joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40288e
pop dword [ebp - 8]
mov eax, 0x7cb931a1
add eax, 0x8386f6ed
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5de5b6bf
sub dword [ebp - 0x18], 0xf937174
mov dword [ebp - 0x14], 0x82ee90e8
sub dword [ebp - 0x14], 0x50bb44a3
mov dword [ebp - 0x10], 0x912707d2
add dword [ebp - 0x10], 0xbb253c5c
mov dword [ebp - 0xc], 0xa588cd44
sub dword [ebp - 0xc], 0xa588cd44
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb6b51cdc
sub dword [ebp - 0x18], 0x4242b386
mov dword [ebp - 0x14], 0xe49a7bc8
sub dword [ebp - 0x14], 0xa32e1a53
mov dword [ebp - 0x10], 0x408f7194
sub dword [ebp - 0x10], 0xdd200528
mov dword [ebp - 0xc], 0xb924c768
add dword [ebp - 0xc], 0x46db3898
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35516
push 0
call eax
mov ecx, 0x42e3
xor edx, edx
add edx, eax
mov ebx, 0x1575dc00
sub ebx, 0x1534dc00
add ebx, dword [ebp - 8]
mov edi, 0x85903c7e
add edi, 0x46c693b4
mov esi, dword [ebx]
add esi, edi
add dword [ebp - 4], 0xb4c3aaa
mov dword [edx], esi
xor dword [ebp - 4], 0x1f431790
add edx, 0x9b9a7b5a
add edx, 0x646584aa
add ebx, 0x1902f38f
sub ebx, 0x1902f38b
loop 0x4029a2
add eax, 0xe5a3189e
add eax, 0x1a5de5c1
xor ebx, ebx
add ebx, eax
add eax, 0x80430731
add eax, 0x7fbcf8d4
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40f898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40f8a7
pop dword [ebp - 0x44]
mov eax, 0x5a8926d3
sub eax, 0x5a482e2c
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x442a8
push 0
mov eax, 0x78698ef7
sub eax, 0x78273cdf
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x6d06a395
add ecx, 0x92f9bdbb
xor edx, edx
add edx, eax
mov edi, 0x435400
add edi, dword [ebp - 0x44]
mov esi, 0x105de2e5
sub dword [ebp - 0x14], ecx
mov ebx, dword [edi]
xor dword [ebp - 0x40], ecx
sub ebx, esi
sub dword [ebp - 4], 0x57cd3c9c
mov dword [edx], ebx
xor dword [ebp - 8], 0x3bb22b8b
add edx, 0x96daed56
sub edx, 0x96daed52
add edi, 0xe590e35e
sub edi, 0xe590e35a
loop 0x40f8fc
add eax, 0xae33e6c2
add eax, 0x51cd9151
mov ebx, eax
add eax, 0x493d2584
sub eax, 0x493d257f
mov ecx, 0x6e837635
add ecx, 0x91bc89cb
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x407b68
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420440]
jne 0x407b72
repz ret
jmp fcn.004099a6

Function at 0x4088cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405f13
and dword [ebp - 0x14], 0
cmp dword [0x4225bc], 0
mov dword [ebp - 0x18], eax
jne 0x40897e
push 0x4022c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408a26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022b8
push ebx
call edi
test eax, eax
je 0x408a26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4022a8
push ebx
mov dword [0x4225bc], eax
call edi
push eax
call esi
push 0x402294
push ebx
mov dword [0x4225c0], eax
call edi
push eax
call esi
push 0x402278
push ebx
mov dword [0x4225c4], eax
call edi
push eax
call esi
mov dword [0x4225cc], eax
test eax, eax
je 0x40897e
push 0x402260
push ebx
call edi
push eax
call esi
mov dword [0x4225c8], eax
mov eax, dword [0x4225c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4089d7
cmp dword [0x4225cc], ecx
je 0x4089d7
push eax
call esi
push dword [0x4225cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4089d7
test ebx, ebx
je 0x4089d7
call edi
test eax, eax
je 0x4089ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4089ce
test byte [ebp - 8], 1
jne 0x4089d7
or dword [ebp + 0x10], 0x200000
jmp 0x408a0a
mov eax, dword [0x4225c0]
cmp eax, dword [ebp - 0x18]
je 0x408a0a
push eax
call esi
test eax, eax
je 0x408a0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408a0a
mov eax, dword [0x4225c4]
cmp eax, dword [ebp - 0x18]
je 0x408a0a
push eax
call esi
test eax, eax
je 0x408a0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4225bc]
call esi
test eax, eax
je 0x408a26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408a28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b68
leave
ret
Function at 0x41c090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7a6648], ax
mov word [0x7a664c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7a6648
mov dword [0x7a6654], 0x320033
mov dword [0x7a665c], 0x6c006c
mov word [0x7a664e], cx
mov dword [0x7a6650], 0x6c0065
mov dword [0x7a6658], 0x64002e
mov word [0x7a664a], dx
mov word [0x7a6660], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7a6644]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7a6640], eax
mov eax, dword [0x427694]
push edx
push eax
mov byte [0x42290b], 0x65
mov dword [0x422901], 0x75747269
mov word [0x422905], 0x6c61
mov byte [0x422900], 0x56
mov word [0x42290c], 0x7463
mov byte [0x42290e], 0
mov dword [0x422907], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x41c180
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.00409120
cmp dword [0x7a6644], 0x37
jne 0x41c24c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x402c2c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x402c48
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x402c5c
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402c7c
push 0x402c98
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x402cd4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x402cf0
push 0x402d10
push 0x402d2c
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7a7638]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x427694]
mov byte [ecx + esi], al
add esp, 0x1050
ret
Function at 0x41c410
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7a6644]
sub esp, 0x48c
push ebx
push ebp
push esi
mov esi, dword [0x427694]
shr eax, 3
push edi
test eax, eax
je 0x41c5e0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x41c444
mov esi, dword [esp + 0x14]
cmp dword [0x7a6644], 0x1c
jne 0x41c461
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x420dc0]
mov eax, dword [0x420dc4]
mov ecx, dword [0x420dc8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x20], edx
mov edx, dword [0x420dcc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x24]
mov esi, ebx
shr esi, 5
cmp dword [0x7a6644], 0x1b
mov dword [esp + 0x10], eax
jne 0x41c4dd
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x9c]
push ecx
push 0
push 0x402b00
push 0x402b6c
push 0x402ba0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x28]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0x7a65b4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x7a6644], 0x1be
jne 0x41c522
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x7a6644], 0x979
mov dword [0x7a65b8], 0xff6b3619
mov dword [0x7a65bc], 0xffffffff
jne 0x41c55f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x41c49a
cmp dword [0x7a6644], 0x8d4
jne 0x41c597
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0x7a6644], 0x17
jne 0x41c5cf
push 0
push 0
push 0
push 0x402bec
push 0x402c20
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x41c440
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
Function at 0x8f7370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x8f738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x920074
push ecx
mov edi, eax
call fcn.0090b198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8f73cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0090b02e
push esi
call fcn.0090afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x8fa850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8fa8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x925720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8fa8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0090b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8fa8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x925720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8fa92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0090c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x8fa957
mov word [eax], si
add eax, 2
push eax
call fcn.0090c030
add esp, 4
jmp 0x8fa959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8fa8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8fa8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x8faff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x8fb080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x8fb0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x920458
push ecx
call fcn.0090b1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0090b1e1
add esp, 0x10
jmp 0x8fb0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0090b20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0090adff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.008fb050
mov eax, dword [0x925728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x8fb13b
push esi
call fcn.008fafb0
add esp, 4
mov dword [0x925728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x8fb14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.008faff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x8fe440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x8fe4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x8fe48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x8fe471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x8fe47e
add edx, ecx
cmp ebx, edx
jb 0x8fe48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x8fe467
xor ecx, ecx
jmp 0x8fe4a2
test eax, eax
jne 0x8fe492
xor ecx, ecx
jmp 0x8fe4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.008fe3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x8fe8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x8fe921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x8fe946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x8fe96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x8fe993
push ecx
push esi
call fcn.008fe4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x8ffc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x8ffc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x8ffc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x8ffc38
add edx, eax
cmp ebx, edx
jb 0x8ffc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x8ffc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x8ffc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x8ffc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x8ffcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x8ffc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x8ffca8
add edx, ecx
cmp ebx, edx
jb 0x8ffcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x8ffc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x8fff60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0090c145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x8ffffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x8fffdd
lea eax, [esp + 0x18]
push eax
jmp 0x8fffe2
push 0x925720
call fcn.0090bfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x8fffb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x8fff40
push 4
push ecx
push eax
call fcn.0090c43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x900310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0090c145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x9003ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x90038d
lea eax, [esp + 0x18]
push eax
jmp 0x900392
push 0x925720
call fcn.0090bfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x900360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x8fff40
push 4
push ecx
push eax
call fcn.0090c43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x901f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x901fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x901fcf
push ebx
push edi
push 0x925770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x901fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x925770
push esi
call ebx
test eax, eax
je 0x901fae
mov ebp, 3
cmp dword [0x925774], ebp
jne 0x901faa
push 0x3e8
call edi
push 0x925770
push esi
call ebx
test eax, eax
jne 0x901f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x901fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x901fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0x905e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x91b8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x905ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.009027a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x905e61
mov edx, dword [eax]
jmp 0x905e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00904050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x905ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x905ebf
cmp esi, edi
je 0x905ebf
mov ecx, esi
call fcn.008fda00
push esi
call fcn.0090b1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00902990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x905ef5
mov eax, dword [eax]
jmp 0x905ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00901640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x905f25
mov eax, dword [eax]
jmp 0x905f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x905f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x905f76
cmp esi, edi
je 0x905f76
mov eax, dword [esi]
cmp eax, edi
je 0x905f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x905f6d
push eax
call fcn.0090b1c8
add esp, 4
push esi
call fcn.0090b1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret