joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bcf0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x41c084]
xor eax, esp
mov dword [esp + 0x110], eax
cmp dword [0x41de74], 0
push esi
mov esi, 1
jne 0x40bd41
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x41de74], eax
test eax, eax
jne 0x40bd41
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040c754
mov esp, ebp
pop ebp
ret
cmp dword [0x41cf34], 0xffffffff
jne 0x40be26
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00410550
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 8]
mov byte [esp + 0xb], 0
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40bd81
mov edx, dword [0x41926c]
mov ecx, dword [0x419270]
mov dword [eax], edx
mov dword [eax + 4], ecx
lea eax, [esp + 8]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40bda0
mov edx, dword [str..log]
mov cl, byte [0x41a5f0]
mov dword [eax], edx
lea edx, [esp + 8]
push edx
mov byte [eax + 4], cl
call fcn.0040bf10
add esp, 4
test edx, edx
jne 0x40bdd1
cmp eax, 0x200000
jb 0x40bddc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x41cf34], eax
test eax, eax
jne 0x40be19
xor esi, esi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040c754
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040c754
mov esp, ebp
pop ebp
ret

Function at 0x40c754
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c084]
jne 0x40c75e
repz ret
jmp fcn.0040e079
Function at 0x413f56
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040edbe
and dword [ebp - 0x14], 0
cmp dword [0x41dd2c], 0
mov dword [ebp - 0x18], eax
jne 0x414009
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4140b1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4140b1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41dd2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41dd30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41dd34], eax
call edi
push eax
call esi
mov dword [0x41dd3c], eax
test eax, eax
je 0x414009
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41dd38], eax
mov eax, dword [0x41dd38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x414062
cmp dword [0x41dd3c], ecx
je 0x414062
push eax
call esi
push dword [0x41dd3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x414062
test ebx, ebx
je 0x414062
call edi
test eax, eax
je 0x414059
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414059
test byte [ebp - 8], 1
jne 0x414062
or dword [ebp + 0x10], 0x200000
jmp 0x414095
mov eax, dword [0x41dd30]
cmp eax, dword [ebp - 0x18]
je 0x414095
push eax
call esi
test eax, eax
je 0x414095
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414095
mov eax, dword [0x41dd34]
cmp eax, dword [ebp - 0x18]
je 0x414095
push eax
call esi
test eax, eax
je 0x414095
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41dd2c]
call esi
test eax, eax
je 0x4140b1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4140b3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c754
leave
ret
Function at 0x4242d9
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x454eef
call fcn.00441f3c
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.00415d94
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x424335
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.00415d94
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b5f
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004258d4
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e43
test esi, esi
je 0x424364
push esi
call fcn.0043a470
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00441fbf
ret

Function at 0x425668
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x425670
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x425680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x425688
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42569c
test al, 0x10
je 0x42569c
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x433d2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x457037
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x47a630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0043069f
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x433d9a
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.004391ea
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.00415d94
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.004417a8
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x433dee
push 0xc8
lea esi, [esp + 0x20]
call fcn.0040bf4f
push 0x46e6b0
mov eax, esi
push eax
call fcn.00441aa3
push dword [esp + 0x1c]
call fcn.00441536
pop ecx
test eax, eax
je 0x433e13
push 0x133
lea esi, [esp + 0x20]
call fcn.0040bf4f
push 0x46e6b0
mov eax, esi
jmp 0x433de8
push dword [esp + 0x1c]
call fcn.0044150e
pop ecx
test eax, eax
jne 0x433e38
push 0x13b
lea esi, [esp + 0x20]
call fcn.0040bf4f
push 0x46e6b0
mov eax, esi
jmp 0x433de8
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.00433cfb
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x433e66
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.00405ea6
cmp edi, ebx
je 0x433e71
push edi
call fcn.0043a470
pop ecx
cmp byte [esp + 0x10], bl
je 0x433e81
push dword [esp + 0x1c]
call fcn.004391ea
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43543c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, eax
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jl 0x4354bc
jg 0x435468
cmp esi, ecx
jbe 0x4354bc
cmp dword [ebp + 0x14], ecx
jg 0x435468
jl 0x435464
cmp esi, 0x7fffffff
jae 0x435468
mov eax, esi
jmp 0x43546d
mov eax, SysReAllocString
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], ecx
je 0x4354ad
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x435497
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x4354b7
jmp 0x4354ad
mov eax, dword [ebp - 4]
test eax, eax
jle 0x4354a8
add ebx, eax
cdq
sub esi, eax
sbb dword [ebp + 0x14], edx
jmp 0x435448
cmp eax, 0xffffffff
jne 0x4354b7
call fcn.004406d5
cmp dword [eax], 4
je 0x435448
or eax, 0xffffffff
jmp 0x4354be
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x43a47b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47a630]
jne 0x43a485
repz ret
jmp fcn.004446e5
Function at 0x10060b00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x7529f8d0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
sub eax, 0x90844508
je 0x10060c45
jmp 0x10060b33
mov eax, dword [ebp - 0x18]
nop word cs:[eax + eax]
sub eax, 0x94af5c9f
je 0x10060d11
jmp 0x10060b50
mov eax, dword [ebp - 0x18]
sub eax, 0xa0d67e5b
je 0x10060d98
nop
jmp 0x10060b65
mov eax, dword [ebp - 0x18]
sub eax, 0xe193d151
je 0x10060c9a
jmp 0x10060b78
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0xf2a6f2fc
je 0x10060cef
jmp 0x10060b90
mov eax, dword [ebp - 0x18]
sub eax, 0x6a90a7
je 0x10060c66
nop
jmp 0x10060ba5
mov eax, dword [ebp - 0x18]
sub eax, 0x428132d9
je 0x10060cad
jmp 0x10060bb8
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0x4fc36b6d
je 0x10060d05
jmp 0x10060bd0
mov eax, dword [ebp - 0x18]
sub eax, 0x55abd84b
je 0x10060c87
nop
jmp 0x10060be5
mov eax, dword [ebp - 0x18]
sub eax, 0x62d1577a
je 0x10060d85
jmp 0x10060bf8
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0x74314e1c
je 0x10060cc8
jmp 0x10060c10
mov eax, dword [ebp - 0x18]
sub eax, 0x7529f8d0
je 0x10060c2a
nop
jmp 0x10060c25
jmp 0x10060da1
mov edx, dword [ebp - 8]
mov eax, 0xe193d151
mov ecx, 0x90844508
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10060da1
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0xe193d151
mov ecx, 0x6a90a7
cmp edx, 0x90
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10060da1
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0xe193d151
mov ecx, 0x55abd84b
cmp edx, 0xcc
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10060da1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xa0d67e5b
jmp 0x10060da1
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x428132d9
jmp 0x10060da1
mov edx, dword [ebp - 0x10]
mov eax, 0x62d1577a
mov ecx, 0x74314e1c
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10060da1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [eax + ecx]
mov eax, dword [ebp + 8]
movzx esi, byte [eax]
mov eax, 0x4fc36b6d
mov ecx, 0xf2a6f2fc
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10060da1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xa0d67e5b
nop dword [eax]
jmp 0x10060da1
mov dword [ebp - 0x14], 0x94af5c9f
jmp 0x10060da1
mov eax, dword [ebp - 0x10]
xor ecx, ecx
sub ecx, 0x8c596a18
sub eax, ecx
add eax, 0x962f8926
sub eax, 0xd2ceff37
sub eax, 0x962f8926
xor ecx, ecx
sub ecx, 0x8c596a18
add eax, ecx
xor edx, edx
sub edx, 1
add edx, 0
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x67994c17
sub eax, 0xebf9d045
add eax, 0x67994c17
add eax, 0xc0eb5e2c
add eax, 0xd2ceff37
sub eax, 0xc0eb5e2c
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xebf9d045
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x428132d9
nop
jmp 0x10060da1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 0xa0d67e5b
jmp 0x10060da1
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop esi
pop ebp
ret
jmp 0x10060b1d
Function at 0x101a95ac
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x101a95eb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101a95eb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101a95eb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x101a95eb
cmp dword [ecx + 0x74], 0xe
jbe 0x101a95eb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x101ad990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101ad9bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101ad9bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x101adce0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101bed40
push 0x101bed38
push str.FlsAlloc
push 0x1f
call fcn.101adfc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101add14
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x101add1a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x101add5e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101bed50
push 0x101bed48
push str.FlsGetValue
push 0x21
call fcn.101adfc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101add95
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x101add9d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101bed58
push 0x101bed50
push str.FlsSetValue
push 0x22
call fcn.101adfc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101addd7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x101b2180
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x101b221d
push ebx
push esi
call fcn.101b2220
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.101b2084
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x101b21ca
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101b221c
push edi
push eax
call fcn.101afcb2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x101b21ea
call fcn.101af18d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101b221b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.101b2084
add esp, 0x20
test eax, eax
jne 0x101b2209
push edi
call fcn.101af18d
jmp 0x101b2211
push ebx
call fcn.101af18d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4073e5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4073cf
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4073ed
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b4073eb
js 0x407411
xbegin 0x8b4073eb
js 0x407411
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40744b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x407432
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40743b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x407445
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x407427
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4073b1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x407498
dec eax
je 0x40748f
sub eax, 3
je 0x407486
mov dword [ebp - 4], 0x40
jmp 0x4074b5
mov dword [ebp - 4], 4
jmp 0x40749b
mov dword [ebp - 4], 0x20
jmp 0x40749b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4074e7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x407467
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00406cf8
clc
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40791b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
Function at 0x4080cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or eax, 0x56a0000
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00406c69
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x408105
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40814e
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
dec dword [edi]
mov esi, 0xc133dc4d
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4080f8
call fcn.00406cf8
sti
sbb byte [edi], cl
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00406cf8
pushal
ret

Function at 0x408a0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00406d08
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00406c69
add esp, 0xc
jmp 0x408c70
Function at 0x40ffd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40ffe8
pop dword [ebp - 0x28]
mov eax, 0xbf56aad5
add eax, 0x40ea5513
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3ea68
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x76dfa643
add ecx, 0x8920a4fc
mov edi, eax
mov ebx, 0x9830f9eb
sub ebx, 0x97eda5eb
add ebx, dword [ebp - 0x28]
mov edx, 0x3bb101b2
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0x4ad1ff1d
sub esi, edx
xor dword [ebp - 0xc], 0x199a5b3b
mov dword [edi], esi
xor dword [ebp - 0x1c], edi
add edi, 0x784412f
add edi, 0xf87bbed5
add ebx, 4
loop 0x41003c
add eax, 0xdd291936
add eax, 0x22d80699
mov ebx, eax
add eax, 0x642d88df
sub eax, 0x642d88da
mov ecx, 0x2e991716
sub ecx, 0x2e591716
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001520
Capabilities:
Delete service

Disassembly:
mov eax, dword [0x10010f74]
push ebx
push esi
mov esi, 8
push edi
cmp dword [0x10010f88], esi
jae 0x1000153a
mov eax, 0x10010f74
push eax
call fcn.10002000
add esp, 4
test eax, eax
je 0x100015a6
cmp dword [0x10010f88], esi
mov esi, dword [0x10010f74]
jae 0x1000155a
mov esi, 0x10010f74
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x100015a6
push ebp
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x10001595
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov ebx, eax
call ebp
push edi
call ebp
pop ebp
test ebx, ebx
je 0x100015a6
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10001f10
Capabilities:
Modify service
Query service status
Start service

Disassembly:
sub esp, 0x1c
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
je 0x10001fe4
mov eax, dword [esp + 0x24]
push esi
push edi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10001fd1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001f99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10001f99
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
je 0x10001fca
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], 2
jne 0x10001fc9
push 0x64
call ebx
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x10001fb2
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
xor eax, eax
pop ebp
add esp, 0x1c
ret