joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e5c0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov dword [esi + 0xc], 0
test eax, eax
je 0x46e62c
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
test eax, eax
jne 0x46e5e2
mov eax, 0x4d68e8
mov edx, dword [esi + 4]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x46e62c
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x46e60b
mov ecx, 0x4d68e8
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x46e617
mov esi, 0x4d68e8
push ecx
push esi
push str.RegSetValueEx:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
pop edi
pop esi
ret 8

Function at 0x46e6e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cfff8
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 8]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], ebx
mov edx, 1
jne 0x46e73d
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 0xffffffff
cmp eax, ebx
je 0x46e72d
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x34], ebx
push 1
lea ecx, [esp + 0x28]
call fcn.00406ad6
jmp 0x46e7e6
cmp dword [esp + 0x3c], ebx
je 0x46e748
mov edx, 2
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
jne 0x46e755
mov ecx, 0x4d68e8
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x46e765
mov eax, 0x4d68e8
mov ebp, dword [esp + 0x2c]
inc ebp
push ebp
push ecx
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x46e7ad
mov ecx, dword [edi + 4]
cmp ecx, ebx
jne 0x46e78c
mov ecx, 0x4d68e8
mov esi, dword [esi + 0x18]
cmp esi, ebx
jne 0x46e798
mov esi, 0x4d68e8
push ecx
push esi
push str.RegSetValueEx:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x46e7c2
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x46e7e6
mov al, byte [ecx - 1]
cmp al, bl
je 0x46e7dc
cmp al, 0xff
je 0x46e7dc
dec al
mov byte [ecx - 1], al
jmp 0x46e7e6
dec ecx
push ecx
call fcn.004be17b
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x20

Function at 0x46e900
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov dword [esi + 0xc], 0
test eax, eax
je 0x46e96f
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
test eax, eax
jne 0x46e922
mov eax, 0x4d68e8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
push 3
push 0
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x46e96f
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x46e94e
mov ecx, 0x4d68e8
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x46e95a
mov esi, 0x4d68e8
push ecx
push esi
push str.RegSetValueEx:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
pop edi
pop esi
ret 0xc
Function at 0x46ea30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x3c
mov eax, dword [ecx + 8]
push ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
cmp eax, ebx
mov dword [ecx + 0xc], ebx
je 0x46ec14
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
xor edi, edi
xor esi, esi
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x46ea5e
xor edx, edx
jmp 0x46ea74
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp esi, edx
jge 0x46eab7
lea ecx, [esp + 0x1c]
push esi
push ecx
mov ecx, ebp
call fcn.0040b350
mov edx, dword [eax + 8]
lea eax, [edi + edx + 1]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x46eaa5
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x2c], ebx
push 1
lea ecx, [esp + 0x20]
call fcn.00406ad6
mov edi, dword [esp + 0x10]
inc esi
jmp 0x46ea53
inc edi
push edi
mov dword [esp + 0x14], edi
call fcn.004bfbe2
add esp, 4
xor esi, esi
mov dword [esp + 0x14], eax
mov ebx, eax
mov dword [esp + 0x54], esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x46eadc
xor edx, edx
jmp 0x46eaf2
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp esi, edx
jge 0x46eba0
lea edx, [esp + 0x1c]
push esi
push edx
mov ecx, ebp
call fcn.0040b350
mov eax, dword [eax + 4]
test eax, eax
jne 0x46eb13
mov eax, 0x4d68e8
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp eax, esi
je 0x46eb49
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x2c], esi
push 1
lea ecx, [esp + 0x20]
call fcn.00406ad6
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, ebp
call fcn.0040b350
mov eax, dword [eax + 8]
lea ebx, [ebx + eax + 1]
mov eax, dword [esp + 0x44]
cmp eax, esi
je 0x46eb81
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x44], esi
push 1
lea ecx, [esp + 0x38]
call fcn.00406ad6
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x10]
inc eax
mov dword [esp + 0x54], eax
mov esi, eax
jmp 0x46ead1
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x50]
mov byte [ecx + edi - 1], 0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x46ebb9
mov eax, 0x4d68e8
mov esi, dword [esp + 0x18]
push edi
push ecx
push 7
