joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbbe4
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x60], edi
push eax
lea eax, [esi + 4]
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
mov dword [ebp - 0x54], vtable.std::exception.0
push eax
movq qword [ebp - 0x50], xmm0
call fcn.004b09ec
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
mov eax, dword [esi + 0x14]
movq xmm0, qword [esi + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x54], vtable.boost::system::system_error.0
movq qword [ebp - 0x48], xmm0
call fcn.00414050
movaps xmm0, xmmword [0x4ff0d0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [ebp - 0x24], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [ebp - 4], 1
mov dword [edi + 0x44], 0x4fd578
mov dword [edi + 0x4c], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
mov dword [ebp - 0x58], 6
call fcn.00420260
mov dword [ebp - 4], 4
lea esi, [edi + 0x30]
mov eax, dword [edi + 0x44]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::system::system_error__.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::system::system_error__.2.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::system::system_error__.1.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00403710
mov eax, dword [edi + 0x44]
add esp, 8
mov dword [edi], vtable.boost::wrapexcept_class_boost::system::system_error_.1.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::system::system_error_.2.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::wrapexcept_class_boost::system::system_error_.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [ebp - 0x24], vtable.boost::exception.0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x422a5d
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x54]
call fcn.00404780
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret
Function at 0x4276f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x42774e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x427710
mov eax, dword [edi]
jmp 0x427839
cmp eax, 0x4e0
jb 0x427839
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x427770
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4277c0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42bdf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc458
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], 0xffffffff
mov esi, dword [eax]
mov dword [ebp - 0x70], esi
cmp ecx, 0xc0000001
jg 0x42be75
je 0x42be6e
cmp ecx, 0x80000000
je 0x42be81
cmp ecx, 0xc0000000
jne 0x42bfe0
mov edi, 2
jmp 0x42be86
mov edi, 1
jmp 0x42be86
cmp ecx, 0xc0000002
jne 0x42bfe0
mov edi, 4
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 4], 0
cmp dword [0x526624], 0
jne 0x42bea7
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 4
call fcn.004136b0
push 0
push 0x10
lea ecx, [ebp - 0x8c]
push ecx
push 0
push esi
call eax
test eax, eax
je 0x42bedb
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x74]
call fcn.00405670
push ecx
mov eax, ecx
jmp 0x42bfed
mov eax, dword [ebp - 0x80]
test eax, eax
jl 0x42bfc0
mov esi, dword [ebp - 0x84]
jg 0x42bef8
test esi, esi
jb 0x42bfc0
test eax, eax
ja 0x42bfc0
jb 0x42bf09
cmp esi, 0xffffffff
ja 0x42bfc0
push 0
push esi
push 0
push 0
push edi
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
jne 0x42bf34
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x74]
call fcn.00405670
push ecx
mov eax, ecx
jmp 0x42bfed
push 0xffffffffffffffff
mov dword [ebx], eax
mov dword [ebx + 8], 0
mov dword [ebx + 4], esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov edi, eax
call esi
push 2
push 0
push 0
lea ecx, [ebx + 0x10]
push ecx
push edi
push dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x42bfa0
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x7c]
call fcn.00405670
mov ecx, ebx
call fcn.00405bb0
push ecx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00405760
push 0x5185f4
lea eax, [ebp - 0x6c]
jmp 0x42bffe
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret 0x1c
push 0x12
lea ecx, [ebp - 0x74]
call fcn.00405650
push ecx
mov eax, ecx
lea ecx, [ebp - 0x6c]
push eax
call fcn.00405760
push 0x5185f4
lea eax, [ebp - 0x6c]
jmp 0x42bffe
push 0x11
lea ecx, [ebp - 0x7c]
call fcn.00405650
push ecx
mov eax, ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00405760
push 0x5185f4
lea eax, [ebp - 0x40]
push eax
call fcn.004b0fc9
int3
Function at 0x42d110
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc548
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x48], 0
mov eax, dword [edi + 0x74]
mov edx, dword [eax]
jne 0x42d24e
cmp byte [edx + 0x30], 0
je 0x42d178
cmp dword [edx + 0x28], 0
jne 0x42d178
cmp dword [edx + 0x14], 8
jb 0x42d170
mov edx, dword [edx]
mov dword [edi + 0x68], edx
mov ecx, dword [edi + 0x6c]
jmp 0x42d193
cmp dword [edx + 0x14], 8
mov ecx, edx
jb 0x42d182
mov ecx, dword [edx]
add edx, 0x18
mov dword [edi + 0x6c], ecx
cmp dword [edx + 0x14], 8
jb 0x42d190
mov edx, dword [edx]
mov dword [edi + 0x68], edx
or dword [edi + 0x30], 1
lea esi, [edi + 0x78]
push esi
lea eax, [edi + 4]
push eax
push dword [edi + 0x64]
push dword [edi + 0x70]
push dword [edi]
push dword [edi + 0x60]
push dword [edi + 0x5c]
push dword [edi + 0x58]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
movups xmm0, xmmword [esi]
mov ecx, dword [edi + 0x54]
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x34], xmm0
test ecx, ecx
je 0x42d1d0
lock inc dword [ecx + 4]
mov ecx, dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x1c], 1
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
call esi
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x14], 0
je 0x42d274
push 0x5263a0
push 0x4228e0
push 0x52640c
mov dword [edi + 0x48], 0
call fcn.00483a79
add esp, 0xc
test eax, eax
je 0x42d26f
mov ecx, dword [ebx + 8]
mov dword [edi + 0x4c], 0x5263a0
cmp dword [edi + 0x48], 0
je 0x42d23b
call fcn.004063d0
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d256
lea eax, [ebp - 0x34]
push eax
call fcn.00406370
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d256
mov ecx, dword [ebx + 8]
call fcn.004063d0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.004bbdd4
push ecx
lea ecx, [ebp - 0x18]
call fcn.00406100
push eax
call fcn.0042e600
int3
Function at 0x42d290
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc548
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x48], 0
mov eax, dword [edi + 0x74]
mov edx, dword [eax]
jne 0x42d3ce
cmp byte [edx + 0x30], 0
je 0x42d2f8
cmp dword [edx + 0x28], 0
jne 0x42d2f8
cmp dword [edx + 0x14], 0x10
jb 0x42d2f0
mov edx, dword [edx]
mov dword [edi + 0x68], edx
mov ecx, dword [edi + 0x6c]
jmp 0x42d313
cmp dword [edx + 0x14], 0x10
mov ecx, edx
jb 0x42d302
mov ecx, dword [edx]
add edx, 0x18
mov dword [edi + 0x6c], ecx
cmp dword [edx + 0x14], 0x10
jb 0x42d310
mov edx, dword [edx]
mov dword [edi + 0x68], edx
or dword [edi + 0x30], 1
lea esi, [edi + 0x78]
push esi
lea eax, [edi + 4]
push eax
push dword [edi + 0x64]
push dword [edi + 0x70]
push dword [edi]
push dword [edi + 0x60]
push dword [edi + 0x5c]
push dword [edi + 0x58]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
movups xmm0, xmmword [esi]
mov ecx, dword [edi + 0x54]
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x34], xmm0
test ecx, ecx
je 0x42d350
lock inc dword [ecx + 4]
mov ecx, dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x1c], 1
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
call esi
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x14], 0
je 0x42d3f4
push 0x5263a0
push 0x4228e0
push 0x52640c
mov dword [edi + 0x48], 0
call fcn.00483a79
add esp, 0xc
test eax, eax
je 0x42d3ef
mov ecx, dword [ebx + 8]
mov dword [edi + 0x4c], 0x5263a0
cmp dword [edi + 0x48], 0
je 0x42d3bb
call fcn.004063d0
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d3d6
lea eax, [ebp - 0x34]
push eax
call fcn.00406370
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d3d6
mov ecx, dword [ebx + 8]
call fcn.004063d0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.004bbdd4
push ecx
lea ecx, [ebp - 0x18]
call fcn.00406100
push eax
call fcn.0042e620
int3
Function at 0x42d410
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc548
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x48], 0
mov eax, dword [edi + 0x74]
mov edx, dword [eax]
jne 0x42d54e
cmp byte [edx + 0x30], 0
je 0x42d478
cmp dword [edx + 0x28], 0
jne 0x42d478
cmp dword [edx + 0x14], 8
jb 0x42d470
mov edx, dword [edx]
mov dword [edi + 0x68], edx
mov ecx, dword [edi + 0x6c]
jmp 0x42d493
cmp dword [edx + 0x14], 8
mov ecx, edx
jb 0x42d482
mov ecx, dword [edx]
add edx, 0x18
mov dword [edi + 0x6c], ecx
cmp dword [edx + 0x14], 8
jb 0x42d490
mov edx, dword [edx]
mov dword [edi + 0x68], edx
or dword [edi + 0x30], 1
lea esi, [edi + 0x78]
push esi
lea eax, [edi + 4]
push eax
push dword [edi + 0x64]
push dword [edi + 0x70]
push dword [edi]
push dword [edi + 0x60]
push dword [edi + 0x5c]
push dword [edi + 0x58]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
movups xmm0, xmmword [esi]
mov ecx, dword [edi + 0x54]
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x34], xmm0
test ecx, ecx
je 0x42d4d0
lock inc dword [ecx + 4]
mov ecx, dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x1c], 1
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
call esi
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x14], 0
je 0x42d574
push 0x5263a0
push 0x4228e0
push 0x52640c
mov dword [edi + 0x48], 0
call fcn.00483a79
add esp, 0xc
test eax, eax
je 0x42d56f
mov ecx, dword [ebx + 8]
mov dword [edi + 0x4c], 0x5263a0
cmp dword [edi + 0x48], 0
je 0x42d53b
call fcn.004063d0
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d556
lea eax, [ebp - 0x34]
push eax
call fcn.00406370
lea ecx, [ebp - 0x34]
call fcn.00406470
jmp 0x42d556
mov ecx, dword [ebx + 8]
call fcn.004063d0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.004bbdd4
push ecx
lea ecx, [ebp - 0x18]
call fcn.00406100
push eax
call fcn.0042e620
int3
Function at 0x42d590
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc578
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x74]
mov edx, dword [edi + 0x48]
mov eax, dword [eax]
test edx, edx
jne 0x42d698
cmp byte [eax + 0x30], dl
je 0x42d675
cmp dword [eax + 0x28], edx
jne 0x42d675
cmp dword [eax + 0x14], 0x10
jb 0x42d5e3
mov eax, dword [eax]
mov dword [edi + 0x68], eax
lea esi, [edi + 0x78]
push esi
lea eax, [edi + 4]
push eax
push dword [edi + 0x64]
push dword [edi + 0x70]
push dword [edi]
push dword [edi + 0x60]
push dword [edi + 0x5c]
push dword [edi + 0x58]
push dword [edi + 0x68]
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
movups xmm0, xmmword [esi]
mov ecx, dword [edi + 0x54]
mov dword [ebp - 0x10], eax
movups xmmword [ebp - 0x2c], xmm0
test ecx, ecx
je 0x42d623
lock inc dword [ecx + 4]
mov ecx, dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], 1
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
call esi
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x10], 0
push 0x5263a0
push 0x4228e0
push 0x52640c
je 0x42d6b4
mov dword [edi + 0x48], 0
call fcn.00483a79
add esp, 0xc
test eax, eax
je 0x42d71d
jmp 0x42d6c9
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x42d67f
mov ecx, dword [eax]
add eax, 0x18
mov dword [edi + 0x6c], ecx
cmp dword [eax + 0x14], 0x10
jb 0x42d68d
mov eax, dword [eax]
mov dword [edi + 0x68], eax
test edx, edx
je 0x42d5e6
mov eax, dword [edi + 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov eax, edx
mov dword [ecx], eax
mov eax, dword [edi + 0x4c]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 8]
call fcn.004063d0
jmp 0x42d707
call fcn.00483a79
add esp, 0xc
test eax, eax
je 0x42d722
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 0x5263a0
cmp dword [edi + 0x48], 0
je 0x42d6f3
mov eax, dword [edi + 0x74]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov eax, dword [edi + 0x4c]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 8]
call fcn.004063d0
jmp 0x42d6ff
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00406370
lea ecx, [ebp - 0x2c]
call fcn.00406470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.004bbdd4
call fcn.004bbdd4
int3
Function at 0x42da90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x1c], 0x10
push ebx
mov ebx, dword [edx + 0x18]
push esi
lea esi, [edx + 8]
mov dword [ebp - 4], ecx
jb 0x42daaa
mov esi, dword [esi]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x42dac7
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x42dab6
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edi
pop edi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edx
jne 0x42db01
cmp eax, edx
jne 0x42daf9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x42db09
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x42db09
cmp eax, edx
jne 0x42db0c
mov eax, dword [edx]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov esi, dword [edx]
push edx
mov dword [eax], esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0041ab00
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
sub ecx, dword [ebp + 8]
push ebx
sar ecx, 5
push esi
push edi
cmp ecx, 2
jl 0x4345c5
add eax, 0xffffffe0
mov dword [ebp + 0xc], eax
movsd xmm0, qword [eax]
movsd qword [ebp - 0x2c], xmm0
movups xmm0, xmmword [eax + 8]
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [eax + 0x18]
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0xf
mov byte [eax + 8], 0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0x30], ecx
movsd xmm0, qword [esi]
lea eax, [esi + 8]
movsd qword [ecx], xmm0
add ecx, 8
push eax
call fcn.00413e10
mov eax, dword [ebp - 0x30]
xor edi, edi
sub eax, esi
xor ebx, ebx
sar eax, 5
mov dword [ebp - 0x30], eax
lea ecx, [eax - 1]
mov dword [ebp - 0x38], ecx
sar ecx, 1
mov dword [ebp - 0x34], ecx
test ecx, ecx
jle 0x434553
lea edx, [ebx + ebx]
xor eax, eax
lea ecx, [edx + 2]
shl ecx, 5
lea ebx, [edx + 1]
movsd xmm0, qword [esi + ecx - 0x20]
comisd xmm0, xmmword [ecx + esi]
lea ecx, [esi + 8]
seta al
shl edi, 5
xor eax, 1
add ecx, edi
add ebx, eax
mov eax, ebx
shl eax, 5
add eax, esi
movsd xmm0, qword [eax]
add eax, 8
push eax
movsd qword [edi + esi], xmm0
call fcn.00413e10
mov ecx, dword [ebp - 0x34]
mov edi, ebx
cmp ebx, ecx
jl 0x434505
mov eax, dword [ebp - 0x30]
cmp ebx, ecx
jne 0x43457f
test al, 1
jne 0x43457f
shl eax, 5
lea ecx, [esi + 8]
shl edi, 5
add ecx, edi
movsd xmm0, qword [eax + esi - 0x20]
add eax, 0xffffffe8
add eax, esi
movsd qword [edi + esi], xmm0
push eax
call fcn.00413e10
mov edi, dword [ebp - 0x38]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], esi
call fcn.00430d60
mov edx, dword [ebp - 0x10]
add esp, 0xc
cmp edx, 0x10
jb 0x4345c5
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4345bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4345d6
push edx
push ecx
call fcn.00499ae0
add esp, 8
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004996e8
mov esp, ebp
pop ebp
ret
call fcn.004bbc5b
int3
Function at 0x4422b0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x50f168
push 0x4b0e70
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x51b170]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x4c], eax
mov edi, ecx
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0x7530
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x44244e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x442412
mov esi, dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x442412
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x4423ff
xor edi, edi
mov dword [ebp - 0x50], edi
cmp edi, dword [ebp - 0x48]
jae 0x442442
lea eax, [edi + edi*8]
movups xmm1, xmmword [esi + eax*4]
movups xmm0, xmmword [esi + eax*4 + 0x10]
movups xmmword [ebp - 0x78], xmm0
mov eax, dword [esi + eax*4 + 0x20]
mov dword [ebp - 0x68], eax
push 0x24
movd eax, xmm1
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x60], esi
test esi, esi
je 0x4423ff
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4423ff
cmp dword [ebp - 0x3c], 1
je 0x442416
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4423ff
cmp dword [ebp - 0x3c], 1
je 0x442416
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jbe 0x4423c5
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x51b170
call fcn.004b9740
add esp, 0xc
xor eax, eax
jmp 0x442453
mov dword [ebp - 4], 0
call fcn.0044243a
inc edi
mov dword [ebp - 0x50], edi
mov esi, dword [ebp - 0x54]
jmp 0x442374
mov dword [ebp - 4], 0xfffffffe
call fcn.00442472
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret