joyce8/EMBER2024-capa huggingface dataset:
Function at 0x567227
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5672c4
push ebx
push esi
call fcn.005671f0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00564ddb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x567271
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5672c3
push edi
push eax
call fcn.0055f54a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x567291
call fcn.0055e7ea
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5672c2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00564ddb
add esp, 0x20
test eax, eax
jne 0x5672b0
push edi
call fcn.0055e7ea
jmp 0x5672b8
push ebx
call fcn.0055e7ea
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5672c7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5672d8
pop esi
ret
push ebx
push edi
push esi
call fcn.005671f0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0055f54a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x567300
push ebx
push esi
push edi
call fcn.00548140
add esp, 0xc
push 0
call fcn.0055e7ea
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x567a5a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00567575

Function at 0x5699c6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0055e4ff
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x569a35
cmp esi, dword [ebp - 4]
je 0x569a30
cmp dword [ebp + 0xc], 0
je 0x569a30
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x569a0d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00569518
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x569a37
xor eax, eax
inc eax
jmp 0x569a37
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x569a9c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b40cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0055e4ff
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0055e4ff
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x569b13
cmp word [ecx], dx
je 0x569b13
mov eax, dword [0x582e4c]
push edi
dec eax
push eax
push 0x582d38
call fcn.00569a3b
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x569b86
cmp word [eax], dx
je 0x569b86
mov eax, dword [edi]
test eax, eax
je 0x569b37
cmp word [eax], dx
je 0x569b37
lea eax, [ebp - 0x10]
push eax
call fcn.0056941e
jmp 0x569b40
lea eax, [ebp - 0x10]
push eax
call fcn.005694b9
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x569bb0
mov eax, dword [0x582d34]
push dword [ebp - 0x14]
dec eax
push eax
push 0x582a28
call fcn.00569a3b
add esp, 0xc
test al, al
je 0x569bb0
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x569b7b
cmp word [eax], di
je 0x569b7b
lea eax, [ebp - 0x10]
push eax
call fcn.0056941e
pop ecx
jmp 0x569bb2
lea eax, [ebp - 0x10]
push eax
call fcn.005694b9
jmp 0x569b78
mov eax, dword [edi]
test eax, eax
je 0x569b9d
cmp word [eax], dx
je 0x569b9d
lea eax, [ebp - 0x10]
push eax
call fcn.005693d3
pop ecx
jmp 0x569bb0
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x569c7b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.005698c0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x569c7b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x569c7b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x569c7b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x569c08
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00561d42
test ebx, ebx
je 0x569c76
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00561d42
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x569c7b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x569c7b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0056dc9d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x569c7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00546aa8
leave
ret
Function at 0x56ddb5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0056dd31
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x56df24
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x56df24
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x56ded9
jg 0x56de11
test eax, eax
je 0x56decf
push 1
push 0x1000
call fcn.0055e824
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x56de34
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x56dec6
push 0x8000
push ebx
call fcn.005586b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x56de5d
jg 0x56de58
cmp ecx, 0x1000
jb 0x56de5d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0056296e
add esp, 0x10
cmp eax, 0xffffffff
je 0x56dea2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x56de58
jl 0x56de89
test ecx, ecx
jne 0x56de4a
push dword [ebp - 0xc]
push ebx
call fcn.005586b6
push esi
call fcn.0055e7ea
add esp, 0xc
xor ebx, ebx
jmp 0x56df32
cmp byte [edi + 0x24], 0
je 0x56deb9
cmp dword [edi + 0x20], 5
jne 0x56deb9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x56dec4
mov ebx, dword [edi + 0x18]
jmp 0x56dec6
xor ebx, ebx
push esi
call fcn.0055e7ea
pop ecx
jmp 0x56df32
test ecx, ecx
jg 0x56de9b
jl 0x56ded9
test eax, eax
jae 0x56de9b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00562d90
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x56def9
cmp byte [edi + 0x1c], 0
je 0x56de9b
jmp 0x56df2a
push ebx
call fcn.005657bd
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x56de9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x56df32
cmp byte [edi + 0x1c], 0
je 0x56df2f
mov ebx, dword [edi + 0x18]
jmp 0x56df32
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00562d90
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x56f5b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56f5dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56f5dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
push eax
mov ebp, esp
push ecx
push esi
push edi
call 0x411a20
test eax, eax
inc edi
cmp eax, dword [ecx]
add byte [ebp + 0x40], ah
cmp dword [0x4199dc], 0x14
jl 0x495e2e
mov eax, dword [0x41cb8d]
test eax, eax
jne 0x7e5e2e
mov dword [0x410384], 0xd4000001
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
add al, 0x97
mov eax, dword [0x410358]
test eax, eax
rol byte [eax + edx*2 + 0x69f42b5a], 1
add byte [edx + 4], ch
call fcn.0040a940
add esp, 0xc
mov dword [0xf1410358], eax
pop ds
in eax, dx
je 0xae405e38
lea ecx, [ebp - 0x2b]
mov esp, dword [edi + edi*8 - 0x30]
mov esi, eax
test dword [ebp + 0x558b1d74], esi
cld
mov eax, dword [ebp + 0xc]
push edx
push esi
push eax
int1
sub al, 0xb4
jbe 0x405da4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0xc
push esi
mov dword [ebx], edi
call dword [0x40bf58]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
dec edi
inc esp
std
shl byte [ecx + eax*8], cl
inc eax
rcl dword [eax - 0x18], 0x85
wait
add byte [eax], al
jmp 0x405e4a
nop
nop
nop
pop ecx
nop
nop
push ebp
xor ch, ah
xchg esi, eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
fld xword [bp + di + 0x7d]
sbb byte [ebx + 0x2b], bh
mov dl, 0x83
cmp byte [esi*2 + 0x78836608], dh
add al, byte [eax]
je 0x405e79
inc ebx
add eax, 0x10
jmp 0x405e66
sub eax, dword [ebp + 0xc]
xor eax, 0xf80e02e4
mov dword [edx], ecx
adc byte [ebp + 0xf10904], bl
enter 0x5000, 0x65
adc eax, sym.imp.MSVCRT.dll_malloc
mov edi, eax
mov eax, dword [ebp + 0x10]
lea esi, [eax + eax*2 + 1]
push esi
add byte [esp + edi*8], dl
inc dword [esp + ebx*2 - 0x3f]
inc eax
add bl, cl
les ecx, [eax]
lea ecx, [ebp - 4]
fld qword [edi]
lea edx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
call fcn.0040ac49
mov edx, dword [ebp - 4]
pop es
sub esi, edx
push esi
push eax
pushfd
adc eax, sym.imp.MSVCRT.dll_realloc
mov ecx, 0x5b0001
add esp, 8
pop ebp
invalid

Function at 0x4070d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ah, 0xec
sub esp, 0x254
add byte [eax], al
mov ecx, dword [ebp + 0xc]
outsd dx, dword [esi]
cmc
xor esi, eax
mov eax, dword [ecx]
insb byte es:[edi], dx
push ecx
add al, 0x89
inc ebp
popal
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebx - 0x14], edi
movsd dword es:[edi], dword [esi]
add byte [ecx - 0x3f7b038b], cl
mov dword [eax + 0x37f07589], edx
jne 0x4070d7
mov dword [edx], ecx
fmul qword [edi]
test byte [edx - 0x74ffff1f], ch
pop ebp
out 0x3c, eax
and eax, 0x458b3c49
hlt

Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov ebx, ecx
popal
push edi
mov eax, esi
adc byte [ebx + 0x4e1f1046], cl
adc al, 0xb
rol edi, 0x45
adc byte [eax], al
add byte [eax], al
dec eax
jne 0x40b083
mov al, byte [esi + 8]
test al, al
je 0x40b10d
mov eax, dword [ebx + 0x84d8d04]
loop 0x40b0ab
push ecx
push 0
Function at 0x41ce03
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ce42
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ce42
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ce42
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ce42
cmp dword [ecx + 0x74], 0xe
jbe 0x41ce42
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42efa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42efcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42efcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438c90
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
dec ebx
call fcn.00438cc4
dec esi
xor dword [edi], edx
dec ebx
add edi, 1
add ebx, 0x269fdbce
add esi, esi
add esi, 0xd0de8654
cmp edi, ecx
jne fcn.00438c90
push esi
pop ebx
sub esi, 0xadc0e507
or ebx, ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401c40
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x218
lea ebp, [esp - 4]
mov eax, dword [0x41513c]
xor eax, ebp
mov dword [ebp + 0x218], eax
push 0x48
mov eax, 0x40f05c
call fcn.0040e02a
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str._stop__
push eax
lea ecx, [ebp + 0x224]
call fcn.00403096
lea ecx, [ebp - 0x18]
push str.___y
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040303e
add esp, 0x10
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040312a
mov eax, dword [0x41602c]
mov esi, 0x41602c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
mov eax, dword [0x41602c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov esi, 0x4127bc
lea edi, [ebp + 0x208]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3c
movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
push esi
lea edi, [ebp + 0x214]
push eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
call fcn.004047c0
add esp, 0xc
lea eax, [ebp + 0x208]
mov dword [ebp - 0x48], eax
push 0x104
lea eax, [ebp]
push eax
mov dword [ebp - 0x54], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004013d0
push str.net.exe
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004013d0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0x800440
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x400
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x401d93
cmp dword [ebp - 0x34], 0x20
jl 0x401d93
push 0x1000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
call fcn.0040312a
lea eax, [ebp - 0x10]
call fcn.0040312a
lea eax, [ebp - 0x18]
call fcn.0040312a
lea eax, [ebp + 0x224]
call fcn.0040312a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x218]
xor ecx, ebp
call fcn.00403af7
add ebp, 0x21c
leave
ret
Function at 0x401efe
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push SysReAllocString
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x401f73
push ebx
push edi
push 0x85
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, esi
je 0x401f6c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401f67
mov eax, dword [ebp - 0x1c]
dec eax
je 0x401f67
dec eax
je 0x401f62
dec eax
je 0x401f67
dec eax
je 0x401f62
dec eax
dec eax
je 0x401f62
dec eax
je 0x401f62
sub eax, 0x39
jne 0x401f69
xor esi, esi
inc esi
jmp 0x401f69
xor esi, esi
push ebx
call edi
push dword [ebp - 4]
call edi
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 4

Function at 0x402119
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push SysReAllocString
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, edi
jne 0x40213d
xor eax, eax
jmp 0x40219d
push ebx
push 0x200000a0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, edi
jne 0x40215e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40219c
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 8], eax
call edi
lea eax, [ebp - 0x20]
push eax
push 4
push ebx
call esi
push 0
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 4]
call esi
xor eax, eax
cmp dword [ebp + 8], eax
setne al
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x403472
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403489
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4034be
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4034ba
cmp edi, eax
jae 0x4034be
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4034ac
cmp edi, eax
jb 0x4034c2
xor eax, eax
jmp 0x4034cb
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x403af7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41513c]
jne 0x403b01
repz ret
jmp fcn.00405d7c

Function at 0x40a81d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040578b
and dword [ebp - 4], 0
cmp dword [0x416b08], 0
mov ebx, eax
jne 0x40a8ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a97f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a97f
push eax
call fcn.00405719
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x416b08], eax
call esi
push eax
call fcn.00405719
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x416b0c], eax
call esi
push eax
call fcn.00405719
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x416b10], eax
call esi
push eax
call fcn.00405719
pop ecx
mov dword [0x416b18], eax
test eax, eax
je 0x40a8ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405719
pop ecx
mov dword [0x416b14], eax
mov eax, dword [0x416b14]
cmp eax, ebx
je 0x40a926
cmp dword [0x416b18], ebx
je 0x40a926
push eax
call fcn.00405794
push dword [0x416b18]
mov esi, eax
call fcn.00405794
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a926
test edi, edi
je 0x40a926
call esi
test eax, eax
je 0x40a91d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a91d
test byte [ebp - 0xc], 1
jne 0x40a926
or dword [ebp + 0x10], 0x200000
jmp 0x40a95f
mov eax, dword [0x416b0c]
cmp eax, ebx
je 0x40a95f
push eax
call fcn.00405794
pop ecx
test eax, eax
je 0x40a95f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a95f
mov eax, dword [0x416b10]
cmp eax, ebx
je 0x40a95f
push eax
call fcn.00405794
pop ecx
test eax, eax
je 0x40a95f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x416b08]
call fcn.00405794
pop ecx
test eax, eax
je 0x40a97f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a981
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x57e44ad8
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x59106e9b
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219