joyce8/EMBER2024-capa huggingface dataset:
Function at 0x117529d0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x178
push ebx
push ebp
mov dword [esp + 0xc], ecx
push esi
mov esi, dword [esp + 0x188]
push edi
xor ecx, ecx
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1177bff4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x38
jl 0x117529e7
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x190], 1
je 0x11752a28
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1177c09c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x11752a5a
mov bl, byte [esp + ecx + 0x50]
jmp 0x11752a5e
mov bl, byte [esp + ecx + 0x34]
mov byte [esp + eax + 0x18], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x11752a4f
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x11752a7c
mov bl, byte [esp + ecx + 0x50]
jmp 0x11752a80
mov bl, byte [esp + ecx + 0x34]
mov byte [esp + eax + 0x18], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x11752a71
xor ecx, ecx
mov eax, 0x1177c004
xor ebx, ebx
mov bl, byte [ecx + 0x1177c0ac]
cmp byte [esp + ebx + 0x18], 0
je 0x11752aab
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1177c0c4]
cmp byte [esp + ebx + 0x18], 0
je 0x11752ac2
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x11752a92
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x11752a1b
lea esi, [esp + 0x88]
lea edi, [esp + 0x108]
mov dword [esp + 0x10], 0x10
mov edx, dword [esi + 4]
mov eax, esi
add esi, 4
mov ecx, edx
mov eax, dword [eax]
mov ebx, edx
shr ecx, 4
and ecx, 0xfc000
and ebx, 0xfc0
or ecx, ebx
mov ebx, eax
and ebx, 0xfc0
mov ebp, eax
shl ebx, 4
and ebp, 0xfc0000
add edi, 4
or ebx, ebp
add edi, 4
shr ecx, 6
shl ebx, 6
or ecx, ebx
add esi, 4
mov dword [edi - 8], ecx
mov ecx, eax
and ecx, 0x3f
and eax, 0x3f000
shl ecx, 4
or ecx, eax
mov eax, edx
shr eax, 4
shl ecx, 0xc
and eax, 0x3f00
and edx, 0x3f
or ecx, eax
mov eax, dword [esp + 0x10]
or ecx, edx
dec eax
mov dword [edi - 4], ecx
mov dword [esp + 0x10], eax
jne 0x11752af8
mov eax, dword [esp + 0x14]
lea edi, [eax + 4]
lea ecx, [eax + 0x84]
cmp edi, ecx
jae 0x11752b97
mov edx, edi
sub ecx, edi
sub edx, eax
add ecx, 3
shr ecx, 2
lea esi, [esp + edx + 0x104]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x178
ret 8
Function at 0x117530a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [ecx + 0x400]
push esi
mov esi, dword [ecx + 0x404]
push edi
xor edi, edi
test edx, edx
jle 0x11753107
push ebx
push ebp
mov ebp, dword [esp + 0x14]
inc eax
and eax, 0xff
mov edx, dword [ecx + eax*4]
add esi, edx
and esi, 0xff
mov ebx, dword [ecx + esi*4]
mov dword [ecx + eax*4], ebx
add ebx, edx
and ebx, 0xff
mov dword [ecx + esi*4], edx
mov dl, byte [ecx + ebx*4]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x18]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jl 0x117530be
pop ebp
pop ebx
mov dword [ecx + 0x404], esi
pop edi
mov dword [ecx + 0x400], eax
pop esi
ret 8
mov dword [ecx + 0x404], esi
pop edi
mov dword [ecx + 0x400], eax
pop esi
ret 8
Function at 0x11754240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
mov eax, dword [esp + 0xa8]
xor ecx, ecx
xor edx, edx
push ebx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov esi, ecx
xor ecx, ecx
push edi
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xa]
mov edi, ecx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xb]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xe]
mov ebp, ecx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xf]
shl ecx, 8
or ecx, edx
mov edx, dword [0x1177c9e4]
mov eax, ecx
mov ecx, dword [0x1177c9e0]
xor ecx, esi
mov esi, dword [esp + 0xb4]
xor edx, edi
mov dword [esp + 0x20], ecx
mov ecx, dword [0x1177c9e8]
mov dword [esp + 0x24], edx
mov edx, dword [0x1177c9ec]
xor ecx, ebp
xor edx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov eax, dword [ecx + 0x1177c9f0]
mov edx, dword [esp + ecx + 0x24]
mov ebp, dword [esp + ecx + 0x2c]
mov ebx, dword [esp + ecx + 0x28]
xor eax, edx
add ecx, 4
xor eax, ebp
xor eax, ebx
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov edx, eax
shr edx, 8
mov byte [esp + 0x12], dl
and eax, 0xff
mov edi, dword [esp + 0x11]
mov edx, dword [esp + 0x10]
mov al, byte [eax + 0x1177c8e0]
and edi, 0xff
and edx, 0xff
mov byte [esp + 0x1b], al
mov bl, byte [edi + 0x1177c8e0]
mov edi, dword [esp + 0x12]
mov dl, byte [edx + 0x1177c8e0]
and edi, 0xff
mov byte [esp + 0x19], bl
xor eax, eax
mov bl, byte [edi + 0x1177c8e0]
mov ah, dl
mov byte [esp + 0x1a], bl
mov edx, dword [esp + 0x19]
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1a]
shl eax, 8
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1b]
shl eax, 8
and edx, 0xff
or edx, eax
mov eax, edx
mov edi, edx
shr eax, 0x13
shl edi, 0xd
or eax, edi
mov edi, edx
mov ebx, edx
shl edi, 0x17
shr ebx, 9
or edi, ebx
mov ebx, dword [esp + ecx + 0x1c]
xor eax, edi
xor eax, ebx
xor eax, edx
cmp ecx, 0x80
mov dword [esp + ecx + 0x2c], eax
mov dword [ecx + esi - 4], eax
jb 0x11754301
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x117546b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
jne 0x11754749
test eax, eax
jle 0x117547d8
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
shr eax, 4
mov dword [esp + 0x2c], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x117546f3
mov eax, dword [esp + 0x24]
push esi
add eax, 4
push esi
push eax
call fcn.11754470
mov ecx, dword [esp + 0x3c]
mov edx, esi
mov eax, ecx
add esp, 0xc
mov ebx, dword [edx]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov ebx, dword [edx + 4]
mov dword [eax + 4], ebx
mov ebx, dword [edx + 8]
mov dword [eax + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x117546e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jle 0x117547d8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
add ecx, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov edx, edi
push esi
push edi
mov ebx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 8]
push eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
call fcn.11754470
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x117547a3
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x1175476e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x117547e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [eax], edi
jae 0x117547f3
xor eax, eax
pop edi
ret
test edi, edi
jbe 0x11754825
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub ebx, ebp
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea esi, [ecx + ebp]
mov dl, byte [edx + eax]
mov al, byte [ebx + esi]
xor dl, al
inc ecx
cmp ecx, edi
mov byte [esi], dl
jb 0x11754804
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
ret
Function at 0x11754850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1177ca70
push 0x116c0f44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x117548e2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x117548db
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x117548db
cmp word [eax + 0x14], dx
je 0x117548db
cmp dword [ebp + 0xc], edx
je 0x117548b5
cmp word [eax + 4], 0x14c
jne 0x117548db
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x117549d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x11754a1d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x11754a1d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x11754a1d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x11754a15
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x11754a24
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x11754a06
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x117552f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1177ca80
push 0x116c0f44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.11754a70
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x117553a3
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x1175539c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11755fe0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x11772008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1177ca9c
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x11756021
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.1168b0c0
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.1168b0c0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.11685790
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.11685790
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.11685790
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.11685790
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.11685790
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.11685790
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.11685790
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x117584f0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x1177215b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.1168b0b0
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x11758537
push eax
lea ecx, [esp + 0x18]
call fcn.1168b300
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x1175854c
push eax
lea ecx, [esp + 0x18]
call fcn.1168b300
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x117585b7
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.11691f30
add esp, 0x10
test eax, eax
jne 0x117585b0
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.1168b0c0
xor eax, eax
jmp 0x11758685
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x1175866e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x1175866e
test esi, esi
je 0x1175866e
call fcn.1169aae0
mov eax, dword [0x117be718]
test eax, eax
je 0x1175866e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.1168f570
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x117be718]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.1168b0c0
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x11758ec0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x11758edd
cmp edi, 4
jbe 0x11758edd
mov dword [0x117c1c6c], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x11758efc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.116954a0
cmp edi, 0xffffffff
je 0x11758f10
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.116954a0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11758f28
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.116954a0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11758f3e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.11695650
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11758f55
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.11695650
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11758f7d
push edi
call fcn.116bf9b7
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11758f94
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.11695650
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11758fab
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.11695ab0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11758fc1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.11695ab0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x11759f60
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117723a0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x11759f93
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x11759fab
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.11694210
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push SysStringLen
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.11694380
test eax, eax
je 0x1175a057
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.11696850
test eax, eax
jne 0x1175a00c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.11694300
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1175a03f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.116949b0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.11685920
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.11685790
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1175a11e
mov dword [eax], 0x10
jmp 0x1175a11e
mov edx, dword [0x11773dfc]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x1178f20c
push ecx
mov byte [esp + 0x24], 2
call fcn.11688710
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push SysStringLen
call fcn.11694380
test eax, eax
jne 0x1175a0cb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.11685790
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.11694300
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1175a102
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.116949b0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.11685920
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.11685790
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1175a110
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.11685790
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.11694300
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175a150
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117723c8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1175a261
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1175a261
cmp word [edi], bx
je 0x1175a261
cmp word [esi], bx
je 0x1175a261
lea ecx, [esp + 0xc]
call fcn.11694210
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1175a1ff
cmp eax, 1
je 0x1175a1ff
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.11694380
test eax, eax
jne 0x1175a1ed
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116943f0
test eax, eax
je 0x1175a250
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.11695650
mov esi, eax
jmp 0x1175a2e6
mov edx, dword [0x11773dfc]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x1178f20c
push ecx
mov byte [esp + 0x2c], 1
call fcn.11688710
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push SysStringLen
call fcn.11694380
test eax, eax
jne 0x1175a275
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685790
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.11694300
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11773dfc]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.116bfee5
add esp, 8
cmp eax, ebx
je 0x1175a29f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.11685a10
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1175a2b8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.11685790
jmp 0x1175a243
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.11695650
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.11685790
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685790
lea ecx, [esp + 0xc]
call fcn.116943d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.11694300
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175b140
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11772520
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.1168b120
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1168b120
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x117c1d58]
test eax, eax
je 0x1175b1f8
cmp ebp, eax
jne 0x1175b1f8
mov eax, dword [0x117c1d5c]
test eax, eax
je 0x1175b1f8
cmp ebx, eax
jb 0x1175b1f8
add eax, 0x493e0
cmp eax, ebx
jb 0x1175b1f8
mov ebp, dword [0x117c1d60]
push 1
inc ebp
push 0x117c1c78
lea ecx, [esp + 0x18]
mov dword [0x117c1d60], ebp
call fcn.11693600
push 0x117c1ca8
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1168b300
push 0x117c1c98
mov ecx, edi
call fcn.1168b300
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1175b26e
push edi
push esi
mov dword [0x117c1d60], 0
call fcn.1175b570
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x117c1c78
call fcn.11693600
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1ca8
mov dword [esp + 0x38], 1
mov dword [0x117c1d58], ebp
mov dword [0x117c1d5c], ebx
call fcn.1168b120
push esi
mov ecx, 0x117c1ca8
call fcn.1168b300
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1c98
call fcn.1168b120
push edi
mov ecx, 0x117c1c98
call fcn.1168b300
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.11693660
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret