joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e1c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
cmp byte [ecx + 0x20], 0
lea eax, [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], ecx
jbe 0x5e1c5e
mov edi, dword [eax]
mov dword [esp + 0xc], edi
cmp esi, edi
jb 0x5e1c55
cmp esi, dword [eax + 8]
jb 0x5e1c6c
add eax, 8
cmp byte [eax + 4], 0
ja 0x5e1c46
mov eax, dword [ecx + 0x14]
pop edi
mov al, byte [esi + eax]
pop esi
add esp, 8
ret 4
movzx eax, byte [eax + 4]
sub esi, edi
push ebx
push ebp
lea ebx, [eax*4 + 0x603f34]
lea ebp, [eax - 1]
mov edi, edi
movzx eax, byte [ebx]
movzx edx, byte [ebx + 1]
add ecx, eax
movzx eax, byte [ecx]
and edx, eax
mov al, byte [ebx + 2]
test al, al
je 0x5e1ca3
movzx ecx, byte [ecx + 1]
movzx eax, al
and ecx, eax
shl ecx, 8
or edx, ecx
mov cl, byte [ebx + 3]
shr edx, cl
test ebp, ebp
je 0x5e1d0b
mov edi, 1
mov ecx, ebp
shl edi, cl
test esi, edi
setne al
mov byte [esp + 0x1c], al
test dl, 1
je 0x5e1cca
test al, al
sete byte [esp + 0x1c]
shr edx, 1
mov eax, edx
xor edx, edx
div ebp
mov eax, 1
mov ecx, edx
shl eax, cl
test esi, eax
je 0x5e1ce3
or esi, edi
jmp 0x5e1ce7
not edi
and esi, edi
cmp byte [esp + 0x1c], 0
je 0x5e1cfa
mov ecx, dword [esp + 0x10]
or esi, eax
dec ebp
sub ebx, 4
jmp 0x5e1c80
mov ecx, dword [esp + 0x10]
not eax
and esi, eax
dec ebp
sub ebx, 4
jmp 0x5e1c80
pop ebp
pop ebx
test dl, 1
je 0x5e1d15
xor esi, 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, dword [eax + 0x14]
add eax, esi
pop esi
mov al, byte [eax + ecx]
add esp, 8
ret 4
Function at 0x5e26b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5e274d
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x5e274c
push ebx
mov ebx, dword [esp + 0x18]
xor edx, edx
test ebx, ebx
je 0x5e2747
push edi
cmp ebx, 0x20
jb 0x5e272b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, ebx
cmp ebp, eax
ja 0x5e26ed
cmp ecx, esi
jae 0x5e272b
movdqa xmm1, xmmword [0x53bd80]
mov eax, ebx
and eax, 0x1f
mov ecx, ebx
sub ecx, eax
mov edi, ebp
mov eax, esi
sub edi, esi
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [edx + ebp + 0x10], xmm0
add edx, 0x20
cmp edx, ecx
jb 0x5e2704
cmp edx, ebx
jae 0x5e2746
mov edi, ebx
lea ecx, [edx + ebp]
sub esi, ebp
sub edi, edx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x67
mov byte [ecx - 1], al
dec edi
jne 0x5e2738
pop edi
mov byte [ebx + ebp], 0
pop ebx
pop ebp
pop esi
ret
Function at 0x401890
Capabilities:
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x40650c
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
push 0x12a
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
add eax, 4
push str.StopService
push eax
mov dword [esp + 0x150], 0
call fcn.004014d0
or ebp, 0xffffffff
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x148], ebp
call fcn.00405740
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x401969
push 0x12f
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x148], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed__error_code_
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x148], ebp
call fcn.00405740
jmp 0x401a64
mov eax, dword [esp + 0x150]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4019d8
push 0x137
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x148], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed__error_code_
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x148], ebp
call fcn.00405740
jmp 0x401a5d
lea ecx, [esp + 0x9c]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401a00
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, 1
jmp 0x401a66
push 0x145
push str..loginService.cpp
lea ecx, [esp + 0xc0]
call fcn.00405530
mov ebx, eax
mov dword [esp + 0x148], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ControlService_failed__error_code_
add ebx, 4
push ebx
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0xb8]
mov dword [esp + 0x148], ebp
call fcn.00405740
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
Function at 0x401a80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40653b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
push 0x150
push str..loginService.cpp
lea ecx, [esp + 0x48]
call fcn.00405530
add eax, 4
push str.UnRegisterService.
push eax
mov dword [esp + 0xd8], 0
call fcn.004014d0
add esp, 8
lea ecx, [esp + 0x40]
mov dword [esp + 0xd0], 0xffffffff
call fcn.00405740
push 0x3c
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x300
mov dword [esp + 0x18], 0x40b478
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x4075b4
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
add esp, 0xd0
ret
Function at 0x401dc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4065d1
mov eax, dword fs:[0]
push eax
sub esp, 0x124
push esi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
push 0x192
push str..loginService.cpp
lea ecx, [esp + 0x24]
call fcn.00405530
add eax, 4
push str.RegCAD
push eax
mov dword [esp + 0x13c], 0
call fcn.004014d0
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x134], 0xffffffff
call fcn.00405740
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401eba
push 0x196
push str..loginService.cpp
lea ecx, [esp + 0x24]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x134], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegOpenKeyEx_error:
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x134], 0xffffffff
call fcn.00405740
xor eax, eax
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x130
ret
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.DisableCAD
mov esi, 4
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
mov dword [0x40b868], eax
mov eax, dword [esp + 0xc]
mov dword [0x40b86c], eax
test eax, eax
jne 0x401f85
push esi
lea edx, [esp + 0x18]
push edx
push esi
push eax
mov eax, dword [esp + 0x18]
push str.DisableCAD
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401f85
push 0x1aa
push str..loginService.cpp
lea ecx, [esp + 0xac]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x134], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tRegSetValueEx_error:
add esi, 4
push esi
call fcn.004054d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0xa4]
mov dword [esp + 0x134], 0xffffffff
call fcn.00405740
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x40b870], 1
mov eax, 1
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x130
ret
Function at 0x401fc0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40662c
mov eax, dword fs:[0]
push eax
sub esp, 0x114
push ebx
push esi
push edi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x40b870], ebx
je 0x4021a9
push 0x1bc
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
add eax, 4
push str.UnRegCAD
push eax
mov dword [esp + 0x134], ebx
call fcn.004014d0
or edi, 0xffffffff
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
call fcn.00405740
lea eax, [esp + 0x10]
push eax
push 0xf013f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4020ae
push 0x1c1
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x12c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegOpenKeyEx_error:
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
call fcn.00405740
xor eax, eax
jmp 0x4021ae
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40218c
cmp dword [0x40b868], ebx
jne 0x40211c
push str.DisableCAD
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40218c
push 0x1cb
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x12c], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteRegKeyVakue_error:
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
jmp 0x402180
push 4
push 0x40b86c
push 4
push ebx
push str.DisableCAD
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40218c
push 0x1d2
push str..loginService.cpp
lea ecx, [esp + 0xa4]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x12c], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegSetValueEx_error:
add esi, 4
push esi
call fcn.004054d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x9c]
mov dword [esp + 0x12c], edi
call fcn.00405740
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x40b870], ebx
mov dword [0x40b86c], ebx
mov dword [0x40b868], ebx
mov eax, 1
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x120
ret
Function at 0x402750
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4066c6
mov eax, dword fs:[0]
push eax
sub esp, 0x324
mov eax, dword [0x40b424]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
push esi
push edi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x334]
mov dword fs:[0], eax
push 0x20a
lea eax, [esp + 0x128]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionAuthenticationCredential_Providers_
push 0x104
lea ecx, [esp + 0x12c]
push ecx
call fcn.004011c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0xf013f
push 0
lea eax, [esp + 0x130]
push eax
push 0x80000002
mov dword [esp + 0x24], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402804
mov ecx, dword [esp + 0x10]
push str.0587CEF0_51FD_4d54_83C2_A1CB89D1BDAA
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push 0x20a
lea eax, [esp + 0x128]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.CLSID_
push 0x104
lea ecx, [esp + 0x12c]
push ecx
call fcn.004011c0
lea edx, [esp + 0x10]
push edx
push 0xf013f
push 0
lea eax, [esp + 0x130]
push eax
push 0x80000000
call esi
test eax, eax
jne 0x4028ae
mov ecx, dword [esp + 0x10]
push str.0587CEF0_51FD_4d54_83C2_A1CB89D1BDAA
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push 0x252
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
add eax, 4
push str.UnRegisterCredential
push eax
mov dword [esp + 0x344], 0
call fcn.004014d0
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x33c], 0xffffffff
call fcn.00405740
mov eax, 1
jmp 0x4028f9
push 0x256
push str..loginService.cpp
lea ecx, [esp + 0xa4]
call fcn.00405530
add eax, 4
push str.UnRegisterCredential_failed
push eax
mov dword [esp + 0x344], 1
call fcn.004014d0
add esp, 8
lea ecx, [esp + 0x9c]
mov dword [esp + 0x33c], 0xffffffff
call fcn.00405740
xor eax, eax
mov ecx, dword [esp + 0x334]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.00405af7
add esp, 0x330
ret
Function at 0x4029f0
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x406747
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x40b424]
xor eax, esp
mov dword [esp + 0x2ac], eax
push esi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xb6]
push ecx
mov word [esp + 0xb8], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x407b0c
push 0x104
lea eax, [esp + 0xb4]
push eax
call fcn.004011c0
push str.wbxcp.dll
push 0x104
lea ecx, [esp + 0xb4]
push ecx
call fcn.004011c0
lea ecx, [esp + 0x90]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
lea edx, [esp + 0x90]
push edx
mov dword [esp + 0x2c4], 0
call fcn.00401070
add esp, 4
test eax, eax
je 0x402b83
call fcn.00402920
test eax, eax
mov eax, str.wbxcp64.dll
jne 0x402acc
mov eax, str.wbxcp.dll
push eax
lea ecx, [esp + 0x94]
call dword [0x407138]
push 0x28d
push str..loginService.cpp
lea ecx, [esp + 0x10]
call fcn.00405530
add eax, 4
push str.Copy_cp_path_:
push eax
mov byte [esp + 0x2c8], 1
call fcn.004014d0
mov ecx, dword [esp + 0x9c]
mov esi, 8
add esp, 8
cmp dword [esp + 0xa8], esi
jae 0x402b22
lea ecx, [esp + 0x94]
push ecx
push eax
call fcn.004054d0
add esp, 8
lea ecx, [esp + 8]
mov byte [esp + 0x2c0], 0
call fcn.00405740
mov eax, dword [esp + 0x94]
cmp dword [esp + 0xa8], esi
jae 0x402b54
lea eax, [esp + 0x94]
push 0
lea ecx, [esp + 0xb0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x90]
mov esi, eax
mov dword [esp + 0x2c0], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov eax, esi
jmp 0x402b9d
lea ecx, [esp + 0x90]
mov dword [esp + 0x2c0], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.00405af7
add esp, 0x2bc
ret
Function at 0x404310
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x40662c
mov eax, dword fs:[0]
push eax
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
push 0x52f
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
add eax, 4
push str.UnInstallService
push eax
mov dword [esp + 0x134], 0
call fcn.004014d0
or ebx, 0xffffffff
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], ebx
call fcn.00405740
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4043e9
push 0x533
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x12c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed__error_code_
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], ebx
call fcn.00405740
jmp 0x4044cb
mov eax, dword [esp + 0x134]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [0x40b878], eax
test eax, eax
jne 0x40445e
push 0x538
push str..loginService.cpp
lea ecx, [esp + 0x1c]
call fcn.00405530
mov edi, eax
mov dword [esp + 0x12c], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed__error_code_
add edi, 4
push edi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], ebx
call fcn.00405740
jmp 0x4044c8
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4044bf
push 0x53c
push str..loginService.cpp
lea ecx, [esp + 0xa4]
call fcn.00405530
mov edi, eax
mov dword [esp + 0x12c], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_delete_service__error_code_
add edi, 4
push edi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x9c]
mov dword [esp + 0x12c], ebx
call fcn.00405740
mov ecx, dword [0x40b878]
push ecx
call ebp
push esi
call ebp
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret
Function at 0x401047
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
push eax
add esi, ecx
mov esi, dword [esp + 0x14]
ror dx, 0xb
push esi
pop eax
rol di, 9
xor edi, 0xbfee8468
sub esi, 0xffffffee
push ecx
pop edi
and ecx, edi
add esi, 0x2a
not edx
mov ecx, dword [esi]
add esi, 0x23
add esi, 0x19
sub dx, 0x6d
add esi, ecx
mov ecx, dword [esp]
mov ecx, dword [esi]
sub ecx, 0xffffffd3
add ecx, 0xffffffef
add ecx, eax
mov esi, esi
xor esi, edi
lea edx, [ecx]
mov edi, dword [edx]
add edi, eax
or esi, 0x79501795
add esi, 0xeab841ab
sub edx, 0xfffffffc
ror cx, 0xb
push dword [edx]
sar ecx, 0xd
pop ecx
add ecx, eax
add edx, 4
or esi, 0xcc1a7d0e
rol si, 3
push dword [edx]
add si, 0xff87
add esi, eax
pop esi
add esi, eax
push eax
pop edx
push esi
neg eax
push edi
push ecx
mov eax, dword [esp + 0x24]
mov edi, ecx
pop ecx
xor ecx, ecx
push ecx
ror esi, 7
xor esi, 0x35b73c88
mov esi, dword [esp + 0x20]
push esi
and edx, ebx
add edx, ebx
pop edx
ror ecx, 3
add ecx, ebp
add esi, dword [edi]
mov ecx, 0
add cl, byte [esi]
ror ecx, 6
xor ecx, 0xabfd4cfd
inc esi
cmp byte [esi], 0
jne 0x401107
xor ecx, eax
je 0x401143
not esi
add edi, 4
mov esi, dword [edi]
or cx, 0x7c
mov ecx, 0xb48a0c5d
add esi, edx
pop ecx
inc ecx
push ecx
mov ecx, 0xe12b6d82
or ecx, 0x7f11add0
xor ecx, ecx
jmp 0x401107
ror ax, 0xf
pop ecx
mov eax, dword [esp + 4]
sub esi, 0x3f9fbf7b
shl ecx, 1
add eax, ecx
xor esi, esi
mov si, word [eax]
shl esi, 2
add eax, dword [esp]
mov eax, dword [esp]
add eax, esi
pop esi
xor ecx, esi
mov edi, dword [eax]
pop ecx
ror cx, 0xd
add edi, edx
and edx, 0x5b056185
mov edx, eax
pop eax
pop edx
pop esi
pop ecx
ret 8

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
mov ecx, 0x28ac0fcc
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x493459d4
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x43b648
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop esi
add eax, 0x3b3a8fb1
mov eax, 0x16478ce8
inc eax
call fcn.0043b684
mov edx, 0x41b7ef23
dec eax
sub eax, eax
xor dword [ebx], esi
add edx, 1
add ebx, 1
or eax, eax
mov edx, edx
cmp ebx, ecx
jne fcn.0043b648
and edx, edx
ret