joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ed6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232f4], 0
push esi
jne 0x405f0d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ee7
mov dword [ecx*4 + 0x4232f0], eax
inc ecx
cmp ecx, 0x100
jl 0x405ee2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f3e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232f0]
xor eax, esi
inc ecx
dec edx
jne 0x405f20
pop edi
not eax
pop esi
ret 0xc

Function at 0x40a053
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
test edx, edx
je 0x40b68a
push ss
add byte [eax], al
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x5a10393f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x2b4053be
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1103d9e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1103d9f2
pushal
call 0x1103d9f8
pop ebp
sub ebp, 0x10
sub ebp, 0x103d9e8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1103da1c
and al, 0x28
add byte [eax], al
add byte [eax - 0x7bf0fe08], al
pop es
add byte [eax], al
add byte [ecx + 0x33], ah
rol byte [eax - 0x3e], 0xc
add cl, ch
add al, 0
add byte [eax], al
mov cl, byte [esp + esi*8 - 0x2617473e]
add eax, dword [ecx]
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1103da25
mov eax, 0x103d9e8
add eax, ebp
add eax, 0x63
mov ecx, 0x580
mov edx, 0xd6b6f598
xor byte [eax], dl
inc eax
dec ecx
jne 0x1103da3c
idiv bh
invalid
jmp 0x1103da4f
adc edx, dword [ebp + 0x13]
adc dword [eax + ebx*4 + 0x59199898], esp
pushal
cwde
cwde
cwde
wait
push ebp
and byte [esi + 0x22989898], bl
mov al, 0x98
cwde
cwde
outsd dx, dword [esi]
jp 0x1103da07
push eax
adc ebx, dword [ecx]
xchg esp, eax
cwde
cwde
cwde
wait
pop ebp
enter 0xfffffffffffff0c8, 0x30
add ch, byte [ebp - 0x58580f68]
push esi
cwde
cdq
mov ah, 0xbc
lock adc byte [ebx + edi*4], al
aad 0x70
popfd
cwde
cwde
cwde
jno 0x1103da42
cwde
cwde
cwde
int 0x15
hlt

Function at 0x1a87380
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1a8738a
pushal
call 0x1a87390
pop ebp
sub ebp, 0x10
sub ebp, 0x1687380
jmp 0x1a873a6
mov eax, 0x1687380
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x65e25e26
xor byte [eax], dl
inc eax
dec ecx
jne 0x1a873bd
jmp 0x1a873d0
lodsd eax, dword [esi]
jmp entry0
Function at 0x40b57d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x410920
cmp edx, dword [eax]
je 0x40b59f
add eax, 8
inc ecx
cmp eax, 0x4109b0
jl 0x40b590
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x410920]
jne 0x40b6cd
mov eax, dword [0xf0f8b4]
cmp eax, 1
je 0x40b6a7
test eax, eax
jne 0x40b5d0
cmp dword [0x410248], 1
je 0x40b6a7
cmp edx, 0xfc
je 0x40b6cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b607
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004088e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b64a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40f48c
push edi
call fcn.00409000
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004088e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004088f0
lea eax, [ebp - 0xa0]
push 0x40f46c
push eax
call fcn.004088f0
push dword [esi + 0x410924]
lea eax, [ebp - 0xa0]
push eax
call fcn.004088f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d753
add esp, 0x2c
pop edi
jmp 0x40b6cd
lea eax, [ebp + 8]
lea esi, [esi + 0x410924]
push 0
push eax
push dword [esi]
call fcn.00408ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x556b7fc4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x2f1b4697
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xd1d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d1d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d1d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d1d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d1d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd1dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd1dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd2f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd1dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd1dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
mov ecx, 0x4df907c5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
mov ecx, 0x176f4ea7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401fd0
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov eax, ecx
mov ecx, dword [eax + 0x12c]
test ecx, ecx
je 0x401fe1
jmp 0x43c660
mov ecx, dword [0x4910e8]
test dword [eax + 0x138], ecx
je 0x401ffa
push str.CATIExtEvent::TerminateAllMsgThreads:_ERROR_m_pDriverMessage_is_NULL
call fcn.0040a4a0
pop ecx
ret
mov eax, dword [0x4a1570]
test eax, eax
je 0x43c688
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4a1570]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4a1570], 0
jmp fcn.0043b2b0

Function at 0x403920
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4920b0]
sub esp, 0x518
test eax, eax
push edi
mov edi, ecx
je 0x403a6d
push esi
lea eax, [esp + 0x18]
push 0
push eax
mov esi, 0xfa
call fcn.0040a4b0
push eax
call fcn.0044d030
add esp, 0xc
cmp eax, 1
jne 0x4039d3
lea ecx, [esp + 8]
push ecx
push 0x2001f
push 0
lea edx, [esp + 0x28]
mov eax, 4
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4039d3
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push str.ATIPOLLINTERVAL
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4039c8
mov esi, dword [esp + 0x10]
cmp esi, 0xfa
jae 0x4039bb
mov esi, 0xfa
jmp 0x4039c8
cmp esi, 0x1388
jbe 0x4039c8
mov esi, 0x1388
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.HKeyPollerTimerEvent
push 0
push 1
push 0
mov dword [0x4920bc], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [edi + 0x24], eax
jne 0x403a09
mov edx, dword [0x4910e8]
test dword [edi + 0x34], edx
je 0x403a09
push str.FAILURE:_Failed_to_create_event_for_HKeyPollerTimerEvent
call fcn.0040a4a0
add esp, 4
mov eax, dword [0x4920b0]
push 0
push esi
push 0x4d2
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x28], eax
test eax, eax
mov eax, dword [edi + 0x34]
jne 0x403a39
mov ecx, dword [0x4910e8]
test ecx, eax
je 0x403a51
push esi
push str.FAILURE:_Failed_to_SetTimer__tick_u
jmp 0x403a49
mov edx, dword [0x4910e8]
test edx, eax
je 0x403a51
push esi
push str.Timer_for_hotkey_poller_setup_ok__tick_u
call fcn.0040a4a0
add esp, 8
mov eax, dword [edi + 0x28]
test eax, eax
pop esi
je 0x403a6d
mov eax, dword [edi + 0x24]
test eax, eax
je 0x403a6d
mov eax, 1
pop edi
add esp, 0x518
ret
xor eax, eax
pop edi
add esp, 0x518
ret
Function at 0x4095e0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x40]
push edi
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
test esi, esi
sete al
lea ecx, [esp + 0x3c]
mov dword [edx], 0x8001
mov dword [edx + 4], 0x620
push eax
push ecx
mov ecx, dword [esp + 0x40]
push 0x2c
lea eax, [esp + 0x14]
push eax
push 0x620
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x409659
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
mov eax, 1
je 0x40965e
mov edi, dword [esp + 0x40]
test edi, edi
je 0x40965e
mov ecx, 0xb
lea esi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x2c
ret
mov eax, 1
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x4099b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
cmp dword [0x492098], 8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
jae 0x409b07
test byte [0x49216c], 2
jne 0x409b07
mov ecx, 0x492a60
call fcn.0042df10
cmp eax, dword [0x49eaf0]
jae 0x409b07
push eax
mov ecx, 0x492a60
call fcn.00430c50
mov esi, eax
xor edi, edi
cmp esi, edi
mov dword [ebp - 0x20], esi
je 0x409b07
push 3
mov ecx, esi
call fcn.00437ab0
test al, 4
je 0x409b07
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.00437890
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409a40
sub eax, edx
mov ebx, eax
mov dword [ebp - 0x1c], ebx
je 0x409b07
lea eax, [ebx + 1]
push eax
mov dword [ebp - 4], edi
call fcn.0045f1c6
add esp, 4
mov esi, eax
jmp 0x409a7a
test esi, esi
mov dword [ebp - 4], 0xffffffff
je 0x409aea
lea ecx, [ebx + 1]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x20]
push ebx
call fcn.00437890
push eax
push esi
call fcn.0045eac0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ae1
mov ecx, dword [ebp - 0x14]
push str.ExtEvent_SetDefault32BppOn2ndDrv
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0045eab0
add esp, 4
mov eax, dword [0x4920b0]
push 0
push 0x7d0
push 0x14d0
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4920c0], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a120
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x654
push edi
xor eax, eax
push eax
mov ecx, 0x188
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0x2c
lea ecx, [esp + 0x18]
push ecx
push 0x620
lea edx, [esp + 0x4c]
push edx
push str..pipeExtEventPipe_Service
mov dword [esp + 0x5c], 0x35
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x54], 0x8001
mov dword [esp + 0x58], 0x620
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x40a191
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40a610
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x220
push esi
push edi
xor eax, eax
push 4
push eax
mov ecx, 0x80
lea edi, [esp + 0x30]
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40a666
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x2c]
push str.bGlobalServiceAlive._failed_to_open_SCM._err_d
push eax
call fcn.0045f139
lea ecx, [esp + 0x34]
push ecx
call fcn.00410a60
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x492098], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x40a679
mov eax, str.Ati_External_Event_Utility
push 4
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a6bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x2c]
push str.bGlobalServiceAlive._failed_to_OpenService._err_d
push edx
call fcn.0045f139
lea eax, [esp + 0x34]
push eax
call fcn.00410a60
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40a720
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x2c]
push str.bGlobalServiceAlive._failed_to_QueryServiceStatus._err_d
push eax
call fcn.0045f139
lea ecx, [esp + 0x34]
push ecx
call fcn.00410a60
add esp, 0x10
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 4
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a970
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 8]
push 0x400
push edx
call fcn.0045f755
add esp, 0x10
test eax, eax
jge 0x40a9b2
lea eax, [esp]
push eax
mov byte [esp + 0x404], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x404
ret
mov ecx, 0x400
sub ecx, eax
push ecx
lea edx, [esp + 4]
push 0x46dc64
push edx
call fcn.0045f620
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x404
ret

Function at 0x40ad10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov ecx, dword [0x492164]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push ebp
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push edi
push eax
xor ebp, ebp
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x34], eax
call fcn.00425350
mov esi, eax
add esp, 8
test esi, esi
je 0x40ad9c
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00427020
add esp, 8
test eax, eax
jne 0x40ad9c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x40ada9
mov eax, SysReAllocString
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push 0
push str.Control_PanelDesktop_
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ae1f
mov ecx, 0x41
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push str.ScreenSaverIsSecure
push edx
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ae14
lea eax, [esp + 0x38]
push eax
call fcn.0045f82d
add esp, 4
mov ebp, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40ae38
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00427120
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test ebp, ebp
pop edi
setne al
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x40b9f0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x650
cmp dword [0x492098], 8
push esi
push edi
jb 0x40ba25
call fcn.00428140
push 0x55
mov ecx, 0x492a60
call fcn.00432530
push 0x1388
call fcn.00428160
add esp, 4
mov eax, dword [0x49eaf4]
push eax
mov ecx, 0x492a60
call fcn.00430c50
test eax, eax
je 0x40ba44
push 0
mov ecx, eax
call fcn.00437ab0
jmp 0x40ba46
xor eax, eax
and eax, 2
mov esi, eax
mov eax, dword [0x4920cc]
test eax, eax
je 0x40ba90
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x40ba90
push esi
call fcn.004220c0
test esi, esi
jne 0x40bb6d
mov eax, dword [0x49eaf4]
push eax
mov ecx, 0x492a60
call fcn.00430c50
test eax, eax
je 0x40bb24
mov ecx, eax
call fcn.00437aa0
jmp 0x40bb26
mov eax, dword [0x49215c]
test eax, eax
je 0x40bb0a
test byte [0x49216c], 2
je 0x40bb0a
xor eax, eax
mov ecx, 0x188
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
mov dword [esp + 0x48], eax
push 1
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push 0x2c
lea edx, [esp + 0x18]
push edx
push 0x620
lea eax, [esp + 0x4c]
push eax
push str..pipeExtEventPipe_Service
mov dword [esp + 0x5c], 0x18
mov dword [esp + 0x54], 0x8001
mov dword [esp + 0x58], 0x620
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x40bb0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040b8a0
call fcn.0040b940
jmp 0x40ba6c
xor eax, eax
test ah, 0x20
je 0x40bb35
push 0
call fcn.0040b770
add esp, 4
mov ecx, 0x492a60
call fcn.0042e4e0
test eax, eax
je 0x40bb68
mov eax, dword [0x4910e8]
test eax, eax
je 0x40bb59
push str.LARGEDESKTOP_FORCEDREMOVE_flag_detected_at_resume
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40bb68
call fcn.00401790
call fcn.00441670
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bd30
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x654
mov eax, dword [0x49eaf4]
push ebx
push esi
push edi
push eax
mov ecx, 0x492a60
call fcn.00430c50
test eax, eax
je 0x40bd5e
push 0
mov ecx, eax
call fcn.00437ab0
jmp 0x40bd60
xor eax, eax
and eax, 2
mov ebx, eax
mov eax, dword [0x49215c]
test eax, eax
mov dword [0x4a155c], 0
je 0x40bde9
test byte [0x49216c], 2
je 0x40bde9
xor eax, eax
mov ecx, 0x188
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
mov dword [esp + 0x50], eax
push 1
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x2c
lea edx, [esp + 0x20]
push edx
push 0x620
lea eax, [esp + 0x54]
push eax
push str..pipeExtEventPipe_Service
mov dword [esp + 0x64], 0x17
mov dword [esp + 0x5c], 0x8001
mov dword [esp + 0x60], 0x620
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x40bde9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x40be47
push 1
call fcn.00417770
mov ecx, 0x492a60
xor esi, esi
call fcn.0042db40
test eax, eax
jbe 0x40be3a
lea ebx, [ebx]
push esi
mov ecx, 0x492a60
call fcn.0042de80
test eax, eax
je 0x40be2b
mov ecx, dword [0x4920d8]
push esi
call fcn.004189f0
mov ecx, 0x492a60
inc esi
call fcn.0042db40
cmp esi, eax
jb 0x40be10
mov eax, dword [0x4920d8]
test eax, eax
je 0x40be47
test ebx, ebx
jne 0x40be7d
mov eax, dword [0x49eaf4]
push eax
mov ecx, 0x492a60
call fcn.00430c50
test eax, eax
je 0x40be64
mov ecx, eax
call fcn.00437aa0
jmp 0x40be66
xor eax, eax
test ah, 0x20
je 0x40be7d
mov ecx, dword [0x4920b0]
push 0x4d4
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40be90
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x654
mov eax, dword [0x49215c]
test eax, eax
push edi
mov dword [0x4a155c], 0
je 0x40bf21
test byte [0x49216c], 2
je 0x40bf21
xor eax, eax
mov ecx, 0x188
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
mov dword [esp + 0x48], eax
push 1
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push 0x2c
lea edx, [esp + 0x18]
push edx
push 0x620
lea eax, [esp + 0x4c]
push eax
push str..pipeExtEventPipe_Service
mov dword [esp + 0x5c], 0x17
mov dword [esp + 0x54], 0x8001
mov dword [esp + 0x58], 0x620
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x40bf21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x40bf32
push 1
call fcn.00417770
pop edi
mov esp, ebp
pop ebp
ret