joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423f5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x1c]
movsx eax, word [0x448760]
movzx ecx, word [0x447ef2]
inc ecx
mov word [0x447ef2], cx
movsx ecx, cx
add ecx, 0x9abb67bf
or ecx, eax
mov eax, 0x69fd1c4
add eax, dword [0x456960]
cmp ecx, eax
jg 0x423fb7
mov eax, dword [0x45282c]
imul eax, eax, 0x2f12eae8
mov ecx, dword [0x44f70c]
lea esi, [ecx - 1]
mov dword [0x44f70c], esi
lea eax, [ecx + eax - 1]
and dword [0x44ffb8], eax
mov ecx, dword [esp + 0x18]
imul eax, dword [0x456120], 0xc83bb600
xor dword [0x44f364], eax
movzx eax, word [0x446184]
inc eax
mov word [0x446184], ax
cwde
imul eax, eax, 0xb8c1c51a
or dword [0x450248], eax
mov eax, dword [0x44d87c]
and eax, 0x4184
lea eax, [eax + eax + 0x7c57]
movzx esi, word [0x44a26a]
sub esi, eax
mov word [0x44a26a], si
mov eax, edx
and eax, 0x1f
mov esi, dword [0x454a1c]
shr esi, 7
movzx edi, word [0x445084]
xor edi, esi
mov word [0x445084], di
cmp edx, 0x20
jl 0x42409b
mov esi, edx
sar esi, 0x1f
shr esi, 0x1b
add esi, edx
sar esi, 5
xor dword [0x456068], 0xb0bc16de
xor edx, edx
cmp dword [ecx + 4], esi
jle 0x424060
mov edi, dword [ecx + 8]
lea ebx, [edi + esi*4]
xor edx, edx
mov ebp, dword [ebx + edx*4]
mov dword [edi + edx*4], ebp
inc edx
mov ebp, dword [ecx + 4]
sub ebp, esi
cmp edx, ebp
jl 0x424050
imul esi, dword [0x45359c], 0x39e3ae14
mov dword [0x45359c], esi
cmp edx, dword [ecx + 4]
jge 0x424085
mov esi, dword [ecx + 8]
mov dword [esi + edx*4], 0
inc edx
cmp edx, dword [ecx + 4]
jl 0x424078
imul edx, dword [0x44da04], 0x2a5a60dd
and edx, 0x34e6cd16
xor dword [0x44e948], edx
mov edx, dword [0x452d9c]
lea esi, [edx + 1]
mov dword [0x452d9c], esi
add edx, 0x3b66c1fd
or dword [0x451d5c], edx
test eax, eax
je 0x424159
mov edx, dword [0x454878]
xor dword [0x4553f8], 0xaaebf020
mov esi, dword [ecx + 4]
test esi, esi
jle 0x42414f
mov ecx, dword [ecx + 8]
mov edx, 0x20
sub edx, eax
mov dword [esp], edx
mov edx, eax
inc esi
xor ebx, ebx
xor word [0x448d6e], 0xd015
mov edi, ecx
mov ebp, dword [edi + esi*4 - 8]
mov ecx, dword [0x4585fc]
lea eax, [ecx + 1]
mov dword [0x4585fc], eax
or ecx, 0x2ab27f78
xor dword [0x457968], ecx
mov ecx, dword [esp]
shl ebp, cl
mov cl, dl
shr dword [edi + esi*4 - 8], cl
xor dword [0x450abc], 0x88614c13
or dword [edi + esi*4 - 8], ebx
mov ecx, edi
mov eax, dword [0x451e78]
mov edi, 0x410619c2
xor eax, edi
and dword [0x458e84], eax
mov dword [0x452fa0], 0xa61181b1
dec esi
cmp esi, 1
mov ebx, ebp
jg 0x4240e7
or dword [0x4535ec], 0x8466fa8f
mov eax, dword [0x450a34]
mov ecx, dword [0x44d3e8]
shl ecx, 3
sub eax, ecx
or dword [0x457538], eax
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4281e5
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
add dword [0x4559bc], 0x2a68dfea
imul eax, dword [0x4519d0], 0xbc0118fc
mov dword [0x4519d0], eax
or dword [0x4540a4], 0xbbfd7c15
imul eax, dword [0x4546c8], 0x82099082
mov dword [0x4546c8], eax
mov eax, dword [0x455c80]
shl eax, 0xa
movzx ecx, word [0x445500]
add ecx, eax
mov word [0x445500], cx
lea eax, [esp]
push eax
call dword [0x444140]
add dword [0x4560e0], 0x8c1e0f67
movzx eax, word [esp + 0xe]
add word [0x4489f4], 0x7ba9
xor edi, edi
mov ecx, 0x15
and dword [0x44fc04], 0xfffa27c5
mov word [0x446632], 0x70e6
lea edi, [edi + eax*2]
add eax, eax
xor dword [0x453ac8], 0x758d6458
dec ecx
jne 0x42825d
mov eax, dword [0x455f48]
shl eax, 5
mov ecx, dword [0x44ec54]
imul ecx, ecx, 0x601253b3
add ecx, eax
mov eax, dword [0x44e2c0]
lea edx, [eax - 1]
mov dword [0x44e2c0], edx
add eax, 0x5ce3081c
xor eax, 0x4d6b037e
cmp ecx, eax
jg 0x4282be
add dword [0x44d4fc], 0x224c406
push 0
call sub.msvcrt.dll_time
add esp, 4
mov esi, eax
xor esi, edi
movzx eax, word [0x448006]
inc eax
mov word [0x448006], ax
cwde
mov ecx, 0xcc16d260
add ecx, dword [0x453efc]
or ecx, eax
cmp ecx, 0xc3661e79
jne 0x4282fa
add dword [0x4531b0], 0xb4383375
call dword [0x444100]
xor esi, eax
movsx eax, word [0x444944]
xor eax, 0xd0d4851d
sub dword [0x4504b8], eax
push esi
call sub.msvcrt.dll_srand
add esp, 4
mov eax, 0xc3faefde
or eax, dword [0x452180]
cmp eax, 0xeb07fd6e
jb 0x428368
mov eax, dword [0x450400]
lea ecx, [eax - 1]
mov dword [0x450400], ecx
mov ecx, dword [0x4566dc]
lea edx, [ecx - 1]
mov dword [0x4566dc], edx
lea eax, [ecx + eax - 2]
mov ecx, dword [0x44dcfc]
sar ecx, 6
xor ecx, eax
imul ecx, dword [0x44dac8]
mov dword [0x44dac8], ecx
add esp, 0x10
pop esi
pop edi
ret
Function at 0x435ca4
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov eax, dword [0x44e87c]
lea ecx, [eax + 1]
mov dword [0x44e87c], ecx
movzx ecx, word [0x449aba]
xor ecx, eax
xor ecx, 0x5e75
mov word [0x449aba], cx
cmp edi, esi
je 0x435d2b
mov eax, dword [0x451594]
movsx ecx, word [0x446022]
lea edx, [ecx + 1]
mov word [0x446022], dx
mov edx, 0xfaf83de4
sub edx, ecx
xor edx, eax
and dword [0x455430], edx
call fcn.00403614
mov ecx, esi
sub ecx, edi
sar ecx, 2
xor edx, edx
div ecx
mov eax, dword [edi]
mov ecx, dword [edi + edx*4]
mov dword [edi], ecx
mov dword [edi + edx*4], eax
imul eax, dword [0x4582d4], 0x123e0861
mov dword [0x4582d4], eax
add edi, 4
cmp esi, edi
jne 0x435cd6
movzx eax, word [0x44806e]
inc eax
mov word [0x44806e], ax
cwde
add eax, 0xe672355c
mov ecx, dword [0x44b914]
inc ecx
mov dword [0x44b914], ecx
and ecx, eax
xor dword [0x452670], ecx
pop esi
pop edi
ret

Function at 0x436590
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004365f0
Function at 0x4365f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x45a880]
test eax, eax
jle 0x4366f3
mov edx, dword [0x45a884]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x436621
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x436696
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x436610
mov dword [esp], esi
call fcn.00436ed0
test eax, eax
mov edi, eax
je 0x43671a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x45a884]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.00436fc0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x45a884]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4366fa
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4366a0
add dword [0x45a880], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x43668f
cmp eax, 0x80
je 0x43668f
cmp eax, 8
je 0x43668f
mov eax, dword [ebp - 0x28]
add esi, dword [0x45a884]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x43668f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00436590
xor ebx, ebx
jmp 0x43662b
mov eax, dword [0x45a884]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00436590
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00436590
lea esi, [esi]

Function at 0x436df0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x436e28
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x436e1e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x436e2a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x436e10
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4d371c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0x4d3779
or al, 0x92
xchg ecx, eax
mov edx, 0x5fb3014e
rcr byte [eax], 1
adc esi, esi
je 0x4d36fe
jp 0x4d374f
pop edx
and eax, 0xb470ef54
mov eax, 0xdd310321
inc edx
add byte [ecx - 0x1b3870ed], bl
fdiv dword [ebx + 0x18]
dec eax
mov al, byte [edx + 0x689a7061]
jl 0x4d37c2
repne cmpsb byte [esi], byte es:[edi]
sbb byte [eax], ch
cmp ah, byte [0x4e3d58ea]
and eax, 0x4e3d58ea
dec esi
shr dword [ebx], 1
nop
sub eax, 0x91100266
jle 0x4d3788
mov byte [ecx], dh
jp 0x4d3753
sub dword [ecx + edi*4 - 0x3f], edi
adc edi, eax
pop edx
mov dword [edx], ecx
mov al, byte [0xb0d75408]
adc ch, 0xb8
adc ch, ah
and bl, byte [ebx]
shr cl, 1
jmp 0x78c2448d
adc byte [0x43787875], cl
pop eax
sub cl, byte [edx + 0x2609ce61]
cmp esp, dword [edi - 0x23eacd9b]
fsub dword [esi - 0x42cc6097]
dec ecx
lodsb al, byte [esi]
mov dword [ebx], ebp
xor dl, byte gs:[0x69a6d8dc]
lahf
xor edi, dword [ebp + 0x2b89ac49]
and cl, byte [eax - 0x5137de15]
and edx, ebx
fld xword [ecx + 0x53]
push ebp
push 0xfffffffffffffffc
pop eax
mov ebx, dword [ebp + 0x5c32fb3a]
nop
fdiv qword [edx - 0x5154e6d8]
wait
pop ss
adc dword [ecx + 0x7e], edi
push cs
jmp 0xe6c7342f
and eax, eax
jp 0x4d3778
cmpsb byte [esi], byte es:[edi]
js 0x4d3830
invalid
test al, 0x82
sahf
stosd dword es:[edi], eax
cmc
adc dword [eax - 0x78], esi
lodsb al, byte [esi]
mov gs, word [eax + edx*2 - 0x68]
add dword [ecx + 0x69f3cea7], edi
ror byte [eax], 0xf5
sbb esi, dword [esi + 0xb3f0fcc]
inc edx
fdivr st(6), st(0)
mov eax, dword [0x84cc68e9]
movsb byte es:[edi], byte [esi]
and byte [eax], bl
cmc
dec eax
adc al, 0x79
mov eax, 0xb4e0283c
sub byte [eax], ah
sub dword [esi], ebx
mov eax, 0x378b4e87
test byte [ebx - 0x60], bh
sbb ch, ch
imul ebp, dword [eax - 0x4e179bb0], 0x6965b259
outsd dx, dword [esi]
add eax, 0x80ca3e7e
sbb eax, 0x4da733fc
nop
bound edx, qword [esi]
out dx, al
and byte [edx + 0x79a82105], al
sar byte [ecx + 0x78], 0xbc
and bl, cl
imul ebp, ecx, 0xffffffd1
cmpsb byte [esi], byte es:[edi]
mov cl, 0x7f
and dword [ecx - 0x625700e0], ebp
test al, 0x8d
push ebp
xor esi, ecx
push edi
clc
jle 0x4d3913
push esi
xchg ecx, eax
add al, byte [ebp - 0x61]
loopne 0x4d3926
add dword [edx - 0x701abc74], 0x46055630
push es
dec ecx
or edi, eax
into
in al, 0xfd
jg 0x4d3934
xor byte [edx], ah
sbb dword [ebx], esp
dec eax
cli
mov cl, 0xfe
mov word [ebx - 0x32857f68], gs
sub al, 0x50
or byte [ecx], 0xc
mov eax, 0x46193862
xor eax, 0x22066cef
mov ch, 0x63
pop ds
mov dh, 0x6a
lock adc byte [ecx + 0x745fc46d], ch
jmp 0x9e4595ee
sahf
jb 0x4d38bb
and cl, byte [ebp - 0x70]
mov ch, 0x20
cli
mov al, byte [0xf0053ba0]
cmp byte [esi + 0x58], bh
iretd
enter 0x45ec, 0xffffffffffffffee
aam 0x94
pop esp
mov ecx, 0x56e860c0
mov al, pe_nt_image_headers32
mov ebx, 0x28bd5744
outsb dx, byte [esi]
and ebx, dword [ebp - 0x2f]
and byte [eax], ah
stosd dword es:[edi], eax
invalid
Function at 0x52a3b3
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte cs:[esi]
fbstp tbyte [ecx]
jb 0x52a32c
adc ebx, ebx
pop ebp
sub eax, 0x6e5e8d9f
sbb al, 0xc7
inc esp
popal
insd dword es:[edi], dx
pop ss
fstp xword [esi + 0x6e]
arpl word [esi], sp
jno 0x52a34b
outsb dx, byte ss:[esi]
or dword [eax - 0xe], 0x3b
not al
or eax, 0x3768d71d
dec ebp
sbb eax, 0x4d3768d7
mov byte [0x4d56f350], al
pop edx
mov ch, 0x3e
push eax
push eax
nop
js 0x52a40e
clc
sti
dec edx
sbb ebx, eax
add byte [esi - 0x11], 0x3f
push esp
inc ecx
loop 0x52a3c5
invalid
dec dword [edi + esi]
xor eax, 0xa4b016b0
movsb byte es:[edi], byte [esi]
cmp byte [esi + 0x41], cl
dec esi
inc ecx
xor byte [esi], al
lodsd eax, dword [esi]
push cs
mov dl, 0x71
mov dword [edi - 0x45], ecx
outsb dx, byte ss:[esi]
and dword [ecx], edx
xchg ebx, eax
sbb ecx, ebx
ja 0x52a3cf
retf
into
mov ebp, 0x820fe731
dec ecx
loop 0x52a393
lahf
push edi
insd dword es:[edi], dx
mov dl, 0x4e
cmp dword [edi], edi
stosd dword es:[edi], eax
xchg byte [ebx], bh
mov al, byte [0xcc38736b]
out dx, eax
jne 0x52a3cd
push ecx
xchg ebp, eax
shl byte [ecx], 0x60
sbb ebp, esp
or dh, dh
cmp byte [esi], bl
dec edi
jne 0x52a3a7
vmread dword [ebp + 0x60ab61ab], esi
mov ch, 0xab
popal
stosd dword es:[edi], eax
pushal
mov ebx, 0x8759953
jp 0x52a3e0
adc dword [edx], ebp
and dword [ebx - 0x8c1c6fd], ebx
add dword [eax - 0x68], edx
or ebx, edi
cld
loope 0x52a44c
invalid

Function at 0x60ac43
Capabilities:
Encode data using xor

Disassembly:
daa
loope 0x60ac93
loope 0x60ac93
clc
or word [eax + ebp*2 - 0x70], di
xor byte [eax], 0xb1
xchg esi, eax
mov eax, 0x3bdf2946
cmp ah, cl
sbb edi, dword [ebp - 0xb]
je 0x60ac45
inc ebx
xchg ecx, eax
int1
enter 0xffffffffffff9e12, 0xffffffffffffffb7
fsub dword [edx - 0x4c]
lcall 0xd5e7, 0xe238af46
sahf
mov bh, 0xd8
bound esi, qword [edx + ebx*4 - 0x1dc750ba]
out 0xd5, eax
lds edx, [ecx + 0x59]
xor byte [esi - 0x7993edcb], 0xcd
neg dword [ebp + 3]
mov ch, pe_nt_image_headers32
xchg edi, eax
bound ebp, qword [edi + 0x47]
jo 0x60ac62
mov byte [0x410e9806], al
mov dword [eax + 0x36e6f18f], esi
stosd dword es:[edi], eax
sal byte [esi - 0x3af9dc84], cl
xchg dword [eax + 0x77], ebx
push eax
push esi
push es
lds eax, [edi + 0x56507758]
add al, 0x19
ror dword [eax + 0x3f63a108], 0xad
pop ebp
les esp, [esi + 0x75]
ror dword [eax], 1
and byte [0xf4c688f3], dl
sbb eax, 0x3a7b1da6
retf 0x60b0
Function at 0x401000
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x1d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1e4]
xor edx, edx
xor ecx, ecx
xor eax, eax
test esi, esi
push edi
jbe 0x401063
mov edi, dword [esp + 0x1e4]
movzx ebx, byte [ecx + edi]
shl eax, 8
or eax, ebx
inc ecx
test cl, 3
jne 0x40105f
mov ebx, eax
and ebx, 0xff0000
mov ebp, eax
shr ebp, 0x10
or ebx, ebp
mov ebp, eax
and ebp, 0xff00
shl eax, 0x10
or ebp, eax
shr ebx, 8
shl ebp, 8
or ebx, ebp
mov dword [esp + edx*4 + 0xe0], ebx
inc edx
xor eax, eax
cmp ecx, esi
jb 0x401022
and esi, 3
je 0x4010a0
mov ecx, 4
sub ecx, esi
shl ecx, 3
shl eax, cl
mov ecx, eax
and ecx, 0xff0000
mov esi, eax
shr esi, 0x10
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shr ecx, 8
shl esi, 8
or ecx, esi
mov dword [esp + edx*4 + 0xe0], ecx
inc edx
mov dword [esp + 0x18], 0xb7e15163
mov eax, 1
lea ecx, [ecx]
mov ecx, dword [esp + eax*4 + 0x14]
sub ecx, 0x61c88647
mov dword [esp + eax*4 + 0x18], ecx
inc eax
cmp eax, 0x2c
jb 0x4010b0
cmp edx, 0x2c
mov eax, 0x2c
jb 0x4010d0
mov eax, edx
lea eax, [eax + eax*2]
xor ebp, ebp
xor ebx, ebx
xor ecx, ecx
xor esi, esi
test eax, eax
mov dword [esp + 0x14], edx
jbe 0x40114b
mov dword [esp + 0x10], eax
mov eax, dword [esp + ebx*4 + 0x18]
lea edx, [ecx + esi]
add edx, eax
mov eax, edx
shr eax, 0x1d
shl edx, 3
or eax, edx
mov esi, eax
mov dword [esp + ebx*4 + 0x18], eax
mov eax, dword [esp + ebp*4 + 0xe0]
lea edi, [ecx + esi]
add ecx, esi
lea edx, [ecx + eax]
and edi, 0x1f
mov eax, edx
mov ecx, 0x20
sub ecx, edi
shr eax, cl
mov ecx, edi
shl edx, cl
mov edi, 0x2c
or eax, edx
mov dword [esp + ebp*4 + 0xe0], eax
mov ecx, eax
xor edx, edx
lea eax, [ebx + 1]
div edi
lea eax, [ebp + 1]
mov ebx, edx
xor edx, edx
div dword [esp + 0x14]
dec dword [esp + 0x10]
mov ebp, edx
jne 0x4010e7
mov edi, dword [esp + 0x1f0]
mov ecx, 0x2c
lea esi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1d0
ret
Function at 0x401c00
Capabilities:
Query service configuration
Query service status

Disassembly:
sub esp, 0x20
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x401c76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1f
ja 0x401c52
je 0x401c48
mov ecx, eax
sub ecx, 5
je 0x401c3e
dec ecx
jne 0x401d27
mov eax, 0xfffffff5
pop ebp
add esp, 0x20
ret
mov eax, 0xfffffff2
pop ebp
add esp, 0x20
ret
mov eax, 0xffffffeb
pop ebp
add esp, 0x20
ret
cmp eax, 0x7b
je 0x401c6c
cmp eax, 0x424
jne 0x401d27
mov eax, 0xfffffff3
pop ebp
add esp, 0x20
ret
mov eax, 0xfffffff4
pop ebp
add esp, 0x20
ret
push edi
push 0xf01ff
push str.XRNBO
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x401c99
call fcn.00401820
pop edi
pop ebp
add esp, 0x20
ret
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x401cb3
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
push ebx
push esi
push 0x200
call fcn.00403c93
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
add esp, 4
lea edx, [esp + 0x10]
push edx
push 0x200
mov esi, eax
push esi
push edi
call ebx
cmp eax, 0x7a
jne 0x401cf2
push esi
call fcn.00403be9
mov eax, dword [esp + 0x14]
push eax
call fcn.00403c93
add esp, 8
mov esi, eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push esi
push edi
call ebx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x401d0d
mov ecx, dword [esi + 4]
mov dword [eax], ecx
push esi
call fcn.00403be9
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
push edi
call esi
push ebp
call esi
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
add esp, 0x20
ret

Function at 0x402440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x40d8b8]
test eax, eax
push esi
push edi
jne 0x4024c1
push 0xa
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402465
pop edi
mov eax, 0xffff0004
pop esi
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40247a
pop edi
mov eax, 0xffff0005
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [0x40d840], eax
call fcn.00403c93
add esp, 4
test eax, eax
mov dword [0x40d8b8], eax
jne 0x4024ab
pop edi
mov eax, 0xffff0006
pop esi
ret
mov ecx, dword [0x40d840]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
pop esi
ret
Function at 0x402ec0
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x40d040]
mov ecx, dword [0x40b788]
mov edx, dword [0x40b78c]
mov dword [esp + 0x280], eax
mov eax, dword [str.S_Emul07.S_E]
mov dword [esp + 0x7c], eax
mov al, byte [0x40b790]
mov dword [esp + 0x80], ecx
push ebx
push esi
push edi
mov byte [esp + 0x94], al
xor eax, eax
mov dword [esp + 0x90], edx
mov ecx, 0x3c
lea edi, [esp + 0x95]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, str.Dump_files__.S_E_
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, 0x13
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x188]
push ecx
push 0x100
mov dword [esp + 0x20], 0x4c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x188]
mov dword [esp + 0x44], edx
lea edx, [esp + 0x18]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x88]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0x100
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
test eax, eax
je 0x403026
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402fcf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00403c93
mov edi, eax
add esp, 4
test edi, edi
jne 0x402fe5
or eax, 0xffffffff
mov ecx, dword [esp + 0x28c]
call fcn.00403bdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40d8b4]
test eax, eax
mov dword [esp + 0x10], 0
je 0x40301d
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.00403be9
add esp, 4
mov ecx, dword [esp + 0x28c]
xor eax, eax
call fcn.00403bdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403420
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
mov esi, eax
mov ecx, dword [esi]
push 0x130b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x403458
push 0
push eax
call ebx
call fcn.00403160
call fcn.00401d30
test eax, eax
jne 0x403475
call fcn.00401730
call fcn.004019a0
call fcn.00401ac0
mov eax, dword [esi + edi*4 + 0x18]
push 5
push eax
mov dword [esi + 4], eax
call ebx
pop edi
pop esi
pop ebx
ret 4
Function at 0x407825
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40da40], ebx
push esi
push edi
jne 0x4078a5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4078e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40c454
push edi
call esi
test eax, eax
mov dword [0x40da40], eax
je 0x4078e0
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40da44], eax
call esi
cmp dword [0x40d8e0], 2
mov dword [0x40da48], eax
jne 0x4078a5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40da50], eax
je 0x4078a5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40da4c], eax
mov eax, dword [0x40da4c]
test eax, eax
je 0x4078ea
call eax
test eax, eax
je 0x4078d1
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40da50]
test eax, eax
je 0x4078d1
test byte [ebp - 8], 1
jne 0x4078ea
cmp dword [0x40d8ec], 4
jb 0x4078e4
or byte [ebp + 0x12], 0x20
jmp 0x407909
xor eax, eax
jmp 0x407919
or byte [ebp + 0x12], 4
jmp 0x407909
mov eax, dword [0x40da44]
test eax, eax
je 0x407909
call eax
mov ebx, eax
test ebx, ebx
je 0x407909
mov eax, dword [0x40da48]
test eax, eax
je 0x407909
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40da40]
pop edi
pop esi
pop ebx
leave
ret