joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b160
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x48b178
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x48b171
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp dword [ebp + 8], 0
jne 0x48b213
test esi, esi
jle 0x48b1aa
mov ecx, 0x48b2bc
mov dl, 1
mov eax, dword [0x408754]
call fcn.0040d61c
call fcn.00404694
jmp 0x48b209
cmp word [ebx + 0x10242], 0
jne 0x48b1cc
mov ecx, 0x48b2bc
mov dl, 1
mov eax, dword [0x408754]
call fcn.0040d61c
call fcn.00404694
jmp 0x48b209
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0x10244]
call dword [ebx + 0x10240]
cmp byte [ebp - 9], 0
jne 0x48b208
mov ecx, 0x48b2bc
mov dl, 1
mov eax, dword [0x408754]
call fcn.0040d61c
call fcn.00404694
jmp 0x48b209
inc esi
cmp dword [ebp + 8], 0
je 0x48b18e
mov byte [ebx + 0x1006c], 0
mov eax, ebx
call fcn.0048affc
cmp dword [ebx + 0x10044], 0
jne 0x48b240
mov ecx, 0x48b2d4
mov dl, 1
mov eax, dword [0x48a87c]
call fcn.0040d61c
call fcn.00404694
mov ecx, 0x48b2ec
mov dl, 2
mov eax, ebx
call fcn.0048b4b0
mov word [ebx + 0x10040], 2
mov ax, word [ebx + 0x10038]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x10042], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x10040]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0x1022a], 0
je 0x48b2a6
mov edx, ebx
mov eax, dword [ebx + 0x1022c]
call dword [ebx + 0x10228]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x48b5a4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48b678
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xffff
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x10030], eax
cmp word [ebx + 0x10222], 0
je 0x48b662
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x48b68c
call fcn.0040a874
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x10030]
mov edx, ebx
mov eax, dword [ebx + 0x10224]
call dword [ebx + 0x10220]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b67f
lea eax, [ebp - 8]
call fcn.00404d40
ret
Function at 0x48b870
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x48b99d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10034]
mov edx, dword [ebp - 4]
call fcn.00404d94
mov dword [ebx + 0x10224], esi
mov dword [ebx + 0x10220], 0x48b7e0
mov edx, 0xfa0
mov eax, ebx
call fcn.0048ae8c
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.0048b160
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x48b905
mov eax, dword [0x4a3934]
mov eax, dword [eax]
call fcn.00459c94
cmp dword [ebx + 0xc], 0
jne 0x48b981
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x48b8f9
jmp 0x48b981
mov edx, dword [edi]
mov eax, ebx
call fcn.0048ae8c
inc dword [edi]
cmp dword [edi], 0xffff
jne 0x48b932
mov dword [edi], 0xfa0
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.0048b160
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x48b96f
mov eax, dword [0x4a3934]
mov eax, dword [eax]
call fcn.00459c94
cmp dword [ebx + 0xc], 0
jne 0x48b981
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x48b963
cmp dword [ebx + 0xc], 0
je 0x48b919
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b9a4
lea eax, [ebp - 4]
call fcn.00404d40
ret
Function at 0x495e34
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x495e40
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x499b14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
xor eax, eax
push ebp
push 0x499c55
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x499c64
mov eax, dword [0x4a4668]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x499c3f
push ebx
mov eax, dword [0x4a4668]
push eax
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x499c3f
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x499c3f
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, esi
call fcn.00402b2c
mov ebx, eax
mov edx, esi
test edx, edx
jl 0x499ba8
inc edx
xor eax, eax
mov ecx, dword [ebp - 8]
add ecx, eax
mov cl, byte [ecx]
lea edi, [eax + ebx]
mov byte [edi], cl
inc eax
dec edx
jne 0x499b98
mov edx, esi
test edx, edx
jl 0x499be6
inc edx
xor eax, eax
lea ecx, [eax + ebx]
mov cl, byte [ecx]
cmp cl, 1
jne 0x499bc3
lea ecx, [eax + ebx]
mov byte [ecx], 0xff
jmp 0x499be2
lea ecx, [eax + ebx]
mov cl, byte [ecx]
test cl, cl
jne 0x499bd4
lea ecx, [eax + ebx]
mov byte [ecx], 0
jmp 0x499be2
mov ecx, dword [ebp - 8]
add ecx, eax
movzx ecx, byte [ecx]
dec ecx
lea edi, [eax + ebx]
mov byte [edi], cl
inc eax
dec edx
jne 0x499bb1
mov eax, dword [ebp - 4]
call fcn.00405200
mov edx, eax
lea eax, [ebp - 0x158]
call fcn.00403344
mov edx, 1
lea eax, [ebp - 0x158]
call fcn.004037a8
call fcn.00402cb8
lea eax, [ebp - 0xc]
push eax
mov edx, ebx
mov ecx, esi
lea eax, [ebp - 0x158]
call fcn.004034a0
call fcn.00402cb8
lea eax, [ebp - 0x158]
call fcn.004034c0
call fcn.00402cb8
mov eax, ebx
call fcn.00402b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499c5c
lea eax, [ebp - 4]
call fcn.00404d40
ret
Function at 0x499c68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
lea eax, [ebp - 4]
call fcn.004057e0
xor eax, eax
push ebp
push 0x499dde
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404dd8
lea edx, [ebp - 8]
mov eax, dword [0x4a3614]
call fcn.0045e1d4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x499dec
call fcn.00406bac
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x499dfc
call fcn.00406bac
mov eax, dword [ebp - 0x18]
call fcn.00405200
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x18]
call fcn.00409f9c
mov eax, dword [ebp - 0x128]
call fcn.00405200
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x499e10
push dword [ebp - 4]
push 0x499e18
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405680
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.004055d4
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
call fcn.00405618
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004055fc
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499de5
lea eax, [ebp - 0x12c]
call fcn.00405488
lea eax, [ebp - 0x128]
call fcn.00404d40
lea eax, [ebp - 0x1c]
call fcn.00405488
lea eax, [ebp - 0x18]
call fcn.00404d40
lea eax, [ebp - 0x10]
call fcn.00406b68
lea eax, [ebp - 0xc]
call fcn.00406b68
lea eax, [ebp - 8]
call fcn.00406b68
lea eax, [ebp - 4]
call fcn.00405488
ret
Function at 0x49ba3c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x49bc3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22c]
mov edx, dword [0x4a3988]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00460a28
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x49bc50
call fcn.0040504c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403344
lea eax, [ebp - 0x1d0]
call fcn.004030e0
call fcn.00402cb8
mov edx, 0x49bc64
lea eax, [ebp - 0x1d0]
call fcn.0040541c
call fcn.0040399c
call fcn.00402cb8
push 0x49bc74
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402f64
push dword [ebp - 0x234]
push 0x49bc84
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.004050c0
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.0040541c
call fcn.0040399c
call fcn.00402cb8
push 0x49bc90
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402f64
push dword [ebp - 0x23c]
push 0x49bc84
push 0x49bca4
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004050c0
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.0040541c
call fcn.0040399c
call fcn.00402cb8
mov edx, 0x49bcbc
lea eax, [ebp - 0x1d0]
call fcn.0040541c
call fcn.0040399c
call fcn.00402cb8
lea eax, [ebp - 0x1d0]
call fcn.004034c0
call fcn.00402cb8
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00403664
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405200
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x49bc15
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bc42
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00404d64
lea eax, [ebp - 4]
call fcn.00404d40
ret
Function at 0x49d00c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49d140
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
mov edx, dword [0x4a36a0]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x110]
mov edx, 0x49d158
call fcn.0040514c
jne 0x49d09b
mov byte [ebp - 0x107], 0
push 0x49d168
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x109]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
jmp 0x49d11a
lea eax, [ebp - 0x114]
mov edx, dword [0x4a36a0]
mov edx, dword [edx]
call fcn.00404f38
mov edx, dword [ebp - 0x114]
mov eax, 0x49d1a0
call fcn.00405344
test eax, eax
jne 0x49d10c
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404fb0
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
mov ecx, 0x49d1a0
call fcn.0040504c
mov eax, dword [0x4a36a0]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
call fcn.00405200
mov esi, eax
push esi
call sub.kernel32.dll_lstrcatA
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
jmp 0x49d11a
mov eax, dword [0x4a36a0]
mov eax, dword [eax]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d147
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00404d64
lea eax, [ebp - 4]
call fcn.00404d40
ret
Function at 0x49d644
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403664
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.00403664
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x7a6aac
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x49d729
mov eax, dword [ebp - 0x60]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x49d706
cmp dword [ebp - 0x6c], 0x10000
je 0x49d71c
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0xc], eax
push 0x1c
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x49d6f4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
sub edx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49daf0
Capabilities:
Get session user name
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x49dc5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49dbf2
push 0xf01ff
mov eax, dword [0x4a356c]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x49dbe9
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
call fcn.0040939c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x49dbd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1c]
call fcn.00404f38
mov edx, 0x49dc78
mov eax, dword [ebp - 0x14]
call fcn.00409520
test eax, eax
jne 0x49dbc1
lea eax, [ebp - 0x14]
mov edx, 0x49dc8c
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dbe0
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.00402b5c
ret
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x49dc44
mov dword [ebp - 0x1c], pe_nt_image_headers32
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040538c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405200
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x10]
call fcn.00405200
call fcn.0040a128
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040538c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00409520
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dc66
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404d64
ret
Function at 0x4066be
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x1c]
mov esi, ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
mov dword [esi], eax
setne cl
mov al, cl
pop esi
pop ebp
ret 0x18

Function at 0x40925c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, 5
jae 0x409272
xor eax, eax
jmp 0x4093d8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov esi, ecx
sub esi, dword [edx]
cmp esi, 5
jbe 0x409288
lea esi, [ecx - 5]
mov dword [edx], esi
mov esi, dword [ebp + 0x14]
add eax, 0xfffffffb
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
jmp 0x409299
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov cl, byte [edi + eax]
cmp cl, 0xe8
je 0x4092b2
cmp cl, 0xe9
je 0x4092b2
inc edi
inc dword [ebp + 0xc]
jmp 0x4093cb
mov ebx, dword [ebp + 0xc]
mov ecx, edi
sub ecx, dword [edx]
mov dword [edx], ebx
add ecx, dword [ebp + 0x10]
cmp ecx, 5
jbe 0x4092c8
and dword [esi], 0
jmp 0x4092d8
test ecx, ecx
jbe 0x4092d8
mov edx, dword [esi]
and edx, 0x77
add edx, edx
dec ecx
jne 0x4092ce
mov dword [esi], edx
mov dl, byte [edi + eax + 4]
test dl, dl
je 0x4092e9
cmp dl, 0xff
jne 0x4093b4
mov ecx, dword [esi]
shr ecx, 1
mov ebx, ecx
and ebx, 7
cmp dword [ebx*4 + 0x428778], 0
mov dword [ebp + 0x14], ecx
je 0x4093b4
cmp ecx, 0x10
jae 0x4093b4
movzx ebx, byte [edi + eax + 3]
movzx edx, dl
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + eax + 2]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + eax + 1]
shl edx, 8
or edx, ebx
cmp dword [ebp + 0x1c], 0
je 0x40933c
mov ebx, dword [ebp + 0xc]
lea ebx, [ebx + edx + 5]
jmp 0x409346
sub edx, edi
sub edx, dword [ebp + 0x10]
sub edx, 5
mov ebx, edx
cmp dword [esi], 0
je 0x409382
movzx eax, byte [ecx + 0x428798]
push 3
pop ecx
sub ecx, eax
shl ecx, 3
mov edx, ebx
shr edx, cl
test dl, dl
je 0x409367
cmp dl, 0xff
jne 0x40937f
push 4
xor edx, edx
pop ecx
sub ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 3
inc edx
shl edx, cl
mov ecx, dword [ebp + 0x14]
dec edx
xor edx, ebx
jmp 0x40932d
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], 5
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + eax + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + eax + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + eax + 2], cl
mov byte [edi + eax + 1], bl
add edi, 5
and dword [esi], 0
jmp 0x4093cb
or dword [esi], 1
mov ecx, dword [esi]
inc edi
inc dword [ebp + 0xc]
test dl, dl
je 0x4093c6
cmp dl, 0xff
jne 0x4093cb
or ecx, 0x10
mov dword [esi], ecx
cmp edi, dword [ebp - 4]
jbe 0x409296
pop esi
mov eax, edi
pop ebx
pop edi
leave
ret 0x18

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [ecx]
mov edx, dword [esp + 4]
jbe 0x409ebb
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x433028]
dec dword [esp + 0x10]
inc edx
cmp dword [esp + 0x10], 0
ja 0x409e9b
pop edi
pop esi
mov dword [ecx], eax
ret 8