joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d89e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [0x44c128]
lea ecx, [eax - 1]
mov dword [0x44c128], ecx
movsx ecx, word [0x44255a]
sub eax, ecx
xor eax, 0xa79782e5
add dword [0x4483bc], eax
mov eax, 0x4840c464
and eax, dword [0x453424]
or eax, 0x231f1a9b
mov dword [0x448f08], eax
mov eax, dword [0x4497bc]
lea ecx, [eax - 1]
mov dword [0x4497bc], ecx
mov dword [0x453cc4], eax
xor edi, edi
test edx, edx
jle 0x40da0b
mov ebp, dword [esp + 0x1c]
inc edx
xor edi, edi
mov dword [esp], edx
or dword [0x44e330], 0x59e6ad02
add dword [0x448bb4], 0x627072cb
movsx eax, word [0x446356]
or dword [0x457edc], eax
and dword [0x44fd6c], 0xfbd8648
mov eax, dword [esp + 0x24]
mul dword [ebp]
mov ecx, 0x4bd5f92b
sub ecx, dword [0x448510]
mov dword [0x453d30], ecx
and word [0x446d32], 0x937b
mov ecx, dword [0x4566a8]
lea ebx, [ecx + 1]
mov dword [0x4566a8], ebx
movsx ebx, word [0x446422]
imul ebx, dword [0x44c5dc]
shl ebx, 4
sub ecx, ebx
or dword [0x449678], ecx
add word [0x4423b0], 0x881
add eax, edi
adc edx, 0
mov ecx, dword [0x44a774]
not ecx
or dword [0x449548], ecx
add eax, dword [esi]
add dword [0x45521c], 0x89cc7ea2
cmp eax, dword [esi]
mov edi, edx
adc edi, 0
and word [0x441bee], 0x45b8
mov ecx, dword [0x454cc4]
lea edx, [ecx - 1]
mov dword [0x454cc4], edx
and ecx, 0xd82240eb
xor dword [0x448464], ecx
mov dword [esi], eax
mov word [0x440eca], 0x652d
mov eax, dword [0x448ccc]
mov ecx, 0x13f0e86e
add eax, ecx
cmp eax, 0x3e89ebee
jg 0x40d9f8
xor dword [0x454de0], 0x47379731
add ebp, 4
add esi, 4
mov edx, dword [esp]
dec edx
cmp edx, 1
jg 0x40d906
and dword [0x44b610], 0x4840a200
mov eax, dword [0x455fb8]
lea ecx, [eax + 1]
mov dword [0x455fb8], ecx
mov ecx, 0x5a707707
sub ecx, eax
movzx eax, word [0x447384]
and eax, ecx
mov word [0x447384], ax
mov eax, dword [0x448094]
sar eax, 6
and eax, 0x64083109
or eax, dword [0x447e44]
or eax, 0x99f5ccf0
mov dword [0x447e44], eax
add dword [esi], edi
mov eax, dword [0x45178c]
mov ecx, dword [0x44b9cc]
lea edx, [ecx - 1]
mov dword [0x44b9cc], edx
imul eax, ecx
or dword [0x44d328], eax
mov eax, dword [esi]
cmp eax, edi
sbb ecx, ecx
and ecx, 1
mov edx, 0x8fdb8e71
sub edx, dword [0x44fac4]
xor edx, 0xcf80fe69
add dword [0x45716c], edx
add esi, 4
cmp eax, edi
mov dword [0x44d69c], 0x8bb6625d
mov edi, ecx
jb 0x40da39
mov eax, dword [0x456b68]
mov eax, dword [0x44d024]
lea ecx, [eax - 1]
mov dword [0x44d024], ecx
cmp eax, 0xd174f86c
jne 0x40dacd
mov eax, dword [0x44e904]
inc dword [0x456160]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ddac
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov dword [0x44f48c], 0x73ceb17
mov eax, dword [0x44a948]
lea ecx, [eax + 1]
mov dword [0x44a948], ecx
add eax, 0x312458dd
and eax, 0x20ff5528
cmp eax, 0x187eb2d6
ja 0x40dde5
mov dword [0x450358], 0x15a40cc6
jmp 0x40de23
movsx eax, word [0x442824]
lea ecx, [eax - 1]
mov word [0x442824], cx
xor eax, 0x8787bec1
cmp eax, 0xeebacedf
jl 0x40de0e
add dword [0x450afc], 0x493cb22f
jmp 0x40de23
mov eax, dword [0x449834]
movzx ecx, word [0x44726e]
xor ecx, eax
mov word [0x44726e], cx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
movsx eax, word [0x444c72]
lea esi, [eax + 1]
mov word [0x444c72], si
or eax, 0x895a16d1
mov esi, 0x9f982c16
xor esi, dword [0x458194]
cmp eax, esi
jl 0x40de8c
mov eax, dword [0x456c24]
mov esi, dword [0x44fcd4]
mov edi, dword [0x44f1b4]
lea ebx, [edi + 1]
mov dword [0x44f1b4], ebx
add esi, edi
xor esi, eax
cmp esi, 0x602d1e1
jg 0x40de82
xor dword [0x45824c], 0xecfbbd77
jmp 0x40de8c
add dword [0x456e48], 0x93f438b7
mov eax, dword [esp + 0x1c]
add dword [0x44c1fc], 0x99b934ea
lea edi, [edx + ecx*4]
mov esi, dword [0x452440]
lea ebx, [esi + 1]
mov dword [0x452440], ebx
cmp esi, 0x125f58c1
je 0x40dec1
mov esi, dword [0x44d828]
mov si, word [0x446ca8]
mov ebx, eax
shr ebx, 8
movsx esi, word [0x440f58]
add esi, 0x78ed132c
or dword [0x454a88], esi
mov esi, eax
shr esi, 0x10
cmp edx, edi
je 0x40df75
shl ecx, 2
xor dword [0x452b80], 0x8e991bc
shl esi, 0x10
shl ebx, 8
movzx edi, bx
or edi, esi
movzx esi, al
lea ebx, [esi + edi]
xor dword [edx], ebx
mov esi, dword [0x455358]
sar esi, 5
mov dword [0x454398], esi
shr ebx, 7
shl eax, 0x19
shr edi, 0xf
or word [0x444df2], 0xfc93
movzx esi, word [0x444610]
mov ebp, esi
inc ebp
mov word [0x444610], bp
or word [0x4433a0], si
movzx ebp, bl
lea esi, [eax + ebx]
lea ebx, [edi + ebx]
imul ax, word [0x444582], 0x7fee
mov word [0x444582], ax
movzx eax, bl
add eax, ebp
xor dword [0x457d84], 0xe228c6
add edx, 4
shr esi, 0x10
add ecx, 0xfffffffc
jne 0x40dee9
mov ecx, dword [0x449504]
sar ecx, 1
cmp ecx, 0xeeafacf1
jl 0x40df91
mov dword [0x455c04], 0x3810503
jmp 0x40dfbf
movsx ecx, word [0x446fcc]
imul ecx, ecx, 0x42fc084d
cmp ecx, 0xb5b828fc
jg 0x40dfb9
mov ecx, 0xabd1f940
sub ecx, dword [0x44bfe8]
add dword [0x456534], ecx
jmp 0x40dfbf
dec dword [0x44c1a4]
shl esi, 0x10
shl ebx, 8
movzx ecx, bx
or ecx, esi
movzx eax, al
or eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410c58
Capabilities:
Hash data with md5

Disassembly:
add dword [0x451f34], 0xf64cfbf6
mov dword [ecx], 0
mov dword [0x44a88c], 0x2ec50948
mov dword [ecx + 4], 0
mov eax, dword [0x453dd4]
mov dword [ecx + 8], 0x67452301
imul ax, word [0x445d32], 0xaf9
mov word [0x445d32], ax
mov dword [ecx + 0xc], 0xefcdab89
movsx eax, word [0x442f62]
shl eax, 6
add eax, 0xe1e3f7f8
imul eax, dword [0x44fa10]
mov dword [0x44fa10], eax
mov dword [ecx + 0x10], 0x98badcfe
imul eax, dword [0x44a3f8], 0x33c2f8ed
mov dword [0x44a3f8], eax
mov dword [ecx + 0x14], 0x10325476
add dword [0x449ef0], 0xf0080401
ret
Function at 0x411776
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
movsx eax, word [0x444f68]
mov ecx, dword [0x450730]
sub eax, ecx
mov ecx, dword [0x4554ec]
inc ecx
mov dword [0x4554ec], ecx
and ecx, eax
cmp ecx, 0xa1813
jl 0x4117bf
mov eax, dword [0x44ebc0]
or eax, 0xf7d7
movzx ecx, word [0x4405b4]
xor ecx, eax
xor ecx, 0x828
mov word [0x4405b4], cx
imul eax, dword [0x4556dc], 0xfafb75ee
mov dword [0x4556dc], eax
cmp dword [0x458c04], 0
jne 0x41184f
mov eax, dword [0x44fe54]
lea ecx, [eax + 1]
mov dword [0x44fe54], ecx
movzx ecx, word [0x4424aa]
imul ecx, eax
mov word [0x4424aa], cx
call fcn.00411a1e
mov dword [0x458c04], eax
dec dword [0x4491c8]
movsx eax, word [0x44171a]
lea ecx, [eax - 1]
mov word [0x44171a], cx
imul eax, eax, 0x29a41a95
mov ecx, dword [0x44bf2c]
inc ecx
mov dword [0x44bf2c], ecx
and ecx, 0x774bb1df
cmp eax, ecx
jle 0x411846
movsx eax, word [0x4471d0]
shl eax, 9
or dword [0x44de48], eax
jmp 0x41184f
or word [0x44239e], 0xcca3
mov ebx, dword [esp + 0x10]
mov eax, 0xd0262fe2
and eax, dword [0x457b7c]
cmp eax, 0xa71b497c
jg 0x411871
mov dword [0x4477f8], 0xcca2fd23
jmp 0x41187b
add dword [0x452020], 0x932ab031
push 3
push 0x3b37
call fcn.004103ea
add esp, 8
mov edi, eax
movzx eax, word [0x4471f0]
inc eax
mov word [0x4471f0], ax
cwde
mov ecx, 0x66b1f8b9
sub ecx, eax
or dword [0x448f0c], ecx
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
mov dword [0x45017c], 0x1a0ab517
push edi
push 3
call fcn.0040d60f
add esp, 8
movsx eax, word [0x444976]
add eax, 0xcae05781
xor dword [0x44ee10], eax
test esi, esi
je 0x4118ee
add dword [0x4562cc], 0x8a0e782d
jmp 0x4119c5
mov eax, 0x228c948
or eax, dword [0x44a7c8]
xor eax, 0x25110680
add dword [0x451534], eax
push 0x3e8
call dword [0x43f198]
inc dword [0x447dd8]
movsx eax, word [0x4471c8]
movsx ecx, word [0x442c1c]
mov edx, 0xc4585560
sub edx, eax
add edx, ecx
and dword [0x458328], edx
push 3
push 0x3b37
call fcn.004103ea
add esp, 8
mov edi, eax
or dword [0x44a060], 0x5b349b47
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
add dword [0x44948c], 0xc23a482e
push edi
push 3
call fcn.0040d60f
add esp, 8
mov eax, dword [0x44870c]
lea ecx, [eax - 1]
mov dword [0x44870c], ecx
add eax, 0xbf539cd5
cmp eax, 0x8780d8b
jg 0x4119b7
mov eax, dword [0x44bde4]
lea ecx, [eax - 1]
mov dword [0x44bde4], ecx
mov ecx, dword [0x44e068]
lea eax, [eax + ecx*2]
mov ecx, dword [0x4568b4]
lea edx, [ecx + 1]
mov dword [0x4568b4], edx
lea eax, [ecx + eax + 1]
mov dword [0x450ce4], eax
add dword [0x4562cc], 0x8a0e782d
test esi, esi
je 0x411a09
or dword [0x44dfa0], 0xc069d45f
push esi
push 1
push 4
push 0x458c04
call sub.msvcrt.dll_fwrite
add esp, 0x10
and word [0x43f73a], 0x93ed
push esi
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, 0x2c00002
and eax, dword [0x44882c]
or eax, 0x3d3bbe58
sub dword [0x44f8b4], eax
mov eax, 0xe932c900
or eax, dword [0x44fcdc]
and dword [0x455ee8], eax
pop esi
pop edi
pop ebx
ret
Function at 0x41569a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [0x454770]
and eax, 0x6822
movzx ecx, word [0x4406ce]
or ecx, eax
mov word [0x4406ce], cx
mov eax, dword [0x447cfc]
add eax, 0x7f12
movzx ecx, word [0x443e12]
or ecx, eax
or ecx, 0xb6ac
mov word [0x443e12], cx
push 0x104
push esi
push 0
call dword [0x43f13c]
mov ecx, eax
xor eax, eax
cmp ecx, 0x104
je 0x41577d
mov eax, 0x1bdd
add eax, dword [0x4484a0]
xor eax, 0x4e10
mov word [0x442832], ax
test ecx, ecx
je 0x415724
inc ecx
mov eax, ecx
movzx ecx, byte [esi + eax - 1]
cmp ecx, 0x5c
je 0x415728
dec eax
cmp eax, 1
jne 0x415714
xor eax, eax
jmp 0x41574d
imul ecx, dword [0x44cb74], 0xa5aa451c
mov dword [0x44cb74], ecx
add dword [0x457fa8], 0xc3019f32
mov byte [esi + eax], 0
dec word [0x444fa4]
mov ecx, dword [0x44dce8]
inc ecx
mov dword [0x44dce8], ecx
movzx edx, word [0x43fde4]
lea esi, [edx + 1]
mov word [0x43fde4], si
and ecx, edx
movzx edx, word [0x447338]
and edx, ecx
mov word [0x447338], dx
pop esi
ret
Function at 0x41e858
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ax, word [0x446902]
xor word [0x445dd2], 0xeb03
push esi
call dword [0x43f1b8]
xor word [0x4448e2], 0x1192
mov bl, byte [esi + 0x1c]
mov eax, dword [0x45778c]
sar eax, 8
add eax, 0x88d592d7
cmp eax, 0x65937243
jg 0x41e8ad
movzx eax, word [0x440638]
inc eax
mov word [0x440638], ax
cwde
xor eax, 0x8d0c1092
sub dword [0x453db4], eax
push esi
call dword [0x43f1bc]
mov eax, dword [0x44ab70]
lea ecx, [eax + 1]
mov dword [0x44ab70], ecx
and eax, 0x219f21de
movsx ecx, word [0x441aa4]
sar ecx, 9
xor ecx, eax
cmp ecx, 0xc0efd883
jl 0x41e8e5
mov dword [0x4582ec], 0x5b6d5028
test bl, bl
jne 0x41e943
add dword [0x45291c], 0x41004401
push 0x1f4
call dword [0x43f198]
mov dword [0x44c490], 0x386f7866
push esi
call dword [0x43f1b8]
add dword [0x4519ec], 0x74e5f363
mov bl, byte [esi + 0x1c]
mov eax, 0xd20801d3
sub eax, dword [0x454214]
or dword [0x456f18], eax
push esi
call dword [0x43f1bc]
add dword [0x450c78], 0x2331563
cmp bl, 0
je 0x41e8e9
xor word [0x447388], 0xd319
mov dword [0x449638], 0xf13393e9
mov edi, 0xbdc67bbb
and word [0x444aa6], 0x9a8c
push 0x1f4
call dword [0x43f198]
add dword [0x4492bc], 0xef4728bd
push esi
call dword [0x43f1b8]
movsx eax, word [0x442e00]
or eax, dword [0x44c95c]
xor dword [0x4542f0], eax
mov ebx, dword [esi + 0x18]
add dword [0x451644], 0xc284fb34
push esi
call dword [0x43f1bc]
mov eax, dword [0x44fa94]
add eax, edi
xor eax, 0x18e2fd5e
or dword [0x4529b0], eax
cmp ebx, 0
jg 0x41e95b
movsx eax, word [0x441f5a]
imul eax, dword [0x450584]
mov dword [0x450584], eax
pop esi
pop edi
pop ebx
ret
Function at 0x420bcc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [esp + 0x18]
imul ecx, dword [0x44db24], 0xd30df2a7
xor ecx, 0xa77c6ec7
cmp ecx, 0x804d0000
jg 0x420c0d
mov ecx, dword [0x44c0c0]
lea edx, [ecx + 1]
mov dword [0x44c0c0], edx
xor ecx, 0x6cfa9148
or dword [0x456d7c], ecx
jmp 0x420c17
add dword [0x4482e8], 0xf9826430
mov bl, byte [esp + 0x1c]
mov cx, word [0x4419f6]
neg word [0x446382]
or dword [0x44d5bc], 0x81c04b2e
mov dword [esi + 0x2020], eax
mov eax, dword [0x455d48]
not eax
mov word [0x445eac], ax
xor dword [0x455420], 0xaec6f346
call fcn.00411a1e
mov ecx, dword [0x454f84]
dec ecx
mov dword [0x454f84], ecx
mov edx, dword [0x452e10]
sub ecx, edx
or ecx, 0x9f2c
movzx edx, word [0x43f936]
add edx, ecx
mov word [0x43f936], dx
test eax, eax
je 0x420c46
mov dword [esp], eax
mov eax, dword [0x44d44c]
cmp eax, 0x76cadb5f
jl 0x420ca3
movsx eax, word [0x4469da]
shl eax, 0xa
xor dword [0x45821c], eax
call fcn.00411a1e
mov dword [esp + 4], eax
mov eax, dword [0x44e230]
mov byte [esp + 4], bl
mov eax, dword [0x453aac]
cmp eax, 0xa25b0d62
jl 0x420ccc
or word [0x43fa04], 0x7e18
jmp 0x420cfb
mov eax, dword [0x455114]
lea ecx, [eax + 1]
mov dword [0x455114], ecx
add eax, 0xf1835534
xor eax, 0x9ca0e1ed
movsx ecx, word [0x440f38]
shl ecx, 4
cmp eax, ecx
jg 0x420cfb
add word [0x446a7c], 0xbeed
push dword [esp]
call fcn.00415c5a
add esp, 4
xor dword [esp + 4], eax
add dword [0x454730], 0x5577f08a
lea eax, [esp]
push 0
push 8
push eax
push dword [esi + 0x2020]
call dword [0x43f07c]
add word [0x4400ce], 0x7eab
cmp eax, 8
jne 0x420e19
mov eax, 0x9d098485
and eax, dword [0x454e98]
mov dword [0x4519a8], eax
sub esp, 4
movzx eax, bl
mov dword [esp], eax
mov ecx, esi
call fcn.00430a00
test al, al
je 0x420e40
mov eax, dword [0x44ce98]
lea ecx, [eax - 1]
mov dword [0x44ce98], ecx
cmp eax, 0x43d64266
jne 0x420d81
and dword [0x450c90], 0x61a56a65
mov dword [esi], 0
mov eax, dword [0x44d1d8]
lea ecx, [eax + 1]
mov dword [0x44d1d8], ecx
imul eax, eax, 0x1822fba0
movzx ecx, word [0x4477cc]
inc ecx
mov word [0x4477cc], cx
movsx ecx, cx
mov edx, dword [0x44c534]
lea edi, [edx + 1]
mov dword [0x44c534], edi
add edx, 0xf73e8e3e
xor edx, ecx
cmp eax, edx
jne 0x420dd2
mov dword [0x4541fc], 0xfc055dc3
mov eax, dword [esp]
mov dword [esi + 4], eax
add dword [0x456b3c], 0x42083354
mov dword [esi + 0x100c], 0
mov dword [0x44d544], 0x1c8edb17
push dword [esp]
call dword [esi + 0x201c]
add esp, 4
mov dword [esi + 0x1010], eax
xor dword [0x456110], 0x4063d6f1
mov eax, 1
jmp 0x420e72
dec word [0x440b96]
xor word [0x4470f8], 0x6447
mov ecx, esi
call fcn.00416402
mov word [0x442072], 0xea8e
mov eax, 0xffffffff
jmp 0x420e72
mov eax, dword [0x44d1a4]
shl eax, 7
and dword [0x44b350], eax
mov ecx, esi
call fcn.00416402
mov ecx, dword [0x453088]
mov eax, 0xfffffffe
cmp ecx, 0x8f108e08
jg 0x420e72
or dword [0x44784c], 0xf1afc13d
add esp, 8
pop esi
pop edi
pop ebx
ret 8
Function at 0x436ef0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00436f50

Function at 0x436f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x4590e0]
test eax, eax
jle 0x437053
mov edx, dword [0x4590e4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x436f81
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x436ff6
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x436f70
mov dword [esp], esi
call fcn.00437830
test eax, eax
mov edi, eax
je 0x43707a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x4590e4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.00437920
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x4590e4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x43705a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x437000
add dword [0x4590e0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x436fef
cmp eax, 0x80
je 0x436fef
cmp eax, 8
je 0x436fef
mov eax, dword [ebp - 0x28]
add esi, dword [0x4590e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x436fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00436ef0
xor ebx, ebx
jmp 0x436f8b
mov eax, dword [0x4590e4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00436ef0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00436ef0
lea esi, [esi]

Function at 0x437750
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x437788
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x43777e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x43778a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x437770
xor eax, eax
pop ebx
pop esi
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x401a6a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401aa9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401aa9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401aa9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401aa9
cmp dword [ecx + 0x74], 0xe
jbe 0x401aa9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ab80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40abad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40abad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001b94e
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b987
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x98d
push 0x80f
push 0x2255
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1001bb18
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
push 2
mov ecx, dword [ebp - 4]
call fcn.10016537
push 2
mov ecx, dword [ebp - 4]
call fcn.10016537
xor ecx, ecx
sub ecx, dword [eax]
imul eax, ecx, 0x3143
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
cmp eax, 0xbd4daed0
jbe 0x1001ba1a
mov dword [ebp - 0x18], 1
jmp 0x1001ba1e
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 2
mov ecx, dword [ebp - 0x50]
call fcn.10016537
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jne 0x1001ba46
mov dword [ebp - 8], 1
jmp 0x1001ba4a
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov esi, dword [ebp - 8]
add esi, 0x511c
push 1
mov ecx, dword [ebp - 4]
call fcn.10016537
cmp esi, dword [eax]
je 0x1001ba72
mov dword [ebp - 0xc], 1
jmp 0x1001ba76
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
push 0
mov ecx, dword [ebp - 4]
call fcn.10016537
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1001baa5
mov dword [ebp - 0x1c], 1
jmp 0x1001baa9
and dword [ebp - 0x1c], 0
push 2
mov ecx, dword [ebp - 4]
call fcn.10016537
mov esi, dword [eax]
imul esi, dword [ebp - 0x1c]
push 0
mov ecx, dword [ebp - 4]
call fcn.10016537
cmp esi, dword [eax]
jg 0x1001bad0
mov dword [ebp - 0x20], 1
jmp 0x1001bad4
and dword [ebp - 0x20], 0
push 0
mov ecx, dword [ebp - 0x28]
call fcn.10016537
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jge 0x1001baed
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
jne 0x1001bb02
push 2
mov ecx, dword [ebp - 4]
call fcn.10016537
cmp dword [eax], 0
jne 0x1001bb02
and dword [ebp - 0x2c], 0
jmp 0x1001bb09
mov dword [ebp - 0x2c], 1
push 0
mov ecx, dword [ebp - 0x28]
call fcn.10016537
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret