joyce8/EMBER2024-capa huggingface dataset:
Function at 0x563520
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x563551
dec al
je 0x56358c
dec al
je 0x5635d1
dec al
je 0x56363a
jmp 0x5636c4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5636c4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x563561
jmp 0x5636c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5636c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x56359c
jmp 0x5636c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5636c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x563600
xor ebp, ebp
jmp 0x563610
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x563619
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5635e1
jmp 0x5636c4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5636c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x563693
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0056093c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x56364e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56cf1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x56cf4a
mov eax, ebx
call fcn.0056d9d0
cmp dword [ebx + 0x40], 0
je 0x56cf43
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x56cfbb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x56cfad
cmp dword [ebx + 8], 0
je 0x56cf6c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x56cf7e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x56cfad
cmp dword [ebx + 8], 0
je 0x56cf5f
cmp eax, 3
je 0x56cf91
dec eax
jne 0x56cf5f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x56cf5f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x56cf5f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x56cfd9
cmp dword [ebx + 0x14], 0xcc
je 0x56cfd9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0056cfe4
pop ebx
ret

Function at 0x62d6ca
Capabilities:
Check for software breakpoints

Disassembly:
adc ch, dh
push eax
sub al, 0xcc
cmp al, 0xcc
adc byte [eax - 0x7339b28], bl
cmp al, 0xb0
jmp 0x62d6e9
call fcn.00856d52
jns 0x62d730
add byte [ecx + 0x5f], bh
scasb al, byte es:[edi]
xchg edx, eax
lea ecx, [eax + 0x5219db9]
test dword [ecx - 0x33], esp
lodsd eax, dword [esi]
popal
frstor dword [ebp + 0x1ef3192d]
xchg esi, eax
jl 0x62d6ce
sbb bl, byte [edx + 0x77fab1c]
sbb al, 0xab
jg 0x62d6f4
in eax, dx
jnp 0x62d678
or byte [esp + ebx*4 - 0x5d0ddd90], bh
and dh, dl
mov byte [0x1ac24a72], al
std
daa
outsb dx, byte [esi]
nop
pop es
inc edi
out 0x1a, eax
inc edi
adc al, 0xb5
aaa
das
xchg ebx, eax
cli
mov ds, word [eax]
mov esp, esi
xor byte [edx + 0x12], dh
rol dword [ecx - 0x76ce447], 0xa9
inc eax
sbb ebp, edi
mov cl, 0xa5
frstor dword [ecx*8 - 0x199cabda]
push esp
mov dh, 0x8a
adc al, 0xce
and ebx, dword [eax + 0x30]
mov ebx, 0xc0daee22
jb 0x62d743
ret 0xfd1a
out dx, al
fcmovb st(0), st(0)
jbe 0x62d6f7
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
salc
push edx
cwde
xchg ebp, eax
in eax, dx
pop es
push ds
fstp qword [ebx + eax]
adc al, 0xd7
sub eax, 0x99b84660
pop ebx
push ds
push 0xffffffffffffffd8
invalid

Function at 0x65b973
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + 0x267723]
call fcn.008146df
push esp
cmp cl, byte [ecx - 0x6b776f8b]
or al, 0xdc
movsb byte es:[edi], byte [esi]
cmp al, 0x7c
dec eax
enter 0x5cac, 0x10
mov eax, 0xa4bc8c34
or eax, ecx
cmpsb byte [esi], byte es:[edi]
mov byte [0x9ebcb6ec], al
invalid
Function at 0x709617
Capabilities:
Encode data using base64

Disassembly:
pushal
pushfd
pop dword [esp + 0x1c]
pushal
mov dword [esp + 8], 0xd268ab76
xor edi, 0xdc3e5038
mov dword [esp + 4], eax
xor ebp, 0xe33a902a
call fcn.007b6474
cmpsb byte [esi], byte es:[edi]
dec byte [ebp + 0x72]
xchg ebp, eax
mov byte [eax + 0x24], bl
test al, 0x28
movsb byte es:[edi], byte [esi]
je 0x6ab561
fadd dword [eax + edx - 0x18]
invalid
invalid
pushfd
bswap cx
nop
push 0xd5571f8d
not ch
push dword [esp + 4]
mov ecx, dword [esp + 0xc]
push 0x31e5a2a2
push 0x2946dd4
push 0x591effbb
xchg dword [esp + 0x1c], ecx
lea esp, [esp + 0x1c]
jno 0x7cf93b
pushal
push esp
mov dword [esp + 0x20], ecx
lea ecx, [ebp + 0x30665d9b]
movzx cx, al
mov byte [esp + 0x10], cl
push ebx
mov ecx, 0x490cc6
pushfd
lea esp, [esp + 0x28]
jle 0x79378b
push ebx
mov ecx, dword [ecx + 0x1d7e65]
push ecx
push 0x9576495b
lea ecx, [ecx - 0x1b6828cb]
call fcn.008843a9
jmp 0x6ab508
push eax
pushfd
pushal
pushfd
xchg dword [esp + 0x28], ecx
mov dword [esp], eax
pop ecx
setae ch
mov ecx, 0x490cc6
push dword [esp + 8]
call fcn.00804ce6

Function at 0x73dc46
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x18]
jg 0x5c2930
push esp
lea eax, [eax - 0x34c02685]
jmp 0x7d6ac7
clc
xor edi, 0xc0306f45
bt si, di
stc
xor ebp, 0x358dad3f
call fcn.0080d804
cmp ah, ch
pop eax
xor al, 0xc
invalid
xchg dh, bl
push eax
test bl, ah
wait
cli
pop ebp
adc ecx, dword [esi + 0x2b81c559]
jae 0x7d6a10
cmp byte [edx], cl
xchg ebx, eax
std
jns 0x7d6ab8
xor eax, 0x3d8d2614
add byte [eax - 0x5a0a7a96], dh
hlt
mov ebx, 0x9c9cf16b
jmp 0x7c9abe
push 0x9ac9a79
push dword [esp + 4]
call fcn.007c8eb3
stosd dword es:[edi], eax
xchg ecx, eax
loopne 0x7d6aff
fisub word [ebx]
invalid
test al, 0x88
jecxz 0x7d6a68
add ebp, dword [ebx + 0x22d34f73]
int1
sal dword [ecx - 0x64], 1
push eax
invalid
js 0x7d6ad1
adc edi, dword [eax - 0x5d]
aad 0xc1
cmp eax, 0xaa85ff26
xchg esi, eax
dec edx
xchg esi, eax
xor byte [0xc0580822], bh
push esp
and cl, byte [edi + 0x51a11434]
adc al, 0xa1
push ecx
arpl word [0xe83cfe4], bx
jne 0x7d6b04
int 0x25
jno 0x7d6b7e
and edx, ebp
hlt
and al, 0xca
jae 0x7d6b18
out 0x4c, eax
aam 0x71
jmp 0x7d6bd0
sub ah, 0xc8
mov dword [ebx - 0x60], eax
jmp 0x3bc9e96c
Function at 0x798816
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + 0x316759]
lea esp, [esp + 4]
jae 0x756262
pushal
lea edx, [edx - 0x271cc062]
jmp 0x82b708
mov edx, esi
not edx
mov edx, 0x56eabc
pushal
call fcn.0062d002
call dword [edi - 0x5a]
and byte [edi + 0x282ae88], dl
salc
push edx
sub dh, dl
mov byte [0x4e6af26e], al
dec esi
mul byte [edx - 0x46]
pop es
xor eax, 0x97ba6eb
outsd dx, dword ds:[esi]
jb 0x6c645a
pop ebp
cmp dword [edi + 0x35], esi
xchg ebp, eax
and eax, 0x4d1be678
cmc
and dl, 0xbe
cmpsb byte [esi], byte es:[edi]
mov word [ebx], ds
cmp dl, byte ds:[esp + esi*2 - 0x49bb758]
scasd eax, dword es:[edi]
invalid
call fcn.007d6179
xor dword [edi], edx
push ds
mov al, byte [0x314d7188]
std
add ebp, 0xe9358bb1
iretd
pushal
pushal
nop
push 0xa9e9260a
lea esp, [esp + 0x44]
jnp 0x81d8a1
pushfd
xchg dword [esp], edx
setb dh
pushfd
lea esp, [esp + 4]
jno 0x6c643a
push edi
mov edx, 0x56eabc
jmp 0x69892e
pushfd
mov dword [esp], edx
push 0x526392c2
mov edx, 0x56eabc
pushfd
call fcn.006e8e06
call fcn.00669c7e
xchg dword [esp + 0x20], edx
mov byte [esp], 0xb
push dword [esp + 8]
mov byte [esp], 0xfe
push dword [esp + 0x24]
ret 0x2c

Function at 0x79d054
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x2c], ecx
movsx cx, dl
push 0xf6e1771c
pop ecx
not cl
mov ecx, 0x50f74e
pushfd
mov ecx, dword [ecx + 0x36cd16]
call fcn.0074695d
push edi
scasd eax, dword es:[edi]
dec byte [esp - 0x7a46f678]
push ebp
or dword [ecx + 0x64e41529], eax
push eax
sub bl, ah
dec eax
mov al, byte [0xb8e75024]
invalid

Function at 0x832c5e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe6663b6b
mov dh, 0x2a
pop dx
xchg esi, eax
fiadd dword ss:[esi]
xchg esi, eax
fimul dword [esi - 0x2a]
mov esp, 0x1e6e0366
fidiv word cs:[edx + 2]
add al, 0x60
pushal
pushal
nop
mov byte [esp], cl
call fcn.00762134
inc esi
sahf
in eax, dx
call 0xda78b51d
push ecx
add eax, 0x2d61b9e9
frstor dword [ecx + 0x29]
add dword [ecx - 0x62fa6e13], eax
add eax, 0xb021741c
lea edi, [ebp - 0x79]
adc al, 0x3f
scasd eax, dword es:[edi]
xor edx, dword [ecx - 0x60]
test dword [ebx + 0x57], ebp
js 0x832c42
pop edi
pop edx
loop 0x832ce6
mov dl, 0x32
pop esi
xor edi, 0x66
xor byte [0xf48aa896], bl
enter 0x5ca2, 0xffffffffffffff99
shr eax, cl
adc dword [eax + esi*8 + 0x57], esi
aaa
ret 0xf824
xor cl, 0x6d
pop ecx
sbb al, 0xd6
sbb dword [ebp + eax*2 - 0x5cc651d2], esi
psubq mm2, qword [ebx - 0x7f]
adc al, 0xbe
fnstenv [edx - 0x7240bc52]
push ebx
enter 0xffffffffffff8eaf, 0xffffffffffffffb5
cmp dword [esi + eax*8], ecx
sub esi, edx
mov al, 0x6a
xchg ebp, eax
sub cl, bl
popal
xor eax, 0x962ac0
sub dl, 0x66
mov ebx, 0xb6ce56a1
cmp dword [ebx], ecx
xchg dword [ebx + 0x63], edi
and al, 0x4d
xchg dword [si - 0x5e4c], ecx
je 0x832cf6
adc dword [esi + edi*4], 0x43aeb2d9
mov edi, 0xafc8538d
invalid
adc ah, byte [ebx]
sub al, 0x58
jecxz 0x832d89
fnstcw word [ebx]
invalid
or esi, esp
call [edi + eax*8 + 0x1242444]
cmc
cmp bl, byte [0xd1ab9b68]
imul ebp, dword [eax + 0x79], 0xfffffff7
pop ebp
ja 0x832d89
lodsd eax, dword [esi]
jp 0x832d92
jmp dword [esi - 0x77]
Function at 0x83ad3e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor edi, 0x1d642655
bt si, 9
stc
xor eax, 0x1625bb73
cmp cl, 0xff
mov word [esp + 0xc], 0x8eb0
xor esi, 0x23957a10
pushfd
xor ecx, 0x5f047944
call fcn.007c1aae
and dword [ecx - 0x38], edi
imul ebp, dword [esi - 0x7c602c78], 0x8fa3174b
imul esp, dword [edx + 0x33b5647e], 0x35b50bae
rcr dword [ecx], 0xc1
mov dword [0x7ea2698f], eax
mov ch, 0x33
scasb al, byte es:[edi]
or esi, dword [ebp - 0x3ee63ecb]
aaa
mov dl, 0
sub eax, 0x9b2fb70d
ja 0x83adae
wait
adc eax, ebx
xchg ebx, eax
adc edx, dword [edi - 0x65f9aa91]
xchg edi, eax
daa
mov byte [0x89777c1e], al
add ebp, edi
and cl, byte [edx + 0x37eb052d]
adc byte [ebp + 0x78], 0xda
push 0xda1939d2
pop esi
adc ah, ah
outsd dx, dword [esi]
fisubr dword [eax - 0x2e]
cmp dword [ecx], ebx
ficomp dword [esi + 0x10]
in al, 0x6f
sar dword [ebp - 0x25f8e469], 1
xor cl, byte [eax - 0x64]
jne 0x83ad76
adc byte [esi + eax], ch
insd dword es:[edi], dx
int1
jnp 0x83adfc
mov dh, 0xcb
mov dword [0x97abd3f9], eax
lahf
and edi, dword [ebx - 0x4b]
add ecx, ecx
insd dword es:[edi], dx
or ebp, ebx
inc ebx
add bh, ah
ret
cli
dec dword [edi]
xchg esp, eax
les ebp, [eax + 0x74]
xchg edi, eax
jl 0x83adab
mov eax, dword [esp + 4]
pushfd
push esi
call fcn.0074499d
mov dword [esp + 0x3c], 0xbcefbdc4
mov word [esp], 0x724
lea esp, [esp + 0x3c]
jmp fcn.005b6173

Function at 0x845f17
Capabilities:
Encode data using xor

Disassembly:
jmp 0x84fbf0
mov dword [esp + 4], eax
pushfd
pushal
mov eax, 0x5b2d81
push 0xecb34bd6
call fcn.006a348d
nop
call fcn.00887b87
fnsave dword [0x88afb884]
pop dword [ebx - 0xd]
outsd dx, dword [esi]
out 0xb3, eax
xor esp, edi
scasd eax, dword es:[edi]
pop es
insd dword es:[edi], dx
add esi, dword [ebp + 0x26141845]
inc edi
inc ecx
std
salc
adc al, 0xb1
and al, bl
in al, dx
std
push ebp
xor dword [esi + ebx + 0x41db5a02], edi
jnp 0x84fc00
add ebp, edi
ret 0x351a
Function at 0x86093d
Capabilities:
Encode data using xor

Disassembly:
clc
dec esp
invalid
call fcn.006a1791
les ebx, [ebx + ebp*2]
lds esi, [eax + 0x12426e88]
xchg esi, eax
cmp byte [0xa26edb5], 0xf0
pushfd
out dx, al
std
scasd eax, dword es:[edi]
stc
fst qword [0xa99b48fb]
cmpsd dword [esi], dword es:[edi]
push edi
das
loope 0x8608f8
dec ecx
adc eax, 0xed113991
rcr dword [ecx - 0x3c21afb], 1
xor byte [ebp - 0x4e662e2], cl
mov esp, 0x6912f455
xor dh, dl
movsd dword es:[edi], dword [esi]
push ebp
loopne 0x8609ca
mov dh, 0xe
or eax, dword [edi + 0xe]
xchg esp, eax
mov edi, 0xb652c76f
inc ebp
nop
mov bl, 0x78
invalid
push ebp
lodsd eax, dword [esi]
xchg ebx, eax
sahf
pushal
movsb byte es:[edi], byte [esi]
mov al, byte [edx]
cmp ebx, dword [ebx]
xchg ebx, eax
mov edi, 0xa71b9357
dec ebx
jecxz 0x860a04
sbb esp, dword [edi - 0x3cd81cb5]
sub eax, ebx
test eax, 0x9af97353
dec ecx
mov bl, 0x67
cmpsd dword [esi], dword es:[edi]
invalid
ret
cmp esi, eax
mov eax, 0xb0c65f10
mov byte [edx + 0x32], ch
mov dl, 0x36
push es
fiadd word [esi + 0x69f54172]
xchg esp, eax
adc byte [eax - 0x2a], ch
clc
push 0x4a
xor al, 8
out dx, al
jns 0x8609d8
daa
mov byte [ecx + 0x7a], al
out 0x98, al
je 0x860a0b
shl byte [eax + edi*2 - 0xf6743bc], 0xe8
adc al, 0x8a
sbb edx, dword [esi + 0x52]
or dword [esi], ecx
sbb al, 0xcb
in al, dx
xchg esp, esi
sti
dec ebp
sub dword [esi + edx - 0x57ad222], esi
add eax, 0xa57a459
xchg edx, eax
mov ecx, 0xc55d97b4
inc eax
ror esi, cl
stosb byte es:[edi], al
xor eax, 0xee76149c
push ebp
xor dword [ebx], ecx
arpl bx, bx
push esi
pop ecx
in al, 0x43
mov edi, 0xfc2475e8
fistp dword [esi]
cmp bl, byte [ebx + 0x27]
and esp, dword [esi + ebp]
dec eax
lodsb al, byte [esi]
or byte [eax + 0x44], bh
cmp byte [ebx], dh
or dword [eax - 0x209c38c], esp
les ecx, [edi + edx - 0x25bca27f]
inc esi
adc eax, 0xcae40a86
invalid

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6f040fac
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x73c165fd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4017a5
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x4021bc
push 0x65
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401862
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x401861
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401861
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0xf013f
push ebx
push 0x4021c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401861
push edi
push esi
push 3
push ebx
push str.svstager
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401861
call fcn.00401868
mov ebx, str.svsvc32
mov esi, eax
mov ecx, ebx
call fcn.00401674
mov edi, str.svsvc64
mov ecx, edi
call fcn.00401674
call fcn.0040112f
test eax, eax
push esi
cmove edi, ebx
push ecx
mov ecx, edi
call fcn.004011ad
pop ecx
pop ecx
test eax, eax
je 0x401861
mov ecx, edi
call fcn.0040151a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x40cd33
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40cde7
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040ccc3
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40cdc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cdf3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40ce0e
test ebp, ebp
je 0x40ce0e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ce16
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40ce56
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ceb2
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40cead
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ce98
test dl, dl
je 0x40ce94
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ce98
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ce78
xor eax, eax
jmp 0x40ce9d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cebc
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40ce65
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40ced3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040cd33
test eax, eax
jne 0x40ceeb
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040cdf3
mov esi, eax
test esi, esi
jne 0x40cf21
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40cf3b
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40d033
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040cd33
mov esi, eax
test esi, esi
jne 0x40d051
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040cdf3
mov dword [esp + 0x18], eax
test eax, eax
je 0x40d049
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040cdf3
mov dword [esp + 0x34], eax
test eax, eax
je 0x40d049
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040cdf3
mov dword [esp + 0x28], eax
test eax, eax
je 0x40d049
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040cdf3
mov dword [esp + 0x30], eax
test eax, eax
je 0x40d049
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40d218
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40d218
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40d17b
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40d1fc
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40d19e
movzx esi, ax
jmp 0x40d1a3
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40d1c2
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40d1d1
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40d225
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40d193
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40d158
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40d24e
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40d24e
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40d233
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret