joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20093869
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
neg ebx
sbb ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
and ebx, 0xfffffffe
inc ebx
push edi
cmp word [esi + 0x10], 0
mov dword [ebp + 0x10], ebx
je 0x2009388c
push ebx
jmp 0x2009388e
push 0
mov edi, dword [ebp + 8]
push edi
call fcn.200e2e5d
mov ax, word [esi + 0x10]
mov word [edi + 2], ax
cmp word [esi + 6], 0
je 0x200938a9
push ebx
jmp 0x200938ab
push 0
lea eax, [edi + 4]
push eax
call fcn.200e2e5d
mov ax, word [esi + 6]
mov word [edi + 6], ax
cmp word [esi + 8], 0
je 0x200938c6
push ebx
jmp 0x200938c8
push 0
lea eax, [edi + 8]
push eax
call fcn.200e2e5d
mov ax, word [esi + 8]
mov word [edi + 0xa], ax
mov cl, byte [esi + 5]
test cl, cl
je 0x200938fc
mov al, byte [esi + 2]
movzx edx, al
shr edx, 7
push edx
mov dl, byte [esi + 3]
and al, 0x7f
push edx
push eax
push ecx
call fcn.2009b88b
mov dword [ebp - 8], eax
jmp 0x20093906
and word [ebp - 8], 0
and word [ebp - 6], 0
push dword [ebp - 8]
lea eax, [edi + 0xc]
push eax
call fcn.200e2e5d
push dword [ebp - 6]
lea eax, [edi + 0xe]
push eax
call fcn.200e2e5d
mov al, byte [esi + 4]
lea ebx, [edi + 0x18]
mov byte [edi + 0x15], al
mov al, byte [esi + 0xd]
mov byte [edi + 0x10], al
mov al, byte [esi + 0xe]
mov byte [edi + 0x11], al
mov al, byte [esi + 0xf]
mov byte [edi + 0x12], al
mov al, byte [esi + 0x12]
mov byte [edi + 0x13], al
mov al, byte [esi + 0x13]
mov byte [edi + 0x14], al
cmp word [esi + 0x14], 0
je 0x20093951
push dword [ebp + 0x10]
jmp 0x20093953
push 0
push ebx
call fcn.200e2e5d
mov ax, word [esi + 0x14]
mov dword [ebp + 8], 0x30
mov word [ebx + 2], ax
mov al, byte [esi + 0x19]
mov byte [ebx + 4], al
mov al, byte [esi + 0x18]
mov byte [ebx + 5], al
mov al, byte [esi + 0x16]
mov byte [ebx + 6], al
mov al, byte [esi + 0x17]
mov byte [ebx + 7], al
mov ax, word [esi + 0x1a]
mov word [ebx + 8], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0xa], ax
mov al, byte [esi + 0x1e]
mov byte [ebx + 0xc], al
mov al, byte [esi + 0x1f]
mov byte [ebx + 0xd], al
mov al, byte [esi + 0x20]
mov byte [ebx + 0xe], al
lea ebx, [esi + 0x38]
lea esi, [edi + 0x32]
xor edi, edi
cmp word [ebx - 0xa], di
je 0x200939b5
push dword [ebp + 0x10]
jmp 0x200939b6
push edi
push esi
call fcn.200e2e5d
mov ax, word [ebx - 0xa]
mov word [esi + 2], ax
cmp word [ebx], di
je 0x200939ce
push dword [ebp + 0x10]
jmp 0x200939cf
push edi
lea eax, [esi + 4]
push eax
call fcn.200e2e5d
mov ax, word [ebx]
add ebx, 0x14
mov word [esi + 6], ax
mov al, byte [ebx - 0x23]
mov byte [esi - 2], al
mov al, byte [ebx - 0x1f]
mov byte [esi - 1], al
mov al, byte [ebx - 0x22]
mov byte [esi + 8], al
mov al, byte [ebx - 0x21]
mov byte [esi + 9], al
mov eax, dword [ebx - 0x1c]
mov dword [esi + 0xa], eax
mov eax, dword [ebx - 0x18]
mov dword [esi + 0xe], eax
mov al, byte [ebx - 0x12]
mov byte [esi + 0x12], al
mov al, byte [ebx - 0x11]
mov byte [esi + 0x13], al
mov al, byte [ebx - 0x20]
mov byte [esi + 0x14], al
add esi, 0x18
dec dword [ebp + 8]
jne 0x200939a8
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x200fd7fd
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp word [edi + 6], 0
jg 0x200fd81d
mov eax, dword [esp + 0xc]
mov dword [eax], 4
mov ecx, dword [edi]
mov dword [eax + 4], ecx
jmp 0x200fd8b2
push ebx
push esi
mov esi, dword [esp + 0x10]
push 1
pop ebx
push esi
call fcn.2010566f
mov dword [esi + 0x1c], 4
movsx eax, word [edi + 4]
movzx ecx, word [edi + 6]
shl eax, 0x10
or eax, ecx
mov dword [esi + 0x20], eax
cmp word [edi + 0xa], 0
jle 0x200fd86a
push esi
call fcn.2010566f
mov dword [esi + 0x1c], 4
push 2
movsx eax, word [edi + 8]
movzx ecx, word [edi + 0xa]
shl eax, 0x10
or eax, ecx
pop ebx
mov dword [esi + 0x20], eax
push esi
call fcn.2010566f
or ebx, 0x80000000
push 0
push esi
mov dword [esi + 0x1c], 4
mov dword [esi + 0x20], ebx
call fcn.20112612
mov ecx, dword [esi + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esi + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x10]
add dword [esi + 0x18], 0xfffffff8
mov eax, dword [esi + 0x18]
mov ecx, dword [ecx]
mov edx, dword [ecx + eax]
mov dword [esi + 0x1c], edx
mov eax, dword [ecx + eax + 4]
mov dword [esi + 0x20], eax
pop esi
pop ebx
pop edi
ret 0xc

