joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101915c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x845
mov dword [0x101b41ac], 0
mov dword [0x101b41b0], 0
mov dword [0x101b41b8], 0
mov dword [0x101b41a4], 0x1160
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jne 0x1019172f
mov eax, dword [ebp - 0x20]
mov dword [0x101b41a4], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101b41ac], edx
mov ecx, dword [0x101b41a8]
add ecx, 0xffffe99f
mov dword [0x101b41a4], ecx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101b41b0], edx
mov dword [0x101b41a4], 0x1a83
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101b41b4], cl
mov dword [0x101b41a4], 0x2dcc
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101b41a8], 0x20ed
mov cl, byte [0x101b41b4]
mov edx, dword [0x101b41b0]
mov byte [edi + edx], cl
mov edx, dword [0x101b41a8]
mov ebx, edx
add ebx, 0xffffe24d
mov dword [0x101b41a4], ebx
mov ebx, dword [0x101b41ac]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x101b41b0]
movzx ecx, byte [edi + ecx]
add ecx, ebx
and ecx, 0xff
mov dword [0x101b41b8], ecx
add edx, 0xffffe20a
mov dword [0x101b41a4], edx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
mov dword [0x101b41a4], 0x14ee
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x3c], ebx
je 0x1019175f
jmp 0x10191743
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], eax
jmp 0x1019162c
mov eax, dword [0x101b41ac]
mov ecx, dword [0x101b41b0]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
jmp 0x1019162c
mov eax, 0xbd3
mov dword [ebp - 0x20], eax
jmp 0x1019161c
Function at 0x401153
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x401160
mov edx, 0x46b090
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop esi
test al, 1
je 0x401175
shr eax, 1
xor eax, 0xedb88320
jmp 0x401177
shr eax, 1
dec esi
jne 0x401168
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x400
jl 0x401163
pop esi
ret

Function at 0x4011e0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor esi, esi
push 0x20000000
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, esi
jne 0x401201
xor eax, eax
jmp 0x401234
push 0x34
push str.VRVWatchServer
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, esi
jne 0x40122b
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40122b
cmp dword [ebp - 0x18], 4
jne 0x40122b
push 1
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x4017dc
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
push edi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x128]
push eax
push edi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401857
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40184e
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0042ae70
pop ecx
test eax, eax
pop ecx
je 0x401848
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40180e
mov ebx, dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x401911
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x46c4b8], 0
je 0x401933
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x46c4b8]
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
mov ebx, eax
je 0x40198b
cmp ebx, 3
jbe 0x40198b
push 0x5c
add esi, 3
push esi
call fcn.0042a3d0
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x40198b
push 9
push str.System32
push esi
call fcn.0042a2b0
add esp, 0xc
test eax, eax
je 0x40197b
push 0x5c
inc esi
jmp 0x401954
push 9
push str.SysWOW64
push esi
call fcn.00429f70
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
leave
ret 8

Function at 0x401993
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.00429f40
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x54]
push esi
push ebx
push eax
call fcn.00429ee0
mov ax, word [ebp + 0xc]
push 0x10
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 1
call fcn.00429ee0
add esp, 0x18
lea eax, [ebp - 0x1054]
mov byte [ebp - 0x55], bl
push 0xfff
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1054]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401a2c
cmp dword [ebp + 0x10], ebx
je 0x401a1c
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop ebx
leave
ret
Function at 0x401a30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x401a63
add eax, 3
and al, 0xfc
call fcn.00429f40
mov ebx, esp
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x401a69
xor eax, eax
xor edx, edx
jmp 0x401a95
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x4628b4
push ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 4]
xor eax, eax
xor esi, esi
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
or eax, ecx
or edx, esi
lea esp, [ebp - 0x10]
pop esi
pop ebx
leave
ret

Function at 0x401c0a
Capabilities:
Get file size

Disassembly:
mov eax, 0x44c884
call fcn.00429dec
sub esp, 0x64
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocString
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401d06
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push str._d__.2d__.2d__.2d:_.2d:_.2d
push eax
call fcn.00429e8b
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [esi + 0x28], edi
call fcn.00429e10
add esp, 0x24
lea ecx, [esi + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004055e7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0xffffffffffffffff
mov dword [esi], eax
push dword [ebp + 8]
call fcn.00401e3b
push dword [ebp + 8]
mov dword [esi + 4], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00401d17
add esp, 0x10
push dword [0x45164c]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.00404c92
or dword [ebp - 4], 0xffffffff
push 1
pop esi
lea ecx, [ebp - 0x3c]
push esi
call fcn.00404e15
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x401d17
Capabilities:
Get file version info

Disassembly:
mov eax, 0x44c8af
call fcn.00429dec
sub esp, 0x38
mov al, byte [ebp + 0xb]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x2c], al
call fcn.00404e15
push 1
pop esi
push ebx
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x401d7a
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x2c]
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.00404e15
push dword [0x45164c]
lea eax, [ebp - 0x2c]
mov ecx, edi
push ebx
push eax
call fcn.00404c92
mov dword [ebp - 0x10], esi
jmp 0x401e1b
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00429f40
mov dword [ebp - 0x14], esp
push esp
push edi
push ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401df6
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4628b4
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
shr ecx, 0x10
push edx
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
lea eax, [ebp - 0x44]
push str._lu._lu._lu._lu
push eax
mov byte [ebp - 0x44], bl
call fcn.00429e8b
lea eax, [ebp - 0x44]
push eax
call fcn.00429e10
add esp, 0x1c
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004055e7
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x2c]
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.00404e15
push dword [0x45164c]
lea eax, [ebp - 0x2c]
mov ecx, edi
push ebx
push eax
call fcn.00404c92
mov dword [ebp - 0x10], esi
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00404e15
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x50]
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ecc
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44c8db
call fcn.00429dec
sub esp, 0x128
mov al, byte [ebp + 0xb]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x24], al
call fcn.00404e15
mov esi, 0x46c4e8
push esi
call fcn.00429e10
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.004055e7
push 1
xor eax, eax
pop esi
lea edi, [ebp - 0x133]
push 0x41
mov byte [ebp - 0x134], bl
pop ecx
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSet_servicesVRVWatchServer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x401f70
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x24]
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.00404e15
push dword [0x45164c]
lea eax, [ebp - 0x24]
mov ecx, edi
push ebx
push eax
call fcn.00404c92
mov dword [ebp - 0x14], esi
jmp 0x402004
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x104
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push str.ImagePath
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x401fd6
lea eax, [ebp - 0x134]
push 0x5c
push eax
call fcn.0042a6b0
pop ecx
cmp eax, ebx
pop ecx
je 0x401fb0
mov byte [eax + 1], bl
cmp byte [ebp - 0x134], 0x22
lea edi, [ebp - 0x134]
jne 0x401fc5
lea edi, [ebp - 0x133]
push edi
call fcn.00429e10
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004055e7
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x24]
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.00404e15
push dword [0x45164c]
lea eax, [ebp - 0x24]
mov ecx, edi
push ebx
push eax
call fcn.00404c92
mov dword [ebp - 0x14], esi
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00404e15
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x402021
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x44c90e
call fcn.00429dec
sub esp, 0x210
push esi
lea ecx, [ebp - 0x21c]
call fcn.0041a326
and dword [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x21c]
push dword [0x46c0a8]
call fcn.0041a446
lea ecx, [ebp - 0xf4]
call fcn.00416729
mov al, byte [ebp - 0xd]
push 0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
mov byte [ebp - 0x20], al
call fcn.00404e15
mov esi, str.Edpup.Xml
push esi
call fcn.00429e10
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.004055e7
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.0041849b
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00404e15
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0xf4]
push eax
call fcn.004169be
mov edx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xec]
mov dword [0x462194], edx
mov edx, dword [ebp - 0x34]
cmp eax, 1
mov dword [0x462190], ecx
mov dword [0x46c4d0], eax
mov dword [0x46c4cc], edx
je 0x402114
test eax, eax
je 0x402114
push 2
pop esi
cmp eax, esi
je 0x402117
cmp eax, 3
je 0x402117
cmp eax, 4
je 0x402117
mov dword [0x46c4d0], esi
jmp 0x402117
push 2
pop esi
cmp ecx, 1
je 0x402133
cmp ecx, esi
je 0x402133
push str.Get_Edpup.xml_file_release_mode_failture._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x462190], esi
jmp 0x402135
mov esi, ecx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00404e15
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.004168e8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0041a3c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x402281
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file

Disassembly:
mov eax, 0x44c920
call fcn.00429dec
sub esp, 0x10
mov eax, dword [0x4664dc]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 4], 0
call edi
mov dword [ebp - 0x18], eax
call edi
sub eax, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x46c0a4
cmp eax, 0x7530
ja 0x402348
push str.VRVEDP_M.exe
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00441112
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.00440e7d
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40233f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x10]
push str.ErrCode_lu
push eax
call fcn.0043f76e
push dword [ebp - 0x10]
call fcn.00402a24
add esp, 0x10
cmp dword [ebp - 0x14], 2
je 0x402348
cmp dword [ebp - 0x14], 3
je 0x402348
push 0x64
call ebx
call edi
sub eax, dword [ebp - 0x18]
cmp eax, 0x7530
jbe 0x4022c3
jmp 0x402348
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Vrvrm_c.lg
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00441112
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
lea ecx, [ebp - 0x1c]
call fcn.00440e7d
push str.EdpAlarm.lg
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00441112
push dword [eax]
call edi
lea ecx, [ebp - 0x1c]
call fcn.00440e7d
push str.Sleep_8000
call fcn.00402a24
mov dword [esp], 0x1f40
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00440e7d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4023b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
xor esi, esi
push 0x208
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00429ee0
add esp, 0xc
lea eax, [ebp - 0x25c]
push str.cmd.exe__c_sc_start__vrvwatchserver
push eax
call fcn.0042a6d7
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00429ee0
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], si
call fcn.00429ee0
add esp, 0x20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x25c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402441
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop esi
leave
ret
Function at 0x402444
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4024b0
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00429ee0
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], si
call fcn.00429ee0
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4024b0
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push 1
pop eax
jmp 0x4024b2
xor eax, eax
pop esi
leave
ret

Function at 0x4024e6
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x44c93f
call fcn.00429dec
sub esp, 0x98
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.StartUUSR__r_n
call esi
push 0x462c70
lea eax, [ebp - 0x10]
push 0x46c0a4
push eax
xor edi, edi
call fcn.00441112
push dword [ebp - 0x10]
and dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x402562
push str.StartUUSR
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40255b
push edi
push edi
push 0xffff0001
call eax
test eax, eax
jl 0x40254f
push 1
pop edi
jmp 0x4025df
push str.UUSR_Start
call esi
jmp 0x4025df
push 0x462c20
jmp 0x402554
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.0040434f
push 0x4622d0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa4]
push 0x462bf4
push eax
call fcn.004064a0
pop ecx
pop ecx
mov ecx, eax
call fcn.00404173
push eax
call fcn.004064a0
pop ecx
lea eax, [ebp - 0x20]
pop ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.00404577
mov eax, dword [eax + 4]
test eax, eax
jne 0x4025be
mov eax, 0x451648
push eax
call esi
push 1
lea ecx, [ebp - 0x20]
call fcn.00404e15
push dword [ebp - 0x10]
call esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.004017c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00440e7d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4025fb
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x44c95f
call fcn.00429dec
sub esp, 0x98
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.StopUUSR__r_n
call esi
push 0x462c70
lea eax, [ebp - 0x10]
push 0x46c0a4
push eax
xor edi, edi
call fcn.00441112
push dword [ebp - 0x10]
and dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x402675
push str.StopUUSR
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40266e
push 0xffff0001
call eax
test eax, eax
jl 0x402662
push 1
pop edi
jmp 0x4026f2
push str.UUSR_Stop
call esi
jmp 0x4026f2
push 0x462c94
jmp 0x402667
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.0040434f
push 0x4622d0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa4]
push 0x462bf4
push eax
call fcn.004064a0
pop ecx
pop ecx
mov ecx, eax
call fcn.00404173
push eax
call fcn.004064a0
pop ecx
lea eax, [ebp - 0x20]
pop ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.00404577
mov eax, dword [eax + 4]
test eax, eax
jne 0x4026d1
mov eax, 0x451648
push eax
call esi
push 1
lea ecx, [ebp - 0x20]
call fcn.00404e15
push dword [ebp - 0x10]
call esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.004017c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00440e7d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402a67
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0x10], eax
jbe 0x402a96
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ebp + 8]
movzx ecx, byte [eax + ecx]
xor ecx, edx
mov edx, dword [ebp + 8]
shr edx, 8
mov ecx, dword [ecx*4 + 0x46c0ac]
xor ecx, edx
inc eax
cmp eax, dword [ebp + 0x10]
mov dword [ebp + 8], ecx
jb 0x402a71
mov eax, dword [ebp + 8]
pop ebp
ret

Function at 0x402a9b
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0xc], ecx
not eax
jbe 0x402acb
push esi
mov edx, dword [esp + 0xc]
movzx esi, al
movzx edx, byte [ecx + edx]
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x46c0ac]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x402aaa
pop esi
not eax
ret
Function at 0x402b43
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00429f40
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push 0x462aa4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042a53a
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x402ba1
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0x1000
push eax
push esi
mov dword [ebp - 8], 1
call fcn.00402ace
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
mov dword [ebp + 8], edi
jg 0x402ba8
push esi
call fcn.0042a48c
pop ecx
xor eax, eax
jmp 0x402c86
push ebx
push ebx
push esi
call fcn.0042a9e9
add esp, 0xc
test byte [esi + 0xc], 0x10
jne 0x402c74
jmp 0x402bc2
mov edi, dword [ebp + 8]
cmp edi, ebx
jle 0x402c74
cmp edi, 0x1000
jge 0x402bd5
mov dword [ebp - 0xc], edi
push esi
lea eax, [ebp - 0x1018]
push dword [ebp - 0xc]
push 1
push eax
call fcn.0042a593
add esp, 0x10
cmp dword [ebp - 8], ebx
mov edi, eax
je 0x402c51
cmp edi, 0x138
mov dword [ebp - 8], ebx
jb 0x402c51
cmp word [ebp - 0x1018], 0x5a4d
jne 0x402ba1
mov eax, dword [ebp - 0xfdc]
mov word [ebp - 0x1006], bx
cmp dword [ebp + eax - 0x1018], 0x4550
lea eax, [ebp + eax - 0x1018]
jne 0x402ba1
mov cx, word [eax + 0x18]
cmp cx, 0x10b
je 0x402c42
cmp cx, 0x20b
jne 0x402ba1
mov dword [eax + 0x58], ebx
mov dword [eax + 0x9c], ebx
mov dword [eax + 0x98], ebx
lea eax, [ebp - 0x1018]
push edi
push eax
push dword [ebp - 4]
call fcn.00402a67
sub dword [ebp + 8], edi
add esp, 0xc
test byte [esi + 0xc], 0x10
mov dword [ebp - 4], eax
je 0x402bbf
push esi
call fcn.0042a48c
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
sete al
pop edi
pop esi
pop ebx
leave
ret