joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7adab0], ax
mov word [0x7adab4], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7adab0
mov dword [0x7adabc], 0x320033
mov dword [0x7adac4], 0x6c006c
mov word [0x7adab6], cx
mov dword [0x7adab8], 0x6c0065
mov dword [0x7adac0], 0x64002e
mov word [0x7adab2], dx
mov word [0x7adac8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7adaac]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7adaa8], eax
mov eax, dword [0x42eafc]
push edx
push eax
mov byte [0x429d73], 0x65
mov dword [0x429d69], 0x75747269
mov word [0x429d6d], 0x6c61
mov byte [0x429d68], 0x56
mov word [0x429d74], 0x7463
mov byte [0x429d76], 0
mov dword [0x429d6f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x422b50
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.0040d190
cmp dword [0x7adaac], 0x37
jne 0x422c1c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4047ac
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x4047c8
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x4047dc
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x4047fc
push 0x404818
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x404854
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404870
push 0x404890
push 0x4048ac
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7aeaa0]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x42eafc]
mov byte [ecx + esi], al
add esp, 0x1050
ret
Function at 0x422de0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7adaac]
sub esp, 0x48c
push ebx
push ebp
push esi
mov esi, dword [0x42eafc]
shr eax, 3
push edi
test eax, eax
je 0x422fb0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x422e14
mov esi, dword [esp + 0x14]
cmp dword [0x7adaac], 0x1c
jne 0x422e31
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x428220]
mov eax, dword [0x428224]
mov ecx, dword [0x428228]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x20], edx
mov edx, dword [0x42822c]
mov ebp, 0xc6ef3720
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x24]
mov esi, ebx
shr esi, 5
cmp dword [0x7adaac], 0x1b
mov dword [esp + 0x10], eax
jne 0x422ead
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x9c]
push ecx
push 0
push 0x404680
push 0x4046ec
push 0x404720
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x28]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0x7ada1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x7adaac], 0x1be
jne 0x422ef2
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x7adaac], 0x979
mov dword [0x7ada20], 0xff6b3619
mov dword [0x7ada24], 0xffffffff
jne 0x422f2f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x422e6a
cmp dword [0x7adaac], 0x8d4
jne 0x422f67
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0x7adaac], 0x17
jne 0x422f9f
push 0
push 0
push 0
push 0x40476c
push 0x4047a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x422e10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
Function at 0x9bc058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9bc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9bc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9bc06a
add dl, dl
jne 0x9bc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9bc0dc
xor eax, eax
add dl, dl
jne 0x9bc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9bc17d
add dl, dl
jne 0x9bc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9bc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9bc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9bc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9bc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9bc075
mov eax, 1
add dl, dl
jne 0x9bc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9bc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9bc0e1
sub eax, ebx
mov ebx, 1
jne 0x9bc128
mov ecx, 1
add dl, dl
jne 0x9bc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9bc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9bc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9bc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9bc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9bc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9bc136
cmp eax, 0x7d00
jae 0x9bc16d
cmp eax, 0x500
jb 0x9bc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9bc075
cmp eax, 0x7f
ja 0x9bc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9bc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9bc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9bc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4078cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x50d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x4078d7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x40791d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x4078fc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40793c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00437450
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x4079cc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x407982
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x407998
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x4079bf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x407971
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408eac
nop
mov ecx, 0x2be425e1
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x21ed35d9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
nop
mov ebx, 0x408ecc
mov ecx, 0xa38489e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6ab0553b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401514
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004025c4
test esi, esi
jne 0x40154a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004026b0
jmp 0x401568
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004013c8
mov edi, eax
test esi, esi
je 0x401568
cmp dword [ebx], 0
je 0x401568
dec esi
jmp 0x401551
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x401ac8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40f008], 0x8088405
inc edx
mov dword [ebx + 0x40f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x401cb4
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x401cd2
push dword [eax]
call sub.KERNEL32.DLL_SetEndOfFile
dec eax
je 0x401cdc
jmp fcn.004012f8
mov eax, 0x67
jmp fcn.004012e8
ret

Function at 0x403884
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, 0xffffffff
mov ecx, edi
shr ecx, 2
jecxz 0x4038db
mov edx, dword [esi]
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x412688]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x412688]
shr edx, 0x10
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x412688]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x412688]
add esi, 4
loop 0x403899
mov ecx, edi
and ecx, 3
jecxz 0x4038f3
mov bl, al
xor bl, byte [esi]
shr eax, 8
inc esi
xor eax, dword [ebx*4 + 0x412688]
loop 0x4038e2
xor eax, 0xffffffff
pop ebx
pop edi
pop esi
ret
Function at 0x403934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x403a56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x412a88]
mov ecx, dword [eax + 0x3c]
add ecx, dword [0x412a88]
mov eax, dword [ecx + 0x78]
xor edx, edx
push edx
push eax
mov eax, dword [0x412a88]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [0x412a88]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, ebx
shl eax, 2
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax]
xor edx, edx
push edx
push eax
mov eax, dword [0x412a88]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.004027b0
mov eax, dword [ebp - 0xc]
call fcn.00402864
mov edx, eax
mov eax, edi
call fcn.00403884
cmp eax, dword [ebp - 4]
jne 0x403a2d
mov eax, ebx
add eax, eax
add eax, dword [esi + 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [0x412a88]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ax, word [eax]
and ax, 0xffff
movzx eax, ax
shl eax, 2
add eax, dword [esi + 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [0x412a88]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax]
add eax, dword [0x412a88]
mov dword [ebp - 8], eax
inc ebx
cmp dword [ebp - 8], 0
jne 0x403a3d
cmp ebx, dword [esi + 0x18]
jne 0x403981
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a5d
lea eax, [ebp - 0xc]
call fcn.004025c4
ret

Function at 0x403e84
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
xor ecx, ecx
mov cl, byte [ebx]
mov edx, esp
lea eax, [ebx + 1]
call fcn.00401368
xor eax, eax
mov al, byte [ebx]
mov byte [esp + eax], 0
mov eax, esp
push eax
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x100
pop ebx
ret

Function at 0x403ebc
Capabilities:
Move file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
xor ecx, ecx
mov cl, byte [ebx]
mov edx, esp
lea eax, [ebx + 1]
call fcn.00401368
xor eax, eax
mov al, byte [ebx]
mov byte [esp + eax], 0
xor ecx, ecx
mov cl, byte [esi]
lea edx, [esp + 0x100]
lea eax, [esi + 1]
call fcn.00401368
xor eax, eax
mov al, byte [esi]
mov byte [esp + eax + 0x100], 0
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x4044ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00401aa8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4112e4]
cmp byte [edx + 8], 0
je 0x404550
mov edx, dword [0x4112d8]
cmp dword [edx], 2
jne 0x404550
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x404554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404604
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004044ec
test al, al
je 0x4045e6
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004026b0
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4045e6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00402a5c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00402a5c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004027b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00403ba0
inc esi
dec ebx
jne 0x40459f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40460b
lea eax, [ebp - 0x2c]
call fcn.004025c4
lea eax, [ebp - 0xc]
call fcn.004025c4
ret

Function at 0x40473c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov al, byte [ebp + 8]
dec al
je 0x40475f
dec al
je 0x404766
dec al
je 0x40476d
dec al
je 0x404774
jmp 0x40477b
mov ebx, 1
jmp 0x40477d
mov ebx, 2
jmp 0x40477d
mov ebx, 4
jmp 0x40477d
mov ebx, 3
jmp 0x40477d
xor ebx, ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push 0
mov eax, edi
call fcn.00402a5c
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x404c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x404cef
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x10]
call fcn.004025c4
mov si, word [ebp - 2]
dec esi
test si, si
jbe 0x404c7c
mov bx, 1
movzx eax, di
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax]
xor ax, bx
add di, ax
inc edi
inc ebx
dec si
jne 0x404c65
movzx eax, di
mov edx, dword [ebp - 8]
movzx esi, byte [edx + eax]
xor si, word [ebp - 2]
test si, si
jbe 0x404cc9
mov bx, 1
movzx eax, di
movzx edx, bx
add eax, edx
mov edx, dword [ebp - 8]
movzx edx, byte [edx + eax]
movzx eax, bx
movzx ecx, word [ebp - 2]
add eax, ecx
add eax, 4
xor edx, eax
lea eax, [ebp - 0x14]
call fcn.004027a0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.0040286c
inc ebx
dec si
jne 0x404c93
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00402618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cf6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004025e8
ret

Function at 0x404d7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, edx
test ecx, ecx
js 0x404d92
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x404d8b
mov eax, esp
xor esi, esi
xor ecx, ecx
movzx ebx, cx
movzx ebx, byte [eax + ebx]
lea edi, [esi + 1]
xor bx, di
add cx, bx
inc ecx
inc esi
movzx ebx, cx
lea edi, [edx + 1]
cmp ebx, edi
jne 0x404d98
mov eax, esi
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x406784
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402a4c
xor eax, eax
push ebp
push 0x4067f9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00402a5c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406800
lea eax, [ebp - 4]
call fcn.004025c4
ret
Function at 0x407fe8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, 0x412e40
xor eax, eax
push ebp
push 0x4080f2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov ecx, dword [0x412e44]
mov dl, 1
mov eax, dword [0x406ef0]
call fcn.00406f64
mov dword [edi], eax
mov eax, dword [edi]
call fcn.004070cc
jmp 0x4080b0
cmp byte [0x410f38], 0
jne 0x4080bf
lea esi, [ebx + 1]
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x407fa0]
call fcn.0040331c
add esp, 4
push esi
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x407fc4]
call fcn.0040331c
add esp, 4
mov dl, 1
mov eax, dword [0x406e54]
call fcn.00407274
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [eax + ebx*4], esi
mov edx, esi
mov eax, dword [edi]
call fcn.00407120
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + ebx*4]
mov dword [edx + eax*4 + 8], ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4]
push eax
push 0x407e84
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
inc ebx
mov eax, dword [edi]
call fcn.004070ec
test eax, eax
jne 0x408029
mov dl, 1
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4080f9
lea eax, [ebp - 8]
mov edx, dword [0x407fc4]
call fcn.00403328
lea eax, [ebp - 4]
mov edx, dword [0x407fa0]
call fcn.00403328
ret
Function at 0x408f4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [0x411244]
mov edi, 0x412e70
xor eax, eax
push ebp
push 0x408fea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00408efc
mov bx, 0x14
mov eax, dword [esi]
call fcn.00408d54
mov word [edi], ax
movzx eax, word [edi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [esi]
mov byte [edx + eax - 0x29], 6
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x408b30
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [edi]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [esi]
mov dword [ecx + edx - 0x28], eax
dec bx
jne 0x408f82
mov edx, dword [ebp - 4]
mov ax, 0xd6
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ff1
lea eax, [ebp - 8]
call fcn.004025c4
ret

Function at 0x408ff8
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 3
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x406808
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
mov edx, ebx
mov ax, 0xd1
call fcn.00404d00
pop ebx
ret

Function at 0x409108
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [0x411244]
mov edi, 0x412e70
xor eax, eax
push ebp
push 0x4091a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004090b8
mov bx, 0x14
mov eax, dword [esi]
call fcn.00408d54
mov word [edi], ax
movzx eax, word [edi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [esi]
mov byte [edx + eax - 0x29], 5
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x4091b4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [edi]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [esi]
mov dword [ecx + edx - 0x28], eax
dec bx
jne 0x40913e
mov edx, dword [ebp - 4]
mov ax, 0xd0
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4091ad
lea eax, [ebp - 8]
call fcn.004025c4
ret