joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401783
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push str.Install_Service_Procedure_Started.
call fcn.004010d2
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4017d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x18]
push eax
push str.OpenSCManager_failed__error_code___d
call fcn.00403450
mov dword [ebp - 0x2c], eax
call fcn.00402e21
add esp, 0x14
jmp 0x4018af
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push str.StopUpdates10_Guard
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40183b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x20]
push edx
push str.Failed_to_create_service__s__error_code___d
call fcn.00403450
mov dword [ebp - 0x30], eax
call fcn.00402e21
add esp, 0x18
jmp 0x4018a5
mov dword [ebp - 0xc], str.StopUpdates10_permanently_blocks_Windows_Update_service
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x10]
push edx
push 3
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push str.Set_Delayed_Auto_Start
call fcn.004010d2
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x28]
push edx
push str.Service__s_installed
call fcn.00403450
mov dword [ebp - 0x34], eax
call fcn.00402e21
add esp, 0x14
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4023d1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push str.Starting_DisableWindowsUpdates
call fcn.004010d2
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x160], 0x44
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0x410890
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 1
mov word [ebp - 0x130], 0
mov word [ebp - 0x12e], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
push str.sc.exe_config_wuauserv_start_disabled
lea eax, [ebp - 0x10c]
push eax
call fcn.00405920
add esp, 8
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x160]
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4024e2
mov byte [ebp - 4], 1
push str.sc.exe_stop_wuauserv
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00405920
add esp, 8
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x160]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402527
mov byte [ebp - 4], 1
push 4
push str.wuauserv
call fcn.004026dd
add esp, 8
push str.Executed_DisableWindowsUpdates
call fcn.004010d2
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x402547
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push str.Stopping_SU10Guard...
call fcn.004010d2
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x160], 0x44
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0x410894
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 1
mov word [ebp - 0x130], 0
mov word [ebp - 0x12e], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
push str.sc.exe_stop_SU10Guard
lea eax, [ebp - 0x10c]
push eax
call fcn.00405920
add esp, 8
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x160]
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402665
mov byte [ebp - 4], 1
push str.SU10Guard_is_trying_to_stop...
call fcn.004010d2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4026dd
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c55a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x214], 0x40f8b4
cmp dword [ebp + 8], 0
jne 0x402719
xor al, al
jmp 0x402810
cmp dword [ebp + 0xc], 1
jae 0x40272c
cmp dword [ebp + 0xc], 4
jbe 0x40272c
xor al, al
jmp 0x402810
mov byte [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00405a70
add esp, 4
cmp eax, 0x190
jbe 0x402768
xor al, al
jmp 0x402810
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push 0x40f8d8
lea eax, [ebp - 0x210]
push eax
call fcn.00405a10
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4027fb
mov byte [ebp - 4], 1
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push 0x40f8e0
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x21c], 1
jmp 0x4027e7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402803
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402821
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c564
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x214], str.SYSTEMCurrentControlSetServices_
cmp dword [ebp + 8], 0
jne 0x40285e
or eax, 0xffffffff
jmp 0x402956
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00405a70
add esp, 4
cmp eax, 0x190
jbe 0x40289e
or eax, 0xffffffff
jmp 0x402956
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push str._s_s
lea eax, [ebp - 0x210]
push eax
call fcn.00405a10
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push 0x20019
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402941
mov byte [ebp - 4], 1
mov dword [ebp - 0x224], 4
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Start
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x40292d
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402949
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402979
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 8], 0
jne 0x40298c
xor al, al
jmp 0x4029de
mov byte [ebp - 0x208], 1
mov byte [ebp - 0x204], 0
mov ecx, 0x410790
call fcn.004034c0
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x410898
mov ecx, dword [ebp + 8]
push ecx
push str.DisabledFeatures
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx edx, byte [ebp - 0x204]
cmp edx, 0x31
jne 0x4029d8
mov byte [ebp - 0x208], 0
mov al, byte [ebp - 0x208]
mov esp, ebp
pop ebp
ret

Function at 0x4029e2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov byte [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x402a01
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x402b4e
mov ecx, dword [ebp - 4]
push ecx
push str.Service_d
lea edx, [ebp - 0x410]
push edx
call fcn.00405a10
add esp, 0xc
mov byte [ebp - 0x20c], 0
mov ecx, 0x410790
call fcn.004034c0
push eax
push 0x200
lea eax, [ebp - 0x20c]
push eax
push 0x41089c
lea ecx, [ebp - 0x410]
push ecx
push str.UserServ
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx edx, byte [ebp - 0x20c]
test edx, edx
je 0x402b49
lea eax, [ebp - 0x20c]
push eax
call fcn.00402821
add esp, 4
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jle 0x402ae8
cmp dword [ebp - 0x414], 4
je 0x402ae8
push 4
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004026dd
add esp, 8
mov byte [ebp - 8], 1
lea edx, [ebp - 0x20c]
push edx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x418], esp
lea eax, [ebp - 0x41c]
push eax
push str.Service_blocked:__s
call fcn.00403450
mov dword [ebp - 0x428], eax
call fcn.00402e21
add esp, 0x14
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00403171
add esp, 4
mov byte [ebp - 8], al
jmp 0x402b49
lea edx, [ebp - 0x20c]
push edx
call fcn.00402fd4
add esp, 4
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 4
jne 0x402b49
lea eax, [ebp - 0x20c]
push eax
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x420], esp
lea edx, [ebp - 0x424]
push edx
push 0x40f96c
call fcn.00403450
mov dword [ebp - 0x42c], eax
call fcn.00402e21
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call fcn.00403171
add esp, 4
mov byte [ebp - 8], al
jmp 0x4029f8
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402fd4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c5f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 8], 0
jne 0x403004
or eax, 0xffffffff
jmp 0x403160
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0xffffffff
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x403031
xor eax, eax
jmp 0x403160
cmp dword [0x4107d0], 3
jne 0x403047
push str.OpenSCManager_is_successfull_
call fcn.004010d2
add esp, 4
mov dword [ebp - 4], 0
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40309c
push 0x40000000
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40309c
push 0x2001c
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4030ba
cmp dword [0x4107d0], 3
jne 0x4030b8
push str.Service_cannot_be_opened_
call fcn.004010d2
add esp, 4
jmp 0x403102
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x34], 4
jne 0x4030fc
cmp dword [0x4107d0], 3
jne 0x4030fc
mov edx, dword [ebp + 8]
push edx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea eax, [ebp - 0x40]
push eax
push str.Service__s_is_running...
call fcn.00403450
mov dword [ebp - 0x44], eax
call fcn.00402e21
add esp, 0x14
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x40310a
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x403128
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403130
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0
je 0x40314e
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403156
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403171
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov byte [ebp - 0x278], 0
mov dword [ebp - 0x2bc], 0x44
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0x4108a0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 1
mov word [ebp - 0x28c], 0
mov word [ebp - 0x28a], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0
mov eax, dword [ebp + 8]
push eax
push str.sc.exe_stop__s
lea ecx, [ebp - 0x264]
push ecx
call fcn.00405a10
add esp, 0xc
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x2bc]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
lea ecx, [ebp - 0x264]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40327f
mov byte [ebp - 0x278], 1
mov al, byte [ebp - 0x278]
mov esp, ebp
pop ebp
ret

Function at 0x40335a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov byte [ebp - 0x208], 0
mov byte [ebp - 0x204], 0
mov ecx, 0x410790
call fcn.004034c0
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x4108a4
push str.DisabledUpdates
push str.State
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x204]
cmp ecx, 0x31
jne 0x4033b0
mov byte [ebp - 0x208], 1
mov al, byte [ebp - 0x208]
mov esp, ebp
pop ebp
ret

Function at 0x407f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or al, 0x50
push esi
push dword [ebp + 8]
call fcn.00407c82
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x407fab
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
invalid
Function at 0x408023
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, 0x88e8458d
pop ebp
call 0xe99e087e
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
sti
invalid
inc dword [ebx - 0x7a76cf3c]
dec eax
invalid
invalid
invalid
call fcn.00407cbd
je 0x4081af
cmp ebx, edx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp
invalid
Function at 0x40808a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, 0x88e8458d
pop ebp
call 0xe99e087e
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00407ccd
push eax
push esi
push dword [ebp + 8]
call fcn.00407c82
sti
invalid
inc dword [ebx - 0x7a76cf3c]
dec eax
invalid
invalid
invalid
call fcn.00407cbd
je 0x4081af
cmp ebx, edx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp
invalid
Function at 0x40854c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x3a]
test dword [esi + 0x25fffffc], edi
lea eax, [ebp - 0x354]
push eax
call fcn.00407ccd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407c82
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
test dword [esi - 4], ecx
invalid
inc dword [edi]
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00407ccd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407c82
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
test dword [eax], ebx
cld
invalid
jmp [ecx - 0x3e67a3a]
invalid
dec dword [ebx - 0x3e57a3a]
invalid
invalid
invalid
invalid
Function at 0x1008c261
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a2250
push 0x100a2248
push 0x1009fea8
push 0x1f
call fcn.1008c129
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008c295
push dword [ebp + 8]
mov ecx, esi
call dword [fcn.1009e29c]
call esi
jmp 0x1008c29b
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008c2df
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a2260
push 0x100a2258
push 0x1009fecc
push 0x21
call fcn.1008c129
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008c316
push dword [ebp + 8]
mov ecx, esi
call dword [fcn.1009e29c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsGetValue]

Function at 0x1008c31e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a2268
push 0x100a2260
push 0x1009fee0
push 0x22
call fcn.1008c129
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008c358
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [fcn.1009e29c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsSetValue]
Function at 0x10090af0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10090b8d
push ebx
push esi
call fcn.10090ab9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1008f981
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10090b3a
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10090b8c
push edi
push eax
call fcn.1008cc00
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10090b5a
call fcn.1008be4a
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10090b8b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1008f981
add esp, 0x20
test eax, eax
jne 0x10090b79
push edi
call fcn.1008be4a
jmp 0x10090b81
push ebx
call fcn.1008be4a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10092cc4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1008a29c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x10092d33
cmp esi, dword [ebp - 4]
je 0x10092d2e
cmp dword [ebp + 0xc], 0
je 0x10092d2e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10092d0b
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10092816
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10092d35
xor eax, eax
inc eax
jmp 0x10092d35
xor eax, eax
pop edi
pop esi
leave
ret