joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov eax, dword [edi]
cmp eax, 0x270
jne 0x403903
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x4038c3
mov eax, dword [edi]
jmp 0x4039e5
cmp eax, 0x4e0
jb 0x4039e5
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x403920
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x403970
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x4038b0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x7656db98
sub eax, 0x7616bf32
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8016839c
add dword [ebp - 0x50], 0xce3bc1af
mov dword [ebp - 0x4c], 0x2efac6f
add dword [ebp - 0x4c], 0x2f439fd6
mov dword [ebp - 0x48], 0x98cf5da3
add dword [ebp - 0x48], 0xb37ce68b
mov dword [ebp - 0x44], 0x5a890f3
add dword [ebp - 0x44], 0xfa576f0d
lea eax, [ebp - 0x50]
push eax
mov eax, 0xc5bb5813
sub eax, 0xc57b27bf
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xedeb1777
add dword [ebp - 0x50], 0x868751df
mov dword [ebp - 0x4c], 0x4bb90885
sub dword [ebp - 0x4c], 0xa4ca710
mov dword [ebp - 0x48], 0xb04bfe6
add dword [ebp - 0x48], 0x586aac86
mov dword [ebp - 0x44], 0x26175137
add dword [ebp - 0x44], 0xd9e8aec9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xc7c2e3a8
add eax, 0x387d4c84
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36b4e
push 0
call eax
mov ecx, 0x5e6c56e7
add ecx, 0xa193f200
xor edx, edx
add edx, eax
mov edi, 0xd00c3d3f
add edi, 0x303432c1
add edi, dword [ebp - 0x40]
mov esi, 0xfbb0c3a4
xor dword [ebp - 0x24], 0x3dc42dd3
mov ebx, dword [edi]
mov dword [ebp - 0x20], 0xa4bb7e41
add ebx, esi
sub dword [ebp - 0x1c], ebx
mov dword [edx], ebx
sub dword [ebp - 0xc], edx
add edx, 0x2afc3f93
add edx, 0xd503c071
add edi, 0x684c1da3
sub edi, 0x684c1d9f
loop 0x401d84
add eax, 0xa0a9727c
add eax, 0x5f57a3f3
mov ebx, eax
add eax, 0x6afe8214
add eax, 0x95017df1
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x41e470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41e492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e488
mov eax, 1
add ebx, ebx
jne 0x41e4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e4a0
jne 0x41e4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e4a0
xor ecx, ecx
sub eax, 3
jb 0x41e4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e542
mov ebp, eax
add ebx, ebx
jne 0x41e4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e50c
inc ecx
add ebx, ebx
jne 0x41e4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e4ed
jne 0x41e509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e51d
jmp 0x41e48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e52c
add edi, ecx
jmp 0x41e48e
pop esi
mov edi, esi
mov ecx, 0x355
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e54a
cmp byte [edi], 7
jne 0x41e54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e54f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e7f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e8e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e57c
mov ecx, edi
jns 0x41e5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e8e4]
or eax, eax
je 0x41e5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x41e599
call dword [esi + 0x1e8f4]
mov ebp, dword [esi + 0x1e8e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e5fb
sub esp, 0xffffff80
jmp 0x407b99
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf
Function at 0x258010a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x258010b6
pop dword [ebp - 0x24]
mov eax, 0x258010b6
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x74e2b9dc
add dword [ebp - 0x34], 0xd96f8b6f
mov dword [ebp - 0x30], 0x254e26f9
sub dword [ebp - 0x30], 0xf31adab4
mov dword [ebp - 0x2c], 0x6366ce56
add dword [ebp - 0x2c], 0xe8e575d8
mov dword [ebp - 0x28], 0x872e4ba6
sub dword [ebp - 0x28], 0x872e4ba6
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa40140b1
add dword [ebp - 0x34], 0xd07128a5
mov dword [ebp - 0x30], 0x2f5c60fc
add dword [ebp - 0x30], 0x12100079
mov dword [ebp - 0x2c], 0x7e8bc518
add dword [ebp - 0x2c], 0xe4e3a754
mov dword [ebp - 0x28], 0xbbf10361
sub dword [ebp - 0x28], 0xbbf10361
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1a9de833
sub eax, 0xf51c17b3
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3db43
push 0
call eax
mov ecx, 0x56b02c21
sub ecx, 0x56afdf91
mov edi, eax
mov ebx, 0x25829600
add ebx, dword [ebp - 0x24]
mov esi, 0x62f06d5
add esi, 0x6bbffb4f
sub dword [ebp - 0x14], 0x76745e47
mov edx, dword [ebx]
xor dword [ebp - 0x20], edx
sub edx, esi
add dword [ebp - 0x20], edx
mov dword [edi], edx
add dword [ebp - 0x1c], 0xd0477e5a
add edi, 0xe7a50412
add edi, 0x185afbf2
add ebx, 4
loop 0x258011c8
add eax, 0xc7b1fb3f
sub eax, 0xc7b0d62c
mov ebx, eax
add eax, 0x4918f274
add eax, 0xb6e70d91
mov ecx, 0x68e3ba72
sub ecx, 0x4363ba72
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40596d
pop dword [ebp - 0x3c]
mov eax, 0xb6a87377
add eax, 0x4997e5f6
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xefcbadfb
add dword [ebp - 0x4c], 0x5e869750
mov dword [ebp - 0x48], 0x33690cee
sub dword [ebp - 0x48], 0x135c0a9
mov dword [ebp - 0x44], 0x7ee1d852
sub dword [ebp - 0x44], 0x32959424
mov dword [ebp - 0x40], 0x7f06a0c7
add dword [ebp - 0x40], 0x80f95f39
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x56e3e336
add eax, 0xa95c8d2a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x65c14699
sub dword [ebp - 0x4c], 0xf14edd43
mov dword [ebp - 0x48], 0x4da97b95
add dword [ebp - 0x48], 0xf3c2e5e0
mov dword [ebp - 0x44], 0xcfe0fe5e
add dword [ebp - 0x44], 0x938e6e0e
mov dword [ebp - 0x40], 0xfc4a6c3a
sub dword [ebp - 0x40], 0xfc4a6c3a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xcef94378
add eax, 0x31472d88
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x392ab
push 0
call eax
mov ecx, 0x2f407794
add ecx, 0xd0bfda39
mov esi, eax
mov edx, 0x34953a2a
sub edx, 0x34543a2a
add edx, dword [ebp - 0x3c]
mov edi, 0x98242cf4
sub edi, 0x470da945
xor dword [ebp - 0x2c], 0x9431f2d7
mov ebx, dword [edx]
add dword [ebp - 8], esi
add ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x18], eax
add esi, 0x4fb423c9
sub esi, 0x4fb423c5
add edx, 0x36b39466
sub edx, 0x36b39462
loop 0x405a8f
add eax, 0x3b73c6c
sub eax, 0x3b60265
mov ebx, eax
add eax, 0x79640ae1
add eax, 0x869bf524
mov ecx, 0xf4cf99fe
sub ecx, 0xf48f99fe
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813004]
jne 0x401010
repz ret
jmp fcn.00401494

Function at 0x4082e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058d1
and dword [ebp - 4], 0
cmp dword [0x815798], 0
mov ebx, eax
jne 0x408396
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408447
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408447
push eax
call fcn.0040585f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x815798], eax
call esi
push eax
call fcn.0040585f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81579c], eax
call esi
push eax
call fcn.0040585f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x8157a0], eax
call esi
push eax
call fcn.0040585f
pop ecx
mov dword [0x8157a8], eax
test eax, eax
je 0x408396
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040585f
pop ecx
mov dword [0x8157a4], eax
mov eax, dword [0x8157a4]
cmp eax, ebx
je 0x4083ee
cmp dword [0x8157a8], ebx
je 0x4083ee
push eax
call fcn.004058da
push dword [0x8157a8]
mov esi, eax
call fcn.004058da
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083ee
test edi, edi
je 0x4083ee
call esi
test eax, eax
je 0x4083e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083e5
test byte [ebp - 0xc], 1
jne 0x4083ee
or dword [ebp + 0x10], 0x200000
jmp 0x408427
mov eax, dword [0x81579c]
cmp eax, ebx
je 0x408427
push eax
call fcn.004058da
pop ecx
test eax, eax
je 0x408427
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408427
mov eax, dword [0x8157a0]
cmp eax, ebx
je 0x408427
push eax
call fcn.004058da
pop ecx
test eax, eax
je 0x408427
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x815798]
call fcn.004058da
pop ecx
test eax, eax
je 0x408447
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408449
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4015a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4015b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4015cd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4015ee
cmp esi, eax
jae 0x4015c7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4015e0
cmp esi, eax
jae 0x4015c7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x402480
Capabilities:
Start service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov esi, ecx
call ebp
mov eax, dword [esi + 0xdc]
push 0
push 5
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf01ff
mov ebx, eax
push str.Spooler
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4024e6
mov ecx, esi
call fcn.00401dd0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4024fc
mov ecx, esi
call fcn.00401dd0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
push 0
call ebp
push str.Uninstall_succeeds.
push esi
call fcn.00401d10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x402530
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 1
lea ecx, [esi + 0xc0]
call fcn.0041fbdd
push 1
lea ecx, [esi + 0x70]
call fcn.0041fbdd
mov eax, dword [esi + 0xdc]
push 0x640000
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetControlPrintMonitors
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x4025ac
mov edx, dword [esp + 0x10]
push str.pdfinst
push edx
mov edi, 1
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlPrintEnvironmentsWindows_NT_x86DriversVersion_3
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4025e4
mov edx, dword [esp + 0x10]
push str.Easy_PDF_Creator
push edx
mov edi, 1
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.SoftwarePDFDesk
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x402624
mov edx, dword [esp + 0x10]
push str.pdf4u
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00402480
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
je 0x40262f
mov ecx, esi
call fcn.00402480
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402640
Capabilities:
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
push esi
push edi
mov esi, ecx
push 1
lea ecx, [esi + 0xc0]
call fcn.0041fbdd
lea edi, [esi + 0x70]
push 1
mov ecx, edi
call fcn.0041fbdd
mov eax, dword [esi + 0xdc]
push 0x640000
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push str.Installing_virtual_printer...
mov ecx, edi
call fcn.0041fb27
mov ecx, esi
call fcn.00401e40
test eax, eax
jne 0x4026e8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov ecx, esi
call fcn.00402530
push 0x1f4
call edi
mov ecx, esi
call fcn.00401e40
test eax, eax
jne 0x4026e8
push 0x64
call edi
mov ecx, esi
call fcn.00402530
push 0x3e8
call edi
mov ecx, esi
call fcn.00401e40
test eax, eax
jne 0x4026e8
push 0x64
call edi
mov ecx, esi
call fcn.00402530
push 0x3e8
call edi
pop edi
mov ecx, esi
pop esi
jmp fcn.00401e40
pop edi
pop esi
ret
Function at 0x40c4df
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42ce10
call fcn.0040dfd8
mov edi, 0x94
mov eax, edi
call fcn.0040d9d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x438ff4], ecx
mov eax, dword [esi + 4]
mov dword [0x439000], eax
mov edx, dword [esi + 8]
mov dword [0x439004], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x438ff8], esi
cmp ecx, 2
je 0x40c53f
or esi, 0x8000
mov dword [0x438ff8], esi
shl eax, 8
add eax, edx
mov dword [0x438ffc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40c57a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c57a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40c592
cmp eax, 0x20b
je 0x40c57f
mov dword [ebp - 0x1c], esi
jmp 0x40c5a6
cmp dword [ecx + 0x84], 0xe
jbe 0x40c57a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40c5a0
cmp dword [ecx + 0x74], 0xe
jbe 0x40c57a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040fa11
pop ecx
test eax, eax
jne 0x40c5ba
push 0x1c
call fcn.0040c4bb
pop ecx
call fcn.0040f908
test eax, eax
jne 0x40c5cb
push 0x10
call fcn.0040c4bb
pop ecx
call fcn.0040f6a2
mov dword [ebp - 4], esi
call fcn.0040f4a4
test eax, eax
jge 0x40c5e4
push 0x1b
call fcn.0040c496
pop ecx
call fcn.0040f405
mov dword [0x43a9d0], eax
call fcn.0040f29b
mov dword [0x438fe8], eax
call fcn.0040f205
test eax, eax
jge 0x40c609
push 8
call fcn.0040c496
pop ecx
call fcn.0040efd2
test eax, eax
jge 0x40c61a
push 9
call fcn.0040c496
pop ecx
push 1
call fcn.0040cbd8
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40c630
push eax
call fcn.0040c496
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.0040ef8c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40c651
movzx eax, word [ebp - 0x40]
jmp 0x40c654
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041a4e0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40c672
push edi
call fcn.0040cd05
call fcn.0040cd27
jmp 0x40c6a4
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040e013
ret