joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d1ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c4
mov eax, dword [0x10276bc4]
xor eax, esp
mov dword [esp + 0x1c0], eax
cmp byte [0x1027dcd8], 0
push ebx
mov ebx, dword [esp + 0x1cc]
mov dword [esp + 0x10], ebx
jne 0x100d1bd9
call fcn.100f07e0
test eax, eax
je 0x100d1bf1
mov byte [0x1027dcd8], 1
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.101dee0e
add esp, 0x1c4
ret
mov eax, dword [ebx + 0x9cc]
test eax, eax
je 0x100d1c12
push 0x400
push eax
call fcn.100f1490
add esp, 8
call fcn.100f07e0
test eax, eax
jne 0x100d1bd9
push ebp
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [esp + 0x18], 4
lea eax, [esp + 0x90]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
nop dword [eax]
lea eax, [esp + 0x40]
push eax
call fcn.100c4e90
push 1
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x28], xmm0
call fcn.100bff10
lea eax, [esp + 0x58]
push eax
call fcn.100c4e90
mov esi, dword [eax + 8]
lea eax, [esp + 0x6c]
push eax
call fcn.100c4e90
add esp, 0x10
lea ebp, [ebx + 1]
mov ecx, eax
mov eax, esi
cdq
push 0
add eax, dword [ecx]
push ebp
adc edx, dword [ecx + 4]
push edx
push eax
call fcn.101e02f0
movups xmm1, xmmword [esp + 0x30]
mov esi, dword [esp + 0x10]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.101e02f0
xor edi, eax
xor ebx, edx
lea eax, [esp + 0x70]
mov dword [esp + 0x20], edi
push eax
mov dword [esp + 0x28], ebx
call fcn.100c4e90
lea esi, [eax + 8]
lea eax, [esp + 0x84]
push eax
call fcn.100c4e90
mov edx, dword [esp + 0x18]
add esp, 8
mov ebx, ebp
mov dword [esp + 0x10], ebx
mov ecx, dword [eax]
add ecx, dword [esi]
lea eax, [edx + 2]
imul edx, dword [esp + 0x28]
imul ecx, eax
mov eax, dword [esp + 0x14]
shl ecx, 0x10
xor ecx, edx
mov dword [esp + 0x28], ecx
movups xmm0, xmmword [esp + 0x20]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
jne 0x100d1c40
movsd xmm0, qword [0x101f60d0]
lea eax, [esp + 0x90]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.100f0630
add esp, 0x10
call fcn.100f07e0
test eax, eax
je 0x100d1c20
lea eax, [esp + 0xd0]
mov byte [esp + 0xd0], 0
push 0x100
push eax
call fcn.100f12d0
add esp, 8
cmp byte [esp + 0xd0], 0
pop edi
pop esi
pop ebp
je 0x100d1da2
lea eax, [esp + 0xc4]
push 0x400
push eax
call fcn.100f1490
add esp, 8
call fcn.100f07e0
test eax, eax
jne 0x100d1bd9
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [esp + 0x14]
call fcn.100bcc60
add esp, 8
call fcn.100f07e0
mov ecx, dword [esp + 0x1c4]
neg eax
pop ebx
sbb eax, eax
xor ecx, esp
and eax, 0xffffffdd
add eax, 0x23
call fcn.101dee0e
add esp, 0x1c4
ret
Function at 0x100d6620
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1004
call fcn.101e01e0
mov eax, dword [0x10276bc4]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x100d6689
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x100d6689
lea eax, [esp]
push eax
call dword [0x102730f8]
add esp, 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.101dee0e
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1000]
xor eax, eax
xor ecx, esp
call fcn.101dee0e
add esp, 0x1004
ret
Function at 0x100fa990
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.101e01e0
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x100fa9d8
sub eax, 2
je 0x100fa9d8
sub eax, 0x15
je 0x100fa9d8
push 0x293
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.100f3bc0
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call fcn.100fa7b0
cmp eax, 1
jne 0x100fa9d0
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push ebp
push edi
xorps xmm0, xmm0
mov dword [esp + 0x10], ecx
xor edi, edi
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
test esi, esi
jne 0x100faa19
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x100faa27
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x100faa7f
cmp esi, 8
je 0x100faac6
mov ecx, dword [esp + 0x10]
test ecx, 0x400
je 0x100faa8e
push ebp
lea eax, [esp + 0x14]
and ecx, 0xfffffbff
push eax
push dword [esp + 0x40]
or ecx, 4
mov edi, esi
push dword [esp + 0x40]
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x100faa45
mov ebx, 1
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2d4
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.100f3bc0
test edi, edi
cmovne esi, edi
push esi
call fcn.100faed0
push eax
push 1
call fcn.100f3200
add esp, 0x20
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2c5
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.100f3bc0
add esp, 0x14
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x10149a90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101e01e0
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x10149ad4
cmp ecx, edx
jb 0x10149ad4
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x10149ac3
pop edi
jmp 0x10149ae1
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call fcn.10120630
add esp, 0x14
pop esi
test eax, eax
je 0x10149b0b
cmp dword [esp], 0x10
jne 0x10149b0b
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x10149c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x10149cc3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x10149cc3
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0xc]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x10149c93
push esi
mov esi, ebp
lea ecx, [ebx + 0x10]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x10149c80
mov eax, dword [ebx + 0xc]
pop esi
cmp edx, eax
jbe 0x10149cc1
sub edx, eax
cmp edx, 0x10
jbe 0x10149ca5
mov edx, 0x10
jmp 0x10149ca9
test edx, edx
je 0x10149cc1
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x10149cb0
pop edi
pop ebx
pop ebp
ret
Function at 0x1014fa20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.101e01e0
mov eax, dword [0x10276bc4]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x1014fa8d
cmp edi, eax
je 0x1014fa81
test ebp, ebp
je 0x1014fb00
test ebx, ebx
js 0x1014fb00
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x1014fa93
test eax, eax
je 0x1014fb00
mov edi, eax
push edi
call fcn.100c5040
add esp, 4
test al, 2
jne 0x1014fb00
test ebp, ebp
je 0x1014fc0b
push edi
mov dword [esp + 0x14], 1
call fcn.100e45d0
add esp, 4
cmp eax, 0x90
jg 0x1014fb00
cmp eax, ebx
jge 0x1014fb1b
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.100eaed0
add esp, 0xc
test eax, eax
je 0x1014fb00
push ebx
push ebp
push dword [esi + 4]
call fcn.100eb080
add esp, 0xc
test eax, eax
je 0x1014fb00
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.100eae30
add esp, 0xc
test eax, eax
jne 0x1014fb37
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101dee0e
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x1014fb00
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x1014fb5a
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x1014fb60
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.100eaed0
add esp, 0xc
test eax, eax
je 0x1014fc18
push edi
call fcn.100e45d0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.100eb080
add esp, 0x10
test eax, eax
je 0x1014fc18
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x1014fbb0
push ebp
push edi
push dword [esi + 0xc]
call fcn.100eaed0
add esp, 0xc
test eax, eax
je 0x1014fc18
push edi
call fcn.100e45d0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.100eb080
add esp, 0x10
test eax, eax
je 0x1014fc18
push dword [esi + 8]
push dword [esi + 4]
call fcn.100eb210
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x1014fc1a
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x1014fbef
jmp 0x1014fb5e
xor ebp, ebp
test ebx, ebx
je 0x1014fc30
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.10001320
add esp, 8
mov eax, ebp
jmp 0x1014fb02

Function at 0x1018c1f0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x1018c204
mov dword [esp + 0x18], fcn.1018a9d0
jmp fcn.10183f20
mov dword [esp + 0x18], fcn.10189c70
jmp fcn.10183c20
Function at 0x101d0d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.101e01e0
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x101d0d9a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x101d0d9e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.100e8990
push eax
call fcn.100e45e0
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x101d0da7
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x101d0d52
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x101d0e23
mov edx, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr edx, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, esi
lea edi, [edi - 1]
sub eax, ebp
mov ecx, ebp
shr ecx, 0x1f
inc ebp
shr eax, 0x1f
xor al, cl
xor cl, dl
or al, cl
movzx ecx, byte [esp + 0x2c]
dec al
movzx edx, al
movzx eax, byte [edi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x10]
jb 0x101d0de5
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [esp + 0x2c], ecx
not ecx
pop ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret
Function at 0x101dedb8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.101ded94
pop esi
leave
ret 8
Function at 0x40657c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065a0
xor eax, eax
test eax, eax
je 0x4065b3
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065b3
xor ecx, ecx
jmp 0x4065b6
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401050
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x24]
push 8
pop ecx
mov esi, edx
mov dword [ebp - 0x30], ebx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, esi
mov al, byte [ebp + ecx - 0x24]
add al, 0x11
add al, cl
not al
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jb 0x401076
lea eax, [ebp - 0x24]
sub eax, ebx
lea edx, [ebx + 2]
mov dword [ebp - 0x34], eax
mov ecx, edx
lea eax, [ebp - 0x23]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
sub eax, ebx
push 8
pop edi
mov ebx, eax
mov al, byte [ebp + esi*4 - 0x24]
mov byte [ecx - 2], al
mov al, byte [ebp + esi*4 - 0x23]
inc esi
mov byte [ecx - 1], al
mov al, byte [edx + ecx]
mov byte [ecx], al
mov al, byte [ebx + ecx]
lea ecx, [ecx + 4]
mov byte [ecx - 3], al
cmp esi, edi
jb 0x4010a7
mov ebx, dword [ebp - 0x30]
lea eax, [ebx + 1]
lea ecx, [ebx + 3]
sub ebx, eax
mov dword [ebp - 0x3c], ebx
lea edx, [ecx + 0x20]
mov ebx, ecx
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x38]
lea esi, [eax + 0x1c]
sub ebx, eax
mov dword [ebp - 0x2c], edx
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x30]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sub eax, edx
sub ebx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov cl, byte [esi]
mov byte [ebp - 0x25], cl
mov ch, byte [eax + esi]
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + esi]
mov byte [ebp - 0x26], al
mov al, byte [ebx + esi]
mov ebx, dword [ebp - 0x30]
mov byte [ebp - 0x27], al
mov eax, edi
and eax, 7
mov dword [ebp - 0x40], eax
jne 0x401172
movzx eax, byte [ebp - 0x25]
mov cl, ch
mov ch, byte [eax + 0x4274f0]
movzx eax, byte [ebp - 0x26]
mov ah, byte [eax + 0x4274f0]
mov byte [ebp - 0x25], ah
movzx eax, byte [ebp - 0x27]
mov al, byte [eax + 0x4274f0]
mov byte [ebp - 0x26], al
movzx eax, cl
mov cl, byte [ebp - 0x25]
mov al, byte [eax + 0x4274f0]
mov byte [ebp - 0x27], al
mov eax, edi
shr eax, 3
xor ch, byte [eax + 0x4276f0]
mov eax, dword [ebp - 0x40]
cmp eax, 4
jne 0x4011a6
movzx eax, ch
mov ch, byte [eax + 0x4274f0]
movzx eax, cl
mov al, byte [eax + 0x4274f0]
mov byte [ebp - 0x25], al
movzx eax, byte [ebp - 0x26]
mov al, byte [eax + 0x4274f0]
mov byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x27]
mov al, byte [eax + 0x4274f0]
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x44]
mov al, byte [eax + edx]
xor al, ch
mov ecx, dword [ebp - 0x34]
mov byte [ebx + ecx], al
mov al, byte [esi - 0x1c]
xor al, byte [ebp - 0x25]
mov byte [esi + 4], al
add esi, 4
mov al, byte [edx]
xor al, byte [ebp - 0x26]
mov byte [edx + 0x20], al
mov eax, dword [ebp - 0x48]
mov al, byte [eax + edx]
add edx, 4
xor al, byte [ebp - 0x27]
inc edi
mov byte [ecx], al
add ecx, 4
mov dword [ebp - 0x34], ecx
cmp edi, 0x3c
jb 0x401105
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x4011f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
movzx ecx, cl
shl ecx, 4
add ecx, dword [ebp + 8]
push 4
pop edi
push 4
pop esi
mov al, byte [ecx]
xor byte [edx], al
inc ecx
inc edx
sub esi, 1
jne 0x40120b
sub edi, 1
jne 0x401208
pop edi
pop esi
pop ebp
ret

Function at 0x40121f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
lea esi, [ecx + 2]
pop edi
mov dh, byte [esi - 2]
mov dl, byte [esi - 1]
mov cl, dh
mov al, byte [esi + 1]
xor cl, dl
mov ch, byte [esi]
mov bl, al
mov byte [ebp - 1], al
xor bl, ch
mov al, cl
mov bh, bl
shr al, 7
add cl, cl
movzx eax, al
xor bh, dh
imul eax, eax, 0x1b
xor bh, dl
xor al, cl
mov cl, dl
xor al, dh
xor cl, ch
xor al, bh
mov byte [esi - 2], al
mov al, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor al, cl
mov cl, byte [ebp - 1]
xor al, dl
xor cl, dh
xor al, bh
mov byte [esi - 1], al
mov al, bl
shr al, 7
add bl, bl
movzx eax, al
imul eax, eax, 0x1b
xor al, bl
xor al, ch
xor al, bh
mov byte [esi], al
mov al, cl
shr al, 7
lea esi, [esi + 4]
movzx eax, al
add cl, cl
imul eax, eax, 0x1b
xor al, cl
xor al, byte [ebp - 1]
xor al, bh
mov byte [esi - 3], al
sub edi, 1
jne 0x40122c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401626
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [ebp - 4], edi
lea eax, [edi + 0xf0]
mov dword [ebp - 8], eax
mov edx, eax
test ebx, ebx
je 0x401675
dec ebx
shr ebx, 4
inc ebx
push 0x10
mov ecx, esi
sub edx, esi
pop edi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x401653
mov edx, dword [ebp - 4]
mov ecx, esi
call fcn.004014b6
mov edx, esi
add esi, 0x10
sub ebx, 1
jne 0x40164c
mov eax, dword [ebp - 8]
mov esi, edx
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401684
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, edx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x4016ef
lea eax, [ecx + 0xf0]
mov dword [ebp - 8], eax
sub eax, ebx
mov dword [ebp + 8], eax
lea eax, [edx - 1]
shr eax, 4
inc eax
push esi
mov dword [ebp - 4], eax
push edi
mov esi, ebx
lea edi, [ebp - 0x1c]
mov edx, ecx
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00401574
mov ecx, dword [ebp + 8]
push 0x10
pop edx
mov al, byte [ecx + ebx]
xor byte [ebx], al
inc ebx
sub edx, 1
jne 0x4016c9
mov edi, dword [ebp - 8]
lea esi, [ebp - 0x1c]
sub ecx, 0x10
sub dword [ebp - 4], 1
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x4016b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4028b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfd8
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xfd8], 0
lea eax, [ebp - 0xfd4]
push ebx
push esi
push 0xfd0
push 0
push eax
mov esi, edx
mov ebx, ecx
call fcn.00406f80
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xfd4]
pop ecx
pop ecx
push eax
sub esp, 0xc
mov ecx, esi
call fcn.004019f0
add esp, 0x14
test eax, eax
jns 0x40290d
or eax, 0xffffffff
jmp 0x40295d
lea esi, [ebp - 0xfd4]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x402916
push edi
sub esi, ecx
xor edi, edi
push 0
lea eax, [ebp - 0xfd8]
push eax
mov eax, esi
sub eax, edi
push eax
lea eax, [ebp - 0xfd4]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402953
add edi, dword [ebp - 0xfd8]
cmp edi, esi
jl 0x402922
xor eax, eax
inc eax
jmp 0x40295c
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x40296d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xfd8], 0
lea eax, [ebp - 0xfd4]
push ebx
push esi
push 0xfd0
mov ebx, ecx
mov dword [ebp - 0xfe0], edx
push 0
push eax
mov dword [ebp - 0xfdc], ebx
call fcn.00406f80
add esp, 0xc
xor esi, esi
push 0
lea eax, [ebp - 0xfd8]
push eax
mov eax, 0xfd0
sub eax, esi
push eax
lea eax, [ebp - 0xfd4]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test ebx, ebx
jne 0x4029e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4029f5
add esi, dword [ebp - 0xfd8]
test ebx, ebx
jne 0x402a00
mov ebx, dword [ebp - 0xfdc]
jmp 0x4029af
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
jmp 0x402a30
push dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0xfd4]
push dword [ebp - 0xfe0]
push 0x57d20
push str.dbe113959660426ee70c233aedd166c8
push str.44e061a68ee8a76229d51517437988e92b79d45056204038beda458f5e2a827a
call fcn.0040187d
or ecx, 0xffffffff
add esp, 0x14
test eax, eax
cmovs eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret

Function at 0x403276
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x4032ca
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push 1
push 2
push 0x10
push 4
push 0x535eb8
mov ebx, 0x5357b8
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x4032de
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push 0xf01ff
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 8], 0x5355b8
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test ebx, ebx
je 0x403311
push ebx
call edi
push esi
call edi
xor eax, eax
inc eax
jmp 0x4032cd