joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402190
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x4021dd
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x4021dd
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0xc]
cmp eax, 5
jne 0x4021fb
cmp dword [esp + 0x10], 1
jne 0x40220d
pop edi
mov eax, 2
pop esi
add esp, 0x9c
ret
cmp eax, 6
jne 0x40220d
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
je 0x40220f
xor eax, eax
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x402540
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
lea eax, [esi - 1]
push 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402573
or eax, 0xffffffff
pop esi
ret 0x14
mov ecx, esi
push ebx
mov ebx, dword [esp + 0xc]
mov edx, ecx
push edi
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x20]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push ebx
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x4025b7
mov ecx, dword [esp + 0x14]
mov byte [ecx + ebx], al
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
ret 0x14

Function at 0x4025d0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402601
or eax, 0xffffffff
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
ret 0x10
Function at 0x402640
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402671
or eax, 0xffffffff
ret 0x10
mov edx, dword [esp + 4]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
ret 0x10

Function at 0x402870
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402896
or eax, 0xffffffff
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
ret 0xc

Function at 0x403280
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov esi, dword [esp + 0x410]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 0xc]
mov ebx, dword [esp + 0x414]
push ecx
push 0x434bf4
push ebx
push esi
call fcn.004206db
add esp, 0x10
lea edx, [esp + 0xc]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0xc]
push 0x400
push edx
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x403307
lea eax, [esp + 0xc]
push eax
push 0x434bf8
push ebx
push esi
call fcn.004206db
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret 8

Function at 0x403340
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push str.terminate_process_id:__ld
mov esi, eax
call fcn.00402100
add esp, 8
test esi, esi
je 0x403393
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x403387
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.TerminateProcess_of__d_failed:__d
call fcn.00402100
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.OpenProcess_of__d_failed:__d
call fcn.00402100
add esp, 0xc
pop edi
pop esi
ret 4
Function at 0x4033b0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1004
call fcn.00420b50
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40340d
mov eax, dword [esp]
shr eax, 2
je 0x40340d
push ebx
mov ebx, dword [esp + 0x100c]
push esi
push edi
lea esi, [esp + 0x10]
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x403404
push eax
push ebx
call fcn.00403420
test eax, eax
je 0x403404
mov edx, dword [esi]
push edx
call fcn.00403340
add esi, 4
dec edi
jne 0x4033eb
pop edi
pop esi
pop ebx
add esp, 0x1004
ret 4

Function at 0x403420
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x10c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x120]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x4034a1
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
push ebx
push esi
mov dword [esp + 0x1c], 0x104
call fcn.004034e0
test eax, eax
jne 0x4034a1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 4
push ecx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4034a1
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
mov edx, dword [esp + 0x11c]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.00402ad0
test eax, eax
je 0x4034bc
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret 8

Function at 0x403650
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x854
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x5c]
push 0x400
mov dword [esp + 0x14], eax
push ecx
push str._SYSTEMROOT_Explorer.exe
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x30], 0x434c8c
mov dword [esp + 0x2c], 0x434c94
call esi
lea edx, [esp + 0x45c]
push 0x400
push edx
push str._SYSTEMROOT__
call esi
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x460]
push ecx
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x78]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
jne 0x403703
lea ecx, [esp + 0x54]
push ecx
push str.start_default_explorer_failed:__s
call fcn.00402100
add esp, 8
or eax, 0xffffffff
add esp, 0x854
ret
mov ecx, dword [esp + 8]
lea edx, [esp + 0x454]
lea eax, [esp + 0x54]
push edx
push eax
push ecx
push str.default_explorer_pid:__ld__cmd:__s__path:__s
call fcn.00402100
mov eax, dword [esp + 0x18]
add esp, 0x10
add esp, 0x854
ret
Function at 0x4038b0
Capabilities:
Persist via run registry key

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push str.Write_Into_Regedit:__s
call fcn.00402100
add esp, 8
test esi, esi
je 0x4038f5
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 0xa
jbe 0x4038f5
push 0x434d38
push 0x434d48
push reloc.WS2_32.dll_accept
push esi
call fcn.00402640
xor eax, eax
pop esi
ret 4
push str.RestoreFiles
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call fcn.00402870
xor eax, eax
pop esi
ret 4
Function at 0x403910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f2c0
push 0x420a70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x820
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x81c], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x81b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
mov dword [ebp - 4], edi
push edi
push edi
push edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
mov dword [0x43a8f8], eax
push edi
push edi
push edi
push edi
call esi
mov dword [0x43a8f4], eax
push 0x40000000
push 0x434db8
call fcn.00407d60
mov dword [0x43a8f0], eax
cmp eax, edi
jne 0x4039a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str..pipe_namedpipeapp_pipe_name
push str.connect_to__s_failed:__d
call fcn.00402100
add esp, 0xc
jmp 0x403b7c
call fcn.00403dc0
call fcn.00407a20
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x1c], eax
mov ebx, 0x800
mov dword [ebp - 0x828], ebx
mov eax, 1
mov dword [0x43a8e4], eax
mov dword [ebp - 4], eax
cmp dword [0x43a8e8], edi
jne 0x403a66
mov esi, 0x800
sub esi, ebx
cmp esi, 8
jb 0x403a38
mov ecx, dword [0x43a8f0]
push ecx
push esi
lea edx, [ebp - 0x81c]
push edx
call fcn.00403d30
mov dword [ebp - 0x824], eax
cmp eax, edi
jle 0x403a38
mov ecx, esi
sub ecx, eax
lea esi, [ebp + eax - 0x81c]
lea edi, [ebp - 0x81c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub dword [ebp - 0x1c], eax
add ebx, eax
mov dword [ebp - 0x828], ebx
xor edi, edi
jmp 0x4039d4
mov eax, dword [0x43a8f4]
push eax
push ebx
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x43a8f0]
push edx
call fcn.00407e40
mov dword [ebp - 0x824], eax
cmp eax, edi
jg 0x403a6b
push str.web_client_pipes_broken
call fcn.00402100
add esp, 4
mov dword [ebp - 4], edi
jmp 0x403aa3
add dword [ebp - 0x1c], eax
sub ebx, eax
mov dword [ebp - 0x828], ebx
jmp 0x4039d4
call fcn.00407c60
call fcn.00406580
mov eax, dword [0x43a8f0]
cmp eax, edi
je 0x403ac2
push eax
call fcn.00407e20
mov dword [0x43a8f0], edi
mov eax, dword [0x43a8f4]
cmp eax, edi
je 0x403ad8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x43a8f4], edi
mov eax, dword [0x43a8f8]
cmp eax, edi
je 0x403aee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x43a8f8], edi
cmp dword [0x43a8e4], edi
mov eax, 0x434e58
jne 0x403b00
mov eax, 0x434e5c
push eax
push str.need_restore___s
call fcn.00402100
add esp, 8
cmp dword [0x43a8e4], edi
je 0x403b23
push edi
push 0x43a3d0
call fcn.00403bd0
jmp 0x403b7c
cmp dword [0x43a7d0], edi
je 0x403b34
push 1
push 1
call fcn.00407370
cmp dword [0x43a3c8], edi
je 0x403b7c
mov edi, 0x43a3d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
jb 0x403b7c
push 0x43a3d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x403b7c
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403dc0
Capabilities:
Create thread

Disassembly:
push 0xc
call fcn.004207c2
add esp, 4
mov dword [0x43a8fc], eax
test eax, eax
jne 0x403dd7
or eax, 0xffffffff
ret
mov dword [eax], 0
mov eax, dword [0x43a8fc]
push 0
push 0
push 0
mov dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x43a8fc]
mov dword [ecx + 8], eax
mov edx, dword [0x43a8fc]
mov eax, dword [edx + 8]
test eax, eax
jne 0x403e0f
or eax, 0xffffffff
ret
push 0
push 0
push 0
push 0x403e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43a8ec], eax
neg eax
sbb eax, eax
neg eax
dec eax
ret

Function at 0x404e40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x940
lea eax, [esp + 0x540]
push esi
mov esi, dword [esp + 0x94c]
push edi
push esi
push 0x4350ac
push 0x400
push eax
call fcn.004206db
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + esi - 1], 0x5c
je 0x404e98
push esi
push 0x4350b0
lea ecx, [esp + 0x550]
push 0x400
push ecx
call fcn.004206db
add esp, 0x10
lea edx, [esp + 0x548]
lea eax, [esp + 0x148]
push edx
push 0x4350b4
push 0x400
push eax
call fcn.004206db
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x148]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404ee1
pop edi
xor eax, eax
pop esi
add esp, 0x940
ret 8
lea eax, [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push eax
push edi
call ebx
test eax, eax
je 0x404fc5
mov esi, dword [esp + 0x950]
lea ecx, [esp + 0x38]
push 0x4350b8
push ecx
call fcn.004212d0
add esp, 8
test eax, eax
je 0x404fb5
lea edx, [esp + 0x38]
push 0x4350bc
push edx
call fcn.004212d0
add esp, 8
test eax, eax
je 0x404fb5
lea eax, [esp + 0x38]
lea ecx, [esp + 0x54c]
push eax
push ecx
push 0x4350c0
lea edx, [esp + 0x158]
push 0x400
push edx
call fcn.004206db
lea eax, [esp + 0x160]
push eax
push str.ie:__s
call fcn.00402100
add esp, 0x1c
lea ecx, [esp + 0x14c]
push ecx
call fcn.00405120
test eax, eax
je 0x404fa1
lea edx, [esp + 0x14c]
push 1
push edx
push esi
call fcn.00404fe0
test eax, eax
jne 0x404fc5
lea eax, [esp + 0x14c]
push eax
push esi
call fcn.00404e40
jmp 0x404fb5
lea ecx, [esp + 0x14c]
push 0
push ecx
push esi
call fcn.00404fe0
test eax, eax
jne 0x404fc5
lea edx, [esp + 0xc]
push edx
push edi
call ebx
test eax, eax
jne 0x404eff
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x940
ret 8

Function at 0x405120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405135
xor eax, eax
ret 4
and eax, 0xff
shr eax, 4
and eax, 1
ret 4
Function at 0x4052a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x940
lea eax, [esp + 0x540]
push esi
mov esi, dword [esp + 0x94c]
push edi
push esi
push 0x43513c
push 0x400
push eax
call fcn.004206db
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + esi - 1], 0x5c
je 0x4052f8
push esi
push 0x435140
lea ecx, [esp + 0x550]
push 0x400
push ecx
call fcn.004206db
add esp, 0x10
lea edx, [esp + 0x548]
lea eax, [esp + 0x148]
push edx
push 0x435144
push 0x400
push eax
call fcn.004206db
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x148]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405341
pop edi
xor eax, eax
pop esi
add esp, 0x940
ret 8
lea eax, [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push eax
push edi
call ebx
test eax, eax
je 0x40543b
mov esi, dword [esp + 0x950]
lea ecx, [esp + 0x38]
push 0x435148
push ecx
call fcn.004212d0
add esp, 8
test eax, eax
je 0x405415
lea edx, [esp + 0x38]
push 0x43514c
push edx
call fcn.004212d0
add esp, 8
test eax, eax
je 0x405415
lea eax, [esp + 0x38]
lea ecx, [esp + 0x54c]
push eax
push ecx
push 0x435150
lea edx, [esp + 0x158]
push 0x400
push edx
call fcn.004206db
lea eax, [esp + 0x160]
push eax
push str.cert:__s
call fcn.00402100
add esp, 0x1c
lea ecx, [esp + 0x14c]
push ecx
call fcn.00405120
test eax, eax
je 0x405401
lea edx, [esp + 0x14c]
push 1
push edx
push esi
call fcn.00405450
test eax, eax
jne 0x405427
lea eax, [esp + 0x14c]
push eax
push esi
call fcn.004052a0
jmp 0x405415
lea ecx, [esp + 0x14c]
push 0
push ecx
push esi
call fcn.00405450
test eax, eax
jne 0x40542e
lea edx, [esp + 0xc]
push edx
push edi
call ebx
test eax, eax
jne 0x40535f
jmp 0x40543b
push 0x435164
jmp 0x405433
push str.sendLibpubCert_failed
call fcn.00402100
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x940
ret 8

Function at 0x4054e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
pop edi
jne 0x405532
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x435194
call fcn.00402100
add esp, 8
or eax, 0xffffffff
add esp, 0x104
ret 0x18
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push ecx
push str._sMicrosoftCredentials
push edx
push eax
call fcn.004206db
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x10]
push ecx
push str._sMicrosoftSystemCertificates
push edx
push eax
call fcn.004206db
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x20]
push ecx
push str._sMicrosoftCLR_Security_Config
push edx
push eax
call fcn.004206db
add esp, 0x30
xor eax, eax
add esp, 0x104
ret 0x18
Function at 0x405bb0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0
push 0
push ebx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x405bd8
pop esi
or eax, 0xffffffff
pop ebx
ret 0x10
mov ecx, dword [esp + 0x18]
push edi
push ecx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405c1b
push ebx
push str.Security_Software_Had_stopped_me:__s
call fcn.00402100
add esp, 8
or edi, 0xffffffff
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
mov edx, dword [esp + 0x18]
push 0x100e
push edx
call fcn.004047a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x406e60
Capabilities:
Get disk information

Disassembly:
sub esp, 0x454
push ebp
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x18]
xor ebp, ebp
push edx
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00403150
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x406f83
cmp dword [esp + 8], ebp
je 0x406f83
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
lea esi, [ebp + 0x41]
lea ecx, [esp + 0x24]
push esi
push 0x4354dc
push 0x40
push ecx
call fcn.004206db
add esp, 0x10
lea edx, [esp + 0x64]
lea eax, [esp + 0x24]
push 0x400
push edx
push eax
call ebx
mov edi, str.DeviceTrueCryptVolume
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x68]
push ecx
push str.DeviceTrueCryptVolume
call fcn.00406fa0
test eax, eax
je 0x406f66
push esi
push str._c:_
lea edx, [esp + 0x2c]
push 0x40
push edx
call fcn.004206db
add esp, 0x10
push ebp
call fcn.00402220
push eax
call dword [esp + 0x18]
test eax, eax
je 0x406f59
push eax
push str.unmountVol_failed:__d
call fcn.00402100
add esp, 8
lea eax, [esp + 0x24]
push ebp
push eax
push 0
call fcn.004030e0
xor eax, eax
inc ebp
mov ecx, 0x100
lea edi, [esp + 0x64]
cmp ebp, 0x1a
rep stosd dword es:[edi], eax
jl 0x406edb
mov eax, dword [esp + 0x1c]
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
push ecx
push eax
call fcn.00403320
pop edi
pop ebp
add esp, 0x454
ret
Function at 0x4074f0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x30
push ebp
push esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0xffffffff
push esi
push str.try_starting_service:__s
call fcn.00402100
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 8], ebp
jne 0x407533
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x30
ret 8
push 0xf01ff
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x407558
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x30
ret 8
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40758a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
pop esi
neg eax
sbb eax, eax
pop ebp
add esp, 0x30
ret 8
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push 0x24
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4075ae
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x30
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov edx, dword [esp + 0x30]
mov edi, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x44], edx
test eax, eax
je 0x407652
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x48]
cmp dword [eax], 0
je 0x40764e
cmp dword [esp + 0x20], 2
jne 0x40764e
mov eax, 0xcccccccd
mul dword [esp + 0x34]
shr edx, 3
cmp edx, 0x3e8
jae 0x4075ff
mov edx, 0x3e8
jmp 0x40760c
cmp edx, 0x2710
jbe 0x40760c
mov edx, 0x7d0
push edx
call ebp
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x24
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40764e
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
cmp ecx, eax
jbe 0x407642
call ebx
mov ecx, dword [esp + 0x30]
mov edi, eax
mov dword [esp + 0x44], ecx
jmp 0x4075d4
call ebx
mov ecx, dword [esp + 0x34]
sub eax, edi
cmp eax, ecx
jbe 0x4075d4
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
pop edi
cmp eax, 4
pop ebx
jne 0x407665
mov dword [esp + 0xc], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
pop esi
pop ebp
mov eax, dword [esp + 4]
add esp, 0x30
ret 8

Function at 0x407a20
Capabilities:
Create thread

Disassembly:
call fcn.00407c60
push 0
push 0
push 0
push 0
mov dword [0x43ad14], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0x407a70
push 0
push 0
mov dword [0x43ad10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43ad18], eax
neg eax
sbb eax, eax
neg eax
dec eax
ret