joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f7c
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x40a00e
call fcn.00415081
cmp al, bl
mov byte [esp + 0xc], al
je 0x409f9d
call dword [sym.imp.ole32.dll_CoRevertToSelf]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x41fa3f
push ebp
push esi
push ebx
push esi
push 0x410e4c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], eax
je 0x41fa15
push 0x2710
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41f9f7
xor edi, edi
push dword [esi + 8]
call ebp
mov dword [esi + 8], ebx
pop ebp
cmp byte [esp + 0xc], bl
je 0x40a007
push edi
call fcn.0040ba26
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
xor edi, edi
inc edi
jmp 0x40a007
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call ebp
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov edi, 0x80004005
jmp 0x409ff0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x41fa2a
call edi
mov edi, eax
jmp 0x409ff0
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x409ff0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41fa54
call esi
mov edi, eax
jmp 0x409ff9
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x409ff9

Function at 0x40a7b1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x44de1c]
push esi
push edi
mov dword [ebp - 4], eax
push 0x7f
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x214], 0
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x23b]
push eax
call fcn.00411971
mov edi, 0x44db70
push edi
mov esi, 0x200
push esi
lea eax, [ebp - 0x214]
push eax
push 0x411a2d
push dword [ebp + 0xc]
lea eax, [ebp - 0x23b]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x214]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a81b
sub eax, ecx
cmp eax, 0x1ef
jae 0x40a897
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.0040a79a
test eax, eax
jne 0x40a889
cmp byte [ebp - 0x214], al
jne 0x41f6c4
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040a5b7
push dword [ebp + 8]
lea eax, [ebp - 0x23b]
push eax
call fcn.00411971
push edi
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x23b]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x41f6db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00417bd0
leave
ret 0xc
mov eax, 0x80004005
jmp 0x40a889
push 0x41f700
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040a5b7
jmp 0x40a847
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41f6ee
call esi
jmp 0x40a889
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x40a889
Function at 0x40aa52
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x442329
call fcn.00417a9e
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x10], ebx
call fcn.00415e97
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx], 0x410344
mov dword [ebx + 4], 0x410448
mov dword [ebx + 8], 0x410434
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], 8
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x30]
call fcn.00416690
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x34]
call fcn.00416690
mov byte [ebp - 4], 3
mov dword [ebx + 0x38], esi
mov byte [ebp - 4], 4
mov dword [ebx + 0x3c], esi
mov byte [ebp - 4], 5
mov dword [ebx + 0x54], esi
mov byte [ebp - 4], 6
xor eax, eax
lea edi, [ebx + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebx + 0x58]
mov esi, 0x416054
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebx + 0x68], 0xffffffff
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40e28f
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40e2c4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40e2ab
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40e2bc
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40e2c6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40e2a1
xor eax, eax
pop edi
pop esi
ret
Function at 0x411488
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x44de1c]
push esi
push edi
mov dword [ebp + 0x3ac], eax
push 0x7f
pop ecx
push dword [ebp + 0x3b8]
xor eax, eax
mov byte [ebp - 0x54], 0
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7f]
push eax
call fcn.00411971
push 0x44db70
mov esi, 0x200
push esi
lea eax, [ebp - 0x54]
push eax
push 0x411a2d
push dword [ebp + 0x3bc]
lea eax, [ebp - 0x7f]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x3c0]
lea edi, [ebp - 0x58]
lea eax, [ebp - 0x54]
call fcn.00412c4b
test al, al
jne 0x4115bc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3ac]
pop edi
pop esi
call fcn.00417bd0
add ebp, 0x3b0
leave
ret 0xc
push ebx
mov ebx, dword [ebp - 0x58]
push 0x20
push ebx
call fcn.004113f6
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x41f702
push 0
push ebx
call fcn.004113f6
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x54]
push eax
push esi
lea eax, [ebp + 0x1ac]
push eax
mov byte [ebx], 0
call fcn.004113c0
cmp byte [edi], 0
pop ebx
lea eax, [ebp + 0x1ac]
jne 0x41f708
push 0
push eax
call fcn.004113f6
pop ecx
pop ecx
lea ecx, [ebp + 0x1ac]
cmp eax, ecx
ja 0x41f715
push dword [ebp + 0x3b8]
lea eax, [ebp - 0x7f]
push eax
call fcn.00411971
push 0x44db70
lea eax, [ebp + 0x1ac]
push eax
push dword [ebp + 0x3bc]
lea eax, [ebp - 0x7f]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x41f726
xor eax, eax
jmp 0x411503
inc edi
jmp 0x4115e0
push edi
push esi
push eax
call fcn.0040a5b7
jmp 0x41161c
cmp ecx, eax
lea edx, [eax - 1]
sbb eax, eax
and eax, edx
mov byte [eax], 0
jmp 0x41161c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41f739
call esi
jmp 0x411503
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x411503

Function at 0x4119b1
Capabilities:
Read .ini file

Disassembly:
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00412136
test eax, eax
jne 0x41154f
push dword [ebp - 0x208]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4115a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20
push esi
call fcn.004113f6
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x41f7f3
jmp 0x411a1f
push dword [ebp - 0x208]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411488
jmp 0x41154f
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x44de1c]
push esi
push edi
mov dword [ebp - 4], eax
push 0x7f
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x204], 0
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x22f]
push eax
call fcn.00411971
push 0x44db70
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x411a2d
push dword [ebp + 0xc]
lea eax, [ebp - 0x22f]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [ebp - 0x204]
cmp byte [esi], 0
jne 0x411521
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00417bd0
leave
ret 8
inc esi
jne 0x411a16
jmp 0x411a1f
Function at 0x412f71
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041510b
mov esi, eax
test esi, esi
jl 0x412fa9
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp - 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call fcn.004154c6
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x416c34
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4459a1
call fcn.00417a9e
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00415e97
xor esi, esi
mov dword [ebp - 4], esi
lea ecx, [ebx + 0x2c]
mov dword [ebx], 0x416330
mov dword [ebx + 4], 0x416510
mov dword [ebx + 8], 0x4168e4
mov dword [ebx + 0xc], 0x4168d0
call fcn.00415f05
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x30], esi
call fcn.00415ee2
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x38]
call fcn.00416c11
mov byte [ebp - 4], 3
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x40], 8
mov byte [ebp - 4], 4
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], esi
mov byte [ebp - 4], 5
mov dword [ebx + 0x4c], esi
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], esi
mov byte [ebp - 4], 6
mov dword [ebx + 0x58], esi
mov byte [ebp - 4], 7
mov dword [ebx + 0x5c], esi
mov byte [ebp - 4], 8
lea edi, [ebx + 0x74]
mov esi, 0x416054
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebx + 0x84], 0
lea ecx, [ebx + 0x88]
call fcn.00416690
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x419cb3
Capabilities:
Terminate process

Disassembly:
push 0x419cf4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x419cd8
push 0x419ce4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419cd8
push dword [esp + 4]
call eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x419fdd
Capabilities:
Terminate process

Disassembly:
push 8
push 0x41a040
call fcn.00417abd
push 8
call fcn.0041806b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x44e4a8], esi
je 0x420cbe
mov dword [0x44e4a4], esi
mov al, byte [ebp + 0x10]
mov byte [0x44e4a0], al
cmp dword [ebp + 0xc], edi
jne 0x41a05c
cmp dword [0x44e414], edi
je 0x41a04c
mov eax, dword [0x44e410]
sub eax, 4
mov dword [0x44e410], eax
cmp eax, dword [0x44e414]
jb 0x41a04c
mov eax, dword [eax]
cmp eax, edi
je 0x41a020
call eax
jmp 0x41a020
push 0x44e48c
mov eax, 0x44e484
call 0x41a08c
pop ecx
push 0x44e498
mov eax, 0x44e490
call 0x41a08c
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.00419ca9
cmp dword [ebp + 0x10], edi
jne 0x420cea
mov dword [0x44e4a8], esi
push dword [ebp + 8]
call fcn.00419cb3
push esi
mov esi, eax
jmp 0x41a094
add esi, 4
cmp esi, dword [esp + 8]
jae 0x41a0a4
mov eax, dword [esi]
test eax, eax
je 0x41a091
call eax
jmp 0x41a091
pop esi
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41a005
call fcn.00417af8
ret

