joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4112e0
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x4dc]
sub esp, 0x4dc
push 0xfffffffffffffffe
push 0x477a58
push 0x43d900
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x483ca0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x4d8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x4e4]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 0x4e8]
xor bl, bl
mov byte [ebp - 0x19], bl
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.00438b10
add esp, 0xc
mov dword [ebp - 4], 0
push 0x40e
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x411469
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x411382
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x411487
mov eax, dword [esi + 0x3c]
lea edi, [esi + eax*2]
cmp dword [edi], 0x4550
jne 0x411374
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
mov word [ebp + 0x410], ax
mov dword [ebp - 0x20], eax
cmp esi, 0xffffffff
je 0x4113f9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4113f2
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea eax, [ebp + 0x410]
push eax
call fcn.00411550
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x4ec]
push str.Module__d_r_n
mov ebx, dword [ebp - 0x24]
push ebx
call fcn.00412a80
lea eax, [ebp]
push eax
push str._s_r_n
push ebx
call fcn.00412a80
push dword [edi + 0x50]
push dword [edi + 0x34]
push str.Image_Base:_0x_08x__Image_Size:_0x_08x_r_n
push ebx
call fcn.00412a80
push dword [edi + 8]
push dword [edi + 0x58]
push str.Checksum:___0x_08x__Time_Stamp:_0x_08x_r_n
push ebx
call fcn.00412a80
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x20]
push str.File_Size:____10d__File_Time:___s_r_n
push ebx
call fcn.00412a80
add esp, 0x48
push str.Version_Information:_r_n
push ebx
call fcn.00412a80
add esp, 8
mov bl, 1
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x411485
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4d8]
xor ecx, ebp
call fcn.004396df
lea esp, [ebp + 0x4dc]
pop ebp
ret
Function at 0x4114b0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x34]
xor edx, edx
mov eax, 0x40000000
xor esi, esi
div edi
xor ebp, ebp
lea ebx, [esi + 1]
shl eax, 2
mov dword [esp + 0x10], eax
test eax, eax
je 0x41153e
push 0x1c
lea eax, [esp + 0x18]
push eax
mov eax, esi
imul eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x41152f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41152f
div edi
add esi, eax
cmp dword [esp + 0x24], 0x1000
jne 0x411538
mov eax, dword [esp + 0x18]
cmp eax, ebp
jbe 0x411538
push ebx
push eax
push dword [esp + 0x60]
mov ebp, eax
call fcn.004112e0
add esp, 0xc
test al, al
je 0x411538
inc ebx
jmp 0x411538
mov eax, 0x10000
div edi
add esi, eax
cmp esi, dword [esp + 0x10]
jb 0x4114e1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x4115f0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x828
mov eax, dword [0x483ca0]
xor eax, esp
mov dword [esp + 0x824], eax
cmp byte [0x48371c], 0
mov eax, dword [esp + 0x82c]
mov dword [esp], eax
jne 0x41162e
xor eax, eax
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.004396df
add esp, 0x828
ret
push edi
push 0x410
lea eax, [esp + 0xc]
mov byte [0x48371c], 0
push 0
push eax
call fcn.00438b10
add esp, 0xc
lea eax, [esp + 8]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x411672
push str.Unknown
lea eax, [esp + 0xc]
push eax
call edi
lea eax, [esp + 8]
push ebp
push eax
call fcn.004115d0
add esp, 4
mov ebp, eax
lea eax, [esp + 0x41c]
push ebp
push eax
call edi
lea eax, [esp + 0x41c]
push 0x2e
push eax
call fcn.00412ae0
add esp, 8
test eax, eax
je 0x4116a8
xor ecx, ecx
mov word [eax], cx
push esi
push str.ERRORLOG.TXT
push ebp
call edi
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4116fa
push str.Error_creating_exception_report_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
pop ebp
xor eax, eax
pop edi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.004396df
add esp, 0x828
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.004114b0
push str.ERRORLOG.TXT
push str._r_n__end_of__s___r_n
push esi
call fcn.00412a80
push esi
call fcn.00412a40
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x464674
push ebp
call edi
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41176d
push dword [esp + 0xc]
push esi
call fcn.00411070
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4116e0
cmp dword [0x483700], 0x51
jne 0x411789
call fcn.004117b0
mov ecx, dword [esp + 0x830]
mov eax, 1
pop esi
pop ebp
pop edi
xor ecx, esp
call fcn.004396df
add esp, 0x828
ret
Function at 0x412a80
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x4872a0]
cmp eax, 0x1c00
jle 0x412ab6
push 0
lea eax, [esp + 4]
push eax
push 0x4872a8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x4872a8
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov dword [0x4872a0], eax
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x10]
lea eax, [eax*2 + 0x4872a8]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
add dword [0x4872a0], eax
pop ecx
ret

Function at 0x412be0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc0c
mov eax, dword [0x483ca0]
xor eax, esp
mov dword [esp + 0xc08], eax
push ebx
mov ebx, dword [esp + 0xc18]
lea eax, [esp + 0x80c]
push ebp
mov ebp, dword [esp + 0xc18]
push esi
push edi
mov edi, dword [esp + 0xc28]
mov esi, ecx
push 0x200
push eax
push ebp
call fcn.0040fa60
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 2
push 0
lea eax, [esp + 0x824]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412d5c
push 0x200
lea eax, [esp + 0x41c]
push eax
push ebx
call fcn.0040fa60
push 0x200
lea eax, [esp + 0x28]
push eax
push edi
call fcn.0040fa60
mov edx, dword [esp + 0xc44]
add esp, 0x18
cmp edx, 4
jne 0x412cf0
push edi
call fcn.0043a280
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
lea eax, [esp + 0x428]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x412d4e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.004031d0
add esp, 4
push eax
push esi
push str.RegSetValueEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x2b
push str.RegistryHandler.cpp
push 0
push str.RegistryHandler::AddRegistryValue__
push dword [0x4868e8]
call fcn.0040a4c0
add esp, 0x2c
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412d93
lea ecx, [esp + 0x18]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412cf7
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
push 0
lea eax, [esp + 0x428]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x412d4e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.004031d0
add esp, 4
push eax
push esi
push str.RegSetValueEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x38
jmp 0x412cc7
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x412d95
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.004031d0
add esp, 4
push eax
push esi
push str.RegOpenKeyEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x46
push str.RegistryHandler.cpp
push 0
push str.RegistryHandler::AddRegistryValue__
push dword [0x4868e8]
call fcn.0040a4c0
add esp, 0x2c
xor al, al
mov ecx, dword [esp + 0xc18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004396df
add esp, 0xc0c
ret 0x10
Function at 0x416210
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret 4

Function at 0x4190fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41913f
call fcn.00416ae9
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41913f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41915b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004163a7
mov ebx, eax
test edi, edi
je 0x419159
test esi, esi
je 0x419159
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e0c4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x483ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00441601
mov dword [ebp - 0x14], eax
cmp dword [0x48e4dc], esi
jne 0x44e1b7
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x44e144
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44e297
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44e297
push 0x46a0f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44e297
push eax
call ebx
push 0x46a0fc
push edi
mov dword [0x48e4dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x46a10c
push edi
mov dword [0x48e4e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x48e4e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48e4ec], eax
test eax, eax
je 0x44e1b4
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48e4e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44e1dc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44e1cf
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x44e1f1
push 4
pop eax
jmp 0x44e299
cmp dword [ebp - 0x14], esi
je 0x44e1f1
push dword [0x48e4dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x44e1d6
mov eax, dword [0x48e4e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x44e24f
cmp dword [0x48e4ec], edi
je 0x44e24f
push eax
call ebx
push dword [0x48e4ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x44e24f
test eax, eax
je 0x44e24f
call ecx
test eax, eax
je 0x44e244
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x44e244
test byte [ebp - 8], 1
jne 0x44e24f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x44e27f
mov eax, dword [0x48e4e0]
cmp eax, edi
je 0x44e27c
push eax
call ebx
test eax, eax
je 0x44e27c
call eax
mov esi, eax
test esi, esi
je 0x44e27c
mov eax, dword [0x48e4e4]
cmp eax, edi
je 0x44e27c
push eax
call ebx
test eax, eax
je 0x44e27c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x48e4dc]
call ebx
test eax, eax
je 0x44e297
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44e299
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004396df
mov esp, ebp
pop ebp
ret
Function at 0x4549d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea esp, [esp]
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x34]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, dword [edi + 0x64]
cmp dword [edi + 0x64], eax
jb 0x454a59
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004384c0
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
jmp 0x454a20
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x454a2f
sub eax, esi
jmp 0x454a31
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x454a20
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x454a4f
sub eax, esi
jmp 0x454a51
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x454a40
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x454ab1
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00454e00
add dword [edi + 0x6c], eax
add esp, 0xc
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x454a9d
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x454ab1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4549e0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x456590
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x4565ac
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4566ad
jmp 0x4565c0
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x456672
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x4565e6
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x456681
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x456676
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x4565c0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4566c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4566cc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004566e0
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001a987
pop dword [ebp - 0x24]
mov eax, 0xf9b137b0
add eax, 0x165071d7
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3b586
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x510b
mov edi, eax
mov ebx, 0x10043e00
add ebx, dword [ebp - 0x24]
mov edx, 0xd56c07e7
sub edx, 0x818dceee
add dword [ebp - 0x1c], 0xbf160214
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xb678fcd3
add esi, edx
xor dword [ebp - 8], 0xf4dbcc06
mov dword [edi], esi
xor dword [ebp - 0x18], 0xd00b1bbd
add edi, 4
add ebx, 4
loop 0x1001a9d5
add eax, 0x9a4672f4
sub eax, 0x9a453bf5
xor ebx, ebx
add ebx, eax
add eax, 0x4d30c020
add eax, 0xb2cf3fe5
mov ecx, 0xe79dc9fa
add ecx, 0x28623606
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401a0f
Capabilities:
Create service
Modify service
Query service status
Stop service

Disassembly:
sub esp, 0x614
push esi
push edi
mov edi, 0x104
push edi
lea eax, [esp + 0x11c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401b8d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [esp + 8], eax
je 0x401b8d
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
lea eax, [esp + 0x20]
push eax
push 0x65
push esi
call ebp
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
push esi
push 0x401584
push esi
push esi
lea eax, [esp + 0x134]
push eax
push 1
push 3
push 0x110
mov ebx, 0xf01ff
push ebx
lea eax, [esp + 0x44]
push eax
mov edi, 0x40157c
push edi
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x401b10
cmp dword [0x405038], 2
jne 0x401b0a
push 0x40156c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
je 0x401b0a
push 0x401554
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x401b03
push 0x400
lea eax, [esp + 0x228]
push eax
push 0x66
push esi
call ebp
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x224]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 1
push dword [esp + 0x1c]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [esp + 0x14]
jmp 0x401b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x401b81
push ebx
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, esi
je 0x401b81
mov ebx, 0x4050c0
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401b66
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b53
cmp dword [0x4050c4], 3
jne 0x401b66
push 0x3e8
call ebp
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x401b4a
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x614
ret
Function at 0x401b96
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esp], eax
je 0x401c25
push esi
push 0xf01ff
push 0x40157c
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x401c1a
push edi
mov edi, 0x4050c0
push edi
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401c0b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x3e8
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x401c01
cmp dword [0x4050c4], 3
jne 0x401c09
push 0x3e8
call ebx
push edi
push esi
call ebp
test eax, eax
jne 0x401bf1
pop ebp
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ecx
ret

Function at 0x401cb6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 1
push esi
mov dword [ebp - 0x10], 0x40157c
mov dword [ebp - 0xc], 0x401c84
jle 0x401d24
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x401cec
cmp cl, 0x2f
jne 0x401d23
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
inc eax
push eax
push 0x4015b4
call esi
test eax, eax
jne 0x401d06
call fcn.00401a0f
jmp 0x401d1b
mov eax, dword [edi + 4]
inc eax
push eax
push 0x4015ac
call esi
test eax, eax
jne 0x401d23
call fcn.00401b96
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x401d44
push 0x401588
push 0xc0000001
push eax
push 1
call fcn.00403752
pop esi
leave
ret