joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41deb2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416fce
and dword [ebp - 4], 0
cmp dword [0x430a1c], 0
mov ebx, eax
jne 0x41df63
push 0x426ddc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e014
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x426dd0
push edi
call esi
test eax, eax
je 0x41e014
push eax
call fcn.00416f5c
mov dword [esp], 0x426dc0
push edi
mov dword [0x430a1c], eax
call esi
push eax
call fcn.00416f5c
mov dword [esp], 0x426dac
push edi
mov dword [0x430a20], eax
call esi
push eax
call fcn.00416f5c
mov dword [esp], 0x426d90
push edi
mov dword [0x430a24], eax
call esi
push eax
call fcn.00416f5c
pop ecx
mov dword [0x430a2c], eax
test eax, eax
je 0x41df63
push 0x426d78
push edi
call esi
push eax
call fcn.00416f5c
pop ecx
mov dword [0x430a28], eax
mov eax, dword [0x430a28]
cmp eax, ebx
je 0x41dfbb
cmp dword [0x430a2c], ebx
je 0x41dfbb
push eax
call fcn.00416fd7
push dword [0x430a2c]
mov esi, eax
call fcn.00416fd7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41dfbb
test edi, edi
je 0x41dfbb
call esi
test eax, eax
je 0x41dfb2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41dfb2
test byte [ebp - 0xc], 1
jne 0x41dfbb
or dword [ebp + 0x10], 0x200000
jmp 0x41dff4
mov eax, dword [0x430a20]
cmp eax, ebx
je 0x41dff4
push eax
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41dff4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41dff4
mov eax, dword [0x430a24]
cmp eax, ebx
je 0x41dff4
push eax
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41dff4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430a1c]
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41e014
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e016
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409623
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40967b
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x40c20c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40966e
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40967d
xor eax, eax
pop esi
leave
ret 4
Function at 0x413370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4199e0], ecx
add edx, 1
cmp edx, 0x100
jb 0x413372
cmp edx, 0x800
jae 0x41345b
mov edi, edi
mov eax, dword [edx*4 + 0x4195e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4199e0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4199dc], eax
jb 0x413430
mov dword [0x4199b4], 0x413ab0
call fcn.004135a0
test eax, eax
jne 0x413478
mov dword [0x4199b4], 0x4139d0
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x4cb92408
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x34227a6f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0xafcc2c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xafcc36
pushal
call 0xafcc3c
pop ebp
sub ebp, 0x10
sub ebp, 0x6fcc2c
jmp 0xafcc52
mov eax, 0x6fcc2c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fc
mov edx, 0xbe96d354
xor byte [eax], dl
inc eax
dec ecx
jne 0xafcc69
jmp 0xafcc7c
fistp word [ecx + 0x5468dddf]
push esp
push esp
aad 0x95
lodsb al, byte [esi]
push esp
push esp
push esp
push edi
cdq
in al, dx
push eax
push esp
push esp
push esp
out dx, al
jl 0xafcce8
push esp
push esp
mov dword [0xdf9c57b6], eax
aad 0x58
push esp
push esp
push esp
push edi
xchg ecx, eax
add al, 4
cmp al, 0x90
sub eax, 0x323c545a
push es
xor eax, 0x70785554
cmp al, 0x10
shr dword [esp + 0x545451bc], cl
push esp
mov ebp, 0x5454547c
add dword [eax], eax
or edi, ebx
rcr dword [esp + edx*2 + 0x54], 1
push esp
ffreep st(1)
pop eax
push esp
push esp
push esp
invalid
invalid

Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ
Function at 0x4c93b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4b7015
lea edi, [esi - 0xb6015]
push edi
or ebp, 0xffffffff
jmp 0x4c93d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c93d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c93c8
mov eax, 1
add ebx, ebx
jne 0x4c93eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c93fc
jne 0x4c941b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c941b
dec eax
add ebx, ebx
jne 0x4c9408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c93e0
add ebx, ebx
jne 0x4c9417
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c946d
xor ecx, ecx
sub eax, 3
jb 0x4c9433
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c94a2
sar eax, 1
mov ebp, eax
jmp 0x4c943e
add ebx, ebx
jne 0x4c943e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c940c
inc ecx
add ebx, ebx
jne 0x4c944c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c940c
add ebx, ebx
jne 0x4c9459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c944e
jne 0x4c946a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c944e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c948c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c947e
jmp 0x4c93ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c948c
add edi, ecx
jmp 0x4c93ce
pop esi
mov edi, esi
mov ecx, 0x11ec
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c94aa
cmp byte [edi], 0xa
jne 0x4c94aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c94af
lea edi, [esi + 0xc7000]
mov eax, dword [edi]
or eax, eax
je 0x4c951e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfda9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfdb3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c94dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfdb40]
or eax, eax
je 0x4c9518
mov dword [ebx], eax
add ebx, 4
jmp 0x4c94f9
call dword [esi + 0xfdb50]
mov ebp, dword [esi + 0xfdb44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xc9579]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c956a
sub esp, 0xffffff80
jmp 0x4012a0
Function at 0x411590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x4115b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4115b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4115a8
mov eax, 1
add ebx, ebx
jne 0x4115cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4115c0
jne 0x4115dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4115c0
xor ecx, ecx
sub eax, 3
jb 0x4115f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411662
mov ebp, eax
add ebx, ebx
jne 0x4115fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41162c
inc ecx
add ebx, ebx
jne 0x411618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41160d
jne 0x411629
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41160d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41164c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41163d
jmp 0x4115ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41164c
add edi, ecx
jmp 0x4115ae
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41166a
cmp byte [edi], 5
jne 0x41166a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41166f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x4116de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x146ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14760]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41169c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14764]
or eax, eax
je 0x4116d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4116b9
call dword [esi + 0x14774]
mov ebp, dword [esi + 0x14768]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411712
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50ed00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x50ed22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ed29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ed18
mov eax, 1
add ebx, ebx
jne 0x50ed3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ed30
jne 0x50ed4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ed30
xor ecx, ecx
sub eax, 3
jb 0x50ed60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50edd2
mov ebp, eax
add ebx, ebx
jne 0x50ed6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50ed78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ed9c
inc ecx
add ebx, ebx
jne 0x50ed88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50ed7d
jne 0x50ed99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ed7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50edbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50edad
jmp 0x50ed1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50edbc
add edi, ecx
jmp 0x50ed1e
pop esi
mov edi, esi
mov ecx, 0x101
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50edda
cmp byte [edi], 1
jne 0x50edda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x50eddf
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x50ee57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50ee0c
mov ecx, edi
jns 0x50ee3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe590]
or eax, eax
je 0x50ee51
mov dword [ebx], eax
add ebx, 4
jmp 0x50ee29
call dword [esi + 0xe594]
popal
jmp 0x503280
Function at 0x44c1d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f42bf
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x679dc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], 0
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 8]
lea esi, [eax + 0x10]
test cl, 1
jne 0x44c28a
or ecx, 1
mov dword [eax + 8], ecx
mov dword [ebp - 4], 1
call fcn.0046785f
mov ecx, eax
mov dword [esi + 0x1384], 0xffffffff
mov dword [esi + 4], ecx
lea edi, [esi + 8]
mov edx, 1
nop
mov eax, ecx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [edi - 4], ecx
cmp edx, 0x270
jb 0x44c260
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [esi], 0x270
mov ecx, dword [eax + 8]
test cl, 2
jne 0x44c2b2
or ecx, 2
mov dword [eax + 0x1398], 0
mov dword [eax + 8], ecx
mov dword [eax + 0x139c], 0x3d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 0x18], al
mov ecx, edi
push dword [ebp - 0x18]
mov dword [ebp - 4], eax
push 0xe
mov dword [ebp - 0x20], 1
call fcn.004614d0
mov dword [edi + 0x10], 0
mov eax, 0xe
nop
dec eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1398]
mov eax, dword [eax + 0x139c]
sub eax, ecx
mov dword [ebp - 0x30], ecx
mov ecx, esi
cmp eax, 0xffffffff
jne 0x44c328
call fcn.00466d10
mov edx, eax
jmp 0x44c36a
inc eax
mov dword [ebp - 0x18], eax
call fcn.00466d10
mov ecx, dword [ebp - 0x18]
mul ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
cmp eax, ecx
jae 0x44c36a
mov eax, ecx
xor edx, edx
neg eax
div ecx
mov eax, edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], eax
jae 0x44c367
mov edi, ecx
mov ecx, esi
call fcn.00466d10
mul edi
cmp eax, dword [ebp - 0x28]
jb 0x44c354
mov edi, dword [ebp - 0x1c]
jmp 0x44c36a
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edi + 0x10]
movsx ax, byte [edx + eax + str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
movzx edx, ax
cmp ecx, dword [edi + 0x14]
jae 0x44c39e
cmp dword [edi + 0x14], 8
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
jb 0x44c391
mov eax, dword [edi]
mov word [eax + ecx*2], dx
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x44c3af
push edx
mov byte [ebp - 0x34], 0
mov ecx, edi
push dword [ebp - 0x34]
push 1
call fcn.00461960
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x44c300
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44d0d0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x679dc8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6806fc], 8
mov eax, 0x6806e8
push esi
cmovae eax, dword [0x6806e8]
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44d1f9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
jne 0x44d14c
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call esi
mov dword [ebp - 0x30], 0x21379666
mov dword [ebp - 0x2c], 0xe68400cb
mov dword [ebp - 0x28], 0xe026091a
mov dword [ebp - 0x24], 0xdd690b57
mov dword [ebp - 0x20], 0xb2f5bf55
mov dword [ebp - 0x1c], 0x779ef4d9
mov dword [ebp - 0x18], 0x9ef18ec8
mov dword [ebp - 0x14], 0xe0d84f08
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x60], 0x4052e425
mov dword [ebp - 0x5c], 0x8fc265bf
mov dword [ebp - 0x58], 0xc0676c76
mov dword [ebp - 0x54], 0xb21b7932
pxor xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x30], xmm1
movaps xmm1, xmmword [ebp - 0x20]
push eax
mov dword [ebp - 0x50], 0x97d58527
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], 0x779efebd
mov dword [ebp - 0x48], 0x9ef18ec8
mov dword [ebp - 0x44], 0xe0d84f08
pxor xmm1, xmmword [ebp - 0x50]
push eax
movaps xmmword [ebp - 0x20], xmm1
call fcn.0044b300
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 0x3860
push 0x67a850
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44d2d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], 0x343b9672
mov dword [ebp - 0x2c], 0xe3ab23da
mov dword [ebp - 0x28], 0xb2024c13
mov dword [ebp - 0x24], 0x88691640
mov dword [ebp - 0x20], 0x9db1a007
mov dword [ebp - 0x1c], 0x779efebd
mov dword [ebp - 0x18], 0x9ef18ec8
mov dword [ebp - 0x14], 0xe0d84f08
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x60], 0x4052e425
mov dword [ebp - 0x5c], 0x8fc265bf
mov dword [ebp - 0x58], 0xc0676c76
mov dword [ebp - 0x54], 0xb21b7932
pxor xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x30], xmm1
movaps xmm1, xmmword [ebp - 0x20]
push eax
mov dword [ebp - 0x50], 0x97d58527
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], 0x779efebd
mov dword [ebp - 0x48], 0x9ef18ec8
mov dword [ebp - 0x44], 0xe0d84f08
pxor xmm1, xmmword [ebp - 0x50]
push eax
movaps xmmword [ebp - 0x20], xmm1
call fcn.0044b300
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 0x3860
je 0x44d138
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44d800
Capabilities:
Delete file
Delete service
Stop service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x679dc8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x44d899
mov dword [ebp - 0x20], 0x205ab64
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x8fc254ef
mov dword [ebp - 0x18], 0xc0676c76
mov dword [ebp - 0x14], 0xb21b7932
movaps xmm1, xmmword [ebp - 0x20]
push 0x10022
mov dword [ebp - 0x50], 0x4052e425
mov dword [ebp - 0x4c], 0x8fc265bf
mov dword [ebp - 0x48], 0xc0676c76
mov dword [ebp - 0x44], 0xb21b7932
pxor xmm1, xmmword [ebp - 0x50]
push eax
push edi
movaps xmmword [ebp - 0x20], xmm1
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x44d8ae
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x3c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
cmp dword [0x6806fc], 8
mov eax, 0x6806e8
cmovae eax, dword [0x6806e8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
test eax, eax
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.005c7d0a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x44da70
Capabilities:
Get file size

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x44da78
mov ecx, dword [ecx]
push edi
push 0
push 0x80
push 3
push 0
push 0
push connect
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x44dab5
cmp edi, 0xffffffff
je 0x44dab5
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
ret