Function at 0x201027a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov al, byte [ebx]
cmp al, 0xff
jae 0x201027ba
movzx eax, al
jmp 0x201027c3
lea eax, [ebx + 1]
push eax
call fcn.200e66a6
mov esi, dword [esp + 0x18]
movsx edi, ax
mov al, byte [esi]
cmp al, 0xff
jae 0x201027d5
movzx eax, al
jmp 0x201027de
lea eax, [esi + 1]
push eax
call fcn.200e66a6
movsx eax, ax
cmp edi, eax
jne 0x20102811
test edi, edi
jle 0x20102808
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebx + 1]
movzx edx, byte [esi + 1]
dec edi
inc ebx
mov ecx, dword [eax + ecx*4 + 0x14]
inc esi
xor ecx, dword [eax + edx*4 + 0x14]
test cl, cl
jne 0x20102811
test edi, edi
jg 0x201027ed
push 1
pop eax
pop edi
pop esi
pop ebx
ret 0xc
xor eax, eax
jmp 0x2010280b
Function at 0x201b81f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [0x6909c108]
mov ebx, ecx
and ebx, 3
push ebx
shr ecx, 2
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
or ecx, ecx
je 0x201b821f
nop
lodsd eax, dword [esi]
not eax
xor dword [edi], eax
add edi, 4
dec ecx
jne 0x201b8214
pop ecx
or ecx, ecx
je 0x201b822d
lodsb al, byte [esi]
not al
xor byte [edi], al
inc edi
dec ecx
jne 0x201b8224
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x202076e4
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x20207716
push esi
call fcn.202090a4
mov eax, dword [esi + 0x40]
test eax, eax
je 0x2020770f
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x20207797
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x20207781
mov eax, dword [esi + 8]
test eax, eax
je 0x20207737
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
test eax, eax
je 0x2020777b
cmp eax, 2
je 0x20207781
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x2020772d
cmp eax, 3
je 0x2020775a
cmp eax, 1
jne 0x2020772d
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x2020772d
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x2020772d
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.202077c4
pop esi
ret 4
cmp eax, 0xcc
je 0x202077b4
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x12
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
push esi
call fcn.202077c4
pop esi
ret 4
Function at 0x20267c30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x20267c49
test al, 0x40
jne 0x20267c49
test al, 2
je 0x20267c4e
or al, 0x20
mov dword [esi + 0xc], eax
or eax, 0xffffffff
pop esi
ret
or al, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
jne 0x20267ce4
push esi
call fcn.202577ca
pop ecx
push dword [esi + 0x18]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.20262f49
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x20267cf5
cmp eax, 0xffffffff
je 0x20267cf5
mov edx, dword [esi + 0xc]
test dl, 0x82
jne 0x20267cb9
mov ecx, dword [esi + 0x10]
push edi
cmp ecx, 0xffffffff
je 0x20267cee
mov edi, ecx
sar edi, 5
and ecx, 0x1f
mov edi, dword [edi*4 + 0x78037760]
lea ecx, [ecx + ecx*8]
lea edi, [edi + ecx*4]
mov cl, byte [edi + 4]
pop edi
and cl, 0x82
cmp cl, 0x82
jne 0x20267cb9
or dh, 0x20
mov dword [esi + 0xc], edx
cmp dword [esi + 0x18], 0x200
jne 0x20267cd6
mov ecx, dword [esi + 0xc]
test cl, 8
je 0x20267cd6
test ch, 4
jne 0x20267cd6
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec eax
mov dword [esi + 4], eax
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
pop esi
ret
mov eax, dword [esi + 8]
mov dword [esi], eax
jmp 0x20267c64
mov edi, 0x780394a8
jmp 0x20267ca7
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
jmp 0x20267c49

Function at 0x202695ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, edi
test edi, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], ecx
jne 0x202695d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
je 0x2026961c
mov eax, dword [esi + 0x18]
mov dword [ebp + 0x14], eax
test word [esi + 0xc], 0x10c
je 0x2026962a
mov eax, dword [esi + 4]
test eax, eax
je 0x2026962a
cmp ecx, eax
mov edi, ecx
jb 0x202695f8
mov edi, eax
push edi
push dword [esi]
push ebx
call fcn.20248721
sub dword [ebp + 8], edi
sub dword [esi + 4], edi
add dword [esi], edi
add esp, 0xc
add ebx, edi
mov edi, dword [ebp - 4]
cmp dword [ebp + 8], 0
jne 0x20269625
mov eax, dword [ebp + 0x10]
jmp 0x202695cb
mov dword [ebp + 0x14], 0x1000
jmp 0x202695e1
mov ecx, dword [ebp + 8]
jmp 0x202695e1
cmp ecx, dword [ebp + 0x14]
jb 0x2026965d
cmp dword [ebp + 0x14], 0
mov eax, ecx
je 0x20269640
xor edx, edx
div dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
push eax
push ebx
push dword [esi + 0x10]
call fcn.20262f49
add esp, 0xc
test eax, eax
je 0x20269677
cmp eax, 0xffffffff
je 0x2026968a
sub dword [ebp + 8], eax
add ebx, eax
jmp 0x20269611
push esi
call fcn.20267c30
cmp eax, 0xffffffff
pop ecx
je 0x2026967b
mov byte [ebx], al
mov eax, dword [esi + 0x18]
inc ebx
dec dword [ebp + 8]
mov dword [ebp + 0x14], eax
jmp 0x20269611
or dword [esi + 0xc], 0x10
mov eax, edi
xor edx, edx
sub eax, dword [ebp + 8]
div dword [ebp + 0xc]
jmp 0x202695cb
or dword [esi + 0xc], 0x20
jmp 0x2026967b
Function at 0x2026ae64
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x2026ae7d
test al, 0x40
jne 0x2026ae7d
test al, 2
je 0x2026ae84
or al, 0x20
mov dword [esi + 0xc], eax
mov eax, 0xffff
pop esi
ret
or al, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
jne 0x2026af27
push esi
call fcn.202577ca
pop ecx
push dword [esi + 0x18]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.20262f49
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x2026af38
cmp eax, 1
je 0x2026af38
cmp eax, 0xffffffff
je 0x2026af38
mov edx, dword [esi + 0xc]
test dl, 0x82
jne 0x2026aef8
mov ecx, dword [esi + 0x10]
push edi
cmp ecx, 0xffffffff
je 0x2026af31
mov edi, ecx
sar edi, 5
and ecx, 0x1f
mov edi, dword [edi*4 + 0x78037760]
lea ecx, [ecx + ecx*8]
lea edi, [edi + ecx*4]
mov cl, byte [edi + 4]
pop edi
and cl, 0x82
cmp cl, 0x82
jne 0x2026aef8
or dh, 0x20
mov dword [esi + 0xc], edx
cmp dword [esi + 0x18], 0x200
jne 0x2026af15
mov ecx, dword [esi + 0xc]
test cl, 8
je 0x2026af15
test ch, 4
jne 0x2026af15
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add eax, 0xfffffffe
mov dword [esi + 4], eax
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
pop esi
ret
mov eax, dword [esi + 8]
mov dword [esi], eax
jmp 0x2026ae9a
mov edi, 0x780394a8
jmp 0x2026aee6
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
jmp 0x2026ae7d

Function at 0x20272274
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
test eax, eax
jle 0x202722c1
push ebx
push edi
lea edi, [esi + 8]
mov ebx, eax
mov eax, dword [esi + 4]
push 3
shr eax, 0xb
and eax, 7
push eax
push edi
call fcn.202723ca
mov eax, dword [esi + 4]
add esp, 0xc
mov ecx, eax
and cx, 0xf800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
dec ebx
mov dword [esi + 4], ecx
jne 0x20272288
pop edi
pop ebx
pop esi
ret
jge 0x202722ee
mov ecx, dword [esi + 4]
push 0
mov eax, ecx
add esi, 8
and ax, 0xf800
dec eax
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi - 4], eax
shr eax, 0xb
and eax, 7
push eax
push esi
call fcn.202723ca
add esp, 0xc
pop esi
ret
Function at 0x738a21
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], edi
pop word [esp]
push word [esp + 1]
pushfd
jmp 0x738a40

Function at 0x738a66
Capabilities:
Parse pe header

Disassembly:
bswap ebp
mov bp, word [esp + 0x16]
bswap ebp
xchg dword [esp + 1], ebp
push word [esp + 0x1c]
push dword [esp + 0x16]
jmp 0x738709
bsr bp, si
stc
lea ebp, [eax + ecx]
mov word [esp + 0x26], sp
xchg word [esp + 0xb], bp
pop ebp
jmp 0x73862e
or ebx, dword [ebp - 0x15]
int3
and ebp, 0x636e0036
call fcn.007386e8
js 0x73865e
mov dword [eax - 0x21], edi
xchg edx, eax
sbb cl, byte [eax + 0x1ace1aef]
int1
shl bp, 1
mov ebp, 0x2fe67459
mov ebp, 0x1f0109b8
lea ebp, [0x1f5c4a18]
pop bp
lea ebp, [edi + ebp]
jmp 0x738662
pop dword [esp + 0x16]
add esp, 1
add esp, 0x22
bswap ebp
bswap ebp
lea esp, [esp + 3]
jmp 0x73867b
inc bp
pushal
bsf bp, bx
lea ebp, [ecx*4]
lea ebp, [edx + ebp]
xchg dword [esp + 0x24], ebp
jmp 0x73864d
call 0x7389de
mov byte [esp + 5], al
pop dword [esp]
call fcn.007389e0
fistp dword [edx + esi*8 - 0x6b]
test byte fs:[eax], bl
popfd
jecxz 0x738a59
sbb byte [ebp - 0x584bc1d], bl
jnp 0x738a12
xchg dword [esp + 1], ebp
jmp 0x738747
mov dword [esp + 0x14], ebx
call fcn.00738a21
pop word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x14], esp
pushfd
jmp 0x738a96
and al, 0xa
jmp 0x738a37
mov dword [esp + 0x2c], ebp
call fcn.00738b1c
pop word [esp + 2]
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x738ae9
lea esp, [esp + 1]
lea esp, [esp]
pushal
pop dword [esp + 0x15]
lea esp, [esp + 1]
jmp 0x738a5d
mov byte [esp + 1], cl
mov dword [esp], esi
mov dword [esp], ecx
mov byte [esp + 2], dh
mov byte [esp + 2], bh
lea esp, [esp + 2]
jmp 0x738a7d
pop word [esp + 2]
call fcn.00738aae
push word [esp + 8]
pop word [esp + 0x1c]
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
jmp 0x738b04
mov word [esp + 1], ax
pop dword [esp]
mov word [esp + 2], ax
mov dword [esp], edi
push word [esp + 1]
mov byte [esp + 3], bl
jmp 0x738ac6
lea esp, [esp + 0x50]
jmp 0x738b47
mov eax, dword fs:[0x30]

Function at 0x738aae
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0x30], esi
push bx
pushal
pushfd
jmp 0x738ad0
Function at 0x402d47
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], 0
call fcn.0040cf00
add esp, 4
test eax, eax
je 0x402d6c
push str.Unable_to_process_standalone__IPC__clients_
call fcn.0040a0f0
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push 0
push 0
push 0x406320
push 0
push edx
call fcn.00438a12
add esp, 0x18
mov dword [esi + 0x68], eax
test eax, eax
pop esi
jne 0x402d9e
push str.Unable_to_process_standalone__IPC__clients_
call fcn.0040a0f0
add esp, 4
add esp, 0x10
ret

Function at 0x404370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4443fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x14]
push esi
mov esi, ecx
push edi
push 0x34
mov dword [esp + 0xc], esi
mov byte [esi + 0x40], al
call fcn.00438a04
xor edi, edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov cl, byte [esp + 0x20]
push 0x10
mov dword [esp + 0x1c], edi
mov byte [esi + 0x4c], cl
call fcn.00438a04
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edi
mov eax, dword [0x44d594]
add esp, 8
inc eax
mov dword [0x44d594], eax
mov dword [esi + 0x30], eax
mov word [esi + 0x3e], di
mov dword [esi + 0x38], edi
mov word [esi + 0x3c], di
mov dword [esi + 0x34], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x409500
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jne 0x40952d
mov ecx, dword [esi]
push eax
push eax
push ecx
push 0x409560
push eax
push eax
call fcn.00438a12
add esp, 0x18
xor edx, edx
test eax, eax
sete dl
mov dword [esi + 4], eax
mov eax, edx
pop esi
ret
Function at 0x4099e0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0xf01ff
push str.SentinelKeysServer
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x409a85
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x409a7e
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
xor edi, edi
cmp edi, 5
jge 0x409a5c
push 0x3e8
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x409a57
cmp dword [esp + 0x18], 1
jne 0x409a57
mov ebx, 1
inc edi
test ebx, ebx
je 0x409a2f
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 1
pop ebx
je 0x409a7a
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
mov edi, dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret

Function at 0x409f50
Capabilities:
Get session user name

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x409fb0
push 0x40
push esi
mov dword [esp + 0x18], 0x40
call fcn.00422e40
add esp, 8
lea eax, [esp + 0x10]
lea ecx, [esi + 0x40]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esi + 0x80], eax
push ebx
mov ecx, 0x40
xor eax, eax
mov edi, 0x458430
push 0x458630
push 0x447264
push 0x458430
rep stosd dword es:[edi], eax
call fcn.004380cf
add esp, 0x10
mov edx, dword [esp + 0x14]
test edx, edx
je 0x409fde
push edx
mov ecx, 0x40
xor eax, eax
mov edi, 0x458530
push 0x458630
push 0x447264
rep stosd dword es:[edi], eax
push 0x458530
call fcn.004380cf
add esp, 0x10
pop edi
pop esi
pop ebx
ret 8

Function at 0x40c980
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.0040cee0
cmp eax, 1
jne 0x40c9b1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x40c9c6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x14]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40ca0a
mov edi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push esi
call ebx
test eax, eax
je 0x40c9ea
cmp eax, 0x102
jne 0x40c9f7
mov eax, dword [esp + 0x24]
inc ebp
cmp ebp, eax
jg 0x40ca01
jmp 0x40c9d0
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0x391
pop ebx
ret
push esi
call fcn.0040ca80
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40ca20
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.0040cee0
cmp eax, 1
jne 0x40ca39
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push 0
push ecx
jmp 0x40ca42
mov edx, dword [esp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x40ca55
mov eax, 1
pop esi
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ca6c
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop esi
ret
mov eax, 0x391
pop esi
ret
Function at 0x40cd70
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
mov dl, byte [0x44d304]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [esp + 0x210]
pop edi
cmp eax, 1
jne 0x40ce04
lea ecx, [esp]
push str.spnserv.dat
push ecx
lea edx, [esp + 0x10c]
push 0x447264
push edx
call fcn.004380cf
mov eax, dword [0x458ba0]
add esp, 0x10
test eax, eax
je 0x40cdfd
push 0x458ba0
call fcn.0040cd20
add esp, 4
push 0x458ba0
jmp 0x40ce72
cmp eax, 2
jne 0x40ce33
lea eax, [esp]
push str.spserv.dat
push eax
lea ecx, [esp + 0x10c]
push 0x447264
push ecx
call fcn.004380cf
mov eax, dword [0x458bc0]
add esp, 0x10
test eax, eax
je 0x40ce6d
jmp 0x40ce60
cmp eax, 3
jne 0x40ce7a
lea edx, [esp]
push str.gnserv.dat
push edx
lea eax, [esp + 0x10c]
push 0x447264
push eax
call fcn.004380cf
mov eax, dword [0x458bc0]
add esp, 0x10
test eax, eax
je 0x40ce6d
push 0x458bc0
call fcn.0040cd20
add esp, 4
push 0x458bc0
call fcn.0040cd40
add esp, 4
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0x208
ret

Function at 0x40d4e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
push 0x4e8
push 5
push 6
mov dword [esp + 0x10], 0x10
call fcn.00422c40
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x40d56e
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push eax
push 0
push ecx
call fcn.0040d610
mov edx, dword [esp + 0x10]
add esp, 0xc
lea eax, [esp + 8]
mov word [esp + 8], 6
push edx
push eax
push esi
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x40d56e
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push esi
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x40d56e
lea eax, [esp + 8]
push eax
call fcn.0040d450
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.004380cf
add esp, 0xc
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
push str.00_00_00_00_FF_FF_FF_FF_FF_FF
push edx
call fcn.004380cf
add esp, 8
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x416e50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc0
mov eax, dword [esp + 0xc4]
push ebx
push ebp
push esi
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.004190c0
mov esi, dword [esp + 0xdc]
lea ebx, [esi + 0x20]
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.004191a0
add esp, 0x10
xor eax, eax
lea ebp, [esi + 0x10]
mov cl, byte [eax + ebp]
mov dl, byte [esp + eax + 0xc]
xor dl, cl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 0x10
jl 0x416ea9
lea edx, [esp + 0xc]
push edi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004191a0
mov edi, esi
lea edx, [esp + 0x18]
add esp, 8
xor ecx, ecx
sub edi, edx
lea eax, [esp + ecx + 0x10]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jl 0x416ed9
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004191a0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push esi
mov dword [esi + 0x30], edx
push ecx
mov dword [esi + 0x34], eax
call fcn.004191a0
add esp, 0x10
mov ecx, 0xfffffff0
mov eax, ebp
sub ecx, esi
pop edi
mov dl, byte [eax - 0x10]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jl 0x416f1d
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.004191a0
mov ecx, 0xffffffe0
add esp, 8
mov eax, ebx
sub ecx, esi
mov dl, byte [eax - 0x10]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jl 0x416f42
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.004191a0
add esp, 8
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret