joyce8/EMBER2024-capa huggingface dataset:
Function at 0x568c68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x568c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00569663
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x568cab
test byte [esp + 8], 2
je 0x568cab
call fcn.005696d6
mov dword [eax], 0xd
call fcn.005696df
mov dword [eax], 5
jmp 0x568c84
xor eax, eax
ret

Function at 0x5794a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x5795c5
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x5795a9
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x5794fb
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x5794d9
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x57a00d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x57a064
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x57a064
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x57a064
xor eax, eax
inc eax
jmp 0x57a066
xor eax, eax
leave
ret 0x10
Function at 0x57a08f
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x57a0fd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x8a5434
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57a0f4
cmp dword [ebp - 0xc], 4
jne 0x57a0f4
cmp dword [ebp - 0x10], edi
je 0x57a0f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x8e5af8], edi
xor eax, eax
jmp 0x57a13c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x8e5af8], edi
jge 0x57a137
lea eax, [ebp - 0x34]
push eax
mov dword [0x8e5af8], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x57a137
cmp word [ebp - 0x14], 5
jb 0x57a137
call fcn.0057a06a
test eax, eax
je 0x57a137
emms
mov dword [0x8e5af8], 1
mov eax, dword [0x8e5af8]
pop edi
leave
ret

Function at 0x58e715
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x58e74d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0058c67b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0058c653
jmp 0x58e759
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x58ff10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x58ff52
call fcn.00596b45
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x58ff52
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x58ff49
xor eax, eax
jmp 0x58ff5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0058ff60
pop edi
pop esi
pop ebx
ret 4

Function at 0x597075
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5970a3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5970c1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00596fdb
jmp 0x5970c1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5970c1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00596fdb
test edi, edi
mov eax, edi
jne 0x5970ab
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xab0
push esi
push edi
xor eax, eax
mov dword [esp + 0xa8], 0
mov ecx, 0x80
lea edi, [esp + 0xac]
rep stosd dword es:[edi], eax
mov byte [esp + 0x2b0], al
mov ecx, 0x200
lea edi, [esp + 0x2b1]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2b0]
push eax
push str.Network_Protect_Enabled
push str._SERVER_COMMUNICATIONS_
call fcn.00427b80
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c0]
push 0x4696c0
push edx
call fcn.00458f3f
mov esi, 1
add esp, 0x18
cmp eax, esi
jne 0x401208
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401208
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401134
mov ecx, dword [esp + 0x20]
mov eax, 2
cmp ecx, eax
jne 0x401134
cmp dword [esp + 0x14], 5
jne 0x401134
cmp dword [esp + 0x18], eax
jne 0x401134
lea ecx, [esp + 0x24]
push str.service_pack
push ecx
call fcn.0044db90
add esp, 8
test eax, eax
je 0x4011df
call fcn.004388d0
cmp eax, 0xfffffffe
jne 0x40116f
lea edx, [esp + 0xac]
push str.ERROR:_unable_to_install_WinSock2_layered_service_provider_because_KaseyaSP.dll_is_missing._n
push edx
call fcn.00458ee7
lea eax, [esp + 0xb0]
push eax
mov dword [esp + 0xb4], esi
call fcn.0043e010
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0xffffffff
jne 0x4011a5
lea ecx, [esp + 0xac]
push str.ERROR:_unable_to_install_WinSock2_layered_service_provider_because_Kaseya_LSP_registry_key_is_missing._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], esi
call fcn.0043e010
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40120d
cmp eax, esi
je 0x40120d
push eax
lea eax, [esp + 0xb0]
push str.ERROR:_unable_to_install_WinSock2_layered_service_provider._Error___d._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0xb4]
push ecx
mov dword [esp + 0xb8], esi
call fcn.0043e010
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0xac]
push str.The_WinSock2_layered_service_provider_for_network_access_functions_will_not_be_enabled_at_this_time._It_will_be_enabled_only_after_installing_Service_Pack_1_or_a_later_service_pack_on_Windows_Server_2003._The_service_pack_contains_required_updates_for_Winsock_kernel_components._n
push edx
call fcn.00458ee7
lea eax, [esp + 0xb0]
push eax
mov dword [esp + 0xb4], esi
call fcn.0043e010
add esp, 0xc
call fcn.00438690
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401370
Capabilities:
Delete file

Disassembly:
test esi, esi
push ebp
mov ebp, dword [esp + 8]
je 0x40144a
test ebx, ebx
je 0x40144a
push edi
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push ebp
mov ecx, edx
push ebx
and ecx, 3
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
test edi, edi
ja 0x40143b
push 0
push 0x80
mov ecx, ebp
mov edx, ecx
shr ecx, 2
push 3
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0
mov ecx, edx
push 3
and ecx, 3
push 0x80000000
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
call edi
cmp eax, 0xffffffff
jne 0x4013f8
push 0
push 0x80
push 3
push 0
push 3
push 0
push esi
call edi
cmp eax, 0xffffffff
je 0x401404
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebp
ret
push esi
call fcn.0044a140
add esp, 4
push 0
push 0x80
push 1
push 0
push 3
push 0x80000000
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp edi, ebp
jle 0x401445
pop edi
or eax, 0xffffffff
pop ebp
ret
mov eax, edi
pop edi
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403c00
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push esi
push edi
push ebx
push ebp
push eax
push ecx
call fcn.00449390
add esp, 0x18
cmp eax, 0x7d1
jne 0x403c45
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push esi
push edi
push ebx
push ebp
push edx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403cb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e0
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403d10
push esi
lea ecx, [esp + 0xa8]
push str.ERROR:_doRemoveFile___source_file__s_not_found._n
push ecx
mov edi, 0x4010
call fcn.00458ee7
lea edx, [esp + 0xac]
push edx
mov dword [esp + 0xb0], 1
call fcn.0043e010
add esp, 0x10
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403da5
cmp dword [esp + 0x18], 2
jne 0x403da5
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x403d4c
xor eax, eax
push 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x403def
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x403d6f
mov esi, 0x400f
push esi
lea ecx, [esp + 0xa8]
push str.ERROR:_doRemoveFile___received_error__d_from_MoveFileEx__._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0xac]
push edx
mov dword [esp + 0xb0], 1
call fcn.0043e010
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
mov eax, esi
call fcn.00401520
mov esi, eax
add esp, 4
test esi, esi
je 0x403def
push esi
lea ecx, [esp + 0xa8]
push str.ERROR:_doRemoveFile___received_error__d_from_configWinInitIni__._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0xac]
push edx
mov dword [esp + 0xb0], 1
call fcn.0043e010
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404a20
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0xe8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
mov edi, dword [esp + 0x104]
mov dword [esi], 0
mov dword [eax], 0
mov ecx, dword [edi]
push 0x25
push ecx
call fcn.004590c0
add esp, 8
test eax, eax
je 0x404a7a
mov edx, dword [esp + 0x100]
mov ebx, dword [esp + 0xfc]
mov eax, dword [edi]
push edx
push ebx
push eax
call fcn.00401450
add esp, 0xc
test eax, eax
jne 0x404a7a
mov dword [edi], ebx
mov eax, dword [0x48bf8c]
test eax, eax
mov ebp, dword [esp + 0x110]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x404b50
push 0x48beb8
push 0x48bf20
lea ecx, [esp + 0x20]
push 0x48be50
push ecx
call fcn.00435bf0
add esp, 0x10
test eax, eax
jne 0x404b50
mov edx, dword [edi]
push eax
push 0x80
push 3
push eax
push 3
push 0x80000000
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x404aef
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 3
push 0
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x404b33
mov ecx, dword [esp + 0x108]
push 0
push esi
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x10c]
mov dword [edx], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ebp
push ecx
call fcn.00423c50
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
call fcn.00435790
add esp, 4
cmp esi, 0xffffffff
jne 0x404beb
mov esi, dword [esp + 0x108]
mov eax, dword [esp + 0x10c]
mov ecx, dword [edi]
push ebp
push eax
push esi
push ecx
call fcn.00449820
add esp, 0x10
test eax, eax
jne 0x404b6e
cmp dword [esi], 0
jne 0x404beb
mov edx, dword [edi]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x404ba7
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 3
push 0
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x404beb
mov ecx, dword [esp + 0x108]
push 0
push esi
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x10c]
mov dword [edx], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ebp
push ecx
call fcn.00423c50
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe8
ret
Function at 0x4066d0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x30c
push esi
mov esi, dword [esp + 0x314]
push edi
xor edi, edi
test esi, esi
jne 0x4066f0
pop edi
xor eax, eax
pop esi
add esp, 0x30c
ret
push 0x104
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x114], 0
mov byte [esp + 0x218], 0
mov byte [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea edx, [esp + 0x110]
push edx
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp + 0x10c]
test al, al
je 0x406760
lea eax, [esp + 0x10c]
push eax
push esi
call fcn.0044db90
add esp, 8
test eax, eax
jne 0x4067d0
push str._WINDIR_
push esi
call fcn.0044db90
add esp, 8
test eax, eax
jne 0x4067d0
push str._SystemRoot_
push esi
call fcn.0044db90
add esp, 8
test eax, eax
jne 0x4067d0
push str._ProgramFiles_
push esi
call fcn.0044db90
add esp, 8
test eax, eax
jne 0x4067d0
mov al, byte [esp + 8]
test al, al
je 0x4067b0
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0044db90
add esp, 8
test eax, eax
jne 0x4067d0
mov al, byte [esp + 0x210]
test al, al
je 0x4067d5
lea edx, [esp + 0x210]
push edx
push esi
call fcn.0044db90
add esp, 8
test eax, eax
je 0x4067d5
mov edi, 1
mov eax, edi
pop edi
pop esi
add esp, 0x30c
ret
Function at 0x411fe0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x214
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push ebp
push eax
mov esi, ecx
push esi
push ebx
call fcn.004025e0
add esp, 0x10
test eax, eax
je 0x412072
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412006
sub eax, edx
mov dword [esp + 0x14], eax
je 0x412072
push edi
push esi
push 0
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x41205a
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41205a
push esi
call edi
xor esi, esi
push ebx
call fcn.00409510
add esp, 4
test esi, esi
je 0x412071
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call edi
pop edi
push ebx
push ebp
lea edx, [esp + 0x24]
push str.WARNING:_Automatically_cleared__d_bytes_out_of_the_Agent_log_file__s._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 1
call fcn.0043e010
add esp, 0x14
pop esi
pop ebp
add esp, 0x214
ret
Function at 0x4142c0
Capabilities:
Access the windows event log

Disassembly:
push ecx
xor ecx, ecx
cmp eax, 2
sete cl
mov dword [0x48bfc0], eax
mov dword [0x48bfd4], edx
mov dword [0x48bfc8], 0
dec ecx
and ecx, 5
cmp eax, 4
mov dword [0x48bfc4], ecx
je 0x414309
cmp eax, 1
je 0x414309
cmp eax, 7
je 0x414309
mov eax, dword [0x48618c]
mov dword [0x48bfd0], eax
inc eax
mov dword [0x48618c], eax
jmp 0x414313
mov dword [0x48bfd0], 0
mov eax, dword [0x48bfd8]
push edi
push 0x48bfbc
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov edi, eax
test edi, edi
jne 0x414368
push esi
push str.KaseyaAgent
push eax
mov dword [esp + 0x10], str.SetServiceStatus_failed
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x414362
push edi
lea ecx, [esp + 0xc]
push ecx
push edi
push 1
push edi
push edi
push edi
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov eax, edi
pop edi
pop ecx
ret
mov eax, edi
pop edi
pop ecx
ret
Function at 0x4158b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
push ebp
mov ebp, dword [esp + 0x94]
test ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
je 0x41595d
push esi
push edi
mov byte [ebp], 0
mov ecx, 0xb
mov esi, str.SystemCurrentControlSetServicesVxDKaseya
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41595b
lea ecx, [ecx]
mov cl, byte [eax + 0x486190]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x415910
xor eax, eax
mov ecx, 0x41
mov edi, ebp
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push ebp
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x28], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
add esp, 0x8c
ret

Function at 0x415b90
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x214
push esi
push edi
push str.KaseyaFlashIconInfoListSema
push 0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x415bef
lea ecx, [esp + 0x1c]
push str.ERROR:_Failed_to_create_mutex_in_removeFirstToggleInfoEntry___n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 1
call fcn.0043e010
mov edi, dword [esp + 0x20]
jmp 0x415c1f
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x415c22
lea eax, [esp + 0x1c]
push str.ERROR:_Failed_to_obtain_mutex_in_removeFirstToggleInfoEntry___n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 1
call fcn.0043e010
add esp, 0xc
mov eax, dword [0x4cb470]
test eax, eax
je 0x415c3c
mov edx, dword [eax]
push eax
mov dword [0x4cb470], edx
call fcn.0045932f
add esp, 4
test edi, edi
jne 0x415c47
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x415c52
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x214
ret
Function at 0x415c60
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x210
cmp eax, 1
je 0x415c7e
cmp eax, 2
je 0x415c7e
or eax, 0xffffffff
add esp, 0x210
ret
push ebp
mov ebp, dword [esp + 0x21c]
test ebp, ebp
push esi
je 0x415c9e
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415c90
sub eax, edx
lea esi, [eax + 1]
jmp 0x415ca3
mov esi, 1
push ebx
add esi, 0xc
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x415cea
push esi
lea eax, [esp + 0x20]
push str.ERROR:_enableToggleSysTryIcon___could_not_allocate__d_bytes_n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 1
call fcn.0043e010
add esp, 0x10
pop ebx
pop esi
mov eax, 0x4099
pop ebp
add esp, 0x210
ret
push edi
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x224]
mov edi, 1
cmp eax, edi
lea edx, [ebx + 0xc]
mov dword [ebx + 8], edx
jne 0x415d1a
mov dword [ebx + 4], edi
jmp 0x415d22
cmp eax, 2
jne 0x415d22
mov dword [ebx + 4], eax
test ebp, ebp
je 0x415d3a
mov eax, ebp
sub edx, ebp
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x415d30
push str.KaseyaFlashIconInfoListSema
push 0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x415d9c
lea ecx, [esp + 0x20]
push str.ERROR:_Failed_to_create_mutex_in_removeFirstToggleInfoEntry___n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], edi
call fcn.0043e010
push ebx
call fcn.0045932f
add esp, 0x10
pop edi
pop ebx
pop esi
mov eax, 0x400b
pop ebp
add esp, 0x210
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x415dbf
lea eax, [esp + 0x20]
push str.ERROR:_Failed_to_obtain_mutex_in_removeFirstToggleInfoEntry___n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x24]
push ecx
jmp 0x415d7a
mov eax, dword [0x4cb470]
test eax, eax
je 0x415de1
cmp dword [eax], 0
mov ecx, 0x4cb470
je 0x415ddb
mov ecx, eax
mov eax, dword [ecx]
cmp dword [eax], 0
jne 0x415dd2
mov edx, dword [ecx]
mov dword [edx], ebx
jmp 0x415de7
mov dword [0x4cb470], ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x210
ret