joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40524f
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edx, esi
xor ebx, ebx
jmp 0x405271
call fcn.00402b47
test al, al
jne 0x405279
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x405266
mov eax, esi
sub eax, edx
sar eax, 1
mov ecx, 0x400
cmp eax, ecx
jle 0x40528a
mov eax, ecx
lea edi, [eax + eax]
push edi
push edx
lea eax, [ebp - 0x824]
push eax
call fcn.0047b530
add esp, 0xc
mov word [ebp + edi - 0x824], bx
jmp 0x4052aa
inc esi
inc esi
mov ax, word [esi]
call fcn.00402b47
test al, al
jne 0x4052a8
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], eax
je 0x40533d
push 0x10020
lea ecx, [ebp - 0x824]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
mov dword [ebp + 8], eax
je 0x40533d
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x405306
push 0x4900ac
call fcn.0040340c
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xc8
push edi
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x405328
push 0x4900a0
jmp 0x40532d
push 0x490094
call fcn.0040340c
pop ecx
push dword [ebp + 8]
call ebx
push edi
call esi
jmp 0x40535c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x405351
push 0x490088
jmp 0x405356
push 0x49007c
call fcn.0040340c
pop ecx
push dword [ebp - 4]
call ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40544c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f8
push ebx
push esi
push edi
mov esi, 0x4900b8
lea edi, [ebp - 0x7f8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov ecx, 0x1f9
lea edi, [ebp - 0x7e6]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
call fcn.004031cd
mov edx, eax
mov ecx, edx
call fcn.00403294
mov esi, eax
sub esi, edx
sar esi, 1
mov eax, 0x3e8
cmp esi, eax
jl 0x40549a
mov esi, eax
push esi
push edx
lea eax, [ebp - 0x7e8]
push eax
call fcn.0040414f
add esp, 0xc
lea eax, [ebp - 0x7f8]
push eax
push 0x64
xor edi, edi
push edi
push 0x8000004
push edi
push 0xffffffffffffffff
mov word [ebp + esi*2 - 0x7e8], di
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, edi
je 0x40550f
push edi
push edi
push edi
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x40550f
push 0x64
push edi
push esi
call fcn.004031e0
mov dword [esi], 0xffffffff
mov dword [esi + 8], edi
lea eax, [esi + 4]
add esp, 0xc
mov dword [0x4a50d4], eax
mov dword [0x4a6b9c], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b5b1
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x4a6c40
mov dword [0x4a6c40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x4a6c44], 5
je 0x40b5d9
xor eax, eax
leave
ret
mov eax, dword [0x4a6c48]
push ebx
push edi
xor edi, edi
sub eax, edi
je 0x40b5f4
dec eax
jne 0x40b675
mov ebx, 0x39000
jmp 0x40b5f9
mov ebx, 0x30000
push esi
push str.DevicePhysicalMemory
lea eax, [ebp - 8]
push eax
call dword [0x4a6c0c]
lea eax, [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 6
mov esi, 0x4a6d60
push esi
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [0x4a6c08]
cmp eax, 0xc0000022
jne 0x40b670
lea eax, [ebp - 0x20]
push eax
push 0x60000
push esi
call dword [0x4a6c08]
push dword [0x4a6d60]
call fcn.0040b4e3
pop ecx
push dword [0x4a6d60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
push 6
push esi
call dword [0x4a6c08]
cmp eax, edi
pop esi
jge 0x40b679
xor eax, eax
jmp 0x40b69d
push 0x1000
push ebx
push edi
push 6
push dword [0x4a6d60]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4a6d5c], eax
neg eax
sbb eax, eax
and eax, dword [0x4a6d60]
pop edi
pop ebx
leave
ret

Function at 0x40b6a1
Capabilities:
Read file via mapping

Disassembly:
mov ecx, dword [esp + 4]
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
shr eax, 0x16
mov eax, dword [ecx + eax*4]
test al, 1
jne 0x40b6ba
xor eax, eax
pop edi
ret
test al, al
push esi
jns 0x40b6cd
mov esi, eax
xor esi, edi
and esi, 0x3fffff
xor esi, eax
jmp 0x40b715
push 0x1000
and eax, 0xfffff000
push eax
push 0
push 4
push dword [0x4a6d60]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3ff
mov ecx, dword [eax + ecx*4]
test ecx, 1
jne 0x40b702
xor eax, eax
jmp 0x40b717
mov esi, ecx
xor esi, edi
and esi, 0xfff
push eax
xor esi, ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, esi
pop esi
pop edi
ret

Function at 0x40b71a
Capabilities:
Read file via mapping

Disassembly:
push esi
push dword [esp + 8]
push dword [0x4a6d5c]
call fcn.0040b6a1
pop ecx
pop ecx
push 0x1000
mov esi, eax
and eax, 0xfffff000
push eax
push 0
push 6
push dword [0x4a6d60]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x40b74f
pop esi
ret
shr esi, 2
and esi, 0x3ff
mov esi, dword [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, esi
pop esi
ret

Function at 0x40b7e1
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40b7ff
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
ret
Function at 0x40b9de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x80000000
push dword [ebp + 8]
call fcn.0040b95d
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x40ba75
push esi
push eax
call fcn.0040b9bc
mov esi, dword [ebp + 0x10]
test esi, esi
pop ecx
mov dword [ebp - 8], eax
je 0x40ba10
mov dword [esi], eax
jmp 0x40ba13
lea esi, [ebp - 8]
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40ba39
add eax, 0x10
push eax
lea ecx, [ebp + 0xc]
call fcn.00433b18
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.0042eb98
test edi, edi
je 0x40ba69
and dword [ebp + 0xc], 0
push 0
lea eax, [ebp + 0xc]
push eax
push dword [esi]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x40ba58
xor eax, eax
push 6
mov dword [esi], eax
add eax, edi
push 0
push eax
call fcn.0047b210
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x40ba78
mov edi, dword [ebp + 0xc]
mov eax, edi
pop edi
leave
ret

Function at 0x40c123
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 8], 0x40
jb 0x40c138
mov eax, dword [esp + 4]
mov dword [ecx + 0xc], eax
cmp word [eax], 0x5a4d
je 0x40c13c
xor eax, eax
jmp 0x40c1a7
mov edx, dword [eax + 0x3c]
push esi
lea esi, [edx + 0xf8]
cmp dword [esp + 0xc], esi
jae 0x40c150
xor eax, eax
jmp 0x40c1a6
add eax, edx
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x40c14c
mov dx, word [eax + 0x16]
test dh, 0x20
je 0x40c14c
test dl, 2
je 0x40c14c
cmp word [eax + 0x14], 0xe0
jne 0x40c14c
mov esi, dword [ecx + 0x10]
add eax, 0xf8
xor edx, edx
mov dword [ecx + 0x14], eax
cmp word [esi + 6], dx
jbe 0x40c1a3
add eax, 0x10
mov esi, dword [eax + 4]
add esi, dword [eax]
cmp esi, dword [esp + 0xc]
ja 0x40c14c
mov esi, dword [ecx + 0x10]
movzx esi, word [esi + 6]
inc edx
add eax, 0x28
cmp edx, esi
jl 0x40c189
xor eax, eax
inc eax
pop esi
ret 8

Function at 0x40c2d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x4a6e10], ebx
push esi
je 0x40c33e
cmp byte [ebp + 8], bl
je 0x40c33e
mov eax, dword [0x4a6efc]
cmp word [eax], bx
je 0x40c33e
test byte [0x4a721c], 2
mov esi, eax
je 0x40c31f
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [0x4a6e10]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x40c33e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 4]
push ecx
shl eax, 1
push eax
push esi
push dword [0x4a6e10]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x10000
push esi
mov ecx, 0x4a6efc
call fcn.00433c6b
mov eax, dword [0x4a6efc]
mov word [eax], bx
mov dword [0x4a6f04], esi
pop esi
mov dword [0x4a6f00], ebx
pop ebx
leave
ret
Function at 0x40c7a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp + 0x10], esi
je 0x40c7d8
cdq
jmp 0x40c7eb
cmp dword [ebp + 0xc], esi
je 0x40c7e5
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x40c7eb
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x40ce12
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
mov esi, dword [esp + 0x38]
mov edi, eax
add edi, esi
xor ebx, ebx
cmp esi, 0x4e20
jb 0x40ce3a
push ebx
call fcn.00430437
pop ecx
cmp esi, ebx
mov esi, dword [esp + 0x3c]
jg 0x40ce59
cmp esi, ebx
jg 0x40ce59
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 8
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jg 0x40ce67
cmp esi, ebx
jle 0x40ce4d
cmp byte [0x4a5290], bl
jle 0x40ce4d
cmp ecx, ebx
jbe 0x40cedc
cmp ecx, 0x7d0
jbe 0x40ce82
mov ecx, 0x3e8
jmp 0x40ce8a
cmp ecx, 0x64
jbe 0x40ce8a
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x40cedc
cmp esi, ebx
jg 0x40cead
call ebp
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x40cee4
push 3
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40cee4
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, ebx
jle 0x40cedc
dec esi
cmp byte [0x4a5290], bl
jg 0x40ce9f
xor esi, esi
jmp 0x40ce59
Function at 0x40ceeb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x325
lea ecx, [ebp - 8]
call fcn.00433c42
mov esi, dword [ebp - 8]
push esi
push 0x324
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
push ebx
call edi
push esi
call edi
cmp word [esi], 0
je 0x40cf7f
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [ebp - 0xc], eax
push esi
call fcn.0040c7ee
cmp eax, dword [ebp - 0xc]
pop ecx
jb 0x40cf6e
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x40cf68
dec eax
jne 0x40cf6e
mov ax, word [esi]
mov word [edi + 2], ax
mov cx, word [esi]
xor eax, eax
inc eax
cmp cx, word [ebx]
mov dword [ebp - 4], eax
jb 0x40cf6e
mov esi, eax
jmp 0x40cf82
mov ax, word [esi]
mov word [edi], ax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x40cf35
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0042eb98
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40cf91
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
push 9
pop ecx
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp + 8]
call dword [0x4a6e50]
test eax, eax
je 0x40d050
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [ebp - 0x1c]
push 0x32
mov dword [ebp - 0xc], eax
pop edi
mov dword [ebp - 4], 0x14
jmp 0x40d048
cmp dword [ebp - 4], 0
jge 0x40d004
mov eax, dword [ebp - 0x18]
push 0xa
xor edx, edx
pop ecx
div ecx
mov edi, eax
mov eax, 0x3e8
cmp edi, eax
jb 0x40d002
mov eax, 0x2710
cmp edi, eax
jbe 0x40d004
mov edi, eax
push 0
push edi
mov ecx, 0x4a6f08
call fcn.0040ce12
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp + 8]
call dword [0x4a6e50]
dec dword [ebp - 4]
jns 0x40d048
test eax, eax
je 0x40d04e
cmp dword [ebp - 0x1c], ebx
jbe 0x40d03e
call esi
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x40d048
call esi
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
ja 0x40d04e
cmp dword [ebp - 0x2c], 2
je 0x40cfde
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40d870
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d8a1
xor eax, eax
jmp 0x40d910
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
lea eax, [ebp - 0x48]
push eax
push ebx
mov dword [ebp - 8], edi
call esi
cmp dword [ebp - 4], 0x40
jne 0x40d905
cmp word [ebp - 0x48], 0x5a4d
jne 0x40d905
push edi
push edi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40d905
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0xf8
push edi
lea eax, [ebp - 0x140]
push eax
push ebx
call esi
cmp dword [ebp - 4], edi
jne 0x40d905
cmp dword [ebp - 0x140], 0x4550
jne 0x40d905
mov dword [ebp - 8], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40d9f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, 0x490eac
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov edi, 0x4a6f08
movsx ax, byte [ebp - 2]
add eax, 0x41
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x40da8a
movsx ebx, byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.HKLMSYSTEMCurrentControlSetControlSession_ManagerEnvironmentCDROM_u_s
push eax
call esi
add esp, 0x10
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0044db48
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.CDROM_u
push eax
call esi
add esp, 0x10
inc byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004335ed
inc byte [ebp - 2]
cmp byte [ebp - 2], 0x1a
jl 0x40da1a
cmp byte [ebp - 1], 0
pop edi
pop esi
pop ebx
jle 0x40daae
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
push eax
push eax
push str.THREAD_Envi
call fcn.00424fb6
leave
ret
Function at 0x40ddd8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
add dword [ebp + 8], 2
push esi
push edi
lea ecx, [ebp - 8]
call fcn.00433c24
lea ecx, [ebp - 4]
call fcn.00433c24
push 0x2c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x40deb9
and word [edi], 0
push ebx
push 1
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov esi, 0x4a6f08
mov ecx, esi
call fcn.0043c245
mov ebx, dword [ebp - 8]
push 1
push 0
lea eax, [ebp - 4]
push eax
add edi, 2
push edi
mov ecx, esi
mov dword [ebp + 8], ebx
call fcn.0043c245
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], esi
je 0x40de70
lea ecx, [ebp + 8]
call fcn.0040b43e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push 0x4904a0
push 0x80000002
jmp 0x40deac
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
shl eax, 1
push eax
push ebx
push 1
push str.RegisteredOwner
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push edi
mov ebx, 0x80000002
push ebx
call fcn.0042f97c
add esp, 0x18
push dword [ebp - 0xc]
call esi
shl eax, 1
push eax
push dword [ebp - 0xc]
push 1
push str.RegisteredOrganization
push edi
push ebx
call fcn.0042f97c
add esp, 0x18
xor esi, esi
pop ebx
jmp 0x40debc
xor esi, esi
inc esi
lea ecx, [ebp - 4]
call fcn.0042eb98
lea ecx, [ebp - 8]
call fcn.0042eb98
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40e3c3
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jge 0x40e3d4
call fcn.0040e368
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [esp + 0xc]
jg 0x40e3e8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
dec eax
js 0x40e3f4
inc eax
xor word [esi], di
inc esi
inc esi
dec eax
jne 0x40e3ec
mov eax, edi
pop edi
shl eax, 0x10
pop esi
ret

Function at 0x40e532
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
and dword [ebp - 8], 0
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x10], 0
cmp byte [0x4a6fbc], 0
mov dword [ebp - 0xc], 4
jne 0x40e5fc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ebx, str.SysStartuped
push ebx
mov edi, str.SOFTWAREPELOGON
push edi
mov esi, 0x80000002
push esi
mov byte [0x4a6fbc], 1
call fcn.0042f905
add esp, 0x18
test eax, eax
jne 0x40e594
cmp dword [ebp - 8], eax
jne 0x40e5f9
push 1
push 0x25
lea eax, [ebp - 0x2e0]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SysStartup.ini
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2e0]
push eax
call fcn.0047acb6
test eax, eax
pop ecx
je 0x40e5d1
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push ebx
push edi
push esi
call fcn.0042f97c
add esp, 0x18
cmp dword [ebp - 4], 1
jne 0x40e5f9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2e0]
push eax
call fcn.0042065b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e735
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x4a6df0], 0
jne 0x40e758
push 0
push dword [0x4a6e00]
push 0x40e67d
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4a6df0], eax
ret

Function at 0x40eb22
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x40eb3d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp - 0x228], ebx
mov ecx, 0x89
lea edi, [ebp - 0x224]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40eb8c
cmp dword [ebp - 0x224], esi
je 0x40eb92
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40eb77
jmp 0x40eb98
mov ebx, dword [ebp - 0x214]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
mov esi, ebx
jg 0x40eb3d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40ed0d
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push edi
je 0x40ed31
cmp dword [ebp + 0xc], 2
jne 0x40ed60
mov edi, dword [ebp + 0x14]
push 0x104
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40ed34
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 0
je 0x40ed44
push dword [ebp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push esi
mov ecx, 0x4a6f08
call fcn.004335ed
pop esi
pop edi
pop ebp
ret
Function at 0x40edf3
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x411
lea ecx, [ebp - 4]
mov byte [0x4a6f15], 1
call fcn.00433c42
push 0x822
push 0
push dword [ebp - 4]
call fcn.0047b210
mov edi, dword [ebp - 4]
add esp, 0xc
push 0x104
add edi, 0x410
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.PE_IDBASE
push 0x1000
mov esi, 0x4a6f08
push esi
call fcn.00435ee3
push str.WM_PE_BASE
push 0x5000
push esi
call fcn.00435ee3
push str.PE_MENU_IDBASE
push 0x100
push esi
call fcn.00435ee3
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x24
push edi
push 0x491252
call esi
push edi
mov ebx, 0x4a6f08
push str.MyName
mov ecx, ebx
call fcn.004335ed
push 0x5c
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edi, edi
cmp eax, edi
je 0x40eeba
lea edi, [eax + 2]
push edi
push 0x49123e
call esi
push edi
push str.MyName0
mov ecx, ebx
call fcn.004335ed
xor edi, edi
push edi
push edi
push 0x49093c
call fcn.0040ed63
push edi
push edi
push str.Favorites
call fcn.0040ed63
push edi
push edi
push str.Programs
call fcn.0040ed63
push edi
push edi
push str.SendTo
call fcn.0040ed63
push edi
push edi
push str.Personal
call fcn.0040ed63
push edi
push str.Start_Menu
push 0x490924
call fcn.0040ed63
add esp, 0x48
push edi
push str.Cache
push str.IECache
call fcn.0040ed63
push edi
push edi
push str.Startup
call fcn.0040ed63
push str.MicrosoftInternet_ExplorerQuick_Launch
push str.AppData
push str.QuickLaunch
call fcn.0040ed63
add esp, 0x24
lea ecx, [ebp - 4]
call fcn.0042eb98
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ef7b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14b8
call fcn.0047bd30
push esi
mov esi, 0x4a5294
and word [ebp - 0x14b8], 0
mov edx, dword [esi]
mov word [ebp - 0x64], 0x26
lea ecx, [ebp - 0x62]
movsx ax, byte [edx]
mov word [ecx], ax
inc ecx
inc ecx
inc edx
test ax, ax
jne 0x40efa1
push 0xa28
lea eax, [ebp - 0x14b8]
push eax
lea eax, [ebp - 0x62]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x14b8]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x4a6f08
call fcn.004335ed
add esi, 4
cmp esi, 0x4a52a8
jl 0x40ef8e
pop esi
leave
ret