joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402640
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
xor eax, eax
test esi, esi
je 0x4027ad
mov byte [esi], al
mov eax, dword [esp + 0x114]
test eax, eax
je 0x40266b
mov dword [eax], 0
push ebx
push edi
push str.QuickTime.qts
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov ebx, dword [esp + 0x118]
je 0x4026cf
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x4026cf
lea eax, [esp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026a0
sub eax, edx
lea edi, [eax - 0xd]
test edi, edi
jbe 0x4026cf
lea edx, [edi + 1]
cmp ebx, edx
jbe 0x4026cf
push edi
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00425700
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x402758
cmp byte [esi], 0
jne 0x40275d
push ebx
push esi
push str.QTSysDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402590
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x402701
push 0
push esi
call fcn.004256b8
add esp, 8
test eax, eax
je 0x402704
mov byte [esi], 0
cmp byte [esi], 0
jne 0x40275d
push ebx
push esi
push str.QuickTime.qts_folder
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402590
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x402732
push 0
push esi
call fcn.004256b8
add esp, 8
test eax, eax
je 0x402735
mov byte [esi], 0
cmp byte [esi], 0
jne 0x40275d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x402755
push 0
push esi
call fcn.004256b8
add esp, 8
test eax, eax
je 0x402758
mov byte [esi], 0
cmp byte [esi], 0
je 0x4027a2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402762
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x4027a2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402777
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x4027a2
mov edi, esi
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402790
mov cx, word [0x4356d4]
mov word [edi], cx
mov cl, byte [esi]
xor eax, eax
test cl, cl
pop edi
setne al
pop ebx
pop esi
add esp, 0x104
ret
Function at 0x4027f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x218]
push esi
push ebp
push str.QTExtDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402590
mov al, byte [ebp]
add esp, 0x10
test al, al
jne 0x40292c
add esi, 0xfffffff6
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push esi
push ecx
call fcn.00402640
mov al, byte [esp + 0x118]
add esp, 0xc
test al, al
je 0x40292c
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402860
sub eax, edx
cmp byte [esp + eax + 7], 0x5c
push edi
je 0x4028a2
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402878
sub eax, edx
cmp byte [esp + eax + 0xb], 0x2f
je 0x4028a2
lea edi, [esp + 0xc]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402890
mov dx, word [0x4356d4]
mov word [edi], dx
lea eax, [esp + 0x110]
mov edx, ebp
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4028b0
lea esi, [esp + 0x110]
lea eax, [esp + 0xc]
push ebx
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4028ee
test cl, cl
je 0x4028ea
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4028ee
add eax, 2
add esi, 2
test cl, cl
jne 0x4028c6
xor eax, eax
jmp 0x4028f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x40292b
mov edi, ebp
dec edi
jmp 0x402900
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402900
mov eax, dword [str.QuickTime_]
mov dword [edi], eax
mov ecx, dword [0x435738]
mov dword [edi + 4], ecx
mov dx, word [0x43573c]
mov word [edi + 8], dx
mov al, byte [0x43573e]
mov byte [edi + 0xa], al
pop edi
mov eax, ebp
pop esi
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402933
sub eax, edx
add esp, 0x208
ret
Function at 0x407b00
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x407b13
mov dword [ebx], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407b21
mov dword [eax], 0
lea eax, [esp + 0xc]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x407b87
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x407b7f
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4356d4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407b7f
test ebx, ebx
mov ecx, dword [esp + 0xc]
je 0x407b72
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x407b7f
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x425357
Capabilities:
Terminate process

Disassembly:
push 8
push 0x435ab0
call fcn.00427d04
push 8
call fcn.00428539
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x43a078], esi
jne 0x42538b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x43a074], esi
mov al, byte [ebp + 0x10]
mov byte [0x43a070], al
cmp dword [ebp + 0xc], edi
jne 0x4253d5
cmp dword [0x43a874], edi
je 0x4253c5
mov eax, dword [0x43a870]
sub eax, 4
mov dword [0x43a870], eax
cmp eax, dword [0x43a874]
jb 0x4253c5
mov eax, dword [eax]
cmp eax, edi
je 0x4253a6
call eax
jmp 0x4253a6
push 0x43902c
mov eax, 0x439024
call fcn.004252b7
pop ecx
push 0x439038
mov eax, 0x439030
call fcn.004252b7
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.00425406
cmp dword [ebp + 0x10], edi
jne 0x425414
mov dword [0x43a078], esi
push dword [ebp + 8]
call fcn.00425275
xor edi, edi
xor esi, esi
inc esi
call fcn.00427d3f
ret

Function at 0x4256b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4256d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00428a56
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4256fb
test byte [esp + 8], 2
je 0x4256fb
call fcn.00428a44
mov dword [eax], 0xd
call fcn.00428a4d
mov dword [eax], 5
jmp 0x4256d4
xor eax, eax
ret
Function at 0x425ed1
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x435ad0
call fcn.00427d04
mov edi, 0x94
mov eax, edi
call fcn.004254d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x43a038], ecx
mov eax, dword [esi + 4]
mov dword [0x43a044], eax
mov edx, dword [esi + 8]
mov dword [0x43a048], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x43a03c], esi
cmp ecx, 2
je 0x425f31
or esi, 0x8000
mov dword [0x43a03c], esi
shl eax, 8
add eax, edx
mov dword [0x43a040], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x425f6c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425f6c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x425f84
cmp eax, 0x20b
je 0x425f71
mov dword [ebp - 0x1c], esi
jmp 0x425f98
cmp dword [ecx + 0x84], 0xe
jbe 0x425f6c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x425f92
cmp dword [ecx + 0x74], 0xe
jbe 0x425f6c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0042ae8f
pop ecx
test eax, eax
jne 0x425fac
push 0x1c
call fcn.00425e57
pop ecx
call fcn.004272f7
test eax, eax
jne 0x425fbd
push 0x10
call fcn.00425e57
pop ecx
call fcn.0042865c
mov dword [ebp - 4], esi
call fcn.00427e59
test eax, eax
jge 0x425fd6
push 0x1b
call fcn.00425e32
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43a868], eax
call fcn.0042ad53
mov dword [0x43a07c], eax
call fcn.0042acb1
test eax, eax
jge 0x425ffc
push 8
call fcn.00425e32
pop ecx
call fcn.0042aa7e
test eax, eax
jge 0x42600d
push 9
call fcn.00425e32
pop ecx
push 1
call fcn.004252ed
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x426023
push eax
call fcn.00425e32
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0042aa21
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x426044
movzx eax, word [ebp - 0x40]
jmp 0x426047
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00402440
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x426065
push edi
call fcn.0042541a
call fcn.0042543c
jmp 0x426097
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00427d3f
ret
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and dword [ebp - 8], 0
test eax, eax
je 0x401185
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [0x41004c]
push edi
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edi, str.path
push edi
push eax
mov dword [ebp - 4], 0x208
call esi
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xc], ecx
jne 0x401182
test eax, eax
jne 0x40111d
and word [ebx + 0x206], ax
mov dword [ebp - 8], ecx
jmp 0x401182
mov eax, dword [ebp - 4]
add eax, 2
push eax
call dword [0x410344]
mov ebx, eax
test ebx, ebx
pop ecx
je 0x401182
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push edi
push dword [eax + 4]
call esi
test eax, eax
jne 0x40117a
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
push 0x103
push ebx
shr eax, 1
and word [ebx + eax*2], 0
push 0x104
push esi
call dword [0x410340]
add esp, 0x10
and word [esi + 0x206], 0
mov dword [ebp - 8], 1
push ebx
call dword [0x41033c]
pop ecx
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x4026bf
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 5
jne 0x402736
and dword [ebp + 8], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, str.LogonTime
push edi
mov esi, str.SystemCurrentControlSetServiceskxesapp_timerecord
push esi
push 0x80000002
call dword [0x41036c]
lea eax, [ebp - 8]
push eax
call dword [0x4100cc]
test eax, eax
je 0x402734
lea eax, [ebp - 0x10]
push eax
call dword [0x4100c8]
test eax, eax
je 0x402734
fild qword [ebp - 8]
fild qword [ebp - 0x10]
fdivp st(1)
call fcn.0040e5b0
push 4
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push edi
push esi
call dword [0x410370]
pop edi
pop esi
xor eax, eax
leave
ret

Function at 0x402a1d
Capabilities:
Delete registry key

Disassembly:
push ecx
call fcn.0040264a
test eax, eax
je 0x402a9e
push ebx
push ebp
mov ebp, dword [0x410054]
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0xf003f
push 1
push ebx
push ebx
mov edi, str.SystemCurrentControlSetServiceskxesapp_timerecord
push edi
mov esi, 0x80000002
push esi
call ebp
cmp eax, ebx
je 0x402a75
push edi
push esi
call dword [0x410048]
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0xf003f
push 1
push ebx
push ebx
push edi
push esi
call ebp
cmp eax, ebx
jne 0x402a9a
push dword [esp + 0x10]
call dword [section..rdata]
push ebx
push ebx
push ebx
push 0x40296b
push ebx
push ebx
call dword [0x4100c0]
cmp eax, ebx
je 0x402a9a
push eax
call dword [0x4100dc]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40345e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [eax + 0x34], esi
jne 0x403473
mov eax, 0x8200000b
jmp 0x4034e4
cmp dword [eax + 0x38], 8
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x208
mov dword [ebp - 4], esi
jb 0x40348f
mov eax, dword [eax + 0x24]
jmp 0x403492
add eax, 0x24
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push eax
push 0x80000002
call dword [0x410044]
cmp eax, esi
jne 0x4034e4
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [0x41004c]
push dword [ebp - 4]
mov edi, eax
call dword [section..rdata]
cmp edi, esi
je 0x4034d6
mov eax, edi
jmp 0x4034e3
push 4
push dword [ebp + 8]
call dword [0x4102c8]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x4034e9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x41701c]
xor eax, ebp
mov dword [ebp + 0x19c], eax
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x34], esi
jne 0x403519
mov eax, 0x8200000b
jmp 0x4035e2
or dword [ebp - 0x74], 0xffffffff
push 0x206
lea eax, [ebp - 0x6a]
push esi
push eax
mov dword [ebp - 0x70], esi
mov word [ebp - 0x6c], si
call fcn.0040be62
add esp, 0xc
cmp ebx, esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x208
mov dword [ebp - 0x78], esi
je 0x4035df
cmp dword [edi + 0x38], 8
jb 0x40355a
mov edi, dword [edi + 0x24]
jmp 0x40355d
add edi, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push edi
push 0x80000002
call dword [0x410054]
cmp eax, esi
jne 0x4035e2
cmp dword [ebp - 0x78], 2
jne 0x4035b5
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push dword [ebp - 0x70]
call dword [0x41004c]
test eax, eax
jne 0x4035b5
lea eax, [ebp - 0x6c]
push eax
push ebx
call dword [0x4102e0]
test eax, eax
pop ecx
pop ecx
jne 0x4035b5
mov dword [ebp - 0x74], esi
jmp 0x4035d1
push ebx
call dword [0x410348]
pop ecx
add eax, eax
push eax
push ebx
push 1
push esi
push esi
push dword [ebp - 0x70]
call dword [0x410050]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x70], esi
je 0x4035df
push dword [ebp - 0x70]
call dword [section..rdata]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 0x19c]
pop edi
xor ecx, ebp
pop esi
call fcn.0040bd2c
add ebp, 0x1a0
leave
ret
Function at 0x403d85
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [eax + 0x34], esi
jne 0x403d9a
mov eax, 0xe0000017
jmp 0x403e0b
cmp dword [eax + 0x38], 8
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x208
mov dword [ebp - 4], esi
jb 0x403db6
mov eax, dword [eax + 0x24]
jmp 0x403db9
add eax, 0x24
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push eax
push 0x80000002
call dword [0x410044]
cmp eax, esi
jne 0x403e0b
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [0x41004c]
push dword [ebp - 4]
mov edi, eax
call dword [section..rdata]
cmp edi, esi
je 0x403dfd
mov eax, edi
jmp 0x403e0a
push 4
push dword [ebp + 8]
call dword [0x4102c8]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x403e10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x41701c]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x34], edi
jne 0x403e40
mov eax, 0xe0000017
jmp 0x403f06
cmp ebx, edi
jne 0x403e4c
or eax, 0xffffffff
jmp 0x403f06
push 0x206
lea eax, [ebp - 0x6e]
push edi
push eax
mov dword [ebp - 0x74], edi
mov word [ebp - 0x70], di
call fcn.0040be62
add esp, 0xc
cmp dword [esi + 0x38], 8
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 0x208
mov dword [ebp - 0x78], edi
jb 0x403e81
mov esi, dword [esi + 0x24]
jmp 0x403e84
add esi, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push esi
push 0x80000002
call dword [0x410054]
cmp eax, edi
jne 0x403f06
cmp dword [ebp - 0x78], 2
jne 0x403edb
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push dword [ebp - 0x74]
call dword [0x41004c]
test eax, eax
jne 0x403edb
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [0x4102e0]
test eax, eax
pop ecx
pop ecx
jne 0x403edb
xor esi, esi
jmp 0x403ef6
push ebx
call dword [0x410348]
pop ecx
add eax, eax
push eax
push ebx
push 1
push edi
push edi
push dword [ebp - 0x74]
call dword [0x410050]
mov esi, eax
cmp dword [ebp - 0x74], edi
je 0x403f04
push dword [ebp - 0x74]
call dword [section..rdata]
mov eax, esi
mov ecx, dword [ebp + 0x198]
pop edi
xor ecx, ebp
pop esi
call fcn.0040bd2c
add ebp, 0x19c
leave
ret
Function at 0x404614
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x9c
lea ebp, [esp - 4]
mov eax, dword [0x41701c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0xc
mov eax, 0x40ebea
call fcn.0040e490
lea ecx, [ebp]
call dword [0x4101b0]
xor esi, esi
push str.SOFTWAREClassesCLSID_
lea ecx, [ebp]
mov dword [ebp - 4], esi
call dword [0x410230]
push str.9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0
lea ecx, [ebp]
call dword [0x410218]
push str.Implemented_Categories_
lea ecx, [ebp]
call dword [0x410218]
push str.A5F7140E_4311_4ef9_AABC_F55941B5EBE5
lea ecx, [ebp]
call dword [0x410218]
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], esi
jae 0x40468d
lea eax, [ebp + 4]
lea ecx, [ebp - 0x10]
push ecx
push 1
push esi
push eax
push 0x80000002
call dword [0x410044]
cmp eax, esi
je 0x4046d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call dword [0x4101c4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0040bd2c
add ebp, 0xa0
leave
ret
push 0x7e
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.0040be62
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push str.idex
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x80
mov dword [ebp - 0x14], esi
call dword [0x41004c]
cmp eax, esi
jne 0x404721
lea eax, [ebp + 0x1c]
push eax
mov ecx, edi
call dword [0x410230]
xor esi, esi
inc esi
push dword [ebp - 0x10]
call dword [section..rdata]
jmp 0x4046a4

Function at 0x40479a
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
xor esi, esi
push esi
push esi
call dword [0x410004]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x4047bc
call dword [0x41009c]
pop esi
leave
ret
push ebx
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
mov edi, 0x110
push dword [ebp + 8]
push 1
push 2
push edi
push 0x32
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [0x410040]
mov ebx, eax
cmp ebx, esi
jne 0x404842
mov ebx, dword [0x41009c]
call ebx
cmp eax, 0x431
je 0x404809
call ebx
mov esi, eax
push dword [ebp - 4]
call dword [0x41003c]
pop edi
mov eax, esi
pop ebx
jmp 0x4047b9
push 2
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [0x410034]
mov ebx, eax
cmp ebx, esi
jne 0x404825
call dword [0x41009c]
jmp 0x4047f8
push dword [ebp + 0x14]
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
push 1
push 2
push edi
push ebx
call dword [0x410030]
test eax, eax
je 0x40481d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [0x41002c]
push ebx
call dword [0x41003c]
jmp 0x4047fa