joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402770
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
invalid

Function at 0x40521c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40523d
mov al, byte [esp]
jmp 0x40523f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40658c
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
pushfd
sub dword [0x40b881], ebx
xchg eax, esi
call fcn.00401629
not edi
or ebx, dword [0x40bfa1]
xor dword [0x40b85b], ebx
or dword [0x40b707], eax
rol edx, 0x14
xor ecx, eax
add esi, dword [0x40bb10]
neg esi
or eax, dword [0x40bc88]
ror edi, 1
xchg ebx, esi
or dword [0x40b78e], esi
sub ecx, dword [0x40bd23]
Function at 0x40694c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
not ecx
sub dword [0x40b941], esi
xor edx, ebp
sub ebx, esi
sub dword [0x40b423], eax
xor ecx, eax
and ebx, 0x10a71c44
xor edi, eax
call fcn.00401b14
or ebx, 0x9b749f3a
neg edx
cmp esp, 0xced2ab74
jne 0x40697f
xchg ebx, esi
and ebx, 0x7033324c
xchg ebx, eax
shl eax, 0x10
xor esi, 0x91551159
or ebx, 0xef024d0a
ror eax, 5
mov edx, 0xc64a7d89
and ecx, ebx
test dword [0x40b03c], ebp
jbe 0x4069aa
mov ecx, edx
mov esi, 0x53e72c65
add edx, 0xbb7bfbf4
shl eax, 7
add edi, esp
inc eax
add ebx, 0xb1d8f08c
test ecx, eax
jg 0x4069cb
mov dword [0x40b938], ecx
or edx, dword [0x40b218]
call fcn.00402952
ror edi, 0x17
call fcn.00407c8b
dec ecx
not edx
cmp ebp, 0x7fab9412
je 0x4069ec
rol esi, 0x12
cmp esi, ebp
jp 0x4069f2
add esi, edx
mov ecx, 0xf8d26e0
xor edx, edi
shr esi, 0x1c
shl esi, 0x15
sub dword [0x40b666], ecx
or ebx, 0xf31d8263
xchg edi, eax
sub edi, 0x961d5a47
or dword [0x40b569], edx
invalid
invalid
invalid

Function at 0x406ba4
Capabilities:
Hash data using murmur3

Disassembly:
fld st(1)
rcr byte [ecx], 0x46
xor dword [0x40b561], 0x28f0275e
or ecx, dword [0x40bc6b]
neg esi
neg esi
dec esi
ror eax, 0x19
sub ebx, ecx
call fcn.004016f6
inc edi
dec eax
or dword [0x40b5d3], ecx
mov esi, 0x9f570a26
add edx, dword [0x40bc16]
rol edx, 0x10
add edx, 0x55042672
ror edx, 6
xor esi, 0x957ca968
call fcn.0040549e
ror ebx, 0x12
add esi, dword [0x40bd4a]
and dword [0x40b71e], 0x9c7029b0
add byte [eax + 0x2b9c7029], dh
xor eax, 0x40bc9c
xor edi, edx
or dword [0x40b457], ebx
or eax, dword [0x40be19]
rol edx, 0x10
xchg ecx, eax
sub ecx, esp
ror ebx, 6
add dword [0x40b972], edi
xor dword [0x40b6b6], ecx
rol ebx, 6
add ecx, esp
xchg ecx, eax
ror edx, 0x10
xor edi, edx
rol ebx, 0x12
call fcn.004042d2
xor esi, 0x957ca968
rol edx, 6
sub edx, 0x55042672
ror edx, 0x10
and esi, 0x3a13fea
xor edx, dword [0x40bf48]
dec edx
and dword [0x40b907], ebx
call fcn.00402f27
dec esi
xor dword [0x40b712], ebx
add dword [0x40b974], ebx
call fcn.00405379
not ecx
ror eax, 0x18
call fcn.00407c8b
sub edi, ebx
xchg ecx, edx
sub dword [0x40b7a7], ebx
call fcn.00403bd5
sub edx, edi
xor eax, 0x608cf8d
xchg edi, esi
xor eax, esp
xor eax, esp
xchg edi, esi
xor eax, 0x608cf8d
add edx, edi
xchg ecx, edx
add edi, ebx
call fcn.00408bd2
rol eax, 0x18
not ecx
add dword [0x40b579], ebx
inc esi
call fcn.00404c78
push dword [ecx]
cmp eax, 0x40b968
Function at 0x406c00
Capabilities:
Hash data using murmur3

Disassembly:
fld st(1)
rcr byte [ecx], 0x46
xor dword [0x40b561], 0x28f0275e
or ecx, dword [0x40bc6b]
neg esi
neg esi
dec esi
ror eax, 0x19
sub ebx, ecx
call fcn.004016f6
inc edi
dec eax
or dword [0x40b5d3], ecx
mov esi, 0x9f570a26
add edx, dword [0x40bc16]
rol edx, 0x10
add edx, 0x55042672
ror edx, 6
xor esi, 0x957ca968
call fcn.0040549e
ror ebx, 0x12
add esi, dword [0x40bd4a]
and dword [0x40b71e], 0x9c7029b0
add byte [eax + 0x2b9c7029], dh
xor eax, 0x40bc9c
xor edi, edx
or dword [0x40b457], ebx
or eax, dword [0x40be19]
rol edx, 0x10
xchg ecx, eax
sub ecx, esp
ror ebx, 6
add dword [0x40b972], edi
xor dword [0x40b6b6], ecx
rol ebx, 6
add ecx, esp
xchg ecx, eax
ror edx, 0x10
xor edi, edx
rol ebx, 0x12
call fcn.004042d2
xor esi, 0x957ca968
rol edx, 6
sub edx, 0x55042672
ror edx, 0x10
and esi, 0x3a13fea
xor edx, dword [0x40bf48]
dec edx
and dword [0x40b907], ebx
call fcn.00402f27
dec esi
xor dword [0x40b712], ebx
add dword [0x40b974], ebx
call fcn.00405379
not ecx
ror eax, 0x18
call fcn.00407c8b
sub edi, ebx
xchg ecx, edx
sub dword [0x40b7a7], ebx
call fcn.00403bd5
sub edx, edi
xor eax, 0x608cf8d
xchg edi, esi
xor eax, esp
xor eax, esp
xchg edi, esi
xor eax, 0x608cf8d
add edx, edi
xchg ecx, edx
add edi, ebx
call fcn.00408bd2
rol eax, 0x18
not ecx
add dword [0x40b579], ebx
inc esi
call fcn.00404c78
push dword [ecx]
cmp eax, 0x40b968

Function at 0x406f74
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ebx], dh
mov ecx, 0xf68105c3
lds esi, [edx + 0x1d29a866]
ret 0x40b6

Function at 0x406ff8
Capabilities:
Hash data using murmur3

Disassembly:
add byte [edi - 0x1af2de2f], al
mov ah, 0x40
add cl, al
invalid

Function at 0x4071e0
Capabilities:
Hash data using murmur3

Disassembly:
neg eax
inc ebx
dec esi
ror edx, 0x1b
not edi
call fcn.00404bbf
xchg ecx, esi
inc esi
xchg eax, esi
push ecx
inc ecx
dec esi
call fcn.00407c8b
add esi, ebp
ror esi, 3
not esi
inc eax
xchg edx, eax
or eax, dword [0x40bbc8]
ror ebx, 0x1a
xor edx, dword [0x40bbb8]
add dword [0x40b9cc], 0x976fb141
call fcn.00407c8b
xor ebx, esp
dec esi
or edx, dword [0x40bed7]
xor edx, 0xea36a1f
and dword [0x40b5d8], esi
sub ebx, 0x1d49068
xor eax, edi
call fcn.00402625
call fcn.0040863f
xor eax, edi
add ebx, 0x1d49068
sub dword [0x40b789], ebx

Function at 0x407258
Capabilities:
Hash data using murmur3

Disassembly:
xor edx, 0xea36a1f
inc esi
xor ebx, esp
call fcn.00407c8b
add dword [0x40b5ef], 0xaea26737
rol ebx, 0x1a
xchg edx, eax
dec eax
not esi
rol esi, 3
sub esi, ebp
inc esi
dec ecx
push esp
xor eax, edx
dec esi
xor edx, dword [0x40bbbd]
neg esi
xchg esi, edx
neg ecx
xchg ebx, esi
ror edx, 0xc
xor edi, 0x1dbcf901
not ecx
call fcn.00408f09
rol ebx, 2
Function at 0x4072a4
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00404f10
mov dword [0x40b911], ecx
call fcn.0040648a
xchg eax, edx
neg esi
call fcn.00401848
sub esi, 0x272342a4
ror ecx, 0xd
rol ecx, 0xd
add esi, 0x272342a4
call fcn.004091e7
neg esi
xchg eax, edx
call fcn.00401848
ror ebx, 2
call fcn.00407c8b
not ecx
xor edi, 0x1dbcf901
rol edx, 0xc
xchg ebx, esi
neg ecx
xchg esi, edx
neg esi
inc esi
xor eax, edx
push eax
xor ebx, dword [0x40bd30]
rol edx, 0x17
or edx, dword [0x40bf64]
xchg esi, edx
add ebx, dword [0x40bc2b]
call fcn.00405d9c
xor eax, dword [0x40bec4]
add edx, dword [0x40bc89]
not eax
rol ecx, 0x16
inc eax
dec eax
ror ecx, 0x16
not eax
call fcn.004060c4
xchg esi, edx
ror edx, 0x17
call dword [sym.imp.kernel32.dll_GetProcAddress]
neg ebx
or ecx, dword [0x40be02]
xor ecx, dword [0x40bbef]
xor esi, 0x24e4da6e
neg edi
add dword [0x40b785], esi
dec ecx
xchg eax, edx
neg esi
rol eax, 0x1d
not esi
xchg ebx, eax
not edx
rol edx, 0x1e
not eax
xor ebx, ebp
not esi
sub dword [0x40b48e], esi
not esi
xor ebx, ebp
not eax
ror edx, 0x1e
not edx
xchg ebx, eax
not esi
ror eax, 0x1d
neg esi
xchg eax, edx
inc ecx
neg edi
xor esi, 0x24e4da6e
neg ebx
add esp, 0x10
inc esi
call fcn.00402c70
xor edi, dword [0x40bfdb]
not esi
xchg ebx, edx
or dword [0x40b8ef], edx
mov dword [0x40b898], ecx
xor eax, 0x8ecd42f9
add eax, 0x8163de40
add dword [0x40b8e1], eax
xor esi, edx
rol eax, 0x19
inc ebx
neg esi
xor ecx, esi
xor ecx, esi
neg esi
dec ebx
ror eax, 0x19
xor esi, edx
sub eax, 0x8163de40
xor eax, 0x8ecd42f9
or dword [0x40b41e], edi
xchg ebx, edx
not esi
dec esi
mov ebx, 0xe022209a
add ecx, dword [0x40be61]
xor dword [0x40b835], edi
inc esi
dec esi
xor eax, dword [0x40bec7]
not ebx
sub edi, esp
rol ebx, 0x14
xchg edi, esi
rol edx, 0x1b
dec edi
or esi, dword [0x40bdcd]
mov dword [0x40b90a], edi
xor dword [0x40b64a], edx
sub ebx, 0xafe2922d
inc ebx
or edx, dword [0x40be7d]
rol ebx, 2
ror ebx, 2
dec ebx
add ebx, 0xafe2922d
add dword [0x40b461], ecx
inc edi
ror edx, 0x1b
xchg edi, esi
ror ebx, 0x14
add edi, esp
not ebx
inc esi
dec esi
add dword [0x40b68b], ecx
or ebx, 0xc00c05d4
not esi
or esi, dword [0x40bcfa]
ror ecx, 0x16

Function at 0x407474
Capabilities:
Hash data using murmur3

Disassembly:
sub dword [0x40b69c], ebx
xor ecx, edi
xor esi, ebx
xor dword [0x40b9e5], 0x437d44b1
xor ecx, 0x55fa291d
or esi, dword [0x40bd20]
not ebx
xor esi, dword [0x40bfa4]
Function at 0x40749c
Capabilities:
Hash data using murmur3

Disassembly:
neg ecx
neg ecx
not ebx
xor ecx, 0x55fa291d
xor esi, ebx
xor ecx, edi
xor dword [0x40b4ab], esi
rol ecx, 0x16
push ss
not esi
sub ebx, 0xe02e259e
call fcn.004024ef
not ebx
inc edx
call fcn.00403900
xor edx, edi
xor ebx, 0x543fb2fe
call fcn.0040542b
dec esi
add edi, dword [0x40bd5d]
ror edi, 0xc
rol edi, 0xc
inc esi
call fcn.004021bb
xor ebx, 0x543fb2fe
xor edx, edi
dec edx
not ebx
call fcn.0040606f
push ebx
not ebx
xor edx, eax
sub edx, dword [0x40bc7f]
not esi
rol ecx, 0x10
not esi
xchg edi, esi
ror ecx, 0x12
sub esi, dword [0x40bb6d]
call fcn.0040606f
call fcn.00407c8b
rol ecx, 0x12
xchg edi, esi
not esi
ror ecx, 0x10
not esi
xor edx, eax
not ebx
mov esi, 0x9e40f4cc
inc esi
sub eax, dword [0x40be96]
add dword [0x40b544], ebx
xor ecx, dword [0x40be07]
call fcn.00402e37
xor edi, edx
add ecx, dword [0x40bbdc]
sub eax, ebx
neg ecx
xor ebx, 0xab7f168f
xor ecx, 0xb591bbb5
call fcn.004022c1
or eax, dword [0x40bb19]
and dword [0x40b4b0], esi
call fcn.004054d3
xor ecx, 0xb591bbb5
xor ebx, 0xab7f168f
neg ecx
add eax, ebx
xor edi, edx
xor dword [0x40b5c8], eax
dec esi
or esi, 0x1783d499
call fcn.00401848
not edi
sub edx, dword [0x40bdee]
xor dword [0x40b503], edx
sub dword [0x40b67c], eax
or ecx, dword [0x40ba1a]
call fcn.00405201
xchg eax, esi
add dword [0x40b73d], ecx
not ecx
rol ecx, 0xc
xor edx, 0xec7b57c0
inc esi
sub eax, 0xe45c82b8
dec esi
add eax, dword [0x40bdf0]
mov dword [0x40b651], edx
add edi, 0x981d7ea7
sub edi, 0x981d7ea7
inc esi
add eax, 0xe45c82b8
dec esi
xor edx, 0xec7b57c0
ror ecx, 0xc
not ecx
mov dword [0x40b421], ebx
xchg eax, esi
add dword [0x40b85a], edx
not edi
call fcn.004054f5
add esi, 0x603c3b23
add dword [0x40b6de], edi
add esi, edi
xor esi, 0xfdd13e8d
add edx, esp
xor edx, ebx
rol ecx, 0x1d
add edi, ecx
xor eax, dword [0x40bd89]
or dword [0x40b72e], 0xe2f5073c
add esi, 0xd6965a10
add eax, dword [0x40bdce]
dec ebx
sub dword [0x40b5ed], 0x167b5fac
neg ebx
add esi, 0x46fb335
not esi
ror ebx, 0x1f
xor edi, esi
sub edx, dword [0x40bec6]
ror edi, 9
not eax
sub ecx, 0x8f7b7545
invalid
invalid

Function at 0x408f90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f44
test al, al
jne 0x408fb1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408ffd
xor eax, eax
push ebp
push 0x408fed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033e8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ff4
lea eax, [ebp - 0xc]
call fcn.00408f80
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094ac
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409506
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094d2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4094e0
cmp edi, 1
jle 0x4094e0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
ret
call fcn.00408f90
test eax, eax
jne 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409506
inc edi
dec esi
jne 0x4094c2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409510
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x40955d
xor ebx, ebx
jmp 0x409552
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c04
test eax, eax
jne 0x409551
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409533
mov al, byte [ebp - 1]
sub al, 1
jb 0x409568
je 0x409571
jmp 0x40957a
call fcn.00406ff8
mov edi, eax
jmp 0x40957c
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x40957c
xor edi, edi
test di, di
je 0x40960d
xor ebx, ebx
jmp 0x4095b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095b7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095ac
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095b7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409589
xor ebx, ebx
jmp 0x409602
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409601
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095f6
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409601
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095c7
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x401c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x401b07
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.00401974
out dx, al
insd dword es:[di], dx
cmp ecx, dword [ebx - 0x38fcdfba]
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x401b16
and dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x401b36
call fcn.00401974
aam 0xd0
loop 0x401b77
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x401b45
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
jbe 0x401b1b
jmp 0x401b07
mov eax, dword [edi + ebx*4]
shl eax, 6
inc edi
adc al, 0x8d
je 0x401bb4
sbb byte [ecx - 0x1017438b], cl
std
invalid
dec esi
or al, 0xf
mov bh, 0xd0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x401bc8
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x401bb9
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
inc ebp
mov ch, 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00401974
rol byte [edi + 0x33], 9
lea eax, [ebp - 0x58]
push eax

Function at 0x401d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401984
push eax
push esi
push dword [ebp + 8]
call fcn.00401939
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401974
scasd eax, dword es:[edi]
inc ecx
outsd dx, dword [esi]
pop esi
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x401e0a
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x401e12
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.00401974
sti
lcall 0xffff, 0x7c858d21
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x402590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
invalid
test edx, edi

Function at 0x4028f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
cld
invalid
push dword [eax]
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
invalid
invalid

Function at 0x406750
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.004099d0
test eax, eax
je 0x406782
mov eax, 1
jmp 0x406827
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4067a1
xor eax, eax
jmp 0x406827
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
mov edx, dword [ebp - 0x21c]
add edx, 0x230
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40680e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x406827
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x401f19
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x401708], eax
je 0x401f3b
cmp dword [0x401708], ebx
jne 0x401fd4
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x401708
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x401708], esi
test esi, esi
jne 0x401faa
mov dword [0x401708], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x401708
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x401708]
not eax
mov dword [0x404164], eax
pop esi
pop ebx
leave
ret

Function at 0x401fd7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x401708]
jne 0x4024d9
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x404380], eax
mov dword [0x40437c], ecx
mov dword [0x404378], edx
mov dword [0x404374], ebx
mov dword [0x404370], esi
mov dword [0x40436c], edi
mov word [0x404398], ss
mov word [0x40438c], cs
mov word [0x404368], ds
mov word [0x404364], es
mov word [0x404360], fs
mov word [0x40435c], gs
pushfd
pop dword [0x404390]
mov eax, dword [ebp]
mov dword [0x404384], eax
mov eax, dword [ebp + 4]
mov dword [0x404388], eax
lea eax, [ebp + 8]
mov dword [0x404394], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4042d0], 0x10001
mov eax, dword [0x404388]
mov dword [0x404284], eax
mov dword [0x404278], 0xc0000409
mov dword [0x40427c], 1
mov eax, dword [0x401708]
mov dword [ebp - 0x328], eax
mov eax, dword [0x404164]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x4042c8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x401714
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x4042c8], 0
jne 0x4025c5
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x402af2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x401708]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x4017dc
push 0x401788
push 0x80000002
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x402b84
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x402b84
shr ecx, 1
cmp word [ebp + ecx*2 - 0x210], 0x5c
push 0xffffffffffffffff
sete al
lea eax, [eax*2 + 0x4018a0]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.00402c09
jmp 0x402b86
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00401fd7
leave
ret 4

Function at 0x402b95
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x401708]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x401828
push 0x401720
push 0x80000002
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x402bf8
cmp dword [ebp - 0x210], 4
jb 0x402bf8
lea eax, [ebp - 0x20c]
push eax
call fcn.00402c09
jmp 0x402bfa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00401fd7
leave
ret 4