joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438888
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00499d70
xor eax, eax
push ebp
push 0x438923
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 0xf
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43892a
lea eax, [ebp - 8]
call fcn.0049993c
ret

Function at 0x438934
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00499d70
xor eax, eax
push ebp
push 0x4389cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 1
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4389d6
lea eax, [ebp - 8]
call fcn.0049993c
ret
Function at 0x4389e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00499d70
xor eax, eax
push ebp
push 0x438a8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov eax, dword [ebp - 0xc]
cmp eax, 0xffff
jbe 0x438a3d
call fcn.00498c20
push eax
push 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438a93
lea eax, [ebp - 8]
call fcn.0049993c
ret

Function at 0x438a9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00499d70
xor eax, eax
push ebp
push 0x438b5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc word [eax + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x30]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
push 0xc
push 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call sym.mjrwsvc.exe__Dnsquery_ReverseIP_qqrx17System_AnsiString
lea eax, [ebp - 0x10]
mov edx, 0x438b74
call fcn.00499bc4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x3e]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234], eax
mov eax, dword [ebp - 4]
add dword [eax + 0x234], 0xc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438b63
lea eax, [ebp - 0x10]
call fcn.0049993c
lea eax, [ebp - 8]
call fcn.0049993c
ret
Function at 0x43a590
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x43a599
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43a747
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Icslogger_TIcsLogger_Lock_qqrv
xor eax, eax
push ebp
push 0x43a725
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 8
je 0x43a5e5
call fcn.004994d8
jmp 0x43a72c
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 8
je 0x43a6ae
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x43a638
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x43a638
lea eax, [ebp - 0x14]
call sym.mjrwsvc.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x14]
push 0x43a760
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00499c7c
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x43a66f
lea eax, [ebp - 0x1c]
call sym.mjrwsvc.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x1c]
push 0x43a760
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00499c7c
mov eax, dword [ebp - 0x18]
call fcn.00499d80
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x43a70f
lea eax, [ebp - 0x24]
call sym.mjrwsvc.exe__Icslogger_IcsLoggerAddTimeStamp_qqrv
push dword [ebp - 0x24]
push 0x43a760
push dword [ebp + 8]
push 0x43a76c
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00499c7c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Icslogger_TIcsLogger_WriteToLogFile_qqrx17System_AnsiString
jmp 0x43a70f
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x43a6d4
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x43a6d4
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [ebp - 4]
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x43a6eb
mov eax, dword [ebp + 8]
call fcn.00499d80
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x43a70f
lea eax, [ebp - 0x28]
mov ecx, 0x43a76c
mov edx, dword [ebp + 8]
call fcn.00499c08
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Icslogger_TIcsLogger_WriteToLogFile_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a72c
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Icslogger_TIcsLogger_UnLock_qqrv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a74e
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.00499960
ret
Function at 0x43a9f0
Capabilities:
Link many functions at runtime

Disassembly:
pop es
adc eax, dword [ebp + 0x49]
arpl word [ebx + 0x4c], si
imul esp, dword [edx + 0x65], 0x78457961
arpl word [ebp + 0x70], sp
je 0x43aa6c
outsd dx, dword [esi]
outsb dx, byte [esi]
pushfd
stosb byte es:[edi], al
inc ebx
add byte [edi + edi*8], dh
dec eax
add byte [eax], al
add byte [ecx], cl
dec ecx
arpl word [ebx + 0x4c], si
dec ecx
inc edx
inc ebp
inc ecx
pop ecx
add byte [eax], al
nop
add byte [eax], al
add byte [eax], al
pushfd
stosb byte es:[edi], al
inc ebx
add byte [eax + eax], cl
add byte [eax], al
jo 0x43aa82
dec ecx
add byte [edi + ecx*4], al
dec ecx
add byte [eax], dl
invalid
dec ecx
add byte [edi + ecx*4], dl
dec ecx
add byte [eax], bl
invalid

Function at 0x43aa20
Capabilities:
Link many functions at runtime

Disassembly:
sub dword [eax], eax
add byte [eax], al
and byte [ecx + 0x63], cl
jae 0x43aa75
dec ecx
inc edx
inc ebp
inc ecx
pop ecx
and byte [eax], ch
arpl word [ecx], bp
and byte [edx], dh
xor byte [eax], dh
xor ebp, dword [0x37303032]
and byte [esi + 0x2e], al
and byte [eax + 0x69], dl
je 0x43aab9
and byte gs:[esi + 0x31], dl
xor byte cs:[eax], dh
and byte [eax], al
add byte [eax], al
pushfd
stosb byte es:[edi], al
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + ebp*4 + 0xc0043], bl
add byte [eax], al
add byte [eax + 8], dh
dec ecx
inc edx
inc ebp
inc ecx
pop ecx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add byte [eax], al
add byte [eax], al

Function at 0x43aae0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x43bd70
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [sym.mjrwsvc.exe__Icslibeay_ICS_OPENSSL_VERSION_NUMBER], eax
cmp dword [sym.mjrwsvc.exe__Icslibeay_GLIBEAY_DLL_Handle], 0
je 0x43ab15
mov byte [ebp - 1], 1
jmp 0x43bd55
mov eax, dword [sym.mjrwsvc.exe__Icslibeay_GLIBEAY_DLL_Name]
Function at 0x43ef04
Capabilities:
Get file version info

Disassembly:
pop es
adc eax, dword [ebp + 0x49]
arpl word [ebx + 0x53], si
jae 0x43ef79
popal
jns 0x43ef56
js 0x43ef76
jo 0x43ef8a
imul ebp, dword [edi + 0x6e], sym.mjrwsvc.exe__Icsssleay_EIcsSsleayException_
xor al, 0xff
dec eax
add byte [eax], al
add byte [ecx], cl
dec ecx
arpl word [ebx + 0x53], si
push ebx
dec esp
inc ebp
inc ecx
pop ecx
add byte [eax], al
nop
je 0x43efcd
and byte gs:[esi + 0x31], dl
xor byte cs:[eax], dh
and byte [eax], al
add byte [eax], al
mov al, 0xef
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, 0xef
inc ebx
add byte [eax + eax], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0xc0043ef], dh
add byte [eax], al
add byte [eax + 8], dh
add byte [eax], al
jo 0x43ef96
dec ecx
add byte [edi + ecx*4], al
dec ecx
add byte [eax], dl
invalid
dec ecx
add byte [edi + ecx*4], dl
dec ecx
add byte [eax], bl
invalid
push ebx
dec esp
inc ebp
inc ecx
pop ecx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add byte [eax], al
add byte [eax], al

Function at 0x43ef34
Capabilities:
Get file version info

Disassembly:
sub dword [eax], eax
add byte [eax], al
and byte [ecx + 0x63], cl
jae 0x43ef90
push ebx
dec esp
inc ebp
inc ecx
pop ecx
and byte [eax], ch
arpl word [ecx], bp
and byte [edx], dh
xor byte [eax], dh
xor ebp, dword [0x37303032]
and byte [esi + 0x2e], al
and byte [eax + 0x69], dl
add al, 0x8f
Function at 0x442388
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
shl eax, 7
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
shr edx, 1
or al, dl
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
shl eax, 6
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
shr edx, 2
or al, dl
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 2]
shl eax, 5
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 3]
shr edx, 3
or al, dl
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 3]
shl eax, 4
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 4]
shr edx, 4
or al, dl
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 4]
shl eax, 3
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 5]
shr edx, 5
or al, dl
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
shl eax, 2
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 6]
shr edx, 6
or al, dl
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add eax, eax
and al, 0xff
mov byte [ebp - 0x1d], al
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x24]
shl eax, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
and eax, 1
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jne 0x442452
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x24]
and al, 0xfe
or al, byte [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x24], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x44244b
mov eax, dword [ebp - 0xc]
mov edx, 8
call fcn.00499ef0
push 1
mov eax, dword [ebp - 0xc]
call fcn.00499d8c
mov edx, eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call sym.mjrwsvc.exe__Icsdes_DES_qqrpxucpuct1o
mov esp, ebp
pop ebp
ret
Function at 0x4456c4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x58
call fcn.00498934
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret
Function at 0x447344
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x4b073b]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx - 1]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x55], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x31
jne 0x44735a
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
dec eax
add eax, eax
lea eax, [eax + eax*2]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
dec eax
shl eax, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x54]
add eax, eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x4f]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x53]
shl eax, 3
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x52]
shl edx, 2
add eax, edx
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x51]
add edx, edx
add eax, edx
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x50]
add eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
dec eax
je 0x447409
dec eax
je 0x44743e
dec eax
je 0x447470
dec eax
je 0x4474a1
jmp 0x4474c9
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x4b0804]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 8
and eax, 0xff
shr eax, 3
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x4474c9
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x4b0804]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 4
and eax, 0xff
shr eax, 2
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x4474c9
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x4b0804]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 2
and eax, 0xff
shr eax, 1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
jmp 0x4474c9
mov eax, dword [ebp - 0x20]
add eax, eax
mov edx, dword [ebp - 0x10]
shl edx, 3
lea edx, [edx*8 + 0x4b0804]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x24]
mov al, byte [eax + edx - 0x40]
and al, 1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x75], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x4473f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jne 0x44738c
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x4b076b]
mov al, byte [ebp + eax - 0x75]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x21
jne 0x4474ea
mov esp, ebp
pop ebp
ret
Function at 0x44b3f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00499d70
xor eax, eax
push ebp
push 0x44b46e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00499d80
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44b439
mov eax, dword [ebx + 4]
call fcn.00499d80
push eax
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.ADVAPI32.DLL_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b475
lea eax, [ebp - 4]
call fcn.0049993c
ret

Function at 0x44c448
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c5df
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004986c4
cmp word [ebx + 0x9a], 0
je 0x44c491
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44c4a5
lea esi, [ebp - 8]
jmp 0x44c4a7
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44c4b1
xor edi, edi
jmp 0x44c4bb
mov eax, dword [ebx + 0x78]
call fcn.00499d80
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00499d80
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044bbb4
mov eax, dword [ebp - 0x14]
call fcn.00499d80
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00499d80
push eax
mov eax, dword [ebp - 0x10]
call fcn.00499d80
push eax
mov eax, ebx
call fcn.0044bce8
push eax
mov eax, ebx
call fcn.0044bcbc
push eax
mov eax, ebx
call fcn.0044bc70
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044ba78
mov eax, dword [ebp - 0x18]
call fcn.00499d80
push eax
mov eax, dword [ebx + 8]
call fcn.00499d80
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44c544
call fcn.004956b0
xor edx, edx
push ebp
push 0x44c5bd
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44c582
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44c578
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c5a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c5c4
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
ret
Function at 0x44c5f0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44c61c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00499d80
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44c641
call fcn.004956b0
xor eax, eax
push ebp
push 0x44c678
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_DeleteService
test eax, eax
jne 0x44c661
call fcn.004956b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c67f
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
ret

Function at 0x450928
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0049993c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x450977
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00499b6c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x456b34
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x456b3a
ret

Function at 0x458eec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x458f3d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x458f24
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x458f14
jmp 0x458f3d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x458f25
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46177c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4d966c
cmp dword [edi], 0
jne 0x4617f8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4d9668]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b0e98
mov ecx, 2
call fcn.004985ac
mov edx, 0x461754
lea eax, [esi + 5]
call fcn.00461774
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00461774
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4617cd
mov dword [0x4d9668], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x461914
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x461964]
test si, 4
je 0x461928
or bl, 1
test si, 8
je 0x461932
or bl, 4
test si, 1
je 0x46193c
or bl, 8
test si, 2
je 0x461946
or bl, 0x10
test si, 0x10
je 0x461950
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x46195f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x461968
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4619a0]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x461981
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x461990
or bl, 4
test esi, 0x20000000
je 0x46199b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret