joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435315
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x4360d5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea edi, [ecx + 4]
mov dword [ebp - 0xc], ecx
mov dword [ecx], 0x44b148
xor edx, edx
xor eax, eax
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4360f0
mov byte [edi + 0x100], dl
mov byte [edi + 0x101], dl
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 8], 0x100
mov al, byte [ecx]
movzx esi, dl
mov edx, dword [ebp + 8]
mov byte [ebp - 1], al
movzx eax, al
movzx edx, byte [esi + edx]
add ebx, edx
add eax, ebx
mov ebx, 0x100
cdq
idiv ebx
movzx ebx, dl
mov al, byte [ebx + edi]
mov byte [ecx], al
mov al, byte [ebp - 1]
mov byte [ebx + edi], al
lea eax, [esi + 1]
cdq
idiv dword [ebp + 0xc]
inc ecx
dec dword [ebp - 8]
jne 0x436111
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x436177
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
mov al, byte [ecx + 0x104]
mov dl, byte [ecx + 0x105]
jbe 0x43621b
push ebx
push esi
push edi
movzx edi, al
movzx ebx, dl
jmp 0x4361a5
mov ebx, dword [ebp - 0xc]
lea eax, [edi + 1]
mov esi, 0x100
cdq
idiv esi
movzx edi, dl
mov al, byte [edi + ecx + 4]
mov byte [ebp - 2], dl
lea esi, [edi + ecx + 4]
mov byte [ebp - 1], al
movzx eax, al
add eax, ebx
mov ebx, 0x100
cdq
idiv ebx
mov ebx, dword [ebp - 8]
movzx eax, dl
mov dword [ebp - 0xc], eax
mov byte [ebp - 3], dl
mov dl, byte [eax + ecx + 4]
lea eax, [eax + ecx + 4]
mov byte [esi], dl
mov dl, byte [ebp - 1]
mov byte [eax], dl
mov eax, dword [ebp + 8]
add ebx, eax
movzx eax, byte [esi]
movzx edx, dl
add eax, edx
mov esi, 0x100
cdq
idiv esi
movzx eax, dl
mov al, byte [eax + ecx + 4]
xor byte [ebx], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jb 0x4361a2
mov al, byte [ebp - 2]
mov dl, byte [ebp - 3]
pop edi
pop esi
pop ebx
push 1
mov byte [ecx + 0x104], al
mov byte [ecx + 0x105], dl
pop eax
leave
ret 8
Function at 0x436f0e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x449733
call fcn.00448b30
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004380fb
xor edi, edi
mov dword [esi + 0x1c], 0xa
mov dword [ebp - 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi], 0x44b158
mov dword [esi + 0x30], ebx
call fcn.0043f025
push edi
mov dword [esi + 4], eax
push dword [ebp + 0xc]
push ebx
push eax
call fcn.0043f04c
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x24], eax
mov ecx, dword [0x45141c]
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov dword [eax + 4], esi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0xaaa360
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4be000]
push edi
or ebp, 0xffffffff
jmp 0xaaa382
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xaaa389
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaa378
mov eax, 1
add ebx, ebx
jne 0xaaa39b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xaaa3ac
jne 0xaaa3cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaa3cb
dec eax
add ebx, ebx
jne 0xaaa3b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xaaa390
add ebx, ebx
jne 0xaaa3c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xaaa41d
xor ecx, ecx
sub eax, 3
jb 0xaaa3e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xaaa452
sar eax, 1
mov ebp, eax
jmp 0xaaa3ee
add ebx, ebx
jne 0xaaa3ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaa3bc
inc ecx
add ebx, ebx
jne 0xaaa3fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaa3bc
add ebx, ebx
jne 0xaaa409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xaaa3fe
jne 0xaaa41a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xaaa3fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xaaa43c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xaaa42e
jmp 0xaaa37e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xaaa43c
add edi, ecx
jmp 0xaaa37e
pop esi
mov edi, esi
mov ecx, 0x24cd7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xaaa45a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xaaa45f
lea edi, [esi + 0x6a6000]
mov eax, dword [edi]
or eax, eax
je 0xaaa4c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6b4244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6b4368]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xaaa485
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6b4370]
or eax, eax
je 0xaaa4c1
mov dword [ebx], eax
add ebx, 4
jmp 0xaaa4a2
call dword [esi + 0x6b436c]
mov ebp, dword [esi + 0x6b4374]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xaaa4fb
sub esp, 0xffffff80
jmp 0x85dcdc
Function at 0x1175c1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1175c26
pushal
call 0x1175c2c
pop ebp
sub ebp, 0x10
sub ebp, 0xd75c1c
jmp 0x1175c42
mov eax, 0xd75c1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x9099516f
xor byte [eax], dl
inc eax
dec ecx
jne 0x1175c59
jmp 0x1175c6c
in al, 0xa2
in al, 0xe6
push ebx
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
out dx, al
scasb al, byte es:[edi]
xchg edi, eax
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
mov byte [0x6f6f69d7], al
outsd dx, dword [esi]
aad 0x47
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
cwde
lea ebp, [edi - 0x1c]
out dx, al
arpl word [edi + 0x6f], bp
outsd dx, dword [esi]
insb byte es:[edi], dx
stosb byte es:[edi], al
aas
aas
pop es
or eax, dword [edi]
popal
outsd dx, dword [esi]
pop es
xlatb
pushfd
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ebx
dec ebx
pop es
invalid
Function at 0x403163
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 8
mov eax, 0x43609f
call fcn.00425651
mov dword [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push 0x441404
xor ebx, ebx
push 1
push ebx
push 0x441414
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x403205
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], ebx
je 0x4031c3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push ebx
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x4031d5
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x441424
push eax
call dword [ecx]
test eax, eax
jl 0x403205
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x403205
mov ecx, dword [eax]
push 1
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00401d7f
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401d7f
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.00401d7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401d7f
call fcn.00425729
ret
Function at 0x4076b3
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov eax, SysReAllocString
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x4076e3
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x407709
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
je 0x40770c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
jne 0x4076fc
jmp 0x4076fe
Function at 0x409990
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x4099a4
cmp dword [esi + 0x30], 0x40
jbe 0x409aa8
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x409aad
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x409aad
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x409aa8
ja 0x4099ef
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x409aa8
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x409aad
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x409aad
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x409a25
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x409a41
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x409a58
mov ecx, 0x20b
cmp ax, cx
jne 0x409a5b
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x409aad
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x409aad
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x409aa8
ja 0x409a96
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x409aa8
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x409f71
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x437871
call fcn.00425651
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x1c], esi
call fcn.00423ac0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
xor eax, eax
cmp byte [ebp + 0x214], bl
push str.InstallDir
setne al
push str.SoftwareAdvancedSystemRepairPro
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x104
add eax, 0x80000001
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2], cx
push esi
lea ecx, [ebp]
call fcn.0040eaf1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00415146
add ebp, 0x20c
leave
ret
Function at 0x40bf85
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x437d66
call fcn.00425651
mov edi, dword [ebp + 8]
push edi
call fcn.00418371
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.0040ada1
pop ecx
mov byte [ebp - 4], 1
call fcn.00414b35
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00401d7f
push dword [edi]
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bfd0
mov byte [ebp - 0xd], 1
mov eax, dword [edi]
push ebx
push ebx
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40bff1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
je 0x40c024
push dword [edi]
call fcn.0041341b
push ebx
call fcn.00423949
pop ecx
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x442d88
call fcn.0040eaf1
mov byte [ebp - 4], 2
push edi
mov byte [ebp - 4], bl
call fcn.00419b23
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00425729
ret 4

Function at 0x40cb15
Capabilities:
Create process on windows

Disassembly:
push 0x54
mov eax, 0x43633f
call fcn.00425651
xor edi, edi
mov dword [ebp - 4], edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.00423ac0
xor eax, eax
push 0x10
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x34], 1
call fcn.00423ac0
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea esi, [ebp + 8]
call fcn.004154fd
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40cb85
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d7f
call fcn.00425729
ret

Function at 0x40d40d
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
xor ebx, ebx
push esi
mov byte [0x452374], 1
push 1
cmp byte [0x452376], bl
je 0x40d42a
push ebx
push 0x4415c8
jmp 0x40d431
push dword [0x4524b0]
push ebx
push dword [0x4523b0]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
cmp byte [0x452376], bl
je 0x40d45f
push 0xbb8
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
ret
Function at 0x40d82b
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x437830
call fcn.00425651
xor eax, eax
mov dword [ebp - 4], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push 0x206
push eax
lea eax, [ebp + 2]
xor ecx, ecx
push eax
mov word [ebp], cx
call fcn.00423ac0
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea ecx, [ebp]
call fcn.0040eaf1
lea eax, [ebp - 0x10]
push 0x441b4c
push eax
mov esi, edi
mov dword [ebp - 0x18], ebx
call fcn.00407653
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x214]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov esi, eax
call fcn.004152e7
add esp, 0x10
mov byte [ebp - 4], 3
call fcn.00414b35
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401d7f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401d7f
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x214]
call fcn.00401d7f
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00415146
add ebp, 0x20c
leave
ret

Function at 0x41073f
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 4
mov eax, 0x435b26
call fcn.00425651
mov edi, ecx
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov esi, ebx
call fcn.0041a4d6
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
mov dword [ebp - 0x10], 1
je 0x4107fc
mov esi, dword [ebx]
call fcn.0040eca9
test al, al
je 0x4107fc
mov eax, dword [ebx]
push edi
push dword [ebp + 0x10]
push dword [eax]
call fcn.00423b40
mov eax, dword [ebx]
add esp, 0xc
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp + 0x10], edi
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4107b9
mov edi, dword [ebp + 0x10]
jmp 0x4107f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4107f3
mov edi, dword [ebp + 0x10]
mov esi, dword [ebx]
call fcn.0040eca9
test al, al
je 0x4107f3
mov eax, dword [ebx]
mov eax, dword [eax]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4107fc
xor edi, edi
mov esi, dword [ebx]
call fcn.0040eca9
mov eax, ebx
call fcn.00425729
ret 0xc
Function at 0x41246d
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0xf01ff
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp esi, edi
jne 0x4124a1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x41254c
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4124be
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
jmp 0x41249a
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call edi
test eax, eax
je 0x41249a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
call esi
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x412530
mov eax, dword [ebp - 0x18]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x412503
mov ecx, 0x2710
cmp eax, ecx
jbe 0x412505
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 8]
call edi
test eax, eax
je 0x412536
cmp dword [ebp - 0x1c], ebx
ja 0x4124dd
call esi
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
ja 0x412536
cmp dword [ebp - 0x2c], 2
je 0x4124e7
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
mov eax, 0x3e8
pop ebx
pop edi
xor edx, edx
pop esi
leave
ret
Function at 0x41284a
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push 0x30
mov eax, 0x436039
call fcn.00425651
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf003f
push esi
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x412952
push 0x2c
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x412952
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push ebx
call esi
test eax, eax
je 0x41293d
cmp dword [ebp - 0x38], 1
je 0x412952
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4128ee
push dword [ebp - 0x24]
call edi
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
call esi
test eax, eax
je 0x41293d
cmp dword [ebp - 0x38], 1
je 0x41293d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2bf20
ja 0x41293d
cmp dword [ebp - 0x38], 3
je 0x4128c0
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41293d
jmp 0x412937
push 0x3e8
call edi
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
call esi
test eax, eax
je 0x41293d
cmp dword [ebp - 0x38], 1
je 0x41293d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2bf20
ja 0x41293d
cmp dword [ebp - 0x38], 1
jne 0x412907
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x18]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d7f
call fcn.00425729
ret
Function at 0x413950
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x435d54
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44dd60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.004179d0
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x4139ac
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x4139ae
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x413a54
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x413a15
mov eax, dword [edi]
push esi
push eax
call fcn.00423ea6
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x413a12
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.00423ac0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413a3b
cmp dword [esp + 0x40], esi
je 0x413a54
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x413a54
mov eax, dword [esi]
push ebx
push eax
call fcn.00423ea6
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret