joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0x464d50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
or ebp, 0xffffffff
jmp 0x464d72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x464d79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x464d68
mov eax, 1
add ebx, ebx
jne 0x464d8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x464d9c
jne 0x464dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x464dbb
dec eax
add ebx, ebx
jne 0x464da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x464d80
add ebx, ebx
jne 0x464db7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x464e0d
xor ecx, ecx
sub eax, 3
jb 0x464dd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x464e42
sar eax, 1
mov ebp, eax
jmp 0x464dde
add ebx, ebx
jne 0x464dde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x464dac
inc ecx
add ebx, ebx
jne 0x464dec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x464dac
add ebx, ebx
jne 0x464df9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x464dee
jne 0x464e0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x464dee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x464e2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x464e1e
jmp 0x464d6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x464e2c
add edi, ecx
jmp 0x464d6e
pop esi
mov edi, esi
mov ecx, 0x847
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x464e4a
cmp byte [edi], 0x11
jne 0x464e4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x464e4f
lea edi, [esi + 0x61000]
mov eax, dword [edi]
or eax, eax
je 0x464ec7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6a2e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6a380]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x464e7c
mov ecx, edi
jns 0x464eab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6a388]
or eax, eax
je 0x464ec1
mov dword [ebx], eax
add ebx, 4
jmp 0x464e99
call dword [esi + 0x6a384]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x464ef8
cmp al, 0xef
ja 0x464eeb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x464ecd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x464eda
mov ebp, dword [esi + 0x6a38c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x464f2c
sub esp, 0xffffff80
jmp 0x40c55a
Function at 0x100094c4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
xor ebx, ebx
push edi
push ebx
push 5
xor esi, esi
mov edx, str.SOFTWAREPoliciesMicrosoftOffice_i.0OneNoteOptionsSave
inc esi
push esi
push str.Notebook_Root
push str.SOFTWAREMicrosoftOffice_i.0OneNoteOptionsSave
call fcn.10010a66
test eax, eax
jne 0x10009559
test edi, edi
je 0x10009557
push esi
push 5
push edi
push ebx
mov word [edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10009552
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10009507
sub ecx, edx
sar ecx, 1
call fcn.10010a66
mov ecx, eax
cmp ecx, 0x824
jl 0x10009529
mov eax, ebx
jmp 0x1000954e
test ecx, ecx
jle 0x1000954c
push 0x5c
pop edx
cmp dx, word [edi + ecx*2 - 2]
je 0x1000954c
lea eax, [ecx + 1]
cmp eax, 0x824
jge 0x10009525
xor eax, eax
mov word [edi + ecx*2], dx
mov word [edi + ecx*2 + 2], ax
mov eax, esi
test eax, eax
jne 0x10009559
xor eax, eax
mov word [edi], ax
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x10010a66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10010a75
pop dword [ebp - 4]
mov eax, 0x10010a75
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x40cff
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x3fc0d2c2
add ecx, 0xc03f6f54
xor edx, edx
add edx, eax
mov edi, 0x1004c000
add edi, dword [ebp - 4]
mov esi, 0xf1dbb46e
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0xbcbf65df
sub edx, 0xbcbf65db
add edi, 0xe209cff6
sub edi, 0xe209cff2
loop 0x10010ac0
add eax, 0x14766e2a
add eax, 0xeb8a8d01
mov ebx, eax
add eax, 0xd3b726b
sub eax, 0xd3b7266
mov ecx, 0xd0ae8242
sub ecx, 0xc0ae8242
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x405742
pop dword [ebp - 0x50]
mov eax, 0x405742
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3bb4a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xbe1f37ea
sub ecx, 0xbe1ee633
xor esi, esi
add esi, eax
mov edi, 0x6122669c
sub edi, 0x60deae9c
add edi, dword [ebp - 0x50]
mov edx, 0x57b56343
add edx, 0x9df45436
mov ebx, dword [edi]
sub dword [ebp - 0x34], esi
add ebx, edx
sub dword [ebp - 0x3c], 0xeeb4d506
mov dword [esi], ebx
xor dword [ebp - 0x40], 0xd97b61ea
add esi, 0x1d9e9843
add esi, 0xe26167c1
add edi, 0xf2974aac
add edi, 0xd68b558
loop 0x405799
add eax, 0x37f2309d
add eax, 0xc80f0912
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5c944f12
sub ecx, 0x5c544f12
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401c20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401c6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c64
test esi, esi
je 0x401c64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c40
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401ede
cmp eax, 4
jne 0x401f00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401eee
cmp edx, 4
je 0x401eee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e50
Function at 0x1000ac70
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0xffffffff
jne 0x1000ac99
mov eax, 7
jmp 0x1000ac9b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000acd0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031348
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1003b470]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
push 0x10
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.1001e660
add esp, 0xc
mov word [ebp - 0x24], 2
lea ecx, [ebp + 8]
call fcn.10007670
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x20], eax
mov cx, word [ebp + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x14], 0xffffffff
push 0x10
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1000ad89
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x1000ad89
mov dword [ebp - 0x28], 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10007650
mov eax, dword [ebp - 0x28]
jmp 0x1000ada2
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10007650
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ed57
mov esp, ebp
pop ebp
ret 0x20

Function at 0x1000adf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, 1
test eax, eax
je 0x1000ae82
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xffffffff
je 0x1000ae41
cmp dword [ebp - 0x10], 0
je 0x1000ae5a
jmp 0x1000ae61
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2733
je 0x1000ae58
or eax, 0xffffffff
jmp 0x1000ae85
jmp 0x1000ae80
or eax, 0xffffffff
jmp 0x1000ae85
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jg 0x1000ae77
mov eax, dword [ebp - 8]
jmp 0x1000ae85
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
jmp 0x1000ae07
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b460
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x1003b470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
push 0x190
push 0
lea eax, [ebp - 0x198]
push eax
call fcn.1001e660
add esp, 0xc
mov word [ebp - 0x19c], 0x202
lea ecx, [ebp - 0x198]
push ecx
mov dx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1000b4be
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 7
jmp 0x1000b4df
mov ecx, dword [ebp - 0x1a0]
add ecx, 4
call fcn.1000ac70
test eax, eax
je 0x1000b4dd
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 7
jmp 0x1000b4df
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed57
mov esp, ebp
pop ebp
ret

Function at 0x1000caf0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
push closesocket
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000cb9c
push closesocket
push 0x100326a4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000cb7f
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 6
ja case.default.0x1000cb66
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x1000cbb4]
jmp dword [eax*4 + 0x1000cbac]
mov dword [ebp - 4], 4
jmp case.default.0x1000cb66
mov dword [ebp - 4], 0
jmp 0x1000cb86
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000cba3
mov dword [ebp - 4], 3
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000ccd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100314f8
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x1003b470]
xor eax, ebp
mov dword [ebp - 0x54], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], ecx
mov eax, dword [ebp - 0x2a8]
mov dword [eax + 0x2a8], 1
mov dword [ebp - 0x78], 0
push 0x104
push 0
lea ecx, [ebp - 0x29c]
push ecx
call fcn.1001e660
add esp, 0xc
push 0x104
lea edx, [ebp - 0x29c]
push edx
mov ecx, 0x1003cab8
call fcn.1000abf0
push eax
call dword [0x1003c78c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10007800
mov dword [ebp - 4], 0
mov ecx, dword [0x10032518]
push ecx
push 0x10032744
lea ecx, [ebp - 0x70]
call fcn.1000e820
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x94]
call fcn.100077d0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x50]
add edx, 1
push edx
push 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x94]
call fcn.100094f0
push 0x10032748
lea ecx, [ebp - 0x94]
call fcn.1000b200
mov dword [ebp - 0x48], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x44]
push ecx
call fcn.1001e660
add esp, 0xc
push 0x3c
push 0
lea edx, [ebp - 0x48]
push edx
call fcn.1001e660
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x3c], str.open
lea ecx, [ebp - 0x94]
call fcn.10007900
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], str.637B00E0_4C16_43f2_BC8C_D231473E7D99
lea ecx, [ebp - 0x94]
call fcn.10007900
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000ce50
mov dword [ebp - 0x2a0], 7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.10007840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10007840
mov eax, dword [ebp - 0x2a0]
jmp 0x1000cea8
lea eax, [ebp - 0x48]
push eax
call dword [0x1003c7c8]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x1000ce74
push 0xbb8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x1000ce7b
mov dword [ebp - 0x78], 2
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x2a4], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.10007840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10007840
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.1001ed57
mov esp, ebp
pop ebp
ret

Function at 0x100123e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10012420
movzx eax, al
test eax, eax
jne 0x1001240b
mov ecx, dword [ebp - 4]
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [ebp - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x190], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x100161e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031bcb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xf8
mov eax, dword [0x1003b470]
xor eax, ebp
mov dword [ebp - 0x74], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x65], 0
cmp dword [ebp + 8], 0
jne 0x10016229
xor al, al
jmp 0x100165ac
mov ecx, dword [ebp - 0x108]
call fcn.10018620
lea ecx, [ebp - 0x58]
call fcn.10010810
cmp dword [ebp + 0xc], 0
jne 0x10016253
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x58]
mov dword [eax + 0x3568], ecx
jmp 0x10016262
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x3568], eax
xor ecx, ecx
jne 0x10016262
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0x3568]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x108]
add ecx, 0x3544
call fcn.10011090
jmp 0x100162aa
mov dword [ebp - 4], 0xffffffff
jmp 0x100162be
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0x3568]
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, dword [ebp - 0x108]
call fcn.10017730
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0x3568]
mov cx, word [eax + 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x108]
call fcn.10018420
movzx eax, al
test eax, eax
jne 0x10016307
xor al, al
invalid
movsd dword es:[edi], dword [esi]
invalid

Function at 0x10017050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax - 1]
jne 0x1001705d
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10017088
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x10017252
cmp dword [ebp + 0xc], 1
je 0x10017252
cmp dword [ebp + 0xc], 8
jne 0x1001721a
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.100163a4
pop ecx
inc esp
stc
invalid
call fcn.10016394
sbb dword [eax - 0x74], ebp
jecxz 0x100171a4
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]