joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401443
pop dword [ebp - 0x38]
mov eax, 0x401443
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xe6c6a6a2
sub dword [ebp - 0x48], 0x98746157
mov dword [ebp - 0x44], 0xac413e3f
sub dword [ebp - 0x44], 0x7a0df1fa
mov dword [ebp - 0x40], 0x9c0ec8e
sub dword [ebp - 0x40], 0xbd74a860
mov dword [ebp - 0x3c], 0x205513e5
sub dword [ebp - 0x3c], 0x205513e5
lea eax, [ebp - 0x48]
push eax
mov eax, 0x216f1344
sub eax, 0x212e9240
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x50b596df
add dword [ebp - 0x48], 0x23bcd277
mov dword [ebp - 0x44], 0xfb0e9213
add dword [ebp - 0x44], 0x465dcf62
mov dword [ebp - 0x40], 0x8007b054
add dword [ebp - 0x40], 0xe367bc18
mov dword [ebp - 0x3c], 0x8aefbfc4
sub dword [ebp - 0x3c], 0x8aefbfc4
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x351fe
push 0
call eax
mov ecx, 0x7d5128b3
sub ecx, 0x7d50ed5d
mov edi, eax
mov edx, 0xd7254099
sub edx, 0xd6de5c99
add edx, dword [ebp - 0x38]
mov esi, 0x7a6f51a9
sub esi, 0xdcd9ca04
sub dword [ebp - 0x10], 0x50c9feef
mov ebx, dword [edx]
mov dword [ebp - 0xc], 0xbf28d7de
xor ebx, esi
xor dword [ebp - 0x10], 0x63fa768e
mov dword [edi], ebx
add dword [ebp - 8], 0x853f8e4a
add edi, 0xe7982865
add edi, 0x1867d79f
add edx, 0xa6c47895
sub edx, 0xa6c47891
loop 0x40155b
add eax, 0xb29b1f08
add eax, 0x4d65c123
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9c9a3790
sub ecx, 0x9c5a3790
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401520
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401536
mov esi, 0x100000
jmp 0x401542
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_WriteFile
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40157f
mov edx, ebx
mov eax, 0x42a5e4
call fcn.004013d4
test al, al
jne 0x40157f
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_Sleep
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401584
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_WriteFile
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4015ce
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_WriteFile
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4015f6
mov edx, ebx
mov eax, 0x42a5e4
call fcn.004013d4
test al, al
jne 0x4015f6
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_Sleep
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016b4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edx, eax
mov ebp, edx
and ebp, 0xfffff000
add edx, dword [esp]
add edx, 0xfff
and edx, 0xfffff000
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 8]
sub eax, ebp
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov esi, dword [0x42a5e4]
jmp 0x401736
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebp, ebx
jbe 0x401708
mov ebx, ebp
cmp edi, dword [esp + 8]
jbe 0x401712
mov edi, dword [esp + 8]
cmp edi, ebx
jbe 0x401734
push 4
push 0x1000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x401734
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
jmp 0x40173e
mov esi, dword [esi]
cmp esi, 0x42a5e4
jne 0x4016fa
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401a08
Capabilities:
Create thread
Move file

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401abe
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x42a5c4
call sub.KERNEL32.DLL_CreateThread
cmp byte [0x42a045], 0
je 0x401a36
push 0x42a5c4
call sub.KERNEL32.DLL_MoveFileA
mov eax, 0x42a5e4
call fcn.004013cc
mov eax, 0x42a5f4
call fcn.004013cc
mov eax, 0x42a620
call fcn.004013cc
push 0xff8
push 0
call sub.KERNEL32.DLL_SetFilePointer
mov dword [0x42a61c], eax
cmp dword [0x42a61c], 0
je 0x401a9d
mov eax, 3
mov edx, dword [0x42a61c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401a73
mov eax, 0x42a604
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x42a610], eax
mov byte [0x42a5bc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ac5
cmp byte [0x42a045], 0
je 0x401abd
push 0x42a5c4
call sub.KERNEL32.DLL_WaitForSingleObject
ret
Function at 0x401acc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x42a5bc], 0
je 0x401ba9
xor edx, edx
push ebp
push 0x401ba2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x42a045], 0
je 0x401afe
push 0x42a5c4
call sub.KERNEL32.DLL_MoveFileA
mov byte [0x42a5bc], 0
mov eax, dword [0x42a61c]
push eax
call sub.KERNEL32.DLL_VirtualQuery
xor eax, eax
mov dword [0x42a61c], eax
mov ebx, dword [0x42a5e4]
jmp 0x401b31
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_Sleep
mov ebx, dword [ebx]
cmp ebx, 0x42a5e4
jne 0x401b1f
mov eax, 0x42a5e4
call fcn.004013cc
mov eax, 0x42a5f4
call fcn.004013cc
mov eax, 0x42a620
call fcn.004013cc
mov eax, dword [0x42a5dc]
test eax, eax
je 0x401b77
mov edx, dword [eax]
mov dword [0x42a5dc], edx
push eax
call sub.KERNEL32.DLL_VirtualQuery
mov eax, dword [0x42a5dc]
test eax, eax
jne 0x401b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ba9
cmp byte [0x42a045], 0
je 0x401b97
push 0x42a5c4
call sub.KERNEL32.DLL_WaitForSingleObject
push 0x42a5c4
call sub.KERNEL32.DLL_CloseHandle
ret
pop ebx
pop ebp
ret
Function at 0x4020f4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x42a5bc], 0
jne 0x402111
call fcn.00401a08
test al, al
je 0x402119
cmp ebx, 0x7ffffff8
jle 0x402123
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402277
xor ecx, ecx
push ebp
push 0x402270
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x42a045], 0
je 0x402144
push 0x42a5c4
call sub.KERNEL32.DLL_MoveFileA
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402154
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4021f3
mov eax, ebx
test eax, eax
jns 0x402169
add eax, 3
sar eax, 2
mov edx, dword [0x42a61c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4021f3
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021a4
mov eax, ebx
test eax, eax
jns 0x402193
add eax, 3
sar eax, 2
mov ecx, dword [0x42a61c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021ca
mov ecx, ebx
test ecx, ecx
jns 0x4021ad
add ecx, 3
sar ecx, 2
mov edi, dword [0x42a61c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x42a5ac]
sub ebx, 4
add dword [0x42a5b0], ebx
call fcn.00403e18
jmp 0x402277
cmp ebx, dword [0x42a614]
jg 0x402245
sub dword [0x42a614], ebx
cmp dword [0x42a614], 0xc
jge 0x402217
add ebx, dword [0x42a614]
xor eax, eax
mov dword [0x42a614], eax
mov eax, dword [0x42a618]
add dword [0x42a618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x42a5ac]
sub ebx, 4
add dword [0x42a5b0], ebx
call fcn.00403e18
jmp 0x402277
mov eax, ebx
call fcn.00402000
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402277
cmp byte [0x42a045], 0
je 0x40226f
push 0x42a5c4
call sub.KERNEL32.DLL_WaitForSingleObject
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402284
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x42a5c0], eax
cmp byte [0x42a5bc], 0
jne 0x4022bc
call fcn.00401a08
test al, al
jne 0x4022bc
mov dword [0x42a5c0], 8
mov dword [ebp - 4], 8
jmp 0x40241d
xor ecx, ecx
push ebp
push 0x402416
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x42a045], 0
je 0x4022dd
push 0x42a5c4
call sub.KERNEL32.DLL_MoveFileA
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4022f8
mov dword [0x42a5c0], 9
jmp 0x4023ed
dec dword [0x42a5ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x42a5b0], eax
test bl, 1
je 0x402358
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402328
test edx, 0x80000003
je 0x402337
mov dword [0x42a5c0], 0xa
jmp 0x4023ed
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40234f
mov dword [0x42a5c0], 0xa
jmp 0x4023ed
add ebx, edx
mov esi, eax
call fcn.00401bac
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x42a618]
jne 0x402398
sub dword [0x42a618], ebx
add dword [0x42a614], ebx
cmp dword [0x42a614], 0x3c00
jle 0x402389
call fcn.00401e9c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403e18
jmp 0x40241d
mov edx, dword [eax]
test dl, 2
je 0x4023bb
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023b6
mov dword [0x42a5c0], 0xb
jmp 0x4023ed
or dword [eax], 1
jmp 0x4023e4
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023ce
cmp dword [eax], 0
je 0x4023ce
cmp dword [eax + 8], 0xc
jge 0x4023da
mov dword [0x42a5c0], 0xb
jmp 0x4023ed
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bac
mov edx, ebx
mov eax, esi
call fcn.00401e14
mov eax, dword [0x42a5c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40241d
cmp byte [0x42a045], 0
je 0x402415
push 0x42a5c4
call sub.KERNEL32.DLL_WaitForSingleObject
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402a1c
Capabilities:
Clear file content

Disassembly:
add esp, 0xfffffff8
push esp
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
je 0x402a34
mov eax, dword [esp]
mov dword [0x429008], eax
pop ecx
pop edx
ret
call sub.KERNEL32.DLL_SetEvent
mov dword [0x429008], eax
pop ecx
pop edx
ret

Function at 0x402f98
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x429008], 0x8088405
inc edx
mov dword [ebx + 0x429008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x425d18
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040481c
xor eax, eax
push ebp
push 0x425dd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c884]
call fcn.0041cc64
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425daf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [eax + 0x1c8], 0x5db
mov eax, dword [ebp - 8]
add eax, 0x34
mov edx, 0x425df0
call fcn.004043e4
mov eax, 0x74
call fcn.00402f98
mov edx, dword [eax*4 + 0x429760]
mov eax, dword [ebp - 8]
add eax, 0x60
call fcn.004043e4
push 0
mov ecx, dword [ebp - 4]
mov edx, 0x425e1c
mov eax, dword [ebp - 8]
call fcn.0041d09c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425db9
mov eax, dword [ebp - 8]
call fcn.004036bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425dde
lea eax, [ebp - 4]
call fcn.00404390
ret

Function at 0x425e20
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040481c
xor eax, eax
push ebp
push 0x425edf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c884]
call fcn.0041cc64
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425eb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [eax + 0x1c8], 0x5db
mov eax, dword [ebp - 8]
add eax, 0x34
mov edx, 0x425ef8
call fcn.004043e4
mov eax, 0x74
call fcn.00402f98
mov edx, dword [eax*4 + 0x429760]
mov eax, dword [ebp - 8]
add eax, 0x60
call fcn.004043e4
push 1
mov ecx, dword [ebp - 4]
mov edx, 0x425f24
mov eax, dword [ebp - 8]
call fcn.0041d09c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x425ec1
mov eax, dword [ebp - 8]
call fcn.004036bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425ee6
lea eax, [ebp - 4]
call fcn.00404390
ret
Function at 0x42814c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
xor ebx, ebx
push 2
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov esi, eax
test esi, esi
je 0x42819f
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push 2
push 0x110
push 0xf0000
mov eax, dword [0x42baac]
push eax
push ebp
push esi
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
push esi
call sub.advapi32.dll_StartServiceCtrlDispatcherA
test ebx, ebx
je 0x42819d
mov bl, 1
jmp 0x42819f
xor ebx, ebx
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4281a8
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, eax
mov dword [esp + 8], 1
push 1
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jle 0x428231
push 0x14
push esi
push ebx
call sub.advapi32.dll_QueryServiceStatus
mov esi, eax
test esi, esi
jle 0x42822b
xor eax, eax
mov dword [esp], eax
push esp
push 0
push esi
call sub.advapi32.dll_SetServiceStatus
test al, al
je 0x428225
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_OpenSCManagerA
test al, al
je 0x428225
jmp 0x42821e
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
call fcn.004241f0
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_OpenSCManagerA
test al, al
je 0x428225
cmp edi, dword [esp + 0x18]
jg 0x428225
cmp dword [esp + 8], 4
jne 0x4281fb
push esi
call sub.advapi32.dll_StartServiceCtrlDispatcherA
push ebx
call sub.advapi32.dll_StartServiceCtrlDispatcherA
cmp dword [esp + 8], 4
sete al
add esp, 0x20
pop edi
pop esi
pop ebx
ret
Function at 0x405646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x405655
pop dword [ebp - 0x3c]
mov eax, 0x46ebea55
sub eax, 0x46ab9400
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x245f33d8
sub dword [ebp - 0x4c], 0xd60cee8d
mov dword [ebp - 0x48], 0xd6690448
add dword [ebp - 0x48], 0x5bca47fd
mov dword [ebp - 0x44], 0x2ac31638
add dword [ebp - 0x44], 0x21892df6
mov dword [ebp - 0x40], 0x1d63c899
sub dword [ebp - 0x40], 0x1d63c899
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc1a109e
sub eax, 0xbd99f5a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x85c8c22b
add dword [ebp - 0x4c], 0xeea9a72b
mov dword [ebp - 0x48], 0xc3cab0ea
sub dword [ebp - 0x48], 0x825e4f75
mov dword [ebp - 0x44], 0x7fb83804
add dword [ebp - 0x44], 0xe3b73468
mov dword [ebp - 0x40], 0x9db698fb
add dword [ebp - 0x40], 0x62496705
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a933
push 0
call eax
mov ecx, 0x569f
mov edi, eax
mov ebx, 0xd105dcc9
sub ebx, 0xd0c27cc9
add ebx, dword [ebp - 0x3c]
mov esi, 0x6a6a004d
sub esi, 0xbe929ad5
xor dword [ebp - 0x34], 0xbfc9ff0
mov edx, dword [ebx]
mov dword [ebp - 0x30], 0xe6a7f072
add edx, esi
mov dword [edi], edx
add dword [ebp - 8], edi
add edi, 4
add ebx, 4
loop 0x40576c
add eax, 0x14d4f
xor ebx, ebx
add ebx, eax
add eax, 0x5991dd31
add eax, 0xa66e22d4
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4058f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421968
push esi
call fcn.00405d21
push esi
call fcn.004058a8
mov edi, eax
test edi, edi
jne 0x405916
xor eax, eax
jmp 0x405968
push edi
call fcn.00405f83
test byte [0x423f78], 0x80
je 0x40592f
mov al, byte [edi]
test al, al
je 0x405912
cmp al, 0x5c
je 0x405912
sub edi, esi
jmp 0x405947
call fcn.0040601c
test eax, eax
je 0x405941
test byte [eax], 0x10
je 0x405912
push esi
call fcn.0040585b
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405933
call fcn.00405814
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059f5
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x4059f8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401bd7
pop dword [ebp - 0x44]
mov eax, 0x7ed06a5c
add eax, 0x816fb17b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x2062c26
sub dword [ebp - 0x54], 0xb3b3e6db
mov dword [ebp - 0x50], 0x6bde110
sub dword [ebp - 0x50], 0xd48a94cb
mov dword [ebp - 0x4c], 0x8712d85a
add dword [ebp - 0x4c], 0xc5396bd4
mov dword [ebp - 0x48], 0xdd7dd19b
sub dword [ebp - 0x48], 0xdd7dd19b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x531f3b0d
add eax, 0xad213553
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x9c2768f
add dword [ebp - 0x54], 0x6aaff2c7
mov dword [ebp - 0x50], 0x6f2e065b
sub dword [ebp - 0x50], 0x2dc1a4e6
mov dword [ebp - 0x4c], 0xe4d07500
add dword [ebp - 0x4c], 0x7e9ef76c
mov dword [ebp - 0x48], 0x9eb691f3
add dword [ebp - 0x48], 0x61496e0d
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36537
push 0
call eax
mov ecx, 0x9d5dd0db
add ecx, 0x62a27626
mov edi, eax
mov ebx, 0xdb5a352a
sub ebx, 0xdb19352a
add ebx, dword [ebp - 0x44]
mov esi, 0xaa5ef5d9
sub esi, 0x3cfe352c
add dword [ebp - 0x14], 0xe860594b
mov edx, dword [ebx]
xor dword [ebp - 0x20], 0xc2cc130d
add edx, esi
add dword [ebp - 0x1c], edi
mov dword [edi], edx
add dword [ebp - 4], eax
add edi, 0x3be566ed
add edi, 0xc41a9917
add ebx, 0xdda5849b
add ebx, 0x225a7b69
loop 0x401cf4
add eax, 0xebc643d3
sub eax, 0xebc534fc
mov ebx, eax
add eax, 0xfb591de5
sub eax, 0xfb591de0
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4029e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00403380
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret