test al, al
je 0x41a2f1
or eax, 0xdba6ef8e
inc esi
inc esi
push eax
movsd dword es:[edi], dword [esi]
loop 0x41a2d7
xchg esp, eax
pop eax
mov bl, byte [ecx - 0x2a]
mov al, byte [0xa1bd5ce3]
pop ss
xor byte [ebp + eax + 0x75], ch
sbb eax, 0x69b6ace7
push edx
call fcn.0047389b
test al, al
je 0x41a30e
and al, byte [eax*8 - 0xa717a59]
dec ebp
sub al, 0x73
salc
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ccc0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
Function at 0x41ffb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfe97
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x676314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x420001
mov eax, dword [esi]
jmp 0x420003
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x2c], 8
mov dword [ebp - 4], ecx
jb 0x420020
mov eax, dword [esi + 0x18]
jmp 0x420023
lea eax, [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ecx
cmp dword [esi + 0x44], 8
jb 0x42003d
mov eax, dword [esi + 0x30]
jmp 0x420040
lea eax, [esi + 0x30]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x42005a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x60]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x420074
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x78]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x42008e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x90]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4200ab
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xa8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4200c8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4200e5
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xd8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x420102
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push 0xc
push str.ZhiNengPYIME
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00402650
push 5
push str.ZHost
lea ecx, [esi + 0x18]
call fcn.00402650
push 0xc
push str.ZHostService
lea ecx, [esi + 0x30]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0x48]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0x60]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0x78]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0xc0]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0xd8]
call fcn.00402650
push 0
push 0x5e87f0
lea ecx, [esi + 0xa8]
call fcn.00402650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421c40
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00473742
test al, al
je 0x421c6a
adc ch, byte [eax - 0x44]
jl 0x421c93
movsb byte es:[edi], byte [esi]
popal
dec ebx
mov esi, 0x382956a1
sal byte [ecx - 0x32], 0x27
movsd dword es:[edi], dword [esi]
pop ebx
sbb dl, byte [esi - 0x17d035db]
push edx
pop ss
add eax, 0x74c08400
and byte [edx + edx*4 + 0x58], cl
call fcn.004733c1
test al, al
je 0x421c93
dec esp
xchg edx, eax
pop eax
retf
call fcn.0047389b
test al, al
je 0x421cb0
adc al, 0x3d
and bl, bl
jbe 0x421cb6
xor bl, byte [edi + 0x2a68e3ca]
mov al, byte [0x9ba88708]
adc eax, 0x458d192d
cld
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
add dword [edi], ecx
add byte [edx], ch
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421dfd
call fcn.00473856
test al, al
je 0x421cf0
dec ecx
push edi
in al, 0x26
push es
mov edx, 0x280f1cb8
xchg ebx, eax
jmp 0x421d39
call fcn.0047351a
test al, al
je 0x421d0d
and eax, 0x84000518
sal byte [esp + edx - 0x58], 0xe9
test al, 0xe9
jmp 0xdb751a7a
jnp 0x421cfa
xor bl, bl
mov dword [0x6097e63a], eax
pushfd
inc edx
pop esp
std
not byte [ebx]
test al, 0xa2
mov edi, 0x516afe8
add byte [eax + eax*8 - 0x6e19eb8c], al
call fcn.004733c1
test al, al
je 0x421d2a
out 0x91, al
ret 0x8b86
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.ZHost
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x421d61
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004732f2
test al, al
je 0x421d7f
jbe 0x421cf1
fdiv dword [ebp + 0x24]
aad 0xbf
frstor dword [ebp + 0x4cc82a53]
mov dl, cl
sbb cl, byte [esi + 0xe]
cmp al, 0xb
call fcn.004737cc
test al, al
je 0x421da5
cmp eax, 0x5110921b
mov edi, 0x4ffc45a2
mov gs, word [esi + 0x76]
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x50cad2f3
cmp al, 0xb7
adc al, 0x2e
sub al, 0x62
int 0x68
or al, 0x7b
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
call fcn.0047362e
test al, al
je 0x421dfd
aas
or edi, edx
pop edi
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4315a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x80c], 0
call fcn.00473811
test al, al
je 0x431611
invalid
mov eax, cs
push eax
imul edx, dword [eax + 0x69a2726e], 0xffffffac
cmc
ljmp 0x82d5
call fcn.0047396a
test al, al
je 0x43162b
xlatb
je 0x4315bf
jp 0x43168f
pop es
dec esp
inc eax
mov al, byte [0x5a5ef39]
sub bl, byte [esi - 0x7a72ea5e]
clc
idiv edi
call dword [eax + 0x68]
aas
add dword [edi], ecx
add byte [edx], ch
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
call fcn.0047362e
test al, al
je 0x431669
mov al, byte [0x40b77490]
test al, 0x1a
cmp eax, 0x99061f07
clc
push edx
retf
call fcn.004736b8
test al, al
je 0x431691
and al, 0x91
sar byte [edx], 0xb7
aas
mov edi, 0xc9a3d101
mov cl, 0x57
idiv byte [ecx - 0x4cf60ce6]
test byte [ebx + 0x1dd9e12e], cl
sahf
das
cmp dword [edx - 0xf427c1c], ecx
mov byte [0xf0bd83e4], al
cmp dword [ebp - 0x810], 0
idiv edi
inc dword [eax]
jne 0x43170d
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.BD2F4D93_5414_4182_A2D5_96BD9C51B5B6
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.ZhiNeng_Shell_Extension
lea eax, [ebp - 0x804]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4316f6
test dx, dx
je 0x4316f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4316f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4316d0
xor eax, eax
jmp 0x4316fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431784
mov dword [ebp - 0x80c], 1
call fcn.0047337c
test al, al
je 0x431726
push edx
add byte [edx], bh
scasd eax, dword es:[edi]
pop edi
push edx
push 0xffffffffffffffd4
scasb al, byte es:[edi]
jnp 0x4316b1
test al, 0x7b
invalid
call fcn.0047355f
test al, al
je 0x43173f
stosb byte es:[edi], al
xchg esp, eax
je 0x431779
sti
mov esp, 0x33928ec8
xchg byte [edi - 0x5c7f4161], cl
call fcn.00473811
test al, al
je 0x43175d
jo 0x431731
cmp eax, 0xb0a1346b
pop ecx
sbb al, 0xc4
and byte [esi], dh
xchg edi, eax
adc ch, 0xa
sbb esp, ecx
cmp byte [esi], bh
ret 0xb5ff
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x80c], 0
jmp 0x43175d
Function at 0x439c00
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
push edi
test esi, esi
je 0x439d32
call fcn.0047337c
test al, al
je 0x439c47
popfd
fldcw word [eax + 0x3c3a8b7f]
xor eax, 0x6c4d0ade
out 0x17, al
loop 0x439c11
out 0x5d, eax
lea edx, [ebp - 0x37ed3e5b]
enter 0xffffffffffff8b1c, 0x75
fsub st(0), st(0)
insb byte es:[edi], dx
lcall 0x1174, 0xc0840003
call fcn.004736b8
test al, al
je 0x439c61
in al, dx
call 0x56afd59d
test eax, 0x2796a920
stc
sbb ch, byte [eax + esi*2 - 0x47]
mov al, byte [0x39adce8]
add byte [eax + eax*8 + 0x252d1774], al
add ch, bh
call fcn.00473742
test al, al
je 0x439c81
sub eax, 0xfd006525
mov byte [0xf38abe71], al
clc
sub dword [eax - 0x14], eax
add eax, 0xc0dbcd92
adc ah, byte [esi - 0x31742953]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439c86
sub ecx, edx
sar ecx, 1
je 0x439d32
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
sub byte [eax - 0xf74ffa2], al
mov dword [ebp - 0x28], esi
fsubr st(0)
enter 0x396, 0
call fcn.0047337c
test al, al
je 0x439cd5
xchg ecx, eax
sbb dword [edx - 0x20589494], ebp
or al, 0xe0
adc ecx, dword [edx - 0x34]
jmp 0x439cae
call fcn.004736b8
test al, al
je 0x439cef
adc esi, dword [edx]
das
and dl, byte [eax]
ret
call fcn.00473742
test al, al
je 0x439d0f
fidivr dword [eax - 0x7283b31f]
loope 0x439ca6
popfd
inc esp
aaa
jb 0x439caf
stosb byte es:[edi], al
push eax
jg 0x439ca4
jb 0x439d04
dec edx
push eax
mov al, 1
mov dword [0x1f74f685], eax
test esi, esi
je 0x439d32
push 0x10020
push dword [ebp - 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x439d47
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
call fcn.00473856
test al, al
je 0x439d65
outsb dx, byte [esi]
xchg esi, eax
cmp eax, dword [ebx + 0x49c1655e]
insd dword es:[edi], dx
add edx, dword [esp + eax*2]
arpl dx, sp
jae 0x439d99
fsub dword [ecx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
push ebx
call esi
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0046ce06
mov esp, ebp
imul esi, dword [eax], 0xe58b0003
pop ebp
ret 4