joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x45c3c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xaa
lea eax, [ebp - 0x20]
call fcn.00404588
mov eax, dword [ebp - 4]
call fcn.00404848
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80000001
jns 0x45c2f9
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x45c30a
lea eax, [ebp - 4]
mov edx, 0x45c3d4
call fcn.00404850
mov eax, dword [ebp - 4]
call fcn.00404848
sar eax, 1
jns 0x45c319
adc eax, 0
test eax, eax
jle 0x45c38b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x14]
add edx, edx
dec edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00404aa8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x45c3e0
call fcn.00404894
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.0040308c
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0xc]
xor byte [ebp - 0x19], al
add dword [ebp - 0xc], 0x11
and dword [ebp - 0xc], 0xff
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0x19]
call fcn.00404770
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
call fcn.00404850
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x45c327
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.004045dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c3c8
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004045ac
lea eax, [ebp - 0x20]
call fcn.00404588
lea eax, [ebp - 4]
call fcn.00404588
ret

Function at 0x45c3e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.004093bc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004093a8
mov eax, dword [ebp - 0xc]
call fcn.00409408
mov esp, ebp
pop ebp
ret

Function at 0x45ead8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.0040271c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45eb49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eb50
mov eax, dword [ebp - 0xc]
call fcn.0040273c
ret
Function at 0x45ebd8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x45ed66
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor edx, edx
mov eax, 2
call fcn.0045e52c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x138], 0x128
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x10]
call fcn.0045e54c
mov dword [ebp - 0xc], eax
jmp 0x45ed2d
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004047f8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409044
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408570
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408570
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404994
je 0x45ed01
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004047f8
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00408570
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.00408570
mov edx, dword [ebp - 0x154]
pop eax
call fcn.00404994
jne 0x45ed1c
push 0
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x10]
call fcn.0045e56c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45ec5c
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ed6d
lea eax, [ebp - 0x154]
mov edx, 7
call fcn.004045ac
lea eax, [ebp - 4]
call fcn.00404588
ret

Function at 0x461ec0
Capabilities:
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x400
mov eax, dword [ebp - 8]
call fcn.004093bc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x461f0f
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004093a8
jmp 0x461f5e
call fcn.00460858
test al, al
je 0x461f4c
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0x461f94
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x461f42
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x410]
call fcn.004093a8
jmp 0x461f5e
lea eax, [ebp - 0xc]
call fcn.00404588
jmp 0x461f5e
lea ecx, [ebp - 0xc]
mov edx, 0x461fa8
mov eax, 0x461fbc
call fcn.0046072c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004045dc
mov eax, dword [ebp - 0x10]
call fcn.00409408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f8e
lea eax, [ebp - 0xc]
call fcn.00404588
ret
Function at 0x46220c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404588
call fcn.00460858
test al, al
je 0x462251
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0x462258
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x462251
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x404]
call fcn.004093a8
mov esp, ebp
pop ebp
ret

Function at 0x462868
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4629d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040907c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408570
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404848
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.00404aa8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4629e4
call fcn.00404994
jne 0x4628e6
lea eax, [ebp - 0x1c]
mov edx, 0x4629f0
call fcn.00404620
mov eax, dword [ebp - 0x1c]
call fcn.00404a48
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408f7c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00404620
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x462960
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x462a00
call fcn.00404894
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x41577c]
call fcn.0040c328
call fcn.00403f40
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
call fcn.0041ace8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041a7cc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040730c
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4629d7
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004045ac
lea eax, [ebp - 4]
call fcn.00404588
ret
Function at 0x4642f0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4643a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x464385
push 0x10
mov eax, dword [ebp - 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x46435c
mov byte [ebp - 9], 0
jmp 0x46437c
mov eax, 0x4643b0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4643a7
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045ac
ret

Function at 0x4643b4
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x46445c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x464441
push 0x20
mov eax, dword [ebp - 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x464420
mov byte [ebp - 9], 0
jmp 0x464438
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464463
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045ac
ret
Function at 0x46446c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4644d4
push 4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4644cb
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4644c2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x464fd4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x465062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404a48
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x465026
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404a48
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
mov ax, word [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465069
lea eax, [ebp - 8]
call fcn.00404588
ret
Function at 0x46636c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46655b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402aa4
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x4663c0
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4663da
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x4663df
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x80], 0
jne 0x4663f2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x466403
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00404a48
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004658f8
mov eax, dword [ebp - 0x24]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.00404a48
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.0045bdc4
mov eax, dword [ebp - 0x28]
call fcn.00404a48
push eax
mov eax, dword [ebp - 4]
call fcn.00465aa4
push eax
mov eax, dword [ebp - 4]
call fcn.00465a60
push eax
mov eax, dword [ebp - 4]
call fcn.004659f8
push eax
push 0xf01ff
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00465740
mov eax, dword [ebp - 0x2c]
call fcn.00404a48
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x90], edx
cmp dword [ebp - 0x10], 0
jne 0x4664ae
call fcn.0040da38
xor eax, eax
push ebp
push 0x466531
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4664f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x4664e9
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46651a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466538
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x46656c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x466598
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xb4]
call dword [ebx + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4665c0
call fcn.0040da38
xor eax, eax
push ebp
push 0x4665f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4665e0
call fcn.0040da38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4665fe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x401000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 8], 0
mov ebx, 0x41
mov dword [ebp - 4], 0x1a
push ebx
lea eax, [ebp + 8]
push 0x405228
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
call edi
cmp eax, 3
jne 0x401065
xor eax, eax
mov cl, byte [ebp + eax + 8]
mov byte [ebp + eax - 0x14], cl
inc eax
test cl, cl
jne 0x401045
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 3
push edx
jmp 0x4010be
lea eax, [ebp + 8]
push eax
call edi
cmp eax, 5
jne 0x401092
xor eax, eax
mov cl, byte [ebp + eax + 8]
mov byte [ebp + eax - 0x14], cl
inc eax
test cl, cl
jne 0x401072
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], 5
push ecx
jmp 0x4010be
lea edx, [ebp + 8]
push edx
call edi
cmp eax, 2
jne 0x4010c4
xor eax, eax
nop
mov cl, byte [ebp + eax + 8]
mov byte [ebp + eax - 0x14], cl
inc eax
test cl, cl
jne 0x4010a0
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 2
push eax
push esi
call fcn.00401800
inc ebx
dec dword [ebp - 4]
jne 0x401025
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push esi
mov dword [ebp - 8], 1
call fcn.00401800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401360
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0x84], eax
mov byte [esi + 4], al
mov byte [esi + 0x90], al
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x160
lea ecx, [ebp - 0x2a0]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x510
push 0x160
lea edx, [ebp - 0x2a0]
push edx
push 0x80
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edx, [esi + 4]
mov eax, ebx
sub edx, ebx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4013e0
mov ecx, dword [ebp - 0x120]
sub ecx, dword [ebp - 0x124]
pop edi
mov dword [esi + 0x84], ecx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401410
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00403e40
push edi
lea eax, [ebp + 0x10]
push 0x405268
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x40143f
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xbc
mov eax, dword [ebp + 0x90]
push ebx
push esi
xor esi, esi
test eax, eax
je 0x4014a3
mov ebx, dword [sym.imp.MSVCR100.dll_fwrite]
mov ecx, eax
sub ecx, esi
push 0
lea edx, [ebp - 0x1000]
push 0
cmp ecx, 0x1000
jbe 0x4014b8
mov eax, dword [ebp + 8]
push 0x1000
push edx
push eax
call fcn.004018f0
push edi
test eax, eax
je 0x4014ee
push 0x1000
lea ecx, [ebp - 0x1000]
push 1
push ecx
call ebx
add esp, 0x10
cmp eax, 0x1000
jne 0x40150c
add esi, eax
mov eax, dword [ebp + 0x90]
cmp esi, eax
jb 0x401453
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xbc
sub eax, esi
push eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.004018f0
push edi
test eax, eax
je 0x40152b
mov ecx, dword [ebp + 0x90]
sub ecx, esi
push ecx
lea edx, [ebp - 0x1000]
push 1
push edx
call ebx
mov ecx, dword [ebp + 0x90]
sub ecx, esi
add esp, 0x10
cmp eax, ecx
je 0x4014a3
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
lea edx, [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xbc
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xbc
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xbc
Function at 0x401550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00403e40
push esi
lea eax, [ebp + 0x10]
push 0x40526c
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40157f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xbc
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fseek]
push 2
push 0
push esi
call ebx
add esp, 0xc
test eax, eax
je 0x4015a8
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xbc
push edi
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
jne 0x4015cf
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xbc
push 0
push 0
push esi
call ebx
add esp, 0xc
push esi
test eax, eax
jne 0x4015bb
push 0x1000
lea ecx, [ebp - 0x1000]
mov dword [ebp + 0x90], edi
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push 1
push ecx
call edi
add esp, 0x10
test eax, eax
je 0x401632
mov ebx, dword [ebp + 8]
push 0
push 0
push eax
lea edx, [ebp - 0x1000]
push edx
push ebx
call fcn.00401800
push esi
test eax, eax
je 0x4015bb
push 0x1000
lea eax, [ebp - 0x1000]
push 1
push eax
call edi
add esp, 0x10
test eax, eax
jne 0x401604
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xbc

Function at 0x401730
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
je 0x40174f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, 1
pop ebp
ret 4

Function at 0x4017b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [ebp + 0x10]
mov ecx, 2
push edx
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], cx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 8]
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
mov esp, ebp
pop ebp
ret 0xc