joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d416c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xaf
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0xfd6584]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d416f0
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 5
jl 0x1d416cf
mov byte [esi + 5], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42266
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0xd
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x34bc4519]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42290
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d4226f
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d422a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x20
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x4ee7fe63]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d422cb
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d422aa
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d422dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xa5
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x350d6373]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42308
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x11
jl 0x1d422e7
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42319
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x18
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x76b6bf98]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42343
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 9
jl 0x1d42322
mov byte [esi + 9], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42354
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xeb
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x4f189b8d]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42380
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 9
jl 0x1d4235f
mov byte [esi + 9], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42391
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xdd
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x3b903a6f]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d423bd
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 9
jl 0x1d4239c
mov byte [esi + 9], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d4245a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0xc0000000
push str..DokeeDriver
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, 0x47b
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR100.dll_malloc]
push esi
mov edi, eax
push 0x1d88560
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 8]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 0x11e
jb 0x1d424a1
push 3
push ebx
push 0x22
push 3
call fcn.01d423ce
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push ebx
lea ecx, [ebp - 0x10]
push ecx
push 4
lea ecx, [ebp - 4]
push ecx
push esi
push edi
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 4], esi
jne 0x1d424e5
mov dword [ebp - 0xc], 1
push edi
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1d425ef
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push esi
push edi
push 0x1d6e0a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x6f714d05
lea ecx, [ebp - 0x2b]
mov ebx, eax
call fcn.01d42f0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
call esi
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x2d00f11c
lea ecx, [ebp - 0x5d]
stosb byte es:[edi], al
call fcn.01d42f45
push eax
push ebx
call esi
mov dword [ebp - 8], eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x5d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, 0x1d6e0dc
sub eax, 0xcf0699f
push eax
lea ecx, [ebp - 0x40]
call fcn.01d42f80
push eax
push ebx
call esi
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x5a16f228
lea ecx, [ebp - 0x1a3]
call fcn.01d42fbb
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x18], eax
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 0xc]
push 0x41e65d44
lea ecx, [ebp - 0x6a]
call fcn.01d42ff6
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
mov ebx, reloc.WS2_32.dll_bind
push ebx
call edi
mov eax, 0x1d6e158
sub eax, 0x6fa65f67
push eax
lea ecx, [ebp - 0x65]
call fcn.01d43031
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
push ebx
call edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x1d4291c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push 0x4567d259
lea ecx, [ebp - 0x10]
call fcn.01d22672
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d42935
push ebx
push esi
push edi
sub eax, edx
push 0x4567d265
lea ecx, [ebp - 0x29]
mov esi, eax
call fcn.01d22672
push 0x53a9e349
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.01d4311f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push edi
xor esi, esi
inc esi
push esi
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
setne al
test al, al
je 0x1d42984
or eax, 0xffffffff
jmp 0x1d42ac4
mov eax, str.M2.0
sub eax, 0xadfa1ae
push eax
lea ecx, [ebp - 0x1d]
mov dword [ebp - 4], esi
call fcn.01d4315c
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
setne al
test al, al
je 0x1d429bb
push 0xfffffffffffffffe
pop eax
jmp 0x1d42ac4
push 0x862a037
lea ecx, [ebp - 9]
call fcn.01d43197
lea edx, [ebp - 0x82c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d429d0
mov eax, dword [ebp + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d429df
lea edi, [ebp - 0x82c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1d429ef
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x82c]
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d42a10
sub eax, esi
mov esi, eax
mov eax, 0x1d6e268
sub eax, 0x56a13dbd
push eax
lea ecx, [ebp - 0xe]
call fcn.01d431d4
push esi
lea ecx, [ebp - 0x82c]
push ecx
xor edi, edi
inc edi
push edi
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
setne al
test al, al
je 0x1d42a52
push 0xfffffffffffffffd
jmp 0x1d429b5
mov eax, str.tHX_
sub eax, 0xbf09248
push eax
lea ecx, [ebp - 0xa]
mov dword [ebp - 4], 3
call fcn.01d43211
push 4
pop esi
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
setne al
test al, al
je 0x1d42a8d
push 0xfffffffffffffffc
jmp 0x1d429b5
mov eax, 0x1d6e27c
sub eax, 0x1ad8ef07
push eax
lea ecx, [ebp - 9]
mov dword [ebp - 4], edi
call fcn.01d4324c
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
setne al
xor ecx, ecx
test al, al
sete cl
lea eax, [ecx - 1]
and eax, 0xfffffffa
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1d42da6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x43
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x783e4923]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42dd0
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x15
jl 0x1d42daf
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d42de1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x82
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x46ad40fe]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42e0d
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 9
jl 0x1d42dec
mov byte [esi + 9], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42e1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0xc
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x223238f3]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42e48
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xc
jl 0x1d42e27
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42e59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 9
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x1ccbea5a]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42e83
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x1c
jl 0x1d42e62
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42e94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x42
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x4cf933d7]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42ebe
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x14
jl 0x1d42e9d
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42ecf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x38
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0xe33be5e]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42ef9
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x36
jl 0x1d42ed8
mov byte [esi + 0x36], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42f0a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x2b
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x6d9a6c59]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42f34
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xe
jl 0x1d42f13
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42f45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x1b
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x2b2a1060]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42f6f
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x1c
jl 0x1d42f4e
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d42f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x56
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0xcf0699f]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42faa
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x14
jl 0x1d42f89
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42fbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0xc
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x58401134]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d42fe5
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x36
jl 0x1d42fc4
mov byte [esi + 0x36], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d42ff6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x7c
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x400f7c18]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d43020
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x29
jl 0x1d42fff
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d43031
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x4a
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x6fa65f67]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d4305b
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x24
jl 0x1d4303a
mov byte [esi + 0x24], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d4306c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x2c
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x5f4f595e]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d43096
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 6
jl 0x1d43075
mov byte [esi + 6], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d430a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x1b
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x44cd98b6]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d430d1
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x1a
jl 0x1d430b0
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d430e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc9
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x3e7e44af]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d4310e
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xe
jl 0x1d430ed
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d4311f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xf6
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x51d30105]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d4314b
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xb
jl 0x1d4312a
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d4315c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x3e
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0xadfa1ae]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d43186
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xc
jl 0x1d43165
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d43197
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xa6
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x68bbdd7]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d431c3
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d431a2
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d431d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xa0
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x56a13dbd]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d43200
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 9
jl 0x1d431df
mov byte [esi + 9], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d43211
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x27
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0xbf09248]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d4323b
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 5
jl 0x1d4321a
mov byte [esi + 5], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d4324c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x57
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x1ad8ef07]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d43276
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d43255
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d43368
Capabilities:
Create service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x1d433e4
cmp dword [ebp + 0xc], edi
je 0x1d433e4
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1d433e4
mov esi, 0xf01ff
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x1d4342d
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x20]
push ecx
push 4
push eax
call esi
test eax, eax
je 0x1d43417
cmp dword [ebp - 0x1c], 1
je 0x1d43417
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1d433ec
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 4]
call esi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
xor ebx, ebx
lea eax, [ebp - 0x20]
push eax
push 4
push dword [ebp + 8]
call esi
test eax, eax
je 0x1d43417
cmp dword [ebp - 0x1c], 1
je 0x1d43417
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x1d433ee
or edi, 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x1d433e7
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 0xc]
push 1
push 1
push 1
push esi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, edi
jne 0x1d43450
or edi, 0xffffffff
jmp 0x1d43420
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x1d433e7
Function at 0x1d43462
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
mov byte [ebp - 1], 0
cmp dword [ebp + 8], esi
jne 0x1d4347c
or eax, 0xffffffff
jmp 0x1d43553
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01d43368
pop ecx
pop ecx
test eax, eax
js 0x1d43474
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1d43474
push ebx
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x1d434cd
or edi, 0xffffffff
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1d43551
mov ebx, dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x24]
push eax
push 4
push edi
call ebx
test eax, eax
je 0x1d434ed
cmp dword [ebp - 0x20], 4
jne 0x1d434ff
push edi
call esi
xor edi, edi
jmp 0x1d434c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1d434ff
push edi
call esi
jmp 0x1d434be
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x1d434fa
xor esi, esi
lea eax, [ebp - 0x24]
push eax
push 4
push edi
call ebx
test eax, eax
je 0x1d43523
cmp dword [ebp - 0x20], 4
je 0x1d43536
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x1d43510
jmp 0x1d4353a
mov byte [ebp - 1], 1
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 8]
call esi
xor eax, eax
cmp byte [ebp - 1], al
setne al
dec eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1d43556
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, esi
jne 0x1d43577
or eax, 0xffffffff
jmp 0x1d435cc
push edi
push 0xf01ff
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, esi
jne 0x1d43596
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1d435c8
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x20]
push eax
push 4
push edi
call esi
test eax, eax
je 0x1d4360b
cmp dword [ebp - 0x1c], 1
je 0x1d4360b
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call esi
test eax, eax
jne 0x1d435d0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
xor ebx, ebx
lea eax, [ebp - 0x20]
push eax
push 4
push edi
call esi
test eax, eax
je 0x1d4360b
cmp dword [ebp - 0x1c], 1
je 0x1d4360b
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x1d435d2
or ebx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 4]
call esi
mov eax, ebx
jmp 0x1d435cb
xor ebx, ebx
jmp 0x1d435f9
Function at 0x1d4367d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x1d43719
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1d43719
lea eax, [ebp + 0xc]
push eax
push 0x10008
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x1d4371e
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x1d43702
cmp esi, edi
jne 0x1d4370e
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 0xc]
call fcn.01d4367d
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x1d436bb
jmp 0x1d4370e
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1d4371e
mov esi, 0x3f2
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret