joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41db4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4045d4
call fcn.004093c4
push 4
mov dword [esp + 0x18], 0
call fcn.0040aa66
mov edi, eax
add esp, 4
test edi, edi
je 0x4068c4
push ebx
call fcn.004091bf
mov dword [edi], eax
call fcn.00408f7e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409385
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4068b8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004093ad
pop ebx
jmp 0x4068c6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b55e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213dc]
jne 0x40b568
repz ret
jmp fcn.004114fc
Function at 0x416bf3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9de
and dword [ebp - 0x14], 0
cmp dword [0x81e734], 0
mov dword [ebp - 0x18], eax
jne 0x416ca6
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d4e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x416d4e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x81e734], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x81e738], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x81e73c], eax
call edi
push eax
call esi
mov dword [0x81e744], eax
test eax, eax
je 0x416ca6
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x81e740], eax
mov eax, dword [0x81e740]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cff
cmp dword [0x81e744], ecx
je 0x416cff
push eax
call esi
push dword [0x81e744]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cff
test ebx, ebx
je 0x416cff
call edi
test eax, eax
je 0x416cf6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416cf6
test byte [ebp - 8], 1
jne 0x416cff
or dword [ebp + 0x10], 0x200000
jmp 0x416d32
mov eax, dword [0x81e738]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d32
mov eax, dword [0x81e73c]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x81e734]
call esi
test eax, eax
je 0x416d4e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b55e
leave
ret
Function at 0x12f48
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x12f83
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x12f6a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x12f7b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x12f85
inc edi
add eax, 0x28
cmp edi, esi
jb 0x12f60
xor eax, eax
pop edi
pop esi
ret
Function at 0x13482
Capabilities:
Inspect section memory permissions

Disassembly:
jle 0x134c0
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x136f7
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x134ad
invalid
cmp dword [eax + 0xc], ebx
je 0x13550
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00012f08
test byte [0x5d39a47d], bh
inc dword [ebp + edi + 0x5d39a47d]
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.00012f08
pop esi
je 0x13561
lea ecx, [ebx + 0xa087]
add byte [ebx], bh
ret
je 0x135bc
add eax, esi
cmp dword [eax], ebx
je 0x135bc
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x135b7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x135a1
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x135a9
cmp edx, ebx
jne 0x136f7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x13578
add eax, dword [eax + 4]
jmp 0x13565
mov dword [ebp + 0xc], ebx
jmp 0x135c7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x135df
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x135fd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1365b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x13642
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1364b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x13655
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x13637
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x135c1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x136a8
dec eax
je 0x1369f
sub eax, 3
je 0x13696
mov dword [ebp - 4], 0x40
jmp 0x136c5
mov dword [ebp - 4], 4
jmp 0x136ab
mov dword [ebp - 4], 0x20
jmp 0x136ab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x136f7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x13677
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00012f08
xchg ebx, eax
cmc
xor ebx, ebx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x13703
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4c892ebc
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x231855ab
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x8f8ac8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008f8c18
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8f8aee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f8ada
add dl, dl
jne 0x8f8af9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f8b4c
xor eax, eax
add dl, dl
jne 0x8f8b06
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f8bed
add dl, dl
jne 0x8f8b15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f8b20
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f8b2b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f8b36
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8f8b42
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8f8ae5
mov eax, 1
add dl, dl
jne 0x8f8b5a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f8b65
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f8b51
sub eax, ebx
mov ebx, 1
jne 0x8f8b98
mov ecx, 1
add dl, dl
jne 0x8f8b7e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f8b89
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f8b75
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f8ae5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8f8baf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f8bba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f8ba6
cmp eax, 0x7d00
jae 0x8f8bdd
cmp eax, 0x500
jb 0x8f8bd8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f8ae5
cmp eax, 0x7f
ja 0x8f8be0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f8ae5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8f8c0e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8f8ae5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 3
and esp, 0xfffffff8
add esp, 4
sub esp, 0x118
call fcn.00403554
mov edx, dword [ebp + 8]
mov dword [ebp - 0x118], str.extjob
xor eax, eax
mov dword [ebp - 0x114], 0x4011f8
mov dword [ebp - 0x110], eax
cmp edx, 1
mov dword [ebp - 0x10c], eax
jle 0x407010
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
movsx eax, byte [edx]
cmp eax, 0x2d
je 0x4010ff
cmp eax, 0x2f
je 0x4010ff
push 0x104
push edx
push 0x4196c0
call dword [sym.imp.MSVCR71.dll_strncpy]
add esp, 0xc
mov byte [0x4197c4], 0
mov eax, 0x4196c0
push eax
push eax
call sub.oracore10.dll_lstlo
push 0x4196c0
lea eax, [ebp - 0x108]
push eax
call sub.oracore10.dll_lstcap
add esp, 0x10
push str.extjob
push str._s__install__________to_install_the_service_n
call dword [sym.imp.MSVCR71.dll_printf]
push str.extjob
push str._s__remove___________to_remove_the_service_n
call dword [sym.imp.MSVCR71.dll_printf]
push str.extjob
push str._s__debug__params____to_run_as_a_console_app_for_debugging_n
call dword [sym.imp.MSVCR71.dll_printf]
push str._nStartServiceCtrlDispatcher_being_called._n
call dword [sym.imp.MSVCR71.dll_printf]
push str.This_may_take_several_seconds.__Please_wait._n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 0x20
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
je section..text1
xor eax, eax
mov esp, ebp
pop ebp
ret
add edx, 1
push edx
push str.install
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40111f
call fcn.004013a8
jmp 0x4011e1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
add edx, 1
push edx
push str.remove
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
jne 0x401145
call fcn.004014a8
jmp 0x4011e1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
add edx, 1
push edx
push str.debug
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4011a7
mov eax, dword [ebp + 8]
cmp eax, 2
jle 0x401184
mov eax, dword [ebp + 0xc]
push 0x104
push dword [eax + 8]
push 0x4196c0
call dword [sym.imp.MSVCR71.dll_strncpy]
add esp, 0xc
jmp 0x40118b
mov byte [0x4196c0], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x4197cc], 1
push eax
push edx
call fcn.00401648
add esp, 8
jmp 0x4011e1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
add edx, 1
push edx
push str.noservice
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40109b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x4197cc], 1
push eax
push edx
call fcn.004027c4
add esp, 8
push 0
call dword [sym.imp.MSVCR71.dll_exit]
pop ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
jmp 0x401060
push str.StartServiceCtrlDispatcher_failed.
call fcn.00401334
pop ecx
jmp 0x4010f9
mov byte [0x4196c0], 0
jmp 0x401074
Function at 0x401334
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 4], edi
mov eax, dword [0x4197cc]
test eax, eax
jne 0x4013a0
push str.extjob
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
call dword [sym.imp.orauts.dll_GetLastError]
lea edx, [ebp - 0x78]
push eax
push str.extjob
push str._s_error:__d
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x10
test edi, edi
je 0x4013a0
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
xor ecx, ecx
push ecx
push edx
push ecx
push 2
push ecx
push ecx
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4014a8
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
push 1
xor eax, eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401627
push 0x10024
push str.extjob
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x401607
push 0x419900
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40159b
push str.Oracle_Job_Scheduler_Exec_Service
push str.Stopping__s.
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
push 0x3e8
call dword [sym.imp.orauts.dll_Sleep]
push 0x419900
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4015fc
mov edx, dword [0x419904]
cmp edx, 3
jne 0x40156e
push 0x4183a4
call dword [sym.imp.MSVCR71.dll_printf]
pop ecx
push 0x3e8
call dword [sym.imp.orauts.dll_Sleep]
push 0x419900
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4015f1
mov edx, dword [0x419904]
cmp edx, 3
je 0x401538
cmp edx, 1
jne 0x401588
push str.Oracle_Job_Scheduler_Exec_Service
push str._n_s_stopped._n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
jmp 0x40159b
push str.Oracle_Job_Scheduler_Exec_Service
push str._n_s_failed_to_stop._n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4015d1
push str.Oracle_Job_Scheduler_Exec_Service
push str._s_removed._n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push 0x100
push 0x419800
call fcn.004016bc
push eax
push str.DeleteService_failed____s_n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 0x10
jmp 0x4015b9
mov edx, dword [0x419904]
jmp 0x40156e
mov edx, dword [0x419904]
jmp 0x40156e
push 0x100
push 0x419800
call fcn.004016bc
push eax
push str.OpenService_failed____s_n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 0x10
jmp 0x4015c0
push 0x100
push 0x419800
call fcn.004016bc
push eax
push str.OpenSCManager_failed____s_n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 0x10
jmp 0x4015c7
Function at 0x403c70
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0xc]
shr eax, 2
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
rdtsc
mov esi, dword [ebp - 0x1c]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403d07
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
mov esi, esi
lea edi, [edi]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x60], xmm0
movdqa xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x403cd0
emms
jmp 0x403d95
mov eax, dword [ebp + 0xc]
mov edx, eax
shr edx, 1
shr eax, 2
add edx, dword [ebp + 8]
add edx, eax
mov dword [ebp - 0x14], edx
rdtsc
mov esi, dword [ebp - 0x14]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403cba
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
lea esi, [esi]
movntdq xmmword [edi], xmm0
movntdq xmmword [edi + 0x10], xmm0
movntdq xmmword [edi + 0x20], xmm0
movntdq xmmword [edi + 0x30], xmm0
movntdq xmmword [edi + 0x40], xmm0
movntdq xmmword [edi + 0x50], xmm0
movntdq xmmword [edi + 0x60], xmm0
movntdq xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x403d60
sfence
emms
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
test dword [0x4197e0], 0x400
jne 0x403c28
test dword [0x4197e0], 0xfffffe00
jne 0x403c70
test dword [0x4197e0], 0xffffff80
jne 0x403c4c
test dword [0x4197e0], 0xffffffff
jne 0x403f3c
call fcn.00404020
jmp fcn.00403da0
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403da0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0xc]
shr eax, 2
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
rdtsc
mov esi, dword [ebp - 0x1c]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403d07
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
mov esi, esi
lea edi, [edi]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x60], xmm0
movdqa xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x403cd0
emms
jmp 0x403d95
mov eax, dword [ebp + 0xc]
mov edx, eax
shr edx, 1
shr eax, 2
add edx, dword [ebp + 8]
add edx, eax
mov dword [ebp - 0x14], edx
rdtsc
mov esi, dword [ebp - 0x14]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403cba
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
lea esi, [esi]
movntdq xmmword [edi], xmm0
movntdq xmmword [edi + 0x10], xmm0
movntdq xmmword [edi + 0x20], xmm0
movntdq xmmword [edi + 0x30], xmm0
movntdq xmmword [edi + 0x40], xmm0
movntdq xmmword [edi + 0x50], xmm0
movntdq xmmword [edi + 0x60], xmm0
movntdq xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x403d60
sfence
emms
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
test dword [0x4197e0], 0x400
jne 0x403c28
test dword [0x4197e0], 0xfffffe00
jne 0x403c70
test dword [0x4197e0], 0xffffff80
jne 0x403c4c
test dword [0x4197e0], 0xffffffff
jne 0x403f3c
call fcn.00404020
jmp fcn.00403da0
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret