joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424cd0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424ed6
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call fcn.00425790
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
call fcn.004243c0
movzx eax, byte [esp + 0xc]
test al, al
je 0x424d34
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0x3c], 1
jmp 0x424d38
mov ecx, dword [esp + 0x18]
movzx edx, byte [esp + 0x1c]
test dl, dl
jne 0x424e10
movzx ebx, byte [esp + 0x1d]
mov byte [ecx + 0x3a], bl
mov eax, dword [esp + 0x24]
shl eax, 0xd
shr bl, 1
test bl, bl
jne 0x424d6d
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x1c], 1
mov dword [ecx + 0x34], 0
jmp 0x424d98
movsx ebx, bl
lea esi, [0x5ca280]
movzx esi, word [esi + ebx*2]
mov dword [ecx + 0x40], esi
test esi, esi
je 0x424ed0
xor edx, edx
div esi
mov dword [ecx + 0x1c], eax
lea edx, [0x5cb440]
mov edx, dword [edx + ebx*4]
mov dword [ecx + 0x34], edx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x20], 0xffffffff
mov dword [ecx + 0x24], 0xffffffff
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.00426310
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.004264a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x30]
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 0x98]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00402110
nop
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
mov byte [esp + 4], 1
call fcn.004021b0
jmp 0x424e3c
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov eax, dword [ecx + 0x10]
shl eax, 0xd
add eax, dword [ecx + 0xc]
mov dword [ecx + 0x44], eax
nop
nop
lea eax, [ecx + 0x3b]
mov dword [esp], eax
mov byte [esp + 4], 2
call fcn.004021b0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.00424320
movzx eax, byte [esp + 0x1c]
test al, al
jne 0x424ec7
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov eax, dword [0x60f45c]
mov edx, ecx
shr ecx, 0x16
mov ebx, dword [eax + ecx*4]
test byte [ebx], al
test byte [eax], al
nop
nop
mov ecx, edx
shr edx, 0x10
and edx, 0x3f
lea eax, [ebx + edx + 0x21800]
nop
mov dword [esp], eax
shr ecx, 0xd
and ecx, 7
mov eax, 1
shl eax, cl
mov byte [esp + 4], al
call fcn.00402190
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 0xa8
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00401fa0
call fcn.0045d080
add esp, 0x10
ret
call fcn.00431090
nop
call fcn.0045c000
jmp fcn.00424cd0
Function at 0x425b60
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425cd0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423a30
mov eax, dword [esp + 4]
test eax, eax
je 0x425cb9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004218a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00408a30
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x425bf7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425c5d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x425c0c
cmp byte [ebp + 6], dl
je 0x425c17
cmp esi, ebx
ja 0x425c5d
jne 0x425bf5
cmp byte [ebp + 6], dl
jbe 0x425bf5
jmp 0x425c5d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408c30
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x425c54
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425c54
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00425a80
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408c30
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x425cb0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x425cb0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x50b337]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004328e0
nop
call fcn.0045c000
jmp fcn.00425b60
Function at 0x426150
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42626c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4261e5
cmp cl, 2
je 0x42618d
cmp cl, 3
jne 0x426255
mov byte [eax + 8], 1
jmp 0x426251
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042ad90
nop
lea eax, [0x613978]
mov dword [esp], eax
call fcn.00408a30
nop
mov eax, dword [0x613944]
sub eax, dword [0x613928]
mov dword [0x613944], eax
mov eax, dword [0x613934]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x613934], ecx
nop
lea eax, [0x613978]
mov dword [esp], eax
call fcn.00408c30
jmp 0x426251
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00412ca0
nop
lea eax, [0x613978]
mov dword [esp], eax
call fcn.00408a30
nop
mov eax, dword [0x61391c]
sub eax, dword [0x613900]
mov dword [0x61391c], eax
mov eax, dword [0x61390c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x61390c], ecx
nop
nop
lea eax, [0x613978]
mov dword [esp], eax
call fcn.00408c30
add esp, 0x14
ret
lea eax, [0x50675a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004328e0
nop
call fcn.0045c000
jmp fcn.00426150
Function at 0x42ce80
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42d0b3
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x980]
mov edx, dword [eax + 0x978]
mov dword [eax + 0x978], 0
sub edx, ecx
shr edx, 2
mov dword [esp + 0x24], edx
movzx ecx, byte [0x62f330]
test cl, cl
jne 0x42cecd
xor ecx, ecx
xor ebx, ebx
jmp 0x42cf09
xor ecx, ecx
jmp 0x42cef3
mov dword [esp + 0x28], ecx
mov edx, dword [eax + ecx*4 + 0x980]
mov dword [esp], edx
call fcn.0041b730
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x42ced1
add eax, 0x978
mov dword [esp], eax
call fcn.0042cd70
add esp, 0x2c
ret
inc ecx
cmp ecx, edx
jge 0x42d07a
mov ebp, dword [eax + ecx*4 + 0x980]
cmp ebp, 0x1000
jb 0x42cf08
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040f8a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test ecx, ecx
jne 0x42cf62
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov dword [esp + 0x20], ecx
mov ebx, dword [eax + 0x2c]
test byte [ebx], al
nop
mov ebp, edx
shr edx, 3
movzx esi, byte [ebx + edx]
and ebp, 7
mov ecx, ebp
mov edi, 1
shl edi, cl
add edx, ebx
xchg esi, eax
xchg edi, ebx
test bl, al
xchg edi, ebx
xchg esi, eax
je 0x42cfa2
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov dword [esp + 0x18], eax
nop
mov dword [esp], edx
xchg edi, eax
mov byte [esp + 4], al
xchg edi, eax
call fcn.00402190
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [0x60f45c]
mov ebx, ecx
shr ecx, 0x16
mov ecx, dword [edx + ecx*4]
test byte [ecx], al
test byte [edx], al
nop
nop
mov edx, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx ebp, byte [ecx + ebx + 0x21840]
lea ecx, [ecx + ebx + 0x21840]
nop
shr edx, 0xd
and edx, 7
mov ebx, ecx
mov ecx, edx
mov esi, 1
shl esi, cl
xchg ebp, eax
xchg esi, ebx
test bl, al
xchg esi, ebx
xchg ebp, eax
jne 0x42d015
mov dword [esp], ebx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.00402190
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0x3a]
test cl, 1
je 0x42d055
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x964]
mov ebp, dword [ecx + 0x968]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebp, 0
mov dword [ecx + 0x964], edx
mov dword [ecx + 0x968], ebp
mov eax, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x980], ecx
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
jmp 0x42cf08
lea ecx, [eax + 0x95c]
mov dword [esp], ecx
lea ecx, [eax + 0x980]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x200
call fcn.00422d80
mov eax, dword [esp + 0x30]
add eax, 0x978
mov dword [esp], eax
call fcn.0042cd70
add esp, 0x2c
ret
call fcn.0045ab50
jmp fcn.0042ce80
Function at 0x4509e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x450ae0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00451250
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4eb100]
mov dword [esp], ecx
call fcn.0040aa30
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x613a10]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.004502f0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0044f8d0
add esp, 0x28
ret
call fcn.0045c000
jmp fcn.004509e0
Function at 0x45d2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x62f6e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45ba8b
je 0x45bade
cmp ebx, 0x20
jbe 0x45bae4
cmp ebx, 0x40
jbe 0x45bb2a
jmp 0x45bbcb
test ebx, ebx
je 0x45bad4
add eax, 0x10
test ax, 0xff0
je 0x45bac0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x537b40]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x537d40]
jmp 0x45baa8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45baa8
pxor xmm1, xmmword [0x62f6f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x62f6f0]
pxor xmm2, xmmword [0x62f700]
pxor xmm3, xmmword [0x62f710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x62f6f0]
pxor xmm2, xmmword [0x62f700]
pxor xmm3, xmmword [0x62f710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45bc2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x62f32f], 0
je 0x45d2da
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45ba50
jmp fcn.004075e0
Function at 0x45d2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4027be
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004075e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045c000
jmp 0x402780
cmp byte [0x62f32f], 0
je 0x45d2fb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45ba50
jmp 0x402780
Function at 0x4aa100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aa2be
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0045d507
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4aa13a
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4aa163
lea eax, [0x4ed440]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.004461d0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.0045d507
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x6c]
movzx edx, word [esp + 0x70]
shl edx, 0xb
movzx ebx, word [esp + 0x78]
or ebx, edx
movzx edx, byte [esp + 0x75]
test dl, dl
je 0x4aa1ab
or ebx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x4aa1ba
or ebx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x4aa1c9
or ebx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x4aa1d8
or ebx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x4aa1e7
or ebx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x4aa1f3
or ebx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x4aa1ff
or ebx, 0x10
mov word [esp + 0x46], cx
mov word [esp + 0x48], bx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 0xc]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
cmp edx, ecx
jae 0x4aa26a
mov dword [esp + 0x24], eax
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xc
lea eax, [0x4ed440]
mov dword [esp + 0x10], eax
call fcn.00446290
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0045dc00
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.0045d9c6
add esp, 0x5c
ret
call fcn.0045c000
jmp fcn.004aa100
Function at 0x4be6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4be853
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4be779
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4be718
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4be785
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4be743
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4be785
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4be785
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004be4e0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004c4db0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0045c000
jmp fcn.004be6e0
Function at 0x40176b
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, esp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x404122], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4043bc], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404350], eax
mov dword [0x40411a], eax
mov dword [0x40433c], 0x30
mov dword [0x404340], 2
jmp 0x4017b0
mov dword [0x404344], 0x403300
mov dword [0x404348], 0
mov dword [0x40434c], 0
mov dword [0x404364], 0x4042e7
mov dword [0x40435c], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404354], eax
mov dword [0x404368], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404358], eax
push 0x40433c
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40411a]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.please_wait
push str.cokun
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4043b4], eax
push 5
push dword [0x4043b4]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x4043b4]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x40436c]
jmp 0x401884
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401876
mov eax, dword [0x404374]
jmp 0x40189f
call 0x402d98
ret
Function at 0x1000f720
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [0x1001e3a8], eax
jne 0x1000f740
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push str.Oxwp__Hbuvwnzi_Dwwlcbq__fep
push str.Gmsag___uogshdwPlu
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [0x1001e3a4], eax
jne 0x1000f77a
mov esp, ebp
pop ebp
ret
mov edx, dword [0x1001e3a8]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 4], str.LadzhdatFqzaarvq_Kvimpfn_U_bocnup__kb
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [0x1001e3a4]
lea eax, [ebp - 4]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f7d0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
push 0xf003f
push str.Gmsag___uogshdwPlu
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xc], eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
mov eax, 1
mov dword [ebp - 0x14], 0x15180
mov dword [ebp - 0x28], 0x3e8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 3
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
lea edx, [ebp - 0x14]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret