joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5df976
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov word [ebp - 0x10], 0
movsx eax, word [ebp + 8]
movsx ecx, word [ebp + 0xc]
cmp eax, ecx
jg 0x5df99e
movsx edx, word [ebp + 8]
test edx, edx
jl 0x5df99e
movsx eax, word [ebp + 0xc]
test eax, eax
jge 0x5df9b2
push str.Division_Error_n
call fcn.00609689
add esp, 4
push 0
call fcn.00607fcc
movsx ecx, word [ebp + 0xc]
test ecx, ecx
jne 0x5df9ce
push str.Division_by_0__Fatal_error__n
call fcn.00609689
add esp, 4
push 0
call fcn.00607fcc
movsx edx, word [ebp + 8]
test edx, edx
jne 0x5df9e1
mov word [ebp - 0x10], 0
jmp 0x5dfa78
movsx eax, word [ebp + 8]
movsx ecx, word [ebp + 0xc]
cmp eax, ecx
jne 0x5df9f8
mov word [ebp - 0x10], 0x7fff
jmp 0x5dfa78
mov dx, word [ebp + 8]
push edx
call fcn.005df820
add esp, 4
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call fcn.005df820
add esp, 4
mov dword [ebp - 8], eax
mov word [ebp - 4], 0
jmp 0x5dfa2c
mov cx, word [ebp - 4]
add cx, 1
mov word [ebp - 4], cx
movsx edx, word [ebp - 4]
cmp edx, 0xf
jge 0x5dfa78
mov ax, word [ebp - 0x10]
shl ax, 1
mov word [ebp - 0x10], ax
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jl 0x5dfa76
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005df33f
add esp, 8
mov dword [ebp - 0xc], eax
push 1
mov dx, word [ebp - 0x10]
push edx
call fcn.005def69
add esp, 8
mov word [ebp - 0x10], ax
jmp 0x5dfa20
mov ax, word [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5dfb32
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov word [ebp - 0xc], 0
movsx eax, word [ebp + 0xc]
test eax, eax
jne 0x5dfb5a
push str.Division_by_0_in_div_l__Fatal_error__n
call fcn.00609689
add esp, 4
push 0
call fcn.00607fcc
cmp dword [ebp + 8], 0
jl 0x5dfb68
movsx ecx, word [ebp + 0xc]
test ecx, ecx
jge 0x5dfb7c
push str.Division_Error_in_div_l__Fatal_error__n
call fcn.00609689
add esp, 4
push 0
call fcn.00607fcc
mov dx, word [ebp + 0xc]
push edx
call fcn.005df80b
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jl 0x5dfb9d
mov ax, 0x7fff
jmp 0x5dfc34
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.005df6b3
add esp, 8
mov dword [ebp + 8], eax
push 1
mov edx, dword [ebp - 4]
push edx
call fcn.005df6b3
add esp, 8
mov dword [ebp - 4], eax
mov word [ebp - 8], 0
jmp 0x5dfbd3
mov ax, word [ebp - 8]
add ax, 1
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
cmp ecx, 0xf
jge 0x5dfc30
push 1
mov dx, word [ebp - 0xc]
push edx
call fcn.005deffa
add esp, 8
mov word [ebp - 0xc], ax
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.005df625
add esp, 8
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jl 0x5dfc2e
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005df33f
add esp, 8
mov dword [ebp + 8], eax
push 1
mov cx, word [ebp - 0xc]
push ecx
call fcn.005def69
add esp, 8
mov word [ebp - 0xc], ax
jmp 0x5dfbc7
mov ax, word [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5faf20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
shr ecx, 2
je 0x5faf40
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [eax]
add eax, 4
xor esi, edx
dec ecx
mov dword [eax - 4], esi
jne 0x5faf32
pop esi
ret
Function at 0x5fbfa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1050
call fcn.00607d30
lea eax, [esp + 0x1054]
push 4
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.005fccf0
add esp, 0xc
test eax, eax
je 0x5fbfd0
mov ax, 1
add esp, 0x1050
ret
mov edx, 0x1010101
push esi
mov esi, dword [esp + 0x1060]
mov dword [esp + 4], edx
push edi
mov edi, dword [esp + 0x1060]
mov dword [esp + 0xc], edx
cmp di, 8
jb 0x5fc019
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push esi
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call fcn.005fc820
add esp, 8
add edi, 0xfff8
add esi, 8
jmp 0x5fbfed
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.005fc350
add esp, 8
test di, di
jbe 0x5fc04d
lea ecx, [esp + 8]
push ebx
sub ecx, esi
mov eax, esi
and edi, 0xffff
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec edi
jne 0x5fc03f
pop ebx
pop edi
xor ax, ax
pop esi
add esp, 0x1050
ret

Function at 0x5fccf0
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov ecx, 0x12
mov esi, 0x6d97c8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x48]
mov ecx, 0x100
mov esi, 0x6d9810
xor edx, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x448]
mov ecx, 0x100
mov esi, 0x6d9c10
mov ebp, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x848]
mov ecx, 0x100
mov esi, 0x6da010
mov dword [esp + 0x20], 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc48]
mov ecx, 0x100
mov esi, 0x6da410
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
shl esi, 8
mov al, byte [edx + ecx]
or esi, eax
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x28]
dec edi
jne 0x5fcd61
mov edi, dword [ebp]
mov eax, dword [esp + 0x20]
xor edi, esi
mov dword [ebp], edi
add ebp, 4
dec eax
mov dword [esp + 0x20], eax
jne 0x5fcd5a
xor ecx, ecx
mov esi, ebx
mov dword [esp + 0x10], ecx
mov edi, 9
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x10]
push edx
push ebx
call fcn.005fc350
mov ecx, dword [esp + 0x19]
mov edx, dword [esp + 0x1a]
xor eax, eax
and ecx, 0xff
mov ah, byte [esp + 0x18]
and edx, 0xff
or eax, ecx
mov ecx, dword [esp + 0x1b]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x1c]
shl eax, 8
and ecx, 0xff
and edx, 0xff
or eax, ecx
mov ecx, dword [esp + 0x1e]
mov dword [esi], eax
mov eax, dword [esp + 0x1d]
shl edx, 8
and eax, 0xff
and ecx, 0xff
or edx, eax
mov eax, dword [esp + 0x1f]
shl edx, 8
or edx, ecx
and eax, 0xff
shl edx, 8
or edx, eax
add esp, 8
mov dword [esi + 4], edx
add esi, 8
dec edi
jne 0x5fcda1
lea ecx, [esp + 0x10]
lea eax, [ebx + 0x48]
push ecx
push eax
push ebx
call fcn.005fce80
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x448]
push edx
push eax
push ebx
call fcn.005fce80
lea eax, [esp + 0x28]
push eax
lea eax, [ebx + 0x848]
push eax
push ebx
call fcn.005fce80
lea ecx, [esp + 0x34]
lea eax, [ebx + 0xc48]
push ecx
push eax
push ebx
call fcn.005fce80
add esp, 0x30
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x8f4ea0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ef298
push 0x8f64ec
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x35
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.008f66e0
add esp, 4
test eax, eax
je 0x8f4eea
mov ecx, eax
call fcn.008f6190
mov dword [ebp - 0x1c], eax
jmp 0x8f4ef1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.008f60f0
test eax, eax
je 0x8f4f32
cmp dword [ebp - 0x1c], 0
je 0x8f4f28
mov ecx, dword [ebp - 0x1c]
call fcn.008f6200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.008f66f0
add esp, 4
mov eax, 0x7895
jmp 0x8f5065
wait
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.008f5880
mov ecx, dword [ebp - 0x1c]
call fcn.008f53d0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
call fcn.008f5700
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x8f4f90
mov esi, eax
test esi, esi
je 0x8f4f7e
mov ecx, esi
call fcn.008f6200
push esi
call fcn.008f66f0
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x8f5065
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x8f4fac
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.008f51a0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x8f4ff0
mov esi, eax
test esi, esi
je 0x8f4fe1
mov ecx, esi
call fcn.008f6200
push esi
call fcn.008f66f0
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x8f5065
cmp dword [ebp - 0x2c], 0
jne 0x8f4ffc
mov eax, dword ds:[0]
mov ecx, dword [ebp - 0x1c]
call fcn.008f5570
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x7895
wait
jmp 0x8f5034
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x8f5048
mov dword [ebp - 0x20], 0x7895
cmp dword [ebp - 0x1c], 0
je 0x8f5062
mov ecx, dword [ebp - 0x1c]
call fcn.008f6200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.008f66f0
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8f5080
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x8f50fc
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.008f4e70
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x8f57a0
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.008f5490
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.008f5490
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.008f5490
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.008f5490
mov ecx, dword [esi + 0x14]
lea edx, [esp + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x8eeb24]
mov edi, dword [0x8eeb28]
mov ecx, 0x8eeb24
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov dword [edx + 4], edi
mov cl, byte [ecx + 0xc]
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.008f56b0
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x8eeaf0], edx
call fcn.008f54f0
mov dword [esi], eax
test eax, eax
je 0x8f586d
push eax
push 0xa84aeb81
call fcn.008f5490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.008f5490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.008f5490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x8f6220
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ef300
push 0x8f64ec
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.008f66e0
add esp, 4
test eax, eax
je 0x8f6271
mov ecx, eax
call fcn.008f6190
mov dword [ebp - 0x1c], eax
jmp 0x8f6278
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.008f60f0
test eax, eax
je 0x8f62b2
cmp dword [ebp - 0x1c], 0
je 0x8f62a8
mov ecx, dword [ebp - 0x1c]
call fcn.008f6200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.008f66f0
add esp, 4
mov eax, 0x2a
jmp 0x8f63de
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.008f5700
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x8f62e1
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.008f5880
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x8f6324
mov esi, eax
test esi, esi
je 0x8f6312
mov ecx, esi
call fcn.008f6200
push esi
call fcn.008f66f0
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x8f63de
mov ecx, dword [ebp - 0x20]
call fcn.008f5b30
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x8f636c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x8f6366
mov esi, eax
test esi, esi
je 0x8f6357
mov ecx, esi
call fcn.008f6200
push esi
call fcn.008f66f0
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x8f63de
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.008f52e0
mov ecx, dword [ebp - 0x20]
call fcn.008f5c90
xor dword [ebp - 0x24], eax
wait
jmp 0x8f63ad
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x8f63ce
mov ecx, dword [ebp - 0x1c]
call fcn.008f6200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.008f66f0
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x8f63db
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8f6da0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x8f6dcf
sub eax, 0x40
je 0x8f6dc8
sub eax, 0x40
je 0x8f6dc1
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x8f6dd4
mov edi, 6
jmp 0x8f6dd4
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x8f6dde
mov eax, ecx
sub eax, 0x80
je 0x8f6e05
sub eax, 0x40
je 0x8f6dfe
sub eax, 0x40
je 0x8f6df7
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x8f6e0a
mov ebp, 0xc
jmp 0x8f6e0a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.008f6ea0
add esp, 0xc
cmp ebp, 1
jle 0x8f6e67
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x8eedd8
push esi
call fcn.008f6f80
push edi
push 0
push esi
call fcn.008f6ef0
push edi
push esi
call fcn.008f6fc0
push edi
push ebx
push esi
call fcn.008f6ea0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x8f6e2e
mov ebx, dword [esp + 0x20]
push edi
push 0x8eedd8
push esi
call fcn.008f6f80
push edi
push 0
push esi
call fcn.008f6ef0
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.008f6ea0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x8f6ea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x8f6ed3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x8f6eca
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x8f6ebc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x591e2181
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x760e23b7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push esi
push eax
push ecx
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x401054
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
mov dword [esp + 8], 4
push eax
mov eax, dword [esp + 0x10]
push ecx
push esi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401049
mov esi, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
ret

Function at 0x401060
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 8]
push esi
push eax
push ecx
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4010c8
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4010bd
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp edx, ecx
sbb esi, esi
neg esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x4010d0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401133
mov eax, dword [esp + 0x28]
push ebp
push esi
push 0x10020
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x401126
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebp
mov ebx, 1
push edi
call ebp
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret

Function at 0x4014a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00418028
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
jbe 0x4014e0
test esi, esi
jbe 0x4014e0
mov edx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, edi
sub edx, edi
mov al, byte [edx + ecx]
mov bl, byte [ebp]
xor al, bl
mov byte [ecx], al
inc ecx
dec esi
jne 0x4014cb
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x410454
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x431a60
cmp edx, dword [eax]
je 0x410476
add eax, 8
inc ecx
cmp eax, 0x431af0
jl 0x410467
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x431a60]
jne 0x4105a4
mov eax, dword [0x4347d8]
cmp eax, 1
je 0x41057e
test eax, eax
jne 0x4104a7
cmp dword [0x42f264], 1
je 0x41057e
cmp edx, 0xfc
je 0x4105a4
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4104de
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004105b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040b9d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x410521
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040b9d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4287bc
push edi
call fcn.00411ba0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004105b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004105c0
lea eax, [ebp - 0xa0]
push 0x42879c
push eax
call fcn.004105c0
push dword [esi + 0x431a64]
lea eax, [ebp - 0xa0]
push eax
call fcn.004105c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00411dc4
add esp, 0x2c
pop edi
jmp 0x4105a4
lea eax, [ebp + 8]
lea esi, [esi + 0x431a64]
push 0
push eax
push dword [esi]
call fcn.0040b9d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4170a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040bbc0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41716b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41716b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41711e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x417129
or bh, 8
and edi, 0x8000000
je 0x417144
mov eax, dword [0x435f3c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41716b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret