joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442290
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 4
shl eax, 0
cmp dword [eax + 0xb37148], 0
jne 0x442310
mov dword [ebp - 0x24], 0xedb88320
mov dword [ebp - 0x10], 0
jmp 0x4422c0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x442310
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
jmp 0x4422e1
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jae 0x442301
mov ecx, dword [ebp - 0x14]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x4422d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0xb37148], ecx
jmp 0x4422b7
mov edx, dword [ebp + 0x10]
not edx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x442373
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x1c], 0
je 0x442371
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
xor ecx, dword [edx*4 + 0xb37148]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
jmp 0x44232a
jmp 0x4423e9
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 2], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 2]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4423e9
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x4423c9
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x4423c9
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x4423c9
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
xor edx, dword [eax*4 + 0xb37148]
mov dword [ebp - 0xc], edx
jmp 0x442373
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x44a0d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493d16
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0xb323bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004391b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00437480
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00437480
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00437480
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.00439180
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], edx
mov dword [ebp - 0x14], 0
jmp 0x44a1b2
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x44a1c8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx*4 + 0x48], 0xffffffff
jmp 0x44a1a9
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45bd70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xb323bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xb376d0], 0
jne 0x45bd8e
call fcn.0045b990
call fcn.00441bf0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0xb376b0]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
cvtsi2ss xmm0, edx
push ecx
movss dword [esp], xmm0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x40]
call fcn.00439180
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x28]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0xb376b8]
mov edx, dword [ebp - 8]
sbb edx, dword [0xb376bc]
call fcn.0046df90
cvtsd2ss xmm0, xmm0
mov edx, dword [0xb376c4]
mov ecx, dword [0xb376c0]
movss dword [ebp - 0x38], xmm0
call fcn.0046df90
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x38]
divss xmm1, xmm0
mov edx, dword [ebp - 0x28]
movss dword [edx + 0xc], xmm1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [0xb376b8], eax
mov dword [0xb376bc], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x45be5a
mov dword [ebp - 0x2c], 1
jmp 0x45be61
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
mov cl, byte [ebp - 0x2c]
mov byte [eax + 0xe1], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x45be89
mov dword [ebp - 0x30], 1
jmp 0x45be90
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x28]
mov cl, byte [ebp - 0x30]
mov byte [eax + 0xe2], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x45beb8
mov dword [ebp - 0x34], 1
jmp 0x45bebf
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x28]
mov cl, byte [ebp - 0x34]
mov byte [eax + 0xe3], cl
mov edx, dword [ebp - 0x28]
mov byte [edx + 0xe4], 0
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x30b]
test ecx, ecx
je 0x45bf1e
mov edx, dword [ebp - 0x28]
cvttss2si eax, dword [edx + 0xcc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
cvttss2si edx, dword [ecx + 0xd0]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0xb376b0]
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0xe0]
test edx, edx
je 0x45bf34
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.004441a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d937
mov esp, ebp
pop ebp
ret
Function at 0x462db0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0xb323bc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x140
push 0
lea eax, [ebp - 0x248]
push eax
call fcn.00470f10
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x49a6fc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x49a700
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x462e36
jmp 0x462f18
push 0x49a704
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x462e62
push 0x49a708
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x462e67
jmp 0x462eef
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x49a6fc
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.localconfig.vdf
lea edx, [ebp - 0x108]
push edx
call fcn.00449cb0
add esp, 8
test eax, eax
je 0x462ed5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x250], esp
lea eax, [ebp - 0x108]
push eax
call fcn.00402ec0
call fcn.00465790
add esp, 0x18
mov ecx, dword [ebp - 0x248]
and ecx, 0x10
je 0x462eef
lea edx, [ebp - 0x108]
push edx
call fcn.00462db0
add esp, 4
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x462e36
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d937
mov esp, ebp
pop ebp
ret
Function at 0x462f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0xb323bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x462f57
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x462f5e
mov al, 1
jmp 0x463049
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.00466870
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.00466870
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.004668d0
add esp, 8
movzx eax, al
test eax, eax
je 0x462fa4
xor al, al
jmp 0x463049
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.00468af0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x462fe6
cmp dword [ebp - 0x34], 1
je 0x462fed
cmp dword [ebp - 0x34], 3
je 0x46303c
jmp 0x463047
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x46301c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.0047a4db
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x46301c
xor al, al
jmp 0x463049
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x463030
mov dword [ebp - 0x3c], 1
jmp 0x463037
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x463049
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x463049
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d937
mov esp, ebp
pop ebp
ret
Function at 0x4659c0
Capabilities:
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494ab6
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0xb323bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x140]
call fcn.00411390
mov dword [ebp - 4], 0
push 0xff
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00470f10
add esp, 0xc
push 0xb38390
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x465ac5
push str.extrimhack_
push 0xb38390
lea ecx, [ebp - 0x184]
call fcn.00402ec0
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x148], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x148]
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.00411450
add esp, 0xc
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x140]
call fcn.0040a650
lea ecx, [ebp - 0x16c]
call fcn.00402e70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x184]
call fcn.00402e70
push 0
lea ecx, [ebp - 0x140]
call fcn.00402e60
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.ConfigLoader.cfg
lea ecx, [ebp - 0x140]
call fcn.00462820
lea ecx, [ebp - 0x140]
call fcn.00402e60
push eax
push 0xff
lea edx, [ebp - 0x110]
push edx
push 0x4b43a8
push str.folder
push 0x49a748
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x128]
call fcn.00402ec0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.00402e50
test eax, eax
ja 0x465b3d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.00402e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.00402e70
jmp 0x465bc0
lea ecx, [ebp - 0x128]
call fcn.00402e50
mov dword [ebp - 0x150], eax
lea ecx, [ebp - 0x128]
call fcn.00402e50
sub eax, 0x31
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x154]
push edx
lea ecx, [ebp - 0x128]
call fcn.00466930
push str.userdata
lea ecx, [ebp - 0x128]
call fcn.00462820
lea ecx, [ebp - 0x128]
call fcn.00402e60
push eax
call fcn.00462db0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.00402e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.00402e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d937
mov esp, ebp
pop ebp
ret
Function at 0x482aa0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00482751

Function at 0x482aab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004828db
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402ac0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
mov dword [0x40f53c], eax
mov dword [0x40f4a8], eax
mov word [0x40f4b4], ax
mov ebx, dword [0x40f5c0]
mov edx, 0xfffffffe
mov esi, esi
movzx eax, word [0x40f4b4]
movzx ecx, byte [edx + ebx + 2]
shl eax, 5
xor eax, ecx
and eax, 0x7fff
inc edx
mov word [0x40f4b4], ax
jne 0x402ae0
call fcn.00405110
pop ebx
ret
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x40ab42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40ab51
pop dword [ebp - 0x40]
mov eax, 0xf4bdd88c
add eax, 0xb82d2c5
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3bf55
push 0
mov eax, 0xe24863cc
add eax, 0x1df88cc4
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x99188430
sub ecx, 0x99182df8
xor edi, edi
add edi, eax
mov edx, 0x7766c06a
sub edx, 0x7725166a
add edx, dword [ebp - 0x40]
mov esi, 0x7e8f7a5b
sub esi, 0x6ba5cfc0
xor dword [ebp - 0x14], 0x9c79beee
mov ebx, dword [edx]
xor dword [ebp - 8], eax
sub ebx, esi
add dword [ebp - 0x18], ebx
mov dword [edi], ebx
add dword [ebp - 0x10], ecx
add edi, 4
add edx, 0x22723114
add edx, 0xdd8dcef0
loop 0x40abb2
add eax, 0xbf5ad5c4
sub eax, 0xbf598a11
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x274db6f3
sub ecx, 0x270db6f3
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1000f8fa
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000f95e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000f93b
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x4b75
push 1
call fcn.1000f8fa
add esp, 0x14
jmp 0x1000f95c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000f95c
push 0xcfa
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x1000f9ac
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000f996
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000f994
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1000f9ac
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000f9ac
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret

Function at 0x1000fe99
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000ff1e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000ff10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000fef1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1000ff0e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000c1d5
mov dword [eax], 0xce34aafb
jmp 0x1000fee6
jmp 0x1000ff1c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1000ff51
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 0x5bfa
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.1000ff55
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1000ffa9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10010001
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000fff3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
mov ecx, dword [ebp - 0x14]
call fcn.1000c1d5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1000ffff
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10010031
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x15b3
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x70b6
push 0x7371
push 0
push 0x79f4
call fcn.1000fc78
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1001245a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100124ed
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100124a0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001249e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x100124eb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100124ce
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100124eb
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000c1d5
mov dword [eax], 0xfffffff8
jmp 0x100124c3
jmp 0x100124ff
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
call fcn.1000f8de
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret