joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b0c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x46b0da
call fcn.0044db8a
mov esi, dword [eax + 0xc]
push dword [0x5abd18]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x46b0f8
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x46b0f0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x46b125
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x46b0f2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0046afee
mov esi, eax
jmp 0x46b117

Function at 0x470275
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x4702b3
push 0x560650
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4702c1
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4702c1
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x4702c3
cmp dword [esi + 4], 0
je 0x4702c1
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x47b769
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0041c417
call fcn.0040fc98
cmp eax, esi
pop esi
jne 0x47b785
mov ecx, 0x5ab760
jmp fcn.00458117
ret

Function at 0x498001
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x54cd6e
call fcn.0052b62d
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040deb0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x498063
call fcn.0044d44d
cmp eax, 1
jne 0x498063
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00413ce6
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0041072d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040fbf8
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040fbf8
mov eax, esi
call fcn.0052b705
ret 0x10
Function at 0x49808c
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x54cd6e
call fcn.0052b62d
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040deb0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4980ee
call fcn.0044d44d
cmp eax, 1
jne 0x4980ee
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00413ce6
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0041072d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040fbf8
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040fbf8
mov eax, esi
call fcn.0052b705
ret 0x14

Function at 0x50f3a1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0050f060
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x50f3eb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041bffa
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004136cf
jmp 0x50f3f6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004542ac
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x50f3fc
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00414707
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x50f439
call fcn.0050f060
mov dword [esi + 0xc], 1
jmp 0x50f43e
call fcn.0050f060
cmp dword [esi], 0
je 0x50f487
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x50f45f
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041bffa
jmp 0x50f471
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.0040e250
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004136cf
jmp 0x50f4ab
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x50f4ab
push dword [esi]
push dword [ebp + 8]
call fcn.004542ac
pop esi
pop ebp
ret 0xc

Function at 0x52b61e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a7a80]
jne 0x52b628
repz ret
jmp fcn.005375d3
Function at 0x53ec53
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a7a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00531f82
and dword [ebp - 0x14], 0
cmp dword [0x5af17c], 0
mov dword [ebp - 0x18], eax
jne 0x53ed06
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x53edae
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x53edae
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x581084
push ebx
mov dword [0x5af17c], eax
call edi
push eax
call esi
push 0x581070
push ebx
mov dword [0x5af180], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5af184], eax
call edi
push eax
call esi
mov dword [0x5af18c], eax
test eax, eax
je 0x53ed06
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5af188], eax
mov eax, dword [0x5af188]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x53ed5f
cmp dword [0x5af18c], ecx
je 0x53ed5f
push eax
call esi
push dword [0x5af18c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x53ed5f
test ebx, ebx
je 0x53ed5f
call edi
test eax, eax
je 0x53ed56
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53ed56
test byte [ebp - 8], 1
jne 0x53ed5f
or dword [ebp + 0x10], 0x200000
jmp 0x53ed92
mov eax, dword [0x5af180]
cmp eax, dword [ebp - 0x18]
je 0x53ed92
push eax
call esi
test eax, eax
je 0x53ed92
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x53ed92
mov eax, dword [0x5af184]
cmp eax, dword [ebp - 0x18]
je 0x53ed92
push eax
call esi
test eax, eax
je 0x53ed92
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5af17c]
call esi
test eax, eax
je 0x53edae
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x53edb0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b61e
leave
ret
Function at 0x401919
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi + 0x1b44]
test al, 1
jne 0x4019be
or al, 1
mov byte [esi + 0x1b44], al
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
push ebx
mov dword [esi + 0x1b48], eax
push edi
lea eax, [esi + 0x1b18]
push eax
mov dword [esi + 0x1b14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1b40], eax
call ebx
mov dword [esi + 0x1b10], eax
cmp dword [esi + 0x1b40], edi
je 0x4019b6
cmp eax, edi
je 0x4019b6
cmp dword [ebp + 0x10], edi
je 0x4019a5
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push dword [ebp + 0x10]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1b0c], eax
cmp eax, edi
je 0x4019b6
push dword [ebp + 0x14]
push dword [esi + 0x1b0c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x4019bc
push esi
call fcn.0040185e
pop edi
pop ebx
movzx eax, byte [esi + 0x1b44]
and eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x40204f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x402083
push esi
mov esi, dword [ebp + 8]
test byte [esi], 2
je 0x402083
mov eax, dword [esi + 0x44]
test eax, eax
je 0x402073
push 0x50
push dword [ecx]
push eax
call fcn.004051ec
push 0
push 0
push esi
call dword [esi + 0x28]
xor eax, eax
inc eax
pop esi
pop ebp
ret 8
push 0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4020f3
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x402153
cmp dword [ebp + 0xc], 0
je 0x40210f
push 0x7fffffff
push esi
call fcn.00401fa9
push esi
call fcn.0040201b
mov eax, dword [esi + 0x3ba4]
test eax, eax
je 0x40214c
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402140
push 0
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x3ba4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
ret 8
Function at 0x402158
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x6c0
push 0x406470
call fcn.00404f6c
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
push 0xfffffffffffffff4
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call ebx
mov dword [ebp - 0x20], eax
mov esi, 0x32e
push esi
push edi
lea eax, [ebp - 0x3a0]
push eax
call fcn.00405205
lea eax, [esi - 4]
mov word [ebp - 0x398], ax
push esi
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x6d0]
push eax
call fcn.004051ec
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040521c
mov dword [ebp - 0x3c], 0x4060f3
mov dword [ebp - 0x38], 0x40618f
mov dword [ebp - 0x34], 0x402305
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
mov dword [esi], 0x237
mov dword [esi + 4], 6
cmp dword [ebp - 0x20], edi
je 0x402255
push 0xfffffffffffffff6
call ebx
cmp dword [ebp - 0x20], eax
jne 0x402255
mov dword [ebp - 0x24], 1
or byte [esi + 0x1bbc], 4
cmp dword [0x407034], 3
jne 0x40222a
lea eax, [ebp - 0x28]
push eax
push 4
push esi
push 0x401e1f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x402247
push 0x401e1f
call fcn.004035b9
lea ecx, [ebp - 0x28]
push ecx
push 4
push esi
push eax
push edi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x402255
and byte [esi + 0x1bbc], 0xfb
mov dword [ebp + 8], 0x4019cd
cmp dword [esi + 0x6c], 4
jne 0x402265
mov dword [ebp + 8], edi
lea ebx, [esi + 0x1bc8]
push 2
push edi
push ebx
push esi
call fcn.00401919
test eax, eax
je 0x4022dd
push 1
push dword [ebp + 8]
lea eax, [esi + 0x78]
push eax
push esi
call fcn.00401919
test eax, eax
je 0x4022dd
mov dword [ebp - 4], edi
cmp dword [ebp - 0x24], edi
jne 0x40229b
push edi
push ebx
call fcn.00402531
cmp dword [ebp - 0x1c], edi
je 0x4022c3
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4022d9
lea eax, [ebp - 0x70]
push eax
call fcn.00401eea
test eax, eax
jne 0x4022c3
jmp 0x4022d9
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x70]
push eax
call fcn.0040529e
call fcn.00401740
ret 4
Function at 0x402351
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 4]
push eax
push 0x401160
push 0x80000002
mov dword [ebp - 8], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4023fb
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x4070e8
xor esi, esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test byte [0x4070e9], 0x40
je 0x4023ab
push 0x7e
mov eax, 0x4070ea
push eax
push eax
call fcn.00406249
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push 0x20
pop ebx
jmp 0x4023c3
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x4023b6
push 2
push 0x4070e8
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4025c4
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
push esi
push dword [ebp + 8]
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x402633
cmp dword [ebp + 0x1c], esi
jne 0x402603
mov dword [ebx], 1
jmp 0x402628
push 0xffffffffffffffff
lea eax, [ebp - 8]
push esi
push eax
cmp edi, esi
je 0x402612
push 2
jmp 0x402614
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, esi
jne 0x402628
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40263d
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x402644
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [0x407034], 3
push edi
mov dword [ebp - 4], esi
jne 0x40266f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x402677
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp dword [0x407034], 3
mov edi, eax
jne 0x402699
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push 0x4023fd
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4026b5
push 0x4023fd
call fcn.004035b9
lea ecx, [ebp - 8]
push ecx
push esi
push dword [ebp + 8]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, esi
je 0x4026d6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x4026df
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [0x407034], edi
jne 0x402712
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x40120c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
inc eax
jmp 0x40279a
push esi
mov esi, dword [ebp + 8]
push 0x4011b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
je 0x40272a
mov byte [esi + 0x29], 0
lea eax, [ebp - 4]
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402787
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x402772
push 0x40118c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x402787
cmp dword [ebp - 8], 0
je 0x402792
test edi, edi
jne 0x402797
mov edi, 0x4011f4
jmp 0x402716
xor eax, eax
inc eax
jmp 0x402799
xor eax, eax
pop esi
pop edi
leave
ret 8
Function at 0x40279f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push esi
xor ebx, ebx
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x4020ae
push 0x40123c
mov dword [0x4070c4], eax
mov dword [0x407010], 0x10
mov dword [0x40701c], 0x42a
mov dword [0x407020], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x4070dc], eax
cmp eax, esi
je 0x402899
push edi
push esi
push 0x1388
push 2
pop edi
push edi
mov dword [0x407018], ebx
call fcn.00402321
push esi
push esi
push 4
mov dword [0x407018], 5
call fcn.00402321
call fcn.00402351
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x4034f7
push esi
push esi
mov dword [0x40701c], esi
mov dword [0x407020], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x40284d
mov dword [0x407020], edi
jmp 0x402884
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [0x4070c4]
call edi
mov eax, dword [0x40700c]
cmp eax, esi
je 0x402871
push esi
push esi
push 0x11
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7530
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4070c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push ebx
call fcn.00402321
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40298e
Capabilities:
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x11c]
push eax
push dword [0x4070e4]
xor ebx, ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [ebp + 8]
test eax, eax
je 0x402b2e
mov dword [ebp + 8], 0x401228
cmp dword [ebp + 0xc], ebx
je 0x4029d5
mov dword [ebp + 8], 0x401224
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 8]
lea eax, [eax + edi - 3]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402b2e
push dword [ebp + 8]
push dword [ebp - 4]
call esi
push ebx
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402b2e
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x402b2e
mov eax, dword [0x4070e4]
mov esi, dword [eax + 0x3c]
add esi, eax
mov ecx, esi
sub ecx, eax
add ecx, 0x16
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], ebx
movzx eax, word [esi + 0x16]
cmp dword [ebp + 0xc], ebx
jne 0x402a87
or eax, 0x2000
mov dword [ebp - 0x18], eax
mov edx, dword [esi + 0x98]
sub edx, dword [esi + 0x9c]
mov dword [ebp - 0x10], edx
mov eax, dword [esi + 0x9c]
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x402aab
and eax, 0xffffdfff
mov dword [ebp - 0x18], eax
mov edx, dword [esi + 0x9c]
shr edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [esi + 0x9c]
shr eax, 1
add eax, dword [esi + 0x98]
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ecx
push dword [ebp + 8]
call edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call ebx
push 0
mov eax, esi
sub eax, dword [0x4070e4]
push 0
add eax, 0x58
push eax
push dword [ebp + 8]
call edi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
sub esi, dword [0x4070e4]
push 0
push 0
add esi, 0x98
push esi
push dword [ebp + 8]
call edi
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402b4a
push edi
call fcn.004061d4
mov ecx, dword [0x4070e4]
mov edx, dword [ecx + 0x3c]
cmp eax, dword [edx + ecx + 8]
jne 0x402b4a
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402d79
Capabilities:
Create process on windows
Create process suspended
Create thread
Resume thread
Terminate process
Use process replacement

Disassembly:
push 0x170
push 0x406528
call fcn.00404f6c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov eax, dword [0x407008]
mov ebx, dword [eax + 0x34]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x34], eax
cmp eax, esi
je 0x402efb
push 0x44
pop edi
push edi
push esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00405205
mov dword [ebp - 0x7c], edi
xor eax, eax
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x50], 0x181
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
cmp ebx, esi
je 0x402df7
push 0x104
lea eax, [ebp - 0x180]
push eax
call fcn.004026df
test eax, eax
jne 0x402e05
push 1
lea eax, [ebp - 0x180]
push eax
call fcn.0040298e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push 4
push 1
push esi
push esi
lea eax, [ebp - 0x180]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x1c], eax
cmp ebx, esi
je 0x402e4e
cmp eax, esi
je 0x402e9d
push esi
lea eax, [ebp - 0x180]
push eax
call fcn.0040298e
push esi
push dword [ebp - 0x2c]
lea eax, [ebp - 0x180]
push eax
call fcn.0040291e
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x402efb
cmp ebx, esi
jne 0x402e5f
mov eax, dword [0x4070e4]
push esi
push 0x80
mov ecx, 0x4070e8
push ecx
sub eax, dword [0x4070e4]
add eax, ecx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp ebx, esi
je 0x402ec5
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
mov eax, dword [0x407008]
push dword [eax + 0x34]
push dword [ebp - 0x2c]
call fcn.004025c4
cmp dword [ebp - 0x1c], esi
jne 0x402ece
cmp dword [ebp - 0x2c], esi
je 0x402eb5
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], esi
je 0x402efb
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402efb
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x407034], esi
jne 0x402ef0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x2c]
push fcn.0040289f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x30], eax
jmp 0x402efb
push dword [ebp - 0x2c]
call fcn.0040289f
mov dword [ebp - 0x2c], esi
or dword [ebp - 4], 0xffffffff
call fcn.00402f11
mov eax, dword [ebp - 0x1c]
call fcn.00401740
ret 4