joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18d1049
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov esi, esi
call fcn.018d143d
mov ebx, ebx
lea eax, [ebp - 0xd8]
push edx
push edi
pop edi
pop edx
mov ebx, 0x61
xchg esi, edi
xchg edi, esi
add bx, 0xa
pushfd
xor ecx, 0x84806bfb
xor ecx, 0x84806bfb
popfd
mov word [eax], bx
xchg ebx, ebx
pushfd
push 0xa541ad0f
add esp, 4
popfd
sub bx, 6
push edi
push eax
pop eax
pop edi
mov word [eax + 2], bx
push eax
pop eax
pushfd
xor ebx, 0x5645ddfa
xor ebx, 0x5645ddfa
popfd
add bx, 0xd
push esi
pop esi
pushfd
push ecx
add esp, 4
popfd
mov word [eax + 4], bx
pushfd
xor ecx, 0x91004738
xor ecx, 0x91004738
popfd
sub bx, 4
mov ecx, ecx
push esi
Function at 0x1000a7e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000a7f3
pop dword [ebp - 0x2c]
mov eax, 0x21a34a04
sub eax, 0x11a2a211
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa3820723
add dword [ebp - 0x3c], 0xaad03e28
mov dword [ebp - 0x38], 0x7c6b280d
sub dword [ebp - 0x38], 0x4a37dbc8
mov dword [ebp - 0x34], 0x860bc325
add dword [ebp - 0x34], 0xc6408109
mov dword [ebp - 0x30], 0x17cfd79b
sub dword [ebp - 0x30], 0x17cfd79b
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xb4d6f41d
add eax, 0x5b29cc07
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc47bbf12
add dword [ebp - 0x3c], 0xaff6aa44
mov dword [ebp - 0x38], 0x839ba2ce
sub dword [ebp - 0x38], 0x422f4159
mov dword [ebp - 0x34], 0x1e23535a
sub dword [ebp - 0x34], 0xbab3e6ee
mov dword [ebp - 0x30], 0xd31c5060
add dword [ebp - 0x30], 0x2ce3afa0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x344a8
push 0
call eax
mov ecx, 0x392b
xor edx, edx
add edx, eax
mov ebx, 0x10047400
add ebx, dword [ebp - 0x2c]
mov esi, 0x7844c5c
sub esi, 0xe95a62bc
add dword [ebp - 0x10], 0xf72b3b4b
mov edi, dword [ebx]
sub dword [ebp - 0xc], esi
add edi, esi
sub dword [ebp - 0x24], edi
mov dword [edx], edi
xor dword [ebp - 0x14], 0x32afeea3
add edx, 0xc3ec0ac4
sub edx, 0xc3ec0ac0
add ebx, 0x252cb59c
sub ebx, 0x252cb598
loop 0x1000a906
add eax, 0x45fc33d7
sub eax, 0x45fb5c58
mov ebx, eax
add eax, 0xbbe9de97
sub eax, 0xbbe9de92
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x10005480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000457d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
invalid
invalid
cmpsd dword [esi], dword es:[edi]

Function at 0x10005980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebp
cld
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.10004510
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x100059ac
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
invalid
invalid
add cl, bh
Function at 0x10001bf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x10021004]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call fcn.10001dd0
push str.IsMatch_entrty_n
call fcn.10001050
add esp, 4
push esi
push 0x20
push 0x100223b4
call fcn.1000a891
add esp, 0xc
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001c55
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
push 0x1001f470
push str.kernel32
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001c80
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push eax
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x10]
cmp ax, 9
je 0x10001cbb
cmp ax, 0xc
je 0x10001cbb
cmp ax, 6
je 0x10001cbb
xor edx, edx
jmp 0x10001cc0
mov edx, 1
mov eax, dword [0x100223b4]
mov ecx, eax
and ecx, 0xfffff
jbe 0x10001ce9
nop
test al, 1
je 0x10001cdd
xor eax, 0x12345678
add eax, eax
jmp 0x10001ce4
add eax, 0x99609961
sar eax, 1
sub ecx, 1
jne 0x10001cd0
cmp eax, 0xd7d2cb86
jne 0x10001d78
cmp dword [esp + 0xc], 0
jne 0x10001d1f
test edx, edx
je 0x10001d1f
mov edx, str.Qt5Gui.dll
mov ecx, edi
call fcn.10001e90
or eax, edx
jne 0x10001d47
mov edx, str.Qt6Gui.dll
mov ecx, edi
call fcn.10001e90
or eax, edx
jmp 0x10001d3d
mov edx, str.Qt5Gui.dll
mov ecx, edi
call fcn.10002060
test eax, eax
jne 0x10001d47
mov edx, str.Qt6Gui.dll
mov ecx, edi
call fcn.10002060
test eax, eax
mov dword [esp + 0xc], 0
je 0x10001d4f
mov dword [esp + 0xc], 1
push str.IsMatch_end_n
call fcn.10001050
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x4c]
mov al, byte [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
call fcn.10006af0
int3
Function at 0x10001dd0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10001e88
cmp dword [0x100223dc], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x10001e03
push str.NtWow64ReadVirtualMemory64
push esi
call edi
mov dword [0x100223dc], eax
cmp dword [0x100223ec], 0
jne 0x10001e19
push str.NtWow64QueryInformationProcess64
push esi
call edi
mov dword [0x100223ec], eax
cmp dword [0x100223d4], 0
jne 0x10001e2f
push str.NtWow64WriteVirtualMemory64
push esi
call edi
mov dword [0x100223d4], eax
cmp dword [0x100223e4], 0
jne 0x10001e45
push str.NtProtectVirtualMemory
push esi
call edi
mov dword [0x100223e4], eax
cmp dword [0x100223e8], 0
jne 0x10001e5b
push str.NtSuspendProcess
push esi
call edi
mov dword [0x100223e8], eax
cmp dword [0x100223d8], 0
jne 0x10001e71
push str.NtResumeProcess
push esi
call edi
mov dword [0x100223d8], eax
cmp dword [0x100223e0], 0
jne 0x10001e87
push str.RtlCreateUserThread
push esi
call edi
mov dword [0x100223e0], eax
pop edi
pop esi
ret

Function at 0x10002060
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x10021004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push 0x18
mov dword [ebp - 0x434], edx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x100020f8
push 0x424
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.10004fa0
add esp, 0xc
mov dword [ebp - 0x430], 0x428
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x100020f1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop word [eax + eax]
push dword [ebp - 0x434]
lea eax, [ebp - 0x410]
push eax
call edi
test eax, eax
je 0x1000210b
lea eax, [ebp - 0x430]
push eax
push esi
call ebx
test eax, eax
jne 0x100020d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
Function at 0x100028e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10021004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000291f
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.10003b84
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], esi
je 0x1000296e
push ebx
call fcn.10003a5d
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.10003a4f
mov esp, ebp
pop ebp
ret

Function at 0x10002990
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10021004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x104]
mov dword [ebp - 0x208], edx
push 0
push eax
call fcn.10004fa0
push 0x100
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.10004fa0
mov esi, 0x100223b4
add esp, 0x18
xor ecx, ecx
lea edx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x100029e0
sub esi, edx
nop dword [eax]
mov eax, ecx
mov byte [ebp + ecx - 0x104], cl
xor edx, edx
div esi
mov al, byte [edx + 0x100223b4]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x100
jl 0x100029f0
xor bl, bl
xor esi, esi
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
movzx eax, byte [ebp + esi - 0x204]
add al, dl
add bl, al
movzx eax, bl
add ecx, eax
movzx eax, byte [ecx]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ecx], dl
cmp esi, 0x100
jl 0x10002a20
xor edi, edi
xor bl, bl
xor dh, dh
cmp dword [ebp + 8], edi
jle 0x10002aa2
nop
inc bl
lea esi, [ebp - 0x104]
movzx eax, bl
lea ecx, [ebp - 0x104]
add esi, eax
mov dl, byte [esi]
add dh, dl
movzx eax, dh
add ecx, eax
movzx eax, byte [ecx]
mov byte [esi], al
mov byte [ecx], dl
movzx eax, byte [esi]
mov ecx, dword [ebp - 0x208]
add al, dl
movzx eax, al
movzx eax, byte [ebp + eax - 0x104]
xor byte [ecx + edi], al
inc edi
cmp edi, dword [ebp + 8]
jl 0x10002a60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
Function at 0x10002ac0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x100223f0], 0
push ebx
push esi
push edi
jne 0x10002add
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea esi, [ebp + 0x14]
test edx, edx
jle 0x10002afc
mov eax, dword [ebp + 0x14]
lea esi, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec edx
mov dword [ebp + 0x10], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x10002b04
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov ecx, esi
test edx, edx
jle 0x10002b1e
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x10002b26
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov ecx, esi
test edx, edx
jle 0x10002b40
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x10002b48
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ecx, esi
test edx, edx
jle 0x10002b62
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x10002b6a
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 0x40], esi
cdq
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10002bac
add dword [esp], 5
retf

Function at 0x10002c40
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d4
mov eax, dword [0x10021004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100223f0], 0
push ebx
push esi
push edi
je 0x10002f30
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x10002c72
add dword [esp], 5
retf
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003a4f
mov esp, ebp
pop ebp
ret

Function at 0x10002f70
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x10021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10022428]
mov edx, dword [0x1002242c]
push ebx
push esi
push edi
test eax, eax
jne 0x10002fbb
test edx, edx
jne 0x10002fbb
call fcn.10002c40
mov esi, eax
mov dword [0x10022428], eax
mov edi, edx
mov dword [0x1002242c], edx
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x13c], edi
jmp 0x10002fcb
mov esi, eax
mov dword [ebp - 0x138], eax
mov edi, edx
mov dword [ebp - 0x13c], edx
test esi, esi
jne 0x10002fd7
test edi, edi
je 0x10003518
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x12c], edx
push 0x33
call 0x10002ff6
add dword [esp], 5
retf
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
xor edx, edx
pop ebx
call fcn.10003a4f
mov esp, ebp
pop ebp
ret
Function at 0x1000e282
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019c70
push 0x10019c68
push str.FlsAlloc
push 0x1e
call fcn.1000e143
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e2b6
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018178]
call esi
jmp 0x1000e2bc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000e300
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019c80
push 0x10019c78
push str.FlsGetValue
push 0x20
call fcn.1000e143
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e337
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000ffa0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001003d
push ebx
push esi
call fcn.1000ff69
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000feb2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000ffea
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001003c
push edi
push eax
call fcn.1000c37b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001000a
call fcn.1000c341
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001003b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000feb2
add esp, 0x20
test eax, eax
jne 0x10010029
push edi
call fcn.1000c341
jmp 0x10010031
push ebx
call fcn.1000c341
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10010040
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10010051
pop esi
ret
push ebx
push edi
push esi
call fcn.1000ff69
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1000c37b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10010079
push ebx
push esi
push edi
call fcn.10006530
add esp, 0xc
push 0
call fcn.1000c341
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1001043d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001008e
Function at 0x10017780
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100177ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100177ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4022e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4041a8], esi
push edi
dec ecx
jne 0x40230f
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4041a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
push eax
push dword [0x4041a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4041b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4023c3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4023aa
pop ebp
ret 0x10
Function at 0x401430
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.004012e0
test eax, eax
jne 0x401449
mov eax, 1
jmp 0x401508
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40147c
push 0
push str.ServiceTest
push str.Couldnt_open_service_manager
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401508
push 0x10020
push str.ServiceTest
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4014bb
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push str.ServiceTest
push str.Couldnt_open_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401508
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xc], 0
je 0x4014f9
mov eax, 1
jmp 0x401508
push str.Service_could_not_be_deleted
call fcn.00401510
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401510
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a30
add esp, 0xc
mov dword [ebp - 8], 0
mov ecx, 4
imul edx, ecx, 0
lea eax, [ebp - 0x20c]
mov dword [ebp + edx - 0xc], eax
push str.ServiceTest
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401594
push 0
mov ecx, 4
imul edx, ecx, 0
lea eax, [ebp + edx - 0xc]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov esp, ebp
pop ebp
ret