Function at 0x41a47c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4427ec
call fcn.00417a9e
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x418748
mov dword [esi + 4], 0x4189b4
mov dword [esi + 8], 0x418788
mov dword [esi + 0xc], 0x418cdc
mov dword [esi + 0x10], 0x418ca0
mov dword [esi + 0x14], 0x418ac0
mov dword [esi + 0x28], 0x4187ac
mov dword [esi + 0x2c], 0x418d3c
mov dword [esi + 0x30], 0x418d24
mov dword [esi + 0x34], 0x418a0c
mov dword [esi + 0x38], 0x4189a0
mov dword [esi + 0x3c], 0x418c28
and dword [ebp - 4], 0
mov dword [esi + 0x50], 0xc0000001
call fcn.00419f3a
mov ecx, dword [0x44de90]
mov eax, dword [ecx]
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041a513
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41ae81
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x443157
call fcn.00417a9e
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4195b0
mov dword [esi + 4], 0x419848
mov dword [esi + 8], 0x419820
mov dword [esi + 0xc], 0x419860
mov dword [ebp - 4], 1
push 0
push esi
mov dword [esi + 0x10], 0xc0000001
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov byte [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041aeea
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41afe7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4434eb
call fcn.00417a9e
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4195f8
mov dword [esi + 4], 0x419848
mov dword [esi + 8], 0x419820
mov dword [esi + 0xc], 0x419860
mov dword [ebp - 4], 1
push 0
push esi
mov dword [esi + 0x10], 0xc0000001
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov byte [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041b050
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4247bb
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x44de1c]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [ebp + 0x388], eax
je 0x42482a
lea eax, [ebp - 0x78]
push eax
push 0x400
push 0
push dword [esi]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42482a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4090a8
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42482a
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ecx + 0x10]
mov esi, dword [esi + 4]
cmp eax, esi
jb 0x424825
jne 0x42482a
cmp dword [ecx + 0x14], 0x20001
jne 0x42482a
xor eax, eax
inc eax
jmp 0x42482c
xor eax, eax
mov ecx, dword [ebp + 0x388]
pop esi
call fcn.00417bd0
add ebp, 0x38c
leave
ret

Function at 0x425b41
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x188]
sub esp, 0x208
mov eax, dword [0x44de1c]
push esi
mov esi, dword [ebp + 0x190]
test esi, esi
push edi
mov dword [ebp + 0x184], eax
mov edi, ecx
je 0x425bbc
push 0x200
lea eax, [ebp - 0x7c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x425bb8
lea eax, [ebp - 0x80]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425bab
push dword [ebp - 0x80]
mov ecx, edi
call fcn.00425b41
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x425b68
xor eax, eax
jmp 0x425bc1
mov eax, 0x80070057
mov ecx, dword [ebp + 0x184]
pop edi
pop esi
call fcn.00417bd0
add ebp, 0x188
leave
ret 4

Function at 0x425e35
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x425e4f
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc
Function at 0x425e78
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x425e83
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4266f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x4429d4
call fcn.00417a9e
sub esp, 0x114
mov eax, dword [0x44de1c]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov dword [ebp - 0x114], esi
mov dword [ebp - 4], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x114]
push dword [ebx]
call fcn.004025ea
cmp eax, esi
jne 0x42678f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x426749
lea eax, [ebp - 0x110]
push eax
call fcn.004266f0
cmp eax, esi
jne 0x42678e
lea eax, [ebp - 0x120]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x114]
mov dword [ebp - 0x118], pe_nt_image_headers32
call edi
test eax, eax
lea ecx, [ebp - 0x114]
je 0x426739
call fcn.004025d3
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004025d3
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00417bd0
leave
ret 4

Function at 0x426dc0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov eax, 0x442d0c
call fcn.00417a9e
sub esp, 0xc
mov dword [ebp - 0x18], ecx
call fcn.00415d8d
cmp eax, 4
jne 0x426e62
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
mov edi, 0x2001f
push edi
push ebx
push ebx
push 0x422840
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x14]
call fcn.00425de7
test eax, eax
jne 0x426e1a
mov eax, dword [ebp - 0x18]
add eax, 0x50
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
push ebx
push ebx
push edi
push ebx
push ebx
push 0x422810
push esi
lea ecx, [ebp - 0x10]
call fcn.00425de7
test eax, eax
jne 0x426e48
mov eax, dword [ebp - 0x18]
add eax, 0x50
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004025d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004025d3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x428eb4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x44de1c]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x274], ebx
mov dword [ebp - 4], eax
je 0x428f2b
lea eax, [edi + 0x150]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
cmp esi, ebx
je 0x428f2b
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
cmp eax, 3
jne 0x428ef8
xor eax, eax
inc eax
jmp 0x428f06
xor ecx, ecx
cmp eax, 2
setne cl
lea ecx, [ecx + ecx + 2]
mov eax, ecx
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
neg ecx
sbb ecx, ecx
and ecx, 4
push ecx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp byte [ebp + 8], bl
jne 0x428f3c
cmp dword [edi + 0x274], ebx
jne 0x429093
mov eax, dword [edi + 0x34]
push ebx
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push ebx
push dword [ebp + 0xc]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x429093
cmp dword [edi + 0x274], ebx
jne 0x429077
mov esi, 0x104
push esi
lea eax, [ebp - 0x288]
push eax
push dword [0x44de24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x429077
lea eax, [ebp - 0x288]
push 0x5c
push eax
call fcn.00404675
cmp eax, ebx
pop ecx
pop ecx
jne 0x428fad
lea eax, [ebp - 0x288]
jmp 0x428fae
inc eax
push 0x4290c0
mov byte [eax], bl
push esi
lea eax, [ebp - 0x288]
push eax
call fcn.0040a5b7
lea eax, [ebp - 0x288]
push 0x4290bc
push eax
call fcn.0043be9c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x28c], eax
je 0x429077
lea eax, [ebp - 0x84]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x428fec
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x84]
push eax
push 0xff
lea eax, [ebp - 0x184]
push eax
call fcn.004113c0
cmp esi, ebx
je 0x42902c
lea ecx, [ebp - 0x184]
dec ecx
mov al, byte [ecx + esi]
cmp al, 0xa
je 0x429029
cmp al, 0xd
je 0x429029
cmp al, 0xc
jne 0x42902c
dec esi
jne 0x42901a
cmp dword [ebp + 0x10], ebx
lea eax, [ebp - 0x184]
je 0x42904b
push dword [ebp + 0x10]
push 0x4290a8
push esi
push eax
call fcn.00427d58
add esp, 0x10
jmp 0x429057
push 0x4290a4
push esi
push eax
call fcn.00427d8f
push dword [ebp - 0x28c]
lea eax, [ebp - 0x184]
push eax
call fcn.0043bdb4
push dword [ebp - 0x28c]
call fcn.0043bd50
add esp, 0xc
cmp byte [ebp + 8], bl
je 0x429093
push 0x200000
add edi, 0x50
push edi
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00417bd0
leave
ret 0xc
Function at 0x42933e
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Stop service

Disassembly:
mov eax, 0x4435f4
call fcn.00417a9e
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
call fcn.00415d8d
cmp eax, 4
jne 0x4293e7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
mov edi, 0x2001f
push edi
push ebx
push ebx
push 0x422840
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x14]
call fcn.00425de7
test eax, eax
jne 0x42939b
push 0x4228e4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 1
push ebx
push ebx
push edi
push ebx
push ebx
push 0x422810
push esi
lea ecx, [ebp + 8]
call fcn.00425de7
test eax, eax
jne 0x4293c7
push 0x4228e4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.004025d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004025d3
jmp 0x429458
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x429447
push 0x10020
add esi, 0x150
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x429436
lea eax, [ebp - 0x34]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov dword [ebp - 0x10], eax
call esi
jmp 0x42943d
mov dword [ebp - 0x10], 1
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x10], ebx
jne 0x429458
mov ecx, dword [ebp - 0x18]
push ebx
push 0xc0001001
push dword [ebp + 8]
call fcn.00428eb4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4