mov ecx, dword [esi + 4]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x46ec04
mov ecx, dword [ebx + 4]
mov edx, 0x4d68e8
test ecx, ecx
je 0x46ebe3
mov edx, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x46ebef
mov ecx, 0x4d68e8
push edx
push ecx
push str.RegSetValueEx:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
mov edx, dword [esp + 0x14]
push edx
call fcn.004c004b
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
Function at 0x46f5a0
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x46f5b0
xor eax, eax
pop esi
ret 4
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
test eax, eax
jne 0x46f5c1
mov eax, 0x4d68e8
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x46f602
mov ecx, dword [edi + 4]
mov edx, 0x4d68e8
test ecx, ecx
je 0x46f5e1
mov edx, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x46f5ed
mov ecx, 0x4d68e8
push edx
push ecx
push str.RegDeleteKey:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
pop edi
pop esi
sete al
ret 4

Function at 0x46f7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 8]
mov dword [esi + 0xc], 0
test eax, eax
jne 0x46f801
xor eax, eax
pop esi
pop ecx
ret 4
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 4]
test eax, eax
jne 0x46f812
mov eax, 0x4d68e8
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x46f85e
mov ecx, dword [edi + 4]
mov edx, 0x4d68e8
test ecx, ecx
je 0x46f83d
mov edx, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x46f849
mov ecx, 0x4d68e8
push edx
push ecx
push str.RegQueryValueEx:__s_:__s
push eax
push 0x503ff0
call fcn.00423520
add esp, 0x14
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
pop edi
not eax
and eax, ecx
pop esi
pop ecx
ret 4
Function at 0x4a1b70
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4d41a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
push 0
lea eax, [esp + 0x20]
sub esp, 0x18
mov dword [esp + 0x30], 0
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0040907d
mov ecx, esi
call fcn.0043ad00
push str.Creating_a_third_party_adapter
push 0x503ff0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CAdapterOther.0
call fcn.00423100
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
mov dword [esi + 0x190], 0x10
mov dword [esi + 0x248], 0
je 0x4a1bfd
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4a1c33
mov al, byte [ecx - 1]
test al, al
je 0x4a1c29
cmp al, 0xff
je 0x4a1c29
dec al
mov byte [ecx - 1], al
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x1c
dec ecx
push ecx
call fcn.004be17b
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x1c
Function at 0x4af6d0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push str.CLogFile::CanLogToFile__:_Entry._n
mov esi, ecx
push 0x503ff0
call fcn.00423100
mov eax, dword [esi + 4]
add esp, 8
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [esp + 0x10]
mov edx, eax
test edi, edi
je 0x4af70a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
cmp edx, dword [esi + 0x24]
jae 0x4af716
mov ebx, 1
jmp 0x4af729
push edx
push str.CLogFile::CanLogToFile__:_Maximum_File_size_has_been_reached._:__d._n
push 0x503ff0
call fcn.00423100
add esp, 0xc
push ebx
push str.CLogFile::CanLogToFile__:_Exit_with_the_Return_Value___d._n
push 0x503ff0
call fcn.00423100
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x4af750
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x204
push ebx
push esi
push str.CLogFile::Print__:_Entry._n
push 0x503ff0
call fcn.00423100
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
push eax
lea edx, [esp + 0x118]
push ecx
push edx
xor esi, esi
call fcn.004c025b
add esp, 0x14
lea eax, [esp + 0x10c]
lea ecx, [esp + 0xc]
push eax
push str._s_r_n
push ecx
call fcn.004bfb90
mov ebx, dword [esp + 0x21c]
add esp, 0xc
mov al, byte [ebx + 8]
test al, al
je 0x4af876
mov ecx, ebx
call fcn.004af340
test eax, eax
je 0x4af876
mov eax, dword [ebx + 4]
push edi
cmp eax, 0xffffffff
je 0x4af867
lea edx, [esp + 0x10]
mov ecx, ebx
push edx
call fcn.004af6d0
test eax, eax
je 0x4af867
lea eax, [esp + 0xc]
push esi
push eax
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], esi
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp esi, 1
jne 0x4af851
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xc]
not ecx
dec ecx
cmp eax, ecx
jne 0x4af851
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4af84a
push str.CLogFile::Print__:_Couldnt_Flush_the_Write_buffers_for_the_File._n
push 0x503ff0
call fcn.00423100
add esp, 8
mov esi, 1
jmp 0x4af86e
push str.CLogFile::Print__:_Couldnt_write_to_the_File._n
push 0x503ff0
call fcn.00423100
add esp, 8
test esi, esi
jne 0x4af86e
mov ecx, ebx
call fcn.004af5e0
mov ecx, ebx
call fcn.004af410
pop edi
push esi
push str.CLogFile::Print__:_Exit_with_the_Return_Value___d._n
push 0x503ff0
call fcn.00423100
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x204
ret
Function at 0x4b0600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d48a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
call fcn.004abdc0
mov ecx, 1
xor eax, eax
mov dword [ebx + 0x144], ecx
mov dword [ebx + 0x148], ecx
mov ecx, 0x5040a8
mov dword [esp + 0x38], eax
mov dword [ebx], vtable.CDriverDiagsKodiak.0
mov word [ebx + 0xcc], 2
mov dword [ebx + 0x138], eax
mov dword [ebx + 0x13c], eax
mov dword [ebx + 0x140], eax
mov dword [ebx + 0x14c], eax
mov dword [ebx + 0x150], eax
mov dword [ebx + 0x154], eax
mov dword [ebx + 0x158], eax
mov dword [ebx + 0x15c], eax
mov dword [ebx + 0x160], eax
mov dword [ebx + 0x164], eax
mov dword [ebx + 0x168], eax
mov dword [ebx + 0x16c], eax
mov dword [ebx + 0x170], eax
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.004c10a8
push 0x20
mov dword [ebx + 0x120], 8
mov dword [esp + 0x18], 0x8001
mov dword [esp + 0x1c], 0x8005
mov dword [esp + 0x20], 0x8006
mov dword [esp + 0x24], 0x8007
mov dword [esp + 0x28], 0x8003
mov dword [esp + 0x2c], 0x8008
mov dword [esp + 0x30], 0x8009
mov dword [esp + 0x34], 0x800a
call fcn.004bf598
mov ecx, dword [ebx + 0x120]
mov dword [ebx + 0x124], eax
shl ecx, 2
mov edi, eax
mov eax, ecx
lea esi, [esp + 0x18]
add esp, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4bb480
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [ebp - 0x11]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
mov dword [ebp - 0x18], esi
mov byte [esi], al
call fcn.00406ad6
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov cl, byte [ebp - 0x11]
lea ebx, [esi + 0x18]
push edi
mov dword [ebp - 4], edi
mov byte [ebx], cl
mov ecx, ebx
call fcn.00406ad6
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dl, byte [ebp - 0x11]
lea ebx, [esi + 0x30]
push edi
mov ecx, ebx
mov byte [ebp - 4], 1
mov byte [ebx], dl
call fcn.00406ad6
mov al, byte [ebp - 0x11]
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov byte [esi + 0x48], al
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [ebp - 4], 2
push 0xe8
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov byte [ebp - 4], 3
call fcn.004bf598
mov ecx, eax
add esp, 4
mov dword [ebp - 0x1c], ecx
cmp ecx, edi
mov byte [ebp - 4], 4
je 0x4bb536
call fcn.0049d050
mov dword [esi + 0x70], eax
jmp 0x4bb55a
xor eax, eax
mov dword [esi + 0x70], eax
jmp 0x4bb55a
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbfc0
Capabilities:
Start service

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, 0x5040a8
call fcn.0042ce90
test eax, eax
je 0x4bc0b3
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x4bbfe3
mov eax, 0x4d68e8
push eax
push str.Starting_NT_Service__s
push 0x503ff0
call fcn.00423100
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4bc023
push str.OpenSCManager_Failed_to_open_SCM
push 0x503ff0
call fcn.004234a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x4bc02f
mov eax, 0x4d68e8
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4bc06e
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x4bc04e
mov eax, 0x4d68e8
push eax
push str.OpenService_failed_on__s
push 0x503ff0
call fcn.004234a0
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x4bc0ae
call esi
push edi
call esi
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x4bc095
mov eax, 0x4d68e8
push eax
push str.Failed_to_StartService__s
push 0x503ff0
call fcn.004234a0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
call esi
push edi
call esi
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4bc0c0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x5040a8
call fcn.0042ce90
test eax, eax
je 0x4bc1e8
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4bc0e6
mov eax, 0x4d68e8
push eax
push str.Removing_NT_Service__s
push 0x503ff0
call fcn.00423100
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4bc127
push str.OpenSCManager_Failed_to_open_SCM
push 0x503ff0
call fcn.004234a0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4bc133
mov eax, 0x4d68e8
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4bc173
mov esi, dword [esi + 0x34]
test esi, esi
jne 0x4bc152
mov esi, 0x4d68e8
push esi
push str.OpenService_failed_on__s
push 0x503ff0
call fcn.004234a0
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4bc1a4
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4bc191
mov eax, 0x4d68e8
push eax
push str.Failed_to_Stop_the_service:_s_n
push 0x503ff0
call fcn.004234a0
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4bc1ce
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4bc1bb
mov eax, 0x4d68e8
push eax
push str.Failed_to_delte_the_service:_s_n
push 0x503ff0
call fcn.004234a0
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x43cf63
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43ccda
call fcn.0043cf90
dec edi
xor dword [ecx], esi
add ecx, 1
add edi, 0x2b46f8be
sub edi, 1
cmp ecx, eax
jne fcn.0043cf63
dec ebx
sub ebx, 1
ret
Function at 0x401790
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
test ebp, ebp
je 0x401983
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipCursor]
push edi
mov edi, dword [sym.imp.USER32.dll_CloseDesktop]
nop
push 0
call edi
push 0
call esi
mov ecx, dword [esp + 0x14]
push 0
xor byte [ebx + ecx], 0x2f
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x38
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x20
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x60
call edi
push 0
call esi
push 0
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0xf4
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x9a
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x93
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x3f
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xc5
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x5e
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x4b
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xf4
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
add byte [ebx + eax], 0xd8
push 0
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xde
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x86
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 5
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x8d
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x41
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x26
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x64
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x73
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xbe
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x88
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x2d
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xeb
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 9
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xda
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
add byte [ebx + eax], 0x70
inc ebx
cmp ebx, ebp
jb 0x4017b0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401990
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x42680c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x3c]
push edi
mov dword [esp + 0x18], 0
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x401b2b
mov edi, dword [esp + 0x48]
nop
mov edx, dword [eax]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x34], 0
mov eax, edx
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x24], xmm0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a01
sub eax, esi
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00401070
test ebx, ebx
je 0x401adb
cmp edi, 3
jbe 0x401adb
mov edi, dword [esp + 0x34]
lea ebx, [esp + 0x24]
mov esi, edi
xor esi, 0x14d
cmp dword [esp + 0x38], 0x10
cmovae ebx, dword [esp + 0x24]
push ebx
shr edi, 2
push edi
push str._x_and__p
call fcn.00401de0
add esp, 0xc
xor edx, edx
test edi, edi
je 0x401a81
nop dword [eax + eax]
imul ecx, dword [ebx + edx*4], 0x5bd1e991
inc edx
imul esi, esi, 0x5bd1e991
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e991
xor esi, ecx
cmp edx, edi
jl 0x401a60
mov eax, dword [esp + 0x34]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401aab
sub eax, 1
je 0x401aa1
sub eax, 1
jne 0x401ab9
movsx ecx, byte [ebx + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [ebx + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [ebx + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor esi, eax
mov edi, dword [esp + 0x48]
mov eax, esi
shr eax, 0xd
xor eax, esi
imul eax, eax, 0x5bd1e991
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
je 0x401ad7
cmp ecx, edi
je 0x401b44
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add eax, 4
mov dword [esp + 0x10], eax
cmp ecx, 0x10
jb 0x401b20
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401b97
push ecx
push edx
call fcn.0040276a
mov eax, dword [esp + 0x18]
add esp, 8
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x4019e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402778
add esp, 0x30
ret
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x38]
cmp ecx, 0x10
jb 0x401b2b
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401b97
push ecx
push edx
call fcn.0040276a
add esp, 8
jmp 0x401b2b
call fcn.0040574f
int3