joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13141f6c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x1314e5bc], 0
jne 0x13141f89
call fcn.13141880
test al, al
je 0x13141f91
cmp ebx, 0x7ffffff8
jle 0x13141f9b
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x131420ef
xor ecx, ecx
push ebp
push 0x131420e8
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x1314e045], 0
je 0x13141fbc
push 0x1314e5c4
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x13141fcc
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x1314206b
mov eax, ebx
test eax, eax
jns 0x13141fe1
add eax, 3
sar eax, 2
mov edx, dword [0x1314e61c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x1314206b
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x1314201c
mov eax, ebx
test eax, eax
jns 0x1314200b
add eax, 3
sar eax, 2
mov ecx, dword [0x1314e61c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x13142042
mov ecx, ebx
test ecx, ecx
jns 0x13142025
add ecx, 3
sar ecx, 2
mov edi, dword [0x1314e61c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x1314e5ac]
sub ebx, 4
add dword [0x1314e5b0], ebx
call fcn.13143740
jmp 0x131420ef
cmp ebx, dword [0x1314e614]
jg 0x131420bd
sub dword [0x1314e614], ebx
cmp dword [0x1314e614], 0xc
jge 0x1314208f
add ebx, dword [0x1314e614]
xor eax, eax
mov dword [0x1314e614], eax
mov eax, dword [0x1314e618]
add dword [0x1314e618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x1314e5ac]
sub ebx, 4
add dword [0x1314e5b0], ebx
call fcn.13143740
jmp 0x131420ef
mov eax, ebx
call fcn.13141e78
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131420ef
cmp byte [0x1314e045], 0
je 0x131420e7
push 0x1314e5c4
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x131420fc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x1314e5c0], eax
cmp byte [0x1314e5bc], 0
jne 0x13142134
call fcn.13141880
test al, al
jne 0x13142134
mov dword [0x1314e5c0], 8
mov dword [ebp - 4], 8
jmp 0x13142295
xor ecx, ecx
push ebp
push 0x1314228e
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x1314e045], 0
je 0x13142155
push 0x1314e5c4
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x13142170
mov dword [0x1314e5c0], 9
jmp 0x13142265
dec dword [0x1314e5ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x1314e5b0], eax
test bl, 1
je 0x131421d0
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x131421a0
test edx, 0x80000003
je 0x131421af
mov dword [0x1314e5c0], 0xa
jmp 0x13142265
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x131421c7
mov dword [0x1314e5c0], 0xa
jmp 0x13142265
add ebx, edx
mov esi, eax
call fcn.13141a24
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x1314e618]
jne 0x13142210
sub dword [0x1314e618], ebx
add dword [0x1314e614], ebx
cmp dword [0x1314e614], 0x3c00
jle 0x13142201
call fcn.13141d14
xor eax, eax
mov dword [ebp - 4], eax
call fcn.13143740
jmp 0x13142295
mov edx, dword [eax]
test dl, 2
je 0x13142233
and edx, 0x7ffffffc
cmp edx, 4
jge 0x1314222e
mov dword [0x1314e5c0], 0xb
jmp 0x13142265
or dword [eax], 1
jmp 0x1314225c
mov eax, edi
cmp dword [eax + 4], 0
je 0x13142246
cmp dword [eax], 0
je 0x13142246
cmp dword [eax + 8], 0xc
jge 0x13142252
mov dword [0x1314e5c0], 0xb
jmp 0x13142265
mov edx, dword [eax + 8]
add ebx, edx
call fcn.13141a24
mov edx, ebx
mov eax, esi
call fcn.13141c8c
mov eax, dword [0x1314e5c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13142295
cmp byte [0x1314e045], 0
je 0x1314228d
push 0x1314e5c4
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x131427b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.13143c34
test esi, esi
jne 0x131427e6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_OpenFileMappingA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.13143d24
jmp 0x13142804
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.131426c4
mov edi, eax
test esi, esi
je 0x13142804
cmp dword [ebx], 0
je 0x13142804
dec esi
jmp 0x131427ed
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x131448b0
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x13144a44
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
test esi, esi
je 0x13144918
push 0x13144a54
push esi
call sub.KERNEL32.DLL_OutputDebugStringA
mov ebx, eax
test ebx, ebx
je 0x13144918
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x13144918
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SizeofResource
jmp 0x13144a3a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x13144958
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x13144a3a
mov eax, dword [ebp - 4]
add eax, 2
call fcn.1314489c
mov esi, eax
cmp byte [esi], 0
je 0x13144a3a
lea eax, [esi + 1]
call fcn.1314489c
mov esi, eax
cmp byte [esi], 0
je 0x13144a3a
jmp 0x1314495e
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SizeofResource
jmp 0x13144a1d
lea eax, [esi + 1]
call fcn.1314489c
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x13144a3a
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SizeofResource
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov esi, eax
cmp esi, 0xffffffff
je 0x13144a3a
push esi
call sub.KERNEL32.DLL_GetVersionExA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x13144a3a
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SizeofResource
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x1314497c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x13148ec0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x1314d3fc]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x131491bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x131491d5
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x131491ce
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x131491e7
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x131491e0
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.13148db0
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x13149201
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.13148ec0
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x13149286
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x131492a3
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.13148e40
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x131492cc
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x131492e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x131492fd
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x131492f6
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x13149311
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.13148ca8
test bl, bl
jne 0x131493e4
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x1314e79c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x13149348
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x1314935c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131491bc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x1314938e
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x1314933d
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131493b1
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x131493c2
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131493d6
jmp 0x1314949f
cmp bl, 1
jne 0x1314949f
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x1314e7f6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x13149404
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x13149418
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131491bc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x1314944a
sub ebx, 6
inc dword [ebp - 8]
jne 0x131493f9
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x13149471
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x13149482
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x13149496
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.13148d2c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x1314a2af
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [eax], 0xfffff000
jne 0x1314a2c4
mov dl, byte [eax + 5]
cmp dl, 0xe8
je 0x1314a2c9
cmp dl, 0xcc
je 0x1314a2c9
dec eax
dec ecx
jne fcn.1314a2af
ret
add eax, 0xa
add eax, dword [eax - 4]
ret

Function at 0x1314a5aa
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, edx
push dword [esp + 0x10]
call dword [ebx + 8]
test eax, eax
je 0x1314a61e
mov eax, dword fs:[0x30]
push eax
xor eax, dword [ebx + 4]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_GetFileSize
test eax, eax
pop edx
je 0x1314a61a
push eax
push edx
push dword [ebx + 0x30]
call dword [ebx + 0x10]
pop edx
pop eax
cmp byte [ebx + 2], 0
sete cl
shl ecx, 1
or cl, 1
push eax
shl eax, cl
add eax, dword [edx + 0x44]
mov ecx, dword [esp + 0x14]
xor ecx, dword [ebx + 4]
mov dword [eax + 8], ecx
cmp byte [ecx], 7
pop eax
jae 0x1314a60a
inc dword [ecx + 4]
dec dword [edx + 4]
jmp 0x1314a612
inc word [ecx + 2]
dec word [edx + 2]
push eax
push dword [ebx + 0x30]
call dword [ebx + 0x18]
pop eax
pop ebx
ret 0xc
push 0x57
pop ecx
call fcn.1314a538
jmp 0x1314a61a

Function at 0x1314aa08
Capabilities:
Delete registry value
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13144098
mov eax, dword [ebp - 8]
call fcn.13144098
xor eax, eax
push ebp
push 0x1314aad7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.131440a8
push eax
call sub.advapi32.dll_StartServiceA
mov ebx, eax
test ebx, ebx
jbe 0x1314aab5
push 0x24
mov eax, dword [ebp - 8]
call fcn.131440a8
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov esi, eax
test esi, esi
jbe 0x1314aaaf
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_RegisterServiceCtrlHandlerA
test eax, eax
je 0x1314aaa9
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x1314aaa9
jmp 0x1314aaa3
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push eax
call fcn.13148744
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x1314aaa9
cmp edi, dword [ebp - 0x10]
ja 0x1314aaa9
cmp dword [ebp - 0x20], 1
jne 0x1314aa84
push esi
call sub.advapi32.dll_QueryServiceStatus
push ebx
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314aade
lea eax, [ebp - 8]
mov edx, 2
call fcn.13143c58
ret
Function at 0x1314aae8
Capabilities:
Delete registry value
Query or enumerate registry value
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.13144098
mov eax, dword [ebp + 8]
call fcn.13144098
xor eax, eax
push ebp
push 0x1314ac7f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0xf003f
push 0
push 0x1314ac94
call sub.advapi32.dll_StartServiceA
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.131440a8
push eax
push 0
push 2
push 0x110
push 0xf01ff
push esi
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_SetServiceStatus
mov dword [ebp - 0x14], eax
mov eax, dword [0x1314d7c4]
cmp dword [eax], 0
je 0x1314abfa
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.13144108
mov eax, 4
call fcn.13142540
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
call fcn.13143ea8
inc eax
call fcn.13142540
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
xor eax, eax
push ebp
push 0x1314abf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0x1c]
call fcn.13146534
mov eax, dword [ebp - 0x18]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x1314d7c4]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314abfa
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.13142560
mov eax, dword [ebp - 0x18]
call fcn.13142560
ret
push 0x1f4
call fcn.13148744
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x1314ac59
jmp 0x1314ac48
cmp dword [ebp - 0x34], 2
jne 0x1314ac59
push 0x1e
call fcn.13148744
cmp dword [ebp - 0x34], 4
jne 0x1314ac44
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov byte [ebp - 5], 1
jmp 0x1314ac48
mov byte [ebp - 5], 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jne 0x1314ac19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314ac86
lea eax, [ebp - 0x1c]
call fcn.13143c34
lea eax, [ebp - 4]
call fcn.13143c34
lea eax, [ebp + 8]
call fcn.13143c34
ret
Function at 0x1314ac98
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13144098
xor eax, eax
push ebp
push 0x1314ad4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x1314ad2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0xf003f
push 0
push 0x1314ad5c
call sub.advapi32.dll_StartServiceA
mov ebx, eax
test ebx, ebx
je 0x1314ad12
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.131440a8
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov edi, eax
test edi, edi
je 0x1314ad0c
push edi
call sub.advapi32.dll_StartServiceCtrlDispatcherA
mov esi, 1
push edi
call sub.advapi32.dll_QueryServiceStatus
push ebx
call sub.advapi32.dll_QueryServiceStatus
test esi, esi
jle 0x1314ad1c
mov byte [ebp - 5], 1
jmp 0x1314ad20
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1314ad34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314ad51
lea eax, [ebp - 4]
call fcn.13143c34
ret

Function at 0x1314b1ec
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1314b329
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.1314b124
test al, al
je 0x1314b2cf
push 0x1314b338
push 4
mov ecx, 0x1314b33c
mov edx, 0x1314b348
mov eax, 0x80000001
call fcn.13149b4c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.13142bec
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
push 0x1314b378
push 1
mov ecx, 0x1314b37c
mov edx, 0x1314b390
mov eax, 0x80000001
call fcn.13149b4c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x28
push 0
push 0
push 0
push 0x1314b3c4
push dword [ebp - 4]
push 0x1314b3d0
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.13143f68
mov eax, dword [ebp - 0x5c]
call fcn.131440a8
push eax
push 0
call fcn.131451d4
test eax, eax
je 0x1314b2cf
push 0x1388
call fcn.13148744
mov eax, dword [0x1314e948]
call fcn.131440a8
mov edx, eax
mov eax, dword [ebp - 0x58]
call fcn.13149fe0
mov ebx, eax
jmp 0x1314b30b
push 0x3e8
call fcn.13148744
mov eax, 0x1314b3e8
call fcn.1314b020
test eax, eax
je 0x1314b2cf
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
mov eax, dword [0x1314e948]
call fcn.131440a8
mov edx, eax
mov eax, ebx
call fcn.13149fe0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314b330
lea eax, [ebp - 0x5c]
call fcn.13143c34
lea eax, [ebp - 4]
call fcn.13143c34
ret
Function at 0x1314bc40
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13144098
mov eax, dword [ebp - 8]
call fcn.13144098
mov eax, dword [ebp - 0xc]
call fcn.13144098
mov eax, dword [ebp + 8]
call fcn.13144098
xor eax, eax
push ebp
push 0x1314bd47
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x1314bce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x1314bd60
call fcn.13143ff4
jne 0x1314bcae
call fcn.1314a08c
test al, al
je 0x1314bcae
mov eax, dword [ebp - 0xc]
call fcn.1314ac98
mov eax, dword [ebp - 8]
mov edx, 0x1314bd60
call fcn.13143ff4
jne 0x1314bcd6
mov eax, dword [ebp + 8]
call fcn.131440a8
mov ecx, eax
mov edx, 0x1314bd64
mov eax, 0x80000001
call fcn.13149c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1314bcea
call fcn.1314524c
push 0
push 0x1314bd94
call sub.user32.dll_PostMessageA
mov ebx, eax
call fcn.1314524c
test ebx, ebx
je 0x1314bd24
call fcn.13145244
push 0
push 0
push 0x3400
push ebx
call sub.user32.dll_GetKeyboardType
push 0xfa0
call fcn.13148744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314bd4e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.13143c58
lea eax, [ebp + 8]
call fcn.13143c34
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219