joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e5c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
mov eax, 0x4b5bf8
call fcn.004a6de4
mov dword [ebp - 0x14], 2
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004b11fc
inc dword [ebp - 0x14]
lea edx, [ebp + 8]
mov word [ebp - 0x20], 8
lea eax, [ebp + 8]
call fcn.004b11fc
inc dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x43af64]
call fcn.0043b064
cmp byte [ebp + 0x10], 0
mov ebx, eax
je 0x406eb2
mov edx, 0x80000002
jmp 0x406eb7
mov edx, 0x80000001
mov eax, ebx
call fcn.004b1188
mov word [ebp - 0x20], 0x14
mov edx, 0x4b586b
lea eax, [ebp - 4]
call fcn.004b11c4
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov cl, 1
mov eax, ebx
call fcn.0043b168
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b12d8
pop ecx
test cl, cl
je 0x406f09
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0043b324
mov eax, ebx
call fcn.0043b0d4
mov esi, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x406f30
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov word [ebp - 0x20], 0x2c
mov edx, 3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x20], 0x20
dec dword [ebp - 0x14]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004b12d8
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004b12d8
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406f80
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
mov eax, 0x4b5c60
call fcn.004a6de4
mov dword [ebp - 0x14], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004b11fc
inc dword [ebp - 0x14]
mov dl, 1
mov word [ebp - 0x20], 8
mov eax, dword [0x43af64]
call fcn.0043b064
cmp byte [ebp + 0xc], 0
mov ebx, eax
je 0x406fc8
mov edx, 0x80000002
jmp 0x406fcd
mov edx, 0x80000001
mov eax, ebx
call fcn.004b1188
mov word [ebp - 0x20], 0x14
mov edx, 0x4b5899
lea eax, [ebp - 4]
call fcn.004b11c4
inc dword [ebp - 0x14]
mov edx, dword [eax]
xor ecx, ecx
mov eax, ebx
call fcn.0043b168
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b12d8
pop ecx
test cl, cl
je 0x40701c
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0043b28c
mov eax, ebx
call fcn.0043b0d4
mov esi, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x407043
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov word [ebp - 0x20], 0x2c
mov edx, 3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x20], 0x20
dec dword [ebp - 0x14]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004b12d8
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407064
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x4b5cd8
push ebx
push esi
push edi
call fcn.004a6de4
mov dword [ebp - 0x1c], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004b11fc
inc dword [ebp - 0x1c]
mov dl, 1
mov word [ebp - 0x28], 8
mov eax, dword [0x43af64]
call fcn.0043b064
cmp byte [ebp + 0xc], 0
mov edi, eax
je 0x4070ad
mov edx, 0x80000002
jmp 0x4070b2
mov edx, 0x80000001
mov eax, edi
call fcn.004b1188
mov word [ebp - 0x28], 0x14
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 4]
call fcn.004b11c4
inc dword [ebp - 0x1c]
mov edx, dword [eax]
xor ecx, ecx
mov eax, edi
call fcn.0043b168
push eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b12d8
pop ecx
test cl, cl
je 0x407150
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.0043b4a4
mov ebx, eax
mov word [ebp - 0x28], 8
mov eax, edi
call fcn.0043b0d4
mov esi, edi
mov dword [ebp - 0xc], esi
test esi, esi
je 0x407130
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov word [ebp - 0x28], 0x2c
mov edx, 3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x28], 0x20
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 0x1c]
call fcn.004b12d8
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x40719c
mov eax, edi
call fcn.0043b0d4
mov esi, edi
mov dword [ebp - 0x14], esi
test esi, esi
je 0x40717e
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x28], 0x44
mov edx, 3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x28], 0x38
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 0x1c]
call fcn.004b12d8
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ed94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.00450d64
mov edi, eax
cmp edi, 0x40
jle 0x40edd1
push 1
push esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call sym.NLSAgtConfig.exe__Hash_THash_CalcString_qqrp17System_TMetaClassx17System_AnsiStringp19Decutil_TProtectioni
jmp 0x40edde
mov eax, esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
call fcn.00450b00
mov eax, esi
call fcn.00450fac
mov eax, dword [esi]
call fcn.00450d64
test eax, eax
jle 0x40edff
mov edi, 1
mov edx, dword [esi]
xor byte [edx + edi - 1], bl
inc edi
dec eax
jne 0x40edf5
mov eax, dword [esi]
call fcn.00450d64
mov edi, eax
mov eax, esi
mov edx, 0x40
call fcn.004510e8
mov eax, esi
call fcn.00450fb4
add eax, edi
xor ecx, ecx
mov cl, bl
mov edx, 0x40
sub edx, edi
call fcn.0044f52c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4197f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call fcn.0044ed08
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x4198d9
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x4bd7dc
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x4b62d4]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x41983a
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x4198a4
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x419838
inc dword [esp]
dec dword [esp + 8]
jne 0x419827
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x4198db
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41aa88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov esi, eax
add dword [esi + 0x14], ebp
mov edi, edx
xor edx, edx
mov dl, byte [esi + 0x1c]
test ebp, ebp
jle 0x41ab58
dec ebp
xor eax, eax
mov al, byte [esi + 0x18]
mov al, byte [esi + eax + 0x1d]
add byte [esi + 0x19], al
inc byte [esi + 0x18]
mov al, byte [esi + edx + 0x1d]
xor ecx, ecx
mov cl, byte [esi + 0x19]
mov cl, byte [esi + ecx + 0x1d]
mov byte [esi + edx + 0x1d], cl
xor ecx, ecx
mov cl, byte [esi + 0x1b]
mov cl, byte [esi + ecx + 0x1d]
xor ebx, ebx
mov bl, byte [esi + 0x19]
mov byte [esi + ebx + 0x1d], cl
xor ecx, ecx
mov cl, byte [esi + 0x18]
mov cl, byte [esi + ecx + 0x1d]
xor ebx, ebx
mov bl, byte [esi + 0x1b]
mov byte [esi + ebx + 0x1d], cl
xor ecx, ecx
mov cl, byte [esi + 0x18]
mov byte [esi + ecx + 0x1d], al
and eax, 0xff
mov al, byte [esi + eax + 0x1d]
add byte [esi + 0x1a], al
xor eax, eax
mov al, byte [esi + 0x1b]
mov al, byte [esi + eax + 0x1d]
add al, byte [esi + edx + 0x1d]
xor edx, edx
mov dl, byte [esi + 0x1a]
add al, byte [esi + edx + 0x1d]
mov dl, byte [edi]
mov byte [esi + 0x1b], dl
inc edi
xor ecx, ecx
mov cl, byte [esi + 0x19]
movzx ecx, byte [esi + ecx + 0x1d]
xor ebx, ebx
mov bl, byte [esi + 0x18]
movzx ebx, byte [esi + ebx + 0x1d]
add ecx, ebx
and ecx, 0xff
mov cl, byte [esi + ecx + 0x1d]
and eax, 0xff
movzx eax, byte [esi + eax + 0x1d]
mov al, byte [esi + eax + 0x1d]
xor al, dl
xor cl, al
xor eax, eax
mov al, cl
mov edx, eax
test ebp, ebp
jg 0x41aaa2
mov byte [esi + 0x1c], dl
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41abb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov esi, eax
mov eax, dword [esi]
call dword [eax + 0x30]
mov byte [esp], al
mov bl, 0xff
xor byte [esp], bl
mov edx, esp
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x24]
dec ebx
cmp bl, 0xff
jne 0x41abc7
lea eax, [esp + 0x11]
xor ecx, ecx
mov edx, 0x28
call fcn.0044f52c
mov byte [esp + 0x11], 0x80
mov byte [esp + 0x12], 2
mov eax, dword [esi]
call dword [eax + 0x30]
shl eax, 8
lea edx, [esp + 0x13]
mov dword [edx], eax
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], 3
mov byte [esp + 0x17], 5
mov byte [esp + 0x18], 7
mov byte [esp + 0x19], 0xb
mov eax, dword [esi + 0x14]
shl eax, 3
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x40], eax
fild qword [esp + 0x3c]
fistp qword [esp + 8]
wait
lea edx, [esp + 0x1a]
lea eax, [esp + 8]
mov ecx, 8
call fcn.0044ed08
mov eax, dword [esi]
call dword [eax + 0x30]
dec eax
test al, al
jb 0x41ac85
inc eax
mov byte [esp + 0x10], al
mov bl, 0
lea edi, [esp + 0x11]
mov edx, edi
mov ecx, 1
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x24]
xor eax, eax
mov al, bl
lea edx, [esi + 0x120]
mov cl, byte [esi + 0x1c]
xor byte [edx + eax], cl
inc ebx
inc edi
dec byte [esp + 0x10]
jne 0x41ac5f
xor edx, edx
mov eax, esi
call sym.NLSAgtConfig.exe__Hash_THash_Protect_qqro
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b328
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jle 0x41b340
push eax
mov ax, word [eax + 0x14]
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b331
pop edx
mov word [edx + 0x14], ax
ret

Function at 0x41b36c
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jle 0x41b394
push eax
mov eax, dword [eax + 0x14]
test ecx, 1
je 0x41b380
xor ax, word [edx]
inc edx
shr ecx, 1
jecxz 0x41b390
rol eax, 5
xor ax, word [edx]
add edx, 2
dec ecx
jne 0x41b384
pop edx
mov dword [edx + 0x14], eax
ret

Function at 0x41b3f0
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41b41f
and ecx, ecx
jle 0x41b41f
push eax
mov ax, word [eax + 0x14]
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41b420]
mov bl, ah
shl ax, 8
mov al, byte [edx]
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x41b408
pop edi
pop ebx
pop edx
mov word [edx + 0x14], ax
ret

Function at 0x41cb98
Capabilities:
Enumerate gui resources

Disassembly:
add bl, al
jmp 0x450510
push cs
or al, 0x54
push eax
jb 0x41cc0d
arpl word [ebp + 0x73], sp
jae 0x41cbec
outsb dx, byte [esi]
outsw dx, word [esi]
sbb al, 0
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
in al, 0xd2
inc esp
add byte [eax], al
add byte [eax], al
add ah, ah
rol byte [eax + eax + 4], cl
add byte [eax], al
add ah, ah
rol byte [eax + eax + 0x10], cl
add byte [eax], al
add byte [eax + 0x41cbcc90], dl
invalid
Function at 0x41cefc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
xor eax, eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x41d0b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x108]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push 0xff
lea eax, [ebp - 0x208]
push eax
push ebx
call sub.USER32.DLL_GetClassNameA
push 0
push ebx
call sub.USER32.DLL_GetWindowThreadProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20c]
call fcn.0043dd18
mov edx, dword [ebp - 0x20c]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_ThreadIdList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call sym.NLSAgtConfig.exe__Processviewer_GetFileNameFromHandle_qqrui
mov edx, dword [ebp - 4]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_DateiList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x210]
call fcn.0043dd18
mov edx, dword [ebp - 0x210]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_HandleList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x41cfde
mov edx, 0x41d0d0
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_VisibleList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x41cfed
mov edx, 0x41d0dc
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_VisibleList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x208]
mov ecx, 0x100
call fcn.00450d14
mov edx, dword [ebp - 0x214]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_ClassList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x108]
mov ecx, 0x100
call fcn.00450d14
mov edx, dword [ebp - 0x218]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_CaptionList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_HandleList]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x21c]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_HandleList]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x21c]
call fcn.0043dd88
push eax
call sub.USER32.DLL_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x220]
call fcn.0043dd18
mov edx, dword [ebp - 0x220]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_PIDList]
mov ecx, dword [eax]
call dword [ecx + 0x38]
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d0bd
lea eax, [ebp - 0x220]
mov edx, 6
call fcn.00450ad0
lea eax, [ebp - 4]
call fcn.00450aac
ret
Function at 0x41d0e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x41d157
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov ebx, 0x1389
mov eax, dword [0x4d2440]
mov eax, dword [eax]
call fcn.00478f68
dec ebx
jne 0x41d10e
call sym.NLSAgtConfig.exe__Processviewer_GetProcessList_qqrv
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 4]
call fcn.0043dd18
mov edx, dword [ebp - 4]
mov eax, dword [sym.NLSAgtConfig.exe__Processviewer_PIDList]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d15e
lea eax, [ebp - 4]
call fcn.00450aac
ret

Function at 0x41d420
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x4bd804
push ebx
push esi
push edi
call fcn.004a6de4
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004b11fc
inc dword [ebp - 8]
xor edi, edi
mov word [ebp - 0x14], 8
push 1
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x41d487
call sub.KERNEL32.DLL_GetLastError
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004b12d8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41d556
mov ecx, dword [ebp + 0xc]
push ecx
cmp dword [ebp + 8], 0
je 0x41d496
mov eax, dword [ebp + 8]
jmp 0x41d49b
mov eax, 0x4bd7f0
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
test esi, esi
jne 0x41d4ce
call sub.KERNEL32.DLL_GetLastError
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004b12d8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41d556
mov ecx, dword [ebp + 0xc]
sub ecx, 4
je 0x41d512
sub ecx, 0xc
je 0x41d4e2
sub ecx, 0x10
je 0x41d4f9
jmp 0x41d52c
push 0
push 0
push esi
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x41d52c
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
jmp 0x41d52c
lea eax, [ebp - 0x40]
push eax
push 1
push esi
call sub.ADVAPI32.DLL_ControlService
test eax, eax
jne 0x41d52c
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
jmp 0x41d52c
lea eax, [ebp - 0x40]
push eax
push esi
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x41d529
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
jmp 0x41d52c
mov edi, dword [ebp - 0x3c]
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, edi
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004b12d8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d5c4
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe60
mov eax, 0x4bd84c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.004a6de4
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
xor ecx, ecx
mov dword [ebp - 0x34], ecx
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x1a0]
push ecx
push 0x168
push eax
push 3
push 0x30
mov edx, dword [ebp - 0x38]
push edx
call sub.ADVAPI32.DLL_EnumServicesStatusA
xor esi, esi
lea ebx, [ebp - 0x1a0]
jmp 0x41d659
mov word [ebp - 0x18], 8
lea eax, [ebp - 4]
mov edx, dword [ebx]
call fcn.004b11c4
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b12d8
inc esi
add ebx, 0x24
cmp esi, dword [ebp - 0x30]
jl 0x41d629
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xea
jne 0x41d670
cmp dword [ebp - 0x34], 0
jne 0x41d5fa
mov ecx, dword [ebp - 0x38]
push ecx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fa28
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x41fa46
and ecx, ecx
jle 0x41fa46
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x41fa31
pop ebx
ret

Function at 0x41fa8c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41fab1
and ecx, ecx
jle 0x41fab1
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41fab3]
mov bl, byte [edx]
xor bl, al
shr ax, 8
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x41fa9f
pop edi
pop ebx
ret

Function at 0x41fcb4
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41fcd7
and ecx, ecx
jle 0x41fcd7
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41fcdd]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x41fcc7
pop edi
pop ebx
ret
Function at 0x422b8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov dword [esp], eax
mov ebx, 0x4bd930
mov eax, dword [esp]
mov esi, dword [eax + 0x38]
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
mov dword [esp + 8], ecx
test byte [esp + 8], 3
jne 0x422bc0
mov ecx, dword [esp]
mov esi, dword [ecx + 0x38]
mov ecx, dword [esi]
add ecx, edx
mov edi, ecx
and edi, 0xff
xor eax, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor eax, dword [ebx + ecx*4 + 0xc00]
mov ecx, dword [esi + 4]
add ecx, eax
mov edi, ecx
and edi, 0xff
xor edx, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor edx, dword [ebx + ecx*4 + 0xc00]
add esi, 8
inc dword [esp + 8]
cmp dword [esp + 8], 0xc
jne 0x422bb3
mov ecx, dword [esp]
mov ecx, dword [ecx + 0x38]
lea esi, [ecx + 0x18]
mov dword [esp + 8], 4
mov ecx, dword [esi + 4]
add ecx, edx
mov edi, ecx
and edi, 0xff
xor eax, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor eax, dword [ebx + ecx*4 + 0xc00]
mov ecx, dword [esi]
add ecx, eax
mov edi, ecx
and edi, 0xff
xor edx, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor edx, dword [ebx + ecx*4 + 0xc00]
sub esi, 8
dec dword [esp + 8]
jne 0x422c5e
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x422cf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov dword [esp], eax
mov ebx, 0x4bd930
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [esp]
mov esi, dword [ecx + 0x38]
mov dword [esp + 8], 4
mov ecx, dword [esi]
add ecx, edx
mov edi, ecx
and edi, 0xff
xor eax, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor eax, dword [ebx + ecx*4 + 0xc00]
mov ecx, dword [esi + 4]
add ecx, eax
mov edi, ecx
and edi, 0xff
xor edx, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor edx, dword [ebx + ecx*4 + 0xc00]
add esi, 8
dec dword [esp + 8]
jne 0x422d21
xor ecx, ecx
mov dword [esp + 8], ecx
test byte [esp + 8], 3
jne 0x422dbf
mov ecx, dword [esp]
mov ecx, dword [ecx + 0x38]
lea esi, [ecx + 0x18]
mov ecx, dword [esi + 4]
add ecx, edx
mov edi, ecx
and edi, 0xff
xor eax, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor eax, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor eax, dword [ebx + ecx*4 + 0xc00]
mov ecx, dword [esi]
add ecx, eax
mov edi, ecx
and edi, 0xff
xor edx, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x400]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor edx, dword [ebx + edi*4 + 0x800]
shr ecx, 0x18
xor edx, dword [ebx + ecx*4 + 0xc00]
sub esi, 8
inc dword [esp + 8]
cmp dword [esp + 8], 0xc
jne 0x422daf
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x422ed8
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov esi, dword [eax + 0x38]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
xchg bh, bl
xchg dh, dl
rol ebx, 0x10
rol edx, 0x10
xchg bh, bl
xchg dh, dl
xor ebx, dword [esi + 0x1000]
xor edi, edi
mov eax, ebx
shr ebx, 0x10
movzx ecx, bh
mov ebp, dword [esi + ecx*4]
movzx ecx, bl
add ebp, dword [esi + ecx*4 + 0x400]
movzx ecx, ah
xor ebp, dword [esi + ecx*4 + 0x800]
movzx ecx, al
add ebp, dword [esi + ecx*4 + 0xc00]
xor edx, dword [esi + edi*4 + 0x1004]
xor ebp, edx
mov edx, eax
mov ebx, ebp
inc edi
test edi, 0x10
je 0x422efb
pop eax
xor edx, dword [esi + 0x1044]
xchg bh, bl
xchg dh, dl
rol ebx, 0x10
rol edx, 0x10
xchg bh, bl
xchg dh, dl
mov dword [eax], edx
mov dword [eax + 4], ebx
pop ebp
pop ebx
pop esi
pop edi
ret