joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 4], 0
mov edi, dword [ebp + 0x18]
mov ebx, ecx
mov dword [ebp - 8], eax
jne 0x444272
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 4], eax
jmp 0x444284
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 4], eax
je 0x444284
mov dword [esi + 4], 0xffffffff
mov eax, dword [ebx]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [esi], 0xffffffff
jne 0x4442b7
mov ecx, dword [ebx]
push 0
push 0x2719
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x4442df
mov ecx, dword [ebx]
push 0
push 0
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
push edi
lea ecx, [ebp - 8]
push ecx
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
push dword [eax + 4]
mov dword [ebp - 8], 0
push dword [eax]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x44433f
cmp eax, 0x3e5
je 0x44433f
cmp eax, 0xea
je 0x44433f
push dword [ebp - 8]
mov ecx, dword [ebx]
push eax
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebx]
push edi
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4444c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 4], 0
mov edi, dword [ebp + 0x18]
mov ebx, ecx
mov dword [ebp - 8], eax
jne 0x4444f2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 4], eax
jmp 0x444504
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 4], eax
je 0x444504
mov dword [esi + 4], 0xffffffff
mov eax, dword [ebx]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [esi], 0xffffffff
jne 0x444537
mov ecx, dword [ebx]
push 0
push 0x2719
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x44455f
mov ecx, dword [ebx]
push 0
push 0
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
push edi
lea ecx, [ebp - 8]
push ecx
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
push dword [eax + 4]
mov dword [ebp - 8], 0
push dword [eax]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x4445bf
cmp eax, 0x3e5
je 0x4445bf
cmp eax, 0xea
je 0x4445bf
push dword [ebp - 8]
mov ecx, dword [ebx]
push eax
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebx]
push edi
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x14
Function at 0x446330
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
xor edi, edi
lea esi, [ebx + 0x15]
movzx edx, byte [esi - 1]
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov dword [ebp + edi*4 - 0x158], edx
inc edi
lea esi, [esi + 4]
cmp edi, 0x10
jb 0x446346
lea edx, [ebp - 0x150]
mov esi, 0x40
nop
mov eax, dword [edx + 0x2c]
xor eax, dword [edx + 0x18]
lea edx, [edx + 4]
xor eax, dword [edx - 0xc]
xor eax, dword [edx - 4]
mov ecx, eax
shr ecx, 0x1f
add eax, eax
xor ecx, eax
mov dword [edx + 0x34], ecx
dec esi
jne 0x446380
mov eax, dword [ebx]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 4]
mov esi, dword [ebx + 8]
mov edi, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
xor ebx, ebx
jmp 0x4463c3
mov edi, dword [ebp - 4]
cmp ebx, 0x14
jae 0x4463dd
mov eax, edx
not eax
and eax, ecx
mov ecx, esi
and ecx, edx
or eax, ecx
mov dword [ebp - 8], 0x5a827999
jmp 0x446412
cmp ebx, 0x28
jae 0x4463eb
mov dword [ebp - 8], 0x6ed9eba1
jmp 0x44640c
cmp ebx, 0x3c
jae 0x446405
mov eax, esi
or eax, edx
and eax, ecx
mov ecx, esi
and ecx, edx
or eax, ecx
mov dword [ebp - 8], 0x8f1bbcdc
jmp 0x446412
mov dword [ebp - 8], 0xca62c1d6
mov eax, ecx
xor eax, esi
xor eax, edx
mov ecx, dword [ebp - 4]
shr edi, 0x1b
shl ecx, 5
xor edi, ecx
add edi, dword [ebp + ebx*4 - 0x158]
mov ecx, esi
add edi, dword [ebp - 8]
inc ebx
add edi, eax
mov eax, dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, edx
shr edx, 2
shl esi, 0x1e
xor esi, edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
cmp ebx, 0x50
jb 0x4463c0
mov eax, dword [ebp - 0x18]
add eax, edi
mov edi, dword [ebp - 0x14]
add dword [edi + 8], esi
add dword [edi + 4], edx
add dword [edi + 0xc], ecx
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
add dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446910
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x44697f
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x446975
test byte [eax + 0x1c], 1
je 0x446975
cmp byte [eax + 0x19], 1
jb 0x446975
push dword [eax + 0x14]
mov edx, 0x48c4c8
push dword [eax + 0x10]
lea ecx, [ebx + 0xa]
call fcn.00401000
add esp, 8
mov eax, 0xfffffffc
jmp 0x446afe
test edi, edi
jne 0x4469b9
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x446975
test byte [eax + 0x1c], 1
je 0x446975
cmp byte [eax + 0x19], 1
jb 0x446975
push dword [eax + 0x14]
mov edx, 0x48c4c8
push dword [eax + 0x10]
lea ecx, [edi + 0xc]
call fcn.00401000
add esp, 8
lea eax, [edi - 4]
jmp 0x446afe
push 0x40
push 0
push edi
call fcn.00463750
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x214], 0x40
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x446a20
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x446a18
test byte [eax + 0x1c], 1
je 0x446a18
cmp byte [eax + 0x19], 1
jb 0x446a18
push dword [eax + 0x14]
mov edx, 0x48c4c8
push dword [eax + 0x10]
mov ecx, 0xe
call fcn.00401000
add esp, 8
or eax, 0xffffffff
jmp 0x446afe
mov ecx, dword [ebp - 0x214]
cmp ecx, 0x40
jbe 0x446a66
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x446a5e
test byte [eax + 0x1c], 1
je 0x446a5e
cmp byte [eax + 0x19], 1
jb 0x446a5e
push ecx
push 0x40
push dword [eax + 0x14]
mov edx, 0x48c4c8
push dword [eax + 0x10]
mov ecx, 0xf
call fcn.00401050
add esp, 0x10
or eax, 0xffffffff
jmp 0x446afe
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00448e20
mov dword [ebp - 4], 0
cmp dword [ebp - 0x218], 8
lea eax, [ebp - 0x248]
lea esi, [ebp - 0x22c]
cmovae esi, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004461a0
push ecx
push dword [eax]
lea ecx, [ebp - 0x244]
push esi
call fcn.00440c10
cmp dword [ebp - 0x230], 0x10
push dword [ebp - 0x214]
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push eax
push edi
call fcn.00460250
add esp, 0xc
lea ecx, [ebp - 0x244]
call fcn.0041c660
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], 0xffffffff
call fcn.00430080
mov ecx, ebx
call fcn.00446b20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret
Function at 0x446cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [ecx], 0x1571
mov dword [ecx + 0x9c0], 1
push esi
mov esi, dword [ecx + 0x9c0]
mov edx, dword [ecx + esi*4 - 4]
shr edx, 0x1e
xor edx, dword [ecx + esi*4 - 4]
imul edx, edx, 0x6c078965
add edx, esi
mov dword [ecx + esi*4], edx
inc dword [ecx + 0x9c0]
cmp dword [ecx + 0x9c0], 0x270
jb 0x446ce1
mov edx, dword [ecx + 0x9bc]
xor edx, dword [ecx + 0x630]
pop esi
jns 0x446d2b
xor edx, 0x1908b0df
add edx, edx
or edx, 1
jmp 0x446d2d
add edx, edx
mov eax, dword [ecx]
xor eax, edx
and eax, 0x7fffffff
xor dword [ecx], eax
xor eax, eax
lea ebx, [ebx]
cmp dword [ecx + eax*4], 0
jne 0x446d54
inc eax
cmp eax, 0x270
jb 0x446d40
mov dword [ecx], connect
ret 4

Function at 0x447b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481dfc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi + 0x28], 0x48cae8
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.0045e321
mov dword [edi], vtable.boost::bad_lexical_cast.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ebx, [esi + 0x14]
lea esi, [edi + 0x14]
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x447bbd
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.2.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.1.0
mov eax, dword [eax + 4]
push ebx
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.0
mov eax, dword [edi + 0x28]
push esi
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
call fcn.0041b790
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447cb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
mov dword [ebp - 0xc], esi
mov edi, ecx
sub ebx, esi
jne 0x447cd0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xffffffff
jne 0x447ce3
call fcn.004480a0
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x447d5a
xor ecx, ecx
lea eax, [ebx + 1]
xor edx, edx
div ecx
mov dword [ebp - 4], 0
mov esi, 1
mov ecx, eax
mov dword [ebp + 8], ecx
nop
cmp ecx, 1
jae 0x447d30
mov byte [ebp - 8], 0
push dword [ebp - 8]
xor edx, edx
push ebx
mov ecx, edi
call fcn.00447cb0
mov ecx, dword [ebp + 8]
add esp, 8
cmp eax, 0xffffffff
ja 0x447d00
cmp eax, ebx
ja 0x447d00
add eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004480a0
imul eax, esi
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, ebx
sub eax, esi
inc eax
neg esi
mov dword [ebp - 4], ecx
cmp esi, eax
je 0x447d51
xor esi, esi
jmp 0x447d30
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
xor edx, edx
lea ecx, [ebx + 1]
div ecx
mov dword [ebp + 8], eax
cmp edx, ebx
jne 0x447d70
inc eax
mov dword [ebp + 8], eax
nop
cmp dword [edi + 0x9c0], 0x270
jne 0x447d83
mov ecx, edi
call fcn.004483f0
mov eax, dword [edi + 0x9c0]
inc eax
mov ecx, dword [edi + eax*4 - 4]
mov dword [edi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
xor edx, edx
div dword [ebp + 8]
cmp eax, ebx
ja 0x447d70
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481dfc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi + 0x28], 0x48cae8
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.0045e321
mov dword [edi], vtable.boost::bad_lexical_cast.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ebx, [esi + 0x14]
lea esi, [edi + 0x14]
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x447f1d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.2.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.1.0
mov eax, dword [eax + 4]
push ebx
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.0
mov eax, dword [edi + 0x28]
push esi
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
call fcn.0041b790
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4483f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, 0xde
lea eax, [edi + 4]
lea esp, [esp]
mov edx, dword [eax]
mov ecx, dword [eax - 4]
xor ecx, edx
and edx, 1
imul edx, edx, 0x9908b0df
and ecx, 0x7ffffffe
xor ecx, dword [eax - 4]
lea eax, [eax + 4]
shr ecx, 1
xor ecx, edx
xor ecx, dword [eax + 0x62c]
mov dword [eax - 8], ecx
dec esi
jne 0x448400
mov edx, dword [edi + 0x37c]
mov ecx, dword [edi + 0x378]
xor ecx, edx
mov esi, dword [edi + 0x380]
and ecx, 0x7ffffffe
xor ecx, dword [edi + 0x378]
mov eax, edx
and eax, 1
shr ecx, 1
imul eax, eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [edi + 0x9ac]
mov eax, esi
mov dword [edi + 0x378], ecx
and eax, 1
imul eax, eax, 0x9908b0df
mov ecx, edx
xor ecx, esi
and ecx, 0x7ffffffe
xor ecx, edx
mov edx, dword [edi + 0x384]
shr ecx, 1
xor ecx, eax
xor ecx, dword [edi + 0x9b0]
mov eax, edx
mov dword [edi + 0x37c], ecx
and eax, 1
imul eax, eax, 0x9908b0df
mov ecx, edx
xor ecx, esi
and ecx, 0x7ffffffe
xor ecx, esi
mov esi, dword [edi + 0x388]
shr ecx, 1
xor ecx, eax
xor ecx, dword [edi + 0x9b4]
mov eax, esi
mov dword [edi + 0x380], ecx
and eax, 1
imul eax, eax, 0x9908b0df
mov ecx, esi
xor ecx, edx
and ecx, 0x7ffffffe
xor ecx, edx
shr ecx, 1
xor ecx, eax
xor ecx, dword [edi + 0x9b8]
lea edx, [edi + 0x390]
mov dword [edi + 0x384], ecx
mov ecx, dword [edi + 0x38c]
mov eax, ecx
and ecx, 1
xor eax, esi
imul ecx, ecx, 0x9908b0df
and eax, 0x7ffffffe
xor eax, esi
shr eax, 1
xor eax, ecx
xor eax, dword [edi + 0x9bc]
mov esi, 0x18c
mov dword [edi + 0x388], eax
lea ecx, [ecx]
mov ecx, dword [edx]
mov eax, dword [edx - 4]
xor eax, ecx
and ecx, 1
imul ecx, ecx, 0x9908b0df
and eax, 0x7ffffffe
xor eax, dword [edx - 4]
lea edx, [edx + 4]
shr eax, 1
xor eax, ecx
xor eax, dword [edx - 0x394]
mov dword [edx - 8], eax
dec esi
jne 0x448520
mov eax, dword [edi]
mov ecx, dword [edi + 0x9bc]
xor ecx, eax
and eax, 1
imul eax, eax, 0x9908b0df
and ecx, 0x7ffffffe
xor ecx, dword [edi + 0x9bc]
mov dword [edi + 0x9c0], esi
shr ecx, 1
xor ecx, eax
xor ecx, dword [edi + 0x630]
mov dword [edi + 0x9bc], ecx
pop edi
pop esi
ret
Function at 0x4515a0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482aab
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], ax
push 0xf003f
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x45160b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45172b
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp - 0x218], 0
jne 0x45162d
xor ecx, ecx
jmp 0x451645
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x451636
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00446020
cmp dword [ebp - 0x21c], 8
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.SAMSUNG_Mobile_Connectivity_Service
push str.ss_conn_service
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x4516e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x4516d0
test byte [eax + 0x1c], 1
je 0x4516d0
cmp byte [eax + 0x19], 3
jb 0x4516d0
push esi
push dword [eax + 0x14]
mov edx, 0x48c6d8
push dword [eax + 0x10]
mov ecx, 0x25
call fcn.0041cb70
add esp, 0xc
push esi
push str.CreateService_Failed__08x_n
call fcn.0045fe03
add esp, 8
jmp 0x451724
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x49cf18]
cmp eax, 0x49cf18
je 0x451717
test byte [eax + 0x1c], 1
je 0x451717
cmp byte [eax + 0x19], 3
jb 0x451717
push dword [eax + 0x14]
mov edx, 0x48c6d8
push dword [eax + 0x10]
mov ecx, 0x26
call fcn.00401000
add esp, 8
push str.CreateService_Succeed_n
call fcn.0045fe03
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x21c], 8
jb 0x451742
push dword [ebp - 0x230]
call fcn.0045dbf3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret
Function at 0x451760
Capabilities:
Delete service

Disassembly:
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x451792
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenSCManager_Failed__08x_n
call fcn.0045fe03
add esp, 8
mov eax, esi
pop edi
pop esi
ret
push ebx
push 0xf01ff
push str.ss_conn_service
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4517cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenService_Failed__08x_n
call fcn.0045fe03
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x451802
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.DeleteService_Failed__08x_n
call fcn.0045fe03
add esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret
push str.DeleteService_Succeed_n
call fcn.0045fe03
add esp, 4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x453930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48293c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi + 0x28], 0x48cae8
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.0045e3cf
mov dword [edi], vtable.boost::io::too_few_args.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ebx, [esi + 0x14]
lea esi, [edi + 0x14]
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4539bd
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.2.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.1.0
mov eax, dword [eax + 4]
push ebx
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.0
mov eax, dword [edi + 0x28]
push esi
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
call fcn.0041b790
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc