joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, ecx
push 2
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401843
push ebx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x40183f
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x40182d
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x401827
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call ebx
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x4017f1
push edi
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00406237
mov esp, ebp
pop ebp
ret

Function at 0x401860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 7
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jbe 0x401882
mov ecx, dword [ecx]
lea eax, [ebp - 0x20c]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4018b2
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 7
mov dword [ebp - 0x208], 0x200
jbe 0x4018c4
mov esi, dword [esi]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x401952
lea ecx, [ebp - 0x204]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4018f6
mov eax, dword [edi + 0x14]
sub ecx, edx
sar ecx, 1
cmp ecx, eax
ja 0x401936
push ebx
mov ebx, edi
cmp eax, 7
jbe 0x401916
mov ebx, dword [edi]
lea esi, [ecx + ecx]
mov dword [edi + 0x10], ecx
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + ebx], ax
pop ebx
jmp 0x401952
lea eax, [ebp - 0x204]
mov byte [ebp - 0x210], 0
push eax
push dword [ebp - 0x210]
push ecx
mov ecx, edi
call fcn.00405a10
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], 0
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.00406237
mov esp, ebp
pop ebp
ret
Function at 0x401980
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 7
push esi
mov esi, edx
jbe 0x40199b
mov ecx, dword [ecx]
lea eax, [ebp - 8]
push eax
push 2
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4019c4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 7
jbe 0x4019cc
mov esi, dword [esi]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret

Function at 0x401a00
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401a77
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x401a6e
push eax
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
Function at 0x4022b0
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4073bd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x148
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0
xor eax, eax
cmp dword [edi + 0x14], 0xf
mov esi, edi
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], edi
jbe 0x402331
mov esi, dword [edi]
mov dword [ebp - 0x13c], esi
cmp eax, dword [edi + 0x10]
jae 0x40238a
push 0x100
lea eax, [ebp - 0x130]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0x40887c
movzx eax, byte [ecx]
inc ecx
mov byte [ebp + eax - 0x130], 1
cmp ecx, 0x40887e
jne 0x402351
mov ecx, dword [edi + 0x10]
add ecx, esi
add esi, dword [ebp - 0x138]
cmp esi, ecx
jae 0x40238a
movzx eax, byte [esi]
cmp byte [ebp + eax - 0x130], 0
jne 0x402453
inc esi
cmp esi, ecx
jb 0x402374
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x402467
cmp dword [edi + 0x10], esi
mov ecx, esi
xorps xmm0, xmm0
mov dword [ebp - 0x144], 0
cmovb ecx, dword [edi + 0x10]
mov eax, edi
cmp dword [edi + 0x14], 0xf
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x140], 0
jbe 0x4023c7
mov eax, dword [edi]
push ecx
push eax
lea ecx, [ebp - 0x154]
call fcn.004058c0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x402408
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4023fe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402494
push ecx
push edx
call fcn.0040638a
add esp, 8
movups xmm1, xmmword [ebp - 0x154]
cmp dword [ebp - 0x140], 0xf
lea ecx, [ebp - 0x2c]
movq xmm0, qword [ebp - 0x144]
movd eax, xmm1
push 0
movups xmmword [ebp - 0x2c], xmm1
cmova ecx, eax
movq qword [ebp - 0x1c], xmm0
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
jne 0x40244b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40245e
lea eax, [esi + 1]
jmp 0x402315
sub esi, dword [ebp - 0x13c]
jmp 0x40238d
mov byte [ebp - 0x131], 0
jmp 0x40246e
mov byte [ebp - 0x131], 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x4024a4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40249a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40249a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040638a
add esp, 8
mov al, byte [ebp - 0x131]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4051f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4052ac
cmp byte [esi + 0x3d], 0
je 0x4052ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40529a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x405261
sub eax, 1
je 0x405265
sub eax, 2
jne 0x40529a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405283
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40529a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00406237
mov esp, ebp
pop ebp
ret

Function at 0x406c9a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x406cd9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406cd9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406cd9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406cd9
cmp dword [ecx + 0x74], 0xe
jbe 0x406cd9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408421
Capabilities:
Check os version
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1134
call fcn.0044f6d0
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Softwareprojonepodlp_agentmessages_
mov esi, reloc.WS2_32.dll_bind
push esi
call edi
push str.Softwareprojonepodlp_serviceMessages_
push esi
call edi
push 0x4b752c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x118
xor edi, edi
lea eax, [ebp - 0x1124]
push edi
push eax
mov dword [ebp - 0x1128], 0x11c
call fcn.00444cd0
add esp, 0xc
lea eax, [ebp - 0x1128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1124], 5
jne 0x4084a2
mov dword [0x4b7590], 1
push 4
pop ebx
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x1130]
push eax
push str.minimalInst
push 0x48eff0
push esi
mov dword [ebp - 0x1134], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4084e5
cmp dword [ebp - 0x1130], ebx
jne 0x4084e5
mov eax, dword [ebp - 0x112c]
jmp 0x4084e7
xor eax, eax
cmp eax, 1
lea eax, [ebp - 0x1008]
jne 0x408531
push str.__s._d_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push 0x48f030
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xdd
push str.._agentmgr.cpp
lea eax, [ebp - 0x1008]
push eax
push edi
call sym.gxbus32.exe_E7248973
add esp, 0x10
jmp 0x4085a9
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push str._AgentManagerThread
push 0xdf
push str.._agentmgr.cpp
mov ebx, str._s._d:_s
push ebx
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push edi
push 0x407e03
call fcn.0041fe02
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push str._ServiceMessageThread
push 0xe0
push str.._agentmgr.cpp
push ebx
lea eax, [ebp - 0x1008]
push 0x800
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x408310
call fcn.0041fe02
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
leave
ret
Function at 0x40b7bd
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00444cd0
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov word [ebp - 0x20a], ax
push str.System_Volume_Information
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b87d
push str.System_Volume_Information_not_found__will_create_it
call fcn.0041fa04
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b86c
push str.create_System_Volume_Information_failed
call fcn.0041fc97
pop ecx
xor eax, eax
jmp 0x40b89d
or eax, 6
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.cid
lea eax, [ebp - 0x210]
push eax
call esi
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044302b
leave
ret

Function at 0x40b8ab
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
xor esi, esi
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00444cd0
add esp, 0xc
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push esi
push esi
push esi
push 0x48f21c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop esi
test eax, eax
je 0x40b908
lea eax, [ebp - 0x44]
push eax
push str.ntfs
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40b908
mov eax, str.D:_system_Volume_informationcid
jmp 0x40b90a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044302b
leave
ret
Function at 0x40bfe7
Capabilities:
Delete file
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00444cd0
add esp, 0xc
lea ebx, [ebp - 0x210]
call fcn.0040b7bd
test eax, eax
jne 0x40c03e
push 0x48e56b
mov ecx, edi
call fcn.0040344e
jmp 0x40c071
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x210]
push eax
call esi
call fcn.0040b8ab
push eax
call esi
push 0x48f4e4
push 0x48eff0
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, edi
call fcn.0040bc6a
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, edi
pop ebx
call fcn.0044302b
leave
ret

Function at 0x40db7a
Capabilities:
Terminate process

Disassembly:
push 0x7c
mov eax, 0x488e2f
call fcn.0044465a
push str.blackCids
lea ecx, [ebp - 0x88]
call fcn.0040344e
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040c135
pop ecx
pop ecx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 2
call fcn.00403c15
lea eax, [ebp - 0x30]
push eax
call fcn.00420d7a
pop ecx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], ebx
je 0x40dc45
cmp byte [ebp - 0x64], 4
jne 0x40dc61
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042985a
mov ecx, eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.004058be
push ebx
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x4d], al
mov byte [ebp - 4], 3
call fcn.00403c15
cmp byte [ebp - 0x4d], bl
je 0x40dc45
lea edi, [ebp - 0x4c]
call fcn.0040bfe7
mov byte [ebp - 4], 6
cmp dword [ebp - 0x38], ebx
jne 0x40dcd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShuffleDeviceId_failed:__d
call fcn.0041fc97
pop ecx
pop ecx
push ebx
push esi
mov ecx, edi
call fcn.00403c15
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.00403c15
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x6c]
call fcn.0042966c
call fcn.004446dd
ret
cmp byte [ebp - 0x64], 6
jne 0x40dc45
lea eax, [ebp - 0x6c]
xor edi, edi
call fcn.0042a06a
test eax, eax
jbe 0x40dc45
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0042a0ba
cmp byte [eax + 8], 4
jne 0x40dcc4
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0042a0ba
push eax
lea ecx, [ebp - 0x88]
call fcn.0042985a
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.004058be
push ebx
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x4d], al
mov byte [ebp - 4], 3
call fcn.00403c15
cmp byte [ebp - 0x4d], bl
jne 0x40dc14
lea eax, [ebp - 0x6c]
inc edi
call fcn.0042a06a
cmp edi, eax
jb 0x40dc75
jmp 0x40dc45
push esi
push str.cidShuffled
push 0x48fa18
call fcn.0041dc6f
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [ebp - 0x48]
jae 0x40dcf2
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40dcfe
lea eax, [ebp - 0x2c]
push ecx
push eax
push str.cid__s_is_black__shuffled_to__s
call fcn.0041f8dc
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40f18d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x483b02
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
push edi
mov eax, dword [0x4a3070]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x18]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], eax
jmp 0x40f1de
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc]
call fcn.00405bac
test al, al
je 0x40f1d8
mov esi, dword [esi + 8]
jmp 0x40f1de
mov dword [esp + 0xc], esi
mov esi, dword [esi]
cmp byte [esi + 0x45], 0
je 0x40f1c4
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
lea edi, [esp + 0x18]
lea esi, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
call fcn.00435277
test al, al
jne 0x40f225
mov ecx, dword [esp + 0xc]
mov eax, dword [ebp + 8]
add ecx, 0xc
call fcn.00405bac
test al, al
je 0x40f2b4
xor esi, esi
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
call fcn.004043f6
push dword [ebp + 8]
lea ecx, [esp + 0x40]
mov dword [esp + 0x84], esi
call fcn.00403470
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 1
call fcn.00403470
mov byte [esp + 0x80], 2
push dword [esp + 0x14]
lea eax, [esp + 0x40]
push dword [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, ebx
call fcn.0040f314
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
mov dword [esp + 0x14], ecx
push 1
lea ecx, [esp + 0x60]
mov dword [esp + 0x1c], eax
call fcn.00403c15
push esi
push 1
lea ecx, [esp + 0x44]
call fcn.00403c15
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.00403c15
lea esi, [esp + 0x10]
call fcn.0040f788
add eax, 0x1c
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4110fe
Capabilities:
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00420fac
cmp dword [eax + 0x18], 8
jb 0x41111a
mov eax, dword [eax + 4]
jmp 0x41111d
add eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x20]
call fcn.00403d0d
lea ecx, [ebp - 0x20]
call fcn.00421025
cmp dword [eax + 0x18], 8
jb 0x411146
mov eax, dword [eax + 4]
jmp 0x411149
add eax, 4
push eax
call edi
push ebx
push 1
lea esi, [ebp - 0x20]
call fcn.00403d0d
push 0x48eff0
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ebx
push ebx
lea eax, [ebp - 4]
push eax
push 0x410fdb
push 1
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0041b768
cmp dword [ebp - 4], 2
jl 0x4111f4
call fcn.0040ff76
mov esi, 0x48f864
call fcn.0041cf53
mov esi, 0x48f84c
call fcn.0041cf53
mov esi, 0x48ff54
call fcn.0041cf53
mov esi, 0x48ff6c
call fcn.0041cf53
mov esi, 0x48ed90
call fcn.0041cf53
mov esi, 0x48f87c
call fcn.0041cf53
mov esi, 0x48ff84
call fcn.0041cf53
mov esi, 0x48ff9c
call fcn.0041cf53
push ebx
push ebx
push ebx
push 0x411061
push 1
push dword [ebp + 8]
call fcn.0041b768
mov esi, dword [ebp + 8]
call fcn.0041bee0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x411281
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c4
call fcn.0044f6d0
mov eax, dword [0x4a3070]
xor eax, esp
mov dword [esp + 0x11c0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [esp + 0x1ac]
mov dword [0x4b7598], eax
call fcn.0040ff0f
xor ebx, ebx
cmp dword [esp + 0x1c0], ebx
jne 0x4112ee
push str._CalcBusServName_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
push 1
call fcn.00403d0d
xor eax, eax
inc eax
mov ecx, dword [esp + 0x11cc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044302b
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x1c4], 8
mov eax, dword [esp + 0x1b0]
jae 0x411306
lea eax, [esp + 0x1b0]
push 0xe
push eax
mov esi, 0x4b75a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.004330c4
mov eax, dword [0x4b6078]
cmp eax, 2
jne 0x411376
mov eax, dword [0x4b6080]
mov eax, dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x41134c
push 0x4906f8
push eax
call esi
test eax, eax
jne 0x41134c
call fcn.00410035
jmp 0x4114a2
mov eax, dword [0x4b6080]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x4114a2
push 0x490700
push eax
call esi
test eax, eax
jne 0x4114a2
call fcn.0040ff76
jmp 0x4114a2
xor edi, edi
inc edi
cmp eax, edi
jne 0x411460
push str.GlobalA51BB395_ECF3_4294_9A75_995BAB94ED74
call fcn.004072a0
test eax, eax
je 0x4113a4
push ebx
push edi
lea esi, [esp + 0x1b4]
call fcn.00403d0d
mov eax, edi
jmp 0x4112d7
push 0x190
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.00444cd0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call fcn.004111fb
test eax, eax
jne 0x411428
push str.__s._d_
lea eax, [esp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str._LoadLibcurl_failed__service_cannot_start
lea eax, [esp + 0x1d0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0x1df
push str..pohost.cpp
lea eax, [esp + 0x1d0]
push eax
push ebx
call sym.gxbus32.exe_E7248975
add esp, 0x10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 1
jmp 0x411391
push 3
call dword [sym.imp.libcurl32.dll_curl_global_init]
pop ecx
lea eax, [esp + 0xc]
push eax
mov byte [0x4b4770], 1
mov byte [0x4b758e], 1
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x410dd9
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x4114a2
cmp eax, 3
jne 0x4114a2
mov eax, dword [0x4b6080]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x4114a2
push 0x49075c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4114a2
mov eax, dword [0x4b6080]
push dword [eax + 8]
push str.delete__s
call fcn.00433453
mov eax, dword [0x4b6080]
pop ecx
pop ecx
push dword [eax + 8]
call fcn.004110fe
xor edi, edi
jmp 0x411420