joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.016d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x16d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16d806a
add dl, dl
jne 0x16d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16d80dc
xor eax, eax
add dl, dl
jne 0x16d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16d817d
add dl, dl
jne 0x16d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x16d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x16d8075
mov eax, 1
add dl, dl
jne 0x16d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16d80e1
sub eax, ebx
mov ebx, 1
jne 0x16d8128
mov ecx, 1
add dl, dl
jne 0x16d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x16d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16d8136
cmp eax, 0x7d00
jae 0x16d816d
cmp eax, 0x500
jb 0x16d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16d8075
cmp eax, 0x7f
ja 0x16d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x16d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x16d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x13d9255
Capabilities:
Hash data with md5

Disassembly:
call fcn.01426ced
jmp 0x1426d28
jmp 0x13d9250
jmp 0x13d926f
and dword [eax], 0
jmp 0x1426d6f
lea esp, [esp + 4]
and dword [eax + 4], 0
jmp 0x1426d12
push esp
jmp fcn.01426d9c
mov dword [eax + 8], reloc.kernel32.dll_GetProcAddress
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
jmp 0x1426d59

Function at 0x13e7f11
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x18
jl 0x13e7f66
rdtsc
mov al, 0x8f
pop dx
push word [esp + 0x14]
jmp 0x13e7fc6
mov al, 0x8f
pop dx
push word [esp + 0x14]
jmp 0x13e7f6a
rdtsc
jmp 0x13e7f50
lea esp, [esp + 0x13]
xchg byte [esp + 2], dl
stc
jmp 0x13e7f9c
lea esp, [esp + 1]
jmp 0x13e7fa8
add ebx, ebp
sub edi, esi
invalid
jg 0x13e7f79
lea esp, [esp + 1]
jmp 0x13e7fa8
lea esp, [esp + 8]
neg cl
inc edx
jle 0x13e7fcc
jg 0x13e7fd5
cmc
outsb dx, byte [esi]
cld
wait
jbe 0x13e7f7c
in eax, 0x83
adc esi, dword [esi - 0x7b]
inc esi
fld qword [edx + ebx*8 - 0x43]
dec esp
cld
jno 0x13e7f54
lea esp, [esp + 0x13]
and al, 0x13
jmp 0x13e7f6e
lea eax, [edx + 5]
jmp 0x13e84a8
lea eax, [edx + 5]
xor ax, 0x5b9d
bsr dx, cx
mov dx, word [esp]
and dx, 0xe863
jmp 0x13e843a
js 0x13e8022
jns 0x13e8022
cmp ebp, dword [ebx + reloc.kernel32.dll_GetProcAddress]
push ebx
int3
add cl, 0x47
call 0x13e802b
dec edi
lea eax, reloc.kernel32.dll_GetProcAddress
mov word [esp + 1], bx
jmp 0x13e805f
mov al, dh
bt eax, edx
jbe 0x13e8086
popal
jmp 0x13e8087
not cl
rdtsc
lea edx, [esp + edi]
not ah
bts dx, si
jmp 0x13e800c
pushal
mov dl, byte [esp]
sete dh
mov dword [esp + 0x14], ecx
not al
mov al, byte [esp]
jmp 0x13e8038
mov al, 0xb8
bswap eax
jmp 0x13e8050
popal
call 0x13e808d
enter 0xffffffffffffd0f7, 0xffffffffffffffeb
add al, 0x6b
cmp byte [0x448b660c], 0x24
add dword [ebp + reloc.kernel32.dll_GetProcAddress], ecx
sahf
and esi, dword [ebx - reloc.kernel32.dll_GetProcAddress]
cli
popfd
insb byte es:[edi], dx
rcl byte [ecx], cl
nop
adc ecx, dword [edx - reloc.kernel32.dll_GetProcAddress]
neg edx
jbe 0x13e8080
mov al, 0xb8
bswap eax
jmp 0x13e8050
neg cl
rdtsc
mov eax, 0xd9d1a2a8
mov ax, bx
rdtsc
jmp 0x13e80b1
mov dx, 0x7a88
jmp 0x13e814f
mov dx, 0x1391
setb al
shr edx, cl
jne 0x13e82a7
mov dx, 0x7a88
jmp 0x13e814f
and dx, 0xe863
mov dx, 0x855a
dec cl
lea eax, [ebx + ebx]
jmp 0x13e83c6
xor ax, 0x5b9d
bsr dx, cx
mov dx, word [esp]
jmp 0x13e8435

Function at 0x13e8366
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x13e83a8
xchg dword [esp + 0xc], ecx
sub esp, 0x1d
push dword [esp + 0x18]
lea esp, [esp + 1]
lea ecx, reloc.kernel32.dll_GetProcAddress
call fcn.013e83fb
jmp 0x13e83c6
Function at 0x13ebbcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf13d68f4
jmp 0x13ebbda
push dword [esp + 2]
jge 0x13ebc8c
pop dword [esp]
jmp 0x13ebc14
mov byte [esp + 0x21], dl
lea esp, [esp + 6]
mov dword [esp + 0x58], esi
push ebx
jmp 0x13ebbb5
dec ebx
js 0x13ebbf9
jns 0x13ebc58
add edx, dword [ecx + reloc.kernel32.dll_GetProcAddress]
adc dword [edx], reloc.kernel32.dll_GetProcAddress
out 0x12, eax
rcl byte [ebx]
mov ah, byte [0x648dc754]
and al, 0x5c
lea esp, [esp + 0x5c]
jmp 0x13ebc9f
add byte [ecx + 0x2a3abfd2], bh
mov ecx, 0x2a3abfd2
mov edi, dword [esp + 0x2c]
bsf bp, cx
jg 0x13ebc38
jle 0x13ebc22
jp 0x13ebbf8
bound eax, qword [0x587940f4]
mov ebx, 0x1c896692
and al, 0xff
je 0x13ebc3f
mov word [esp], bx
push dword [esp + 3]
mov dword [esp + 0x5c], edi
jmp 0x13ebbf0
add ecx, dword [ecx - reloc.kernel32.dll_GetProcAddress]
into
mov dx, sp
lea ebp, reloc.kernel32.dll_GetProcAddress
mov cx, di
jmp 0x13ebc75
mov dx, sp
lea ebp, reloc.kernel32.dll_GetProcAddress
mov cx, di
jmp 0x13ebc75
cmp al, 0xff
jmp dword [esi - 0x75]
mov ecx, 0x2a3abfd2
jmp 0x13ebbfe
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13ebca5
lea ebp, [esp]
sub esp, 0x1e
jle 0x13ebc5f
lea eax, reloc.kernel32.dll_GetProcAddress
rdtsc
jmp 0x13ebce3
pop dword [esp]
mov word [esp], bx
push dword [esp + 3]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
pushfd
jmp 0x13eb40d
rdtsc
push word [esp + 0x11]
sub esp, 0xa0
jmp 0x13ebccd
push word [esp + 0x11]
jmp 0x13ebcac

Function at 0x13f5968
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
lea ecx, [eax*4]
jmp 0x13f59a0
pop ecx
inc bl
btr cx, ax
je 0x13f598a
jne 0x13f59c9
lea ecx, [eax + ebp]
lea ecx, reloc.kernel32.dll_GetProcAddress
lea ecx, [esi*4]
neg ch
not cx
call 0x13f59fa
in al, dx
or cx, 0xa08f
not cx
mov cx, word [esp]
xchg dword [esp], ebx
call fcn.013f5a14
inc esi
ror ch, cl
jmp 0x13f59e4

Function at 0x13f5aa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.013f5b3e
jo 0x13f5aa6
add byte [eax], al
add byte [eax - 5], dh
imul ecx, dword [esi], reloc.kernel32.dll_GetProcAddress
dec edx
push esi
fdiv qword [edx + 0x15]
in al, 0x25
test eax, 0x3d826bc8

Function at 0x13f5bef
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bl
xchg bh, cl
lea ebx, reloc.kernel32.dll_GetProcAddress
xchg dword [esp], edx
call fcn.013f5b9c
Function at 0x1429809
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.014297c8
lea esp, [esp + 2]
jmp 0x1429840
call fcn.01429893
jg 0x1429841
add eax, 0xf47c4daa
int1
mov eax, 0xbf6c1875
adc eax, dword [ecx - reloc.kernel32.dll_GetProcAddress]
mov ecx, ebp
int 0x8b
sbb dword [esi + 0x40], esp
mov ebx, dword [ecx]
inc ax
je 0x142982a
not ecx
jmp 0x14299f1
sete cl
neg cx
jmp 0x142990b
mov cl, 0xbf
lea ecx, reloc.kernel32.dll_GetProcAddress
mov cx, word [esp]
jmp 0x1429970
sete cl
neg cx
add ebp, 6
mov ecx, 0x127bac91
jmp 0x14298e5
bsr cx, di
jmp fcn.013f578a
mov ecx, esp
jmp 0x1429915
mov byte [ebx], al
clc
jns 0x1429941
mov ecx, esp
bsr cx, di
jmp fcn.013f578a
mov al, byte [ebp + 4]
lea ecx, [esp + esi]
neg cx
jl 0x1429905
jge 0x14298dd
xchg esi, eax
or dword [ecx + reloc.kernel32.dll_GetProcAddress], ebx
dec ebx
loop 0x14299f4
insb byte es:[edi], dx
xchg edx, eax
aas
sbb eax, ebp
sub dl, byte [ecx + 0xffc9505]
mov ecx, 0x585ffa9c
mov dword [eax], reloc.kernel32.dll_GetProcAddress
dec esp
fbld tbyte [esi]
push ecx
not cl
lea ecx, [ebp*4]
or al, 0xad
add byte [eax], al
add byte [eax], al
jmp 0x14299b8

Function at 0x1485015
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1485070
bsf di, bp
bsr edx, ebp
xchg ah, dl
mov ah, al
cmc
lea edx, [ebx + esi]
jmp 0x14850b0
mov di, word [esp + 3]
push word [esp + 2]
not dx
pop word [esp + 1]
pop eax
not dh
jmp 0x1485017
mov ah, 0x26
bswap edx
mov dh, 0xc4
sub esp, 0x1a
setne dh
mov byte [esp + 0xe], cl
jmp 0x14850f9
rdtsc
pop word [esp + 8]
pop word [esp]
not ax
jmp 0x14850e3
sub esp, 0x18
pop word [esp + 0xd]
add esp, 0x1f
pop word [esp + 3]
jmp 0x1485125
dec dh
rdtsc
pop dword [esp + 9]
rdtsc
lea edx, reloc.kernel32.dll_GetProcAddress
mov byte [esp + 0x11], ah
jmp 0x14850c2
dec dx
bts edi, esi
sub esp, 2
pop dword [esp + 6]
sub esp, 0xe
stc
jmp 0x1485e71
push edx
sub esp, 6
push dword [esp + 0xb]
setae dl
mov al, 0xca
add esp, 6
jmp 0x148510f
mov dword [esp + 0x17], ecx
xchg edx, edi
cmc
push edi
bsr edi, esp
mov ax, word [esp + 9]
jmp 0x14851a1
push word [esp]
push word [esp + 4]
mov word [esp], cx
mov di, word [esp + 1]
jmp 0x148518b
rcl edx, cl
inc edi
lea edx, [ebp*4]
xchg word [esp + 9], di
sub esp, 0xa
mov di, dx
jmp 0x148514a
clc
xchg al, ah
pop word [esp + 3]
mov dword [esp + 2], ecx
lea eax, [edx + ebx]
jmp 0x14851cb
inc dx
xchg edx, eax
not edx
mov eax, 0x87234ae1
lea esp, [esp + 0x19]
mov word [esp], bx
jmp 0x148515c
xchg byte [esp + 2], ah
btc di, dx
pop dx
shl eax, cl
push dword [esp + 4]
call 0x14851b5
push edi
fisttp dword [ebx + 0x2e]
fisttp qword [edi]
mov esi, 0xc24448f
pop dword [esp + 0xc]
xchg di, dx
mov dword [esp + 0xe], edx
not dl
pop eax
bswap eax
jmp 0x1485174
mov edi, dword [esp + 0xa]
bts dx, dx
lea eax, reloc.kernel32.dll_GetProcAddress
mov dx, 0x3e2a
sets dh
xchg byte [esp + 0x10], ah
jmp 0x14851e7
neg dx
pop edx
push dword [esp + 0x15]
mov edx, dword [esp + 9]
dec al
xchg dword [esp + 0x13], edi
jmp 0x148523a
Function at 0x1485a84
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dh, bl
pop word [esp + 0x17]
mov ax, di
mov byte [esp + 5], ch
mov dx, di
dec eax
jmp 0x1485aef
not dx
lea edx, [eax + ebp]
std
xchg word [esp + 4], di
setno dl
jmp 0x1485a65
setne ah
btc edx, ebx
add esp, 1
not di
bsr ax, dx
jmp 0x1485ad2
pop eax
pop edi
mov dx, bp
or ax, 0x1692
add esp, 7
mov edi, dword [esp]
jmp 0x1485a95
xchg edx, eax
bt edi, ecx
sbb dl, 0x6c
clc
setae dl
std
jmp 0x1485b00
lea edi, reloc.kernel32.dll_GetProcAddress
add esp, 0
bswap eax
pop dx
mov al, byte [esp]
mov edi, 0x7c9ea7a8
jmp 0x1485abc
neg al
lea edi, [ecx + ebx]
mov edi, dword [esp + 0x11]
dec edi
add esp, 8
neg al
jmp 0x1485aab
rdtsc
mov di, word [esp]
xchg dl, al
clc
lea edx, [esp + edi]
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x1485b3d
rdtsc
sub esp, 6
btc edx, ecx
pop word [esp]
rcl ah, 1
mov word [esp], sp
jmp 0x1485b26

Function at 0x1487bc2
Capabilities:
Check for peb beingdebugged flag
Get number of processors

Disassembly:
jmp 0x148504b
call 0x1486fff
jmp 0x1487cdc
mov eax, dword [eax + 0xc]
jmp 0x1487bd6
mov byte [esp + 2], al
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
mov eax, dword fs:[0x30]
jmp 0x1487bac
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x1487be4
push eax
jmp 0x1486ffa
pop eax
sub eax, 0x1086fff
push eax
jmp 0x1484fe0

Function at 0xae1b6a
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae1b6a
ret
Function at 0x404da8
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x405d58
call fcn.00401604
mov eax, dword [0x407030]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x404eb8
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x404e69
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00402310
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x404e56
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x404eb8
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x404eb8
mov al, byte [edi]
cmp al, 0x5c
je 0x404e77
cmp al, 0x2f
jne 0x404e7c
cmp al, byte [edi + 1]
je 0x404eb2
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.00404f4f
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x404eb8
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404ef0
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x404ed4
push edi
call fcn.00401397
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00401188
call fcn.0040163f
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4090a0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
push edi
xor eax, eax
lea edx, [esi + 0x20]
mov ecx, 0x400
mov edi, edx
mov dword [esi + 0x1024], eax
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push 0xfff
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4090ec
mov eax, dword [esp + 0xc]
pop edi
mov dword [esi + 0x1020], eax
pop esi
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0xc]
pop edi
mov dword [esi + 0x1020], edx
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
Function at 0xcba058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xcba1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcba07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcba06a
add dl, dl
jne 0xcba089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcba0dc
xor eax, eax
add dl, dl
jne 0xcba096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcba17d
add dl, dl
jne 0xcba0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcba0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcba0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcba0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcba0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcba075
mov eax, 1
add dl, dl
jne 0xcba0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcba0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcba0e1
sub eax, ebx
mov ebx, 1
jne 0xcba128
mov ecx, 1
add dl, dl
jne 0xcba10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcba119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcba105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcba075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcba13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcba14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcba136
cmp eax, 0x7d00
jae 0xcba16d
cmp eax, 0x500
jb 0xcba168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcba075
cmp eax, 0x7f
ja 0xcba170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcba075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcba19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcba075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401759
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401794
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401790
lea ebx, [ebx]
cmp esi, eax
jae 0x401794
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401780
cmp esi, eax
jb 0x40179a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402940
Capabilities:
Check os version
Query service status
Start service
Stop service

Disassembly:
sub esp, 0xbc
mov eax, dword [0x4818b0]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
mov esi, ecx
cmp dword [esi + 0x11c], 0
mov dword [esp + 0x24], esi
je 0x402abd
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x2c], 5
jne 0x402ad3
cmp dword [esp + 0x30], 0
jne 0x402ad3
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [esp + 0x24], edi
test edi, edi
je 0x402abc
push 0xf01ff
push str.stisvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x402ab5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebp
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x402a38
cmp dword [esp + 0x14], 1
je 0x402a38
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402a38
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, 3
jne 0x402a2c
cmp edi, 0xea60
jae 0x402a2c
mov eax, dword [esp + 0x28]
push eax
call ebp
add edi, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x402a08
cmp eax, 1
jne 0x402a38
push 0x3e8
call ebp
lea edx, [esp + 0x10]
push edx
push esi
call ebx
test eax, eax
je 0x402aa8
cmp dword [esp + 0x14], 4
je 0x402aa8
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x402aa8
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x402aa8
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, 2
jne 0x402a95
cmp edi, 0xea60
jae 0x402a95
mov ecx, dword [esp + 0x28]
push ecx
call ebp
add edi, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
push esi
call ebx
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x402a71
cmp eax, 4
jne 0x402aa8
mov eax, dword [esp + 0x30]
mov dword [eax + 0x11c], 0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x2c]
pop ebp
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.004305c0
add esp, 0xbc
ret
mov ecx, dword [esp + 0xbc]
mov dword [esi + 0x11c], 0
pop esi
xor ecx, esp
call fcn.004305c0
add esp, 0xbc
ret
Function at 0x402ff4
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4818b0]
xor eax, esp
mov dword [esp + 0x88], eax
push esi
mov esi, ecx
call fcn.00402ee0
test eax, eax
je 0x403015
mov ecx, dword [esi + 0x84]
lea eax, [esp + 4]
push eax
push 0x20119
push 0
push ecx
jmp 0x403028
mov eax, dword [esi + 0x84]
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 4]
test eax, eax
je 0x403079
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.DriverDesc
push eax
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00411a68
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x8c]
pop esi
xor ecx, esp
call fcn.004305c0
add esp, 0x8c
ret

Function at 0x40a81a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40a83e
cmp dword [edi + 0x54], 0
jne 0x40a83e
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00415f85
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040a7db
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4111ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4111f3
call fcn.00415f85
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4111f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41120f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410d26
mov esi, eax
test edi, edi
je 0x41120d
test ebx, ebx
je 0x41120d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4120a0
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46bed1
call fcn.00431d43
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4120c5
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41210b
lea ecx, [ebp - 0x10]
call fcn.00401280
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a929
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401030
mov eax, esi
call fcn.00431e1b
ret 8

Function at 0x414cd1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x414d19
call fcn.00415f85
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x414d19
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x414d5c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x414d45
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x414d45
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x414d59
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4305c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4818b0]
jne 0x4305ca
repz ret
jmp fcn.00437597