joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401eb0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov edi, str.GetAutoStartToReg_Enter_r_n
call fcn.00401000
push 0x103
xor esi, esi
lea eax, [esp + 0x19]
push esi
push eax
mov byte [esp + 0x20], 0
call fcn.00408410
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f63
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
push 0x4125a0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f4e
mov edi, str.Get_auto_start_registry_success__r_n
call fcn.00401000
mov esi, 1
jmp 0x401f58
mov edi, str.Get_auto_start_registry_error__r_n
call fcn.00401000
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00402bfe
add esp, 0x114
ret

Function at 0x401f80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0x1d0], eax
push esi
push edi
push 0x103
xor esi, esi
lea eax, [esp + 0xd9]
push esi
push eax
mov byte [esp + 0xe0], 0
call fcn.00408410
push 0xc7
lea ecx, [esp + 0x1d]
push esi
push ecx
mov byte [esp + 0x24], 0
call fcn.00408410
mov edi, str.SetAutoStartToReg_Enter_r_n
call fcn.00401000
push 0x412498
lea edx, [esp + 0xf0]
push 0x104
push edx
call fcn.00402d8d
push str.BackgroundServiceModemListener.exe_start
lea eax, [esp + 0xfc]
push 0x104
push eax
call fcn.00402d8d
push 0x4125a0
lea ecx, [esp + 0x40]
push str.ModemListener_Reg_Key_Value_:__s_r_n
push ecx
call fcn.00402c0d
lea edi, [esp + 0x48]
call fcn.00401000
lea edx, [esp + 0x110]
push edx
mov eax, edi
push str.ModemListener_Path:__s_r_n
push eax
call fcn.00402c0d
add esp, 0x48
call fcn.00401000
lea ecx, [esp + 8]
push ecx
push 0x20006
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4020a3
push 0x104
lea edx, [esp + 0xd8]
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push 0x4125a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40208e
mov edi, str.Set_auto_start_registry_success__r_n
call fcn.00401000
mov esi, 1
jmp 0x402098
mov edi, str.Set_auto_start_registry_error__r_n
call fcn.00401000
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str.SetAutoStartToReg_Exit_r_n
call fcn.00401000
mov ecx, dword [esp + 0x1d8]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00402bfe
add esp, 0x1d4
ret
Function at 0x4020d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd8
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0xd4], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x411f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4021ce
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.ProductPath
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0x104
call edi
mov ebx, eax
test ebx, ebx
je 0x402146
cmp ebx, 0xea
jne 0x4021bf
mov ecx, dword [esp + 8]
push esi
push ecx
call fcn.00402f20
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.ProductPath
push ecx
call edi
test eax, eax
jne 0x4021b5
mov edx, dword [esp + 0xc]
push edx
push esi
push 0x412498
xor ebx, ebx
call fcn.004091c0
push 0xc7
lea eax, [esp + 0x29]
push ebx
push eax
mov byte [esp + 0x30], bl
call fcn.00408410
push esi
lea ecx, [esp + 0x34]
push str.ModemListener_Path:__s_r_n
push ecx
call fcn.00402c0d
add esp, 0x24
lea edi, [esp + 0x18]
call fcn.00401000
push esi
call fcn.00402d4a
add esp, 4
pop esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.00402bfe
add esp, 0xd8
ret

Function at 0x402250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 1
push 0
push 0x411d60
push 0x80000002
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x14], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022b5
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push str.DeviceMgr
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4022c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0x110], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x411f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40238f
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x40e138
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, str.Open
lea eax, [esp + 0x10]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402360
test dl, dl
je 0x40235c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402360
add eax, 2
add ecx, 2
test dl, dl
jne 0x402340
xor eax, eax
jmp 0x402365
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40238b
mov eax, esi
mov dword [0x411b4c], 1
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00402bfe
add esp, 0x114
ret
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00402bfe
add esp, 0x114
ret

Function at 0x4023b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd8
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0xd4], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x411f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4024aa
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push str.AdapterDnsForIPv6
push eax
mov dword [esp + 0x20], 0x104
call edi
mov ebp, eax
test ebp, ebp
je 0x402422
cmp ebp, 0xea
jne 0x40249b
mov ecx, dword [esp + 8]
push esi
push ecx
call fcn.00402f20
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.AdapterDnsForIPv6
push ecx
call edi
test eax, eax
jne 0x402491
mov edx, dword [esp + 0xc]
push edx
push esi
push 0x412180
call fcn.004091c0
push 0xc7
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call fcn.00408410
push esi
lea ecx, [esp + 0x34]
push str.Get__DNS:__s_r_n
push ecx
call fcn.00402c0d
add esp, 0x24
lea edi, [esp + 0x18]
call fcn.00401000
push esi
call fcn.00402d4a
add esp, 4
pop esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.00402bfe
add esp, 0xd8
ret
Function at 0x4024c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x411f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4024e9
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
push str.WriteDNSFlag
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x402526
cmp eax, 0xea
jne 0x402584
mov ecx, dword [esp + 8]
push ecx
call fcn.00402f20
mov ecx, dword [esp + 0x10]
add esp, 4
lea edx, [esp + 8]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push str.WriteDNSFlag
push ecx
call edi
test eax, eax
jne 0x40257b
push 1
push 0x40e178
push esi
call fcn.00402c8a
add esp, 0xc
test eax, eax
jne 0x40257b
mov edi, str.Get_DNS_Flag_value_1_r_n
call fcn.00401000
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.00402d4a
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x4025a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd8
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0xd4], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x411f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40269e
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.AdapterNetCfgID
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0x104
call edi
mov ebx, eax
test ebx, ebx
je 0x402616
cmp ebx, 0xea
jne 0x40268f
mov ecx, dword [esp + 8]
push esi
push ecx
call fcn.00402f20
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.AdapterNetCfgID
push ecx
call edi
test eax, eax
jne 0x402685
mov edx, dword [esp + 0xc]
push edx
push esi
push 0x412288
call fcn.004091c0
push 0xc7
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call fcn.00408410
push esi
lea ecx, [esp + 0x34]
push str.Get_Adapter_ID:__s_r_n
push ecx
call fcn.00402c0d
add esp, 0x24
lea edi, [esp + 0x18]
call fcn.00401000
push esi
call fcn.00402d4a
add esp, 4
pop esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.00402bfe
add esp, 0xd8
ret
Function at 0x4026c0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x2e4
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0x2e0], eax
push ebx
push edi
xor ebx, ebx
push 0x18f
lea eax, [esp + 0x59]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0x60], bl
call fcn.00408410
add esp, 0xc
mov edi, str.SetAdapterDns_enter_r_n
call fcn.00401000
cmp byte [0x412180], bl
je 0x4028c7
cmp byte [0x412288], bl
je 0x4028c7
mov eax, str.SYSTEMCurrentControlSetServicesTCPIP6ParametersInterfaces_
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402720
push esi
sub eax, edx
push eax
push str.SYSTEMCurrentControlSetServicesTCPIP6ParametersInterfaces_
lea ecx, [esp + 0x60]
push 0x190
push ecx
call fcn.00402e01
push 0x412288
lea edx, [esp + 0x6c]
push 0x190
push edx
call fcn.00402d8d
push 0xc4
lea eax, [esp + 0x248]
push ebx
mov ecx, 0x10
mov esi, 0x40e1f0
lea edi, [esp + 0x20c]
push eax
mov dword [esp + 0x38], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00408410
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0x28
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push ebx
push 0xf003f
push ebx
lea eax, [esp + 0x34]
push eax
push ebx
lea ecx, [esp + 0x204]
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x402819
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x4027c0
mov edi, str.SetAdapterDns_Interfaces_key_is_exist__r_n
jmp 0x4027ca
cmp eax, 1
jne 0x4027cf
mov edi, str.SetAdapterDns_Interfaces_key_create_success__r_n
call fcn.00401000
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
lea ecx, [esp + 0x50]
push ecx
push ebx
push 0x412288
push edx
mov dword [esp + 0x3c], ebx
call esi
test eax, eax
jne 0x402819
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x40280a
mov edi, str.SetAdapterDns_Guid_key_is_exist__r_n
jmp 0x402814
cmp eax, 1
jne 0x402819
mov edi, str.SetAdapterDns_Guid_key_create_success__r_n
call fcn.00401000
lea eax, [esp + 0xc]
push eax
push 0x20006
push ebx
lea ecx, [esp + 0x64]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402868
lea edi, [esp + 0x58]
call fcn.00401000
mov edi, str._r_nSubKey_Not_exist__r_n
call fcn.00401000
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x2e0]
xor ecx, esp
call fcn.00402bfe
add esp, 0x2e4
ret
mov eax, 0x412180
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402870
sub eax, edx
mov edx, dword [esp + 0xc]
push eax
push 0x412180
push 1
push ebx
push str.NameServer
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x40284b
mov edi, str.SetAdapterDns_exit__r_n
call fcn.00401000
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2e0]
xor ecx, esp
call fcn.00402bfe
add esp, 0x2e4
ret
mov edi, str.DNS_or_NetCfgId_is_empty__r_n
call fcn.00401000
mov ecx, dword [esp + 0x2e8]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00402bfe
add esp, 0x2e4
ret
Function at 0x402bfe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410040]
jne 0x402c08
repz ret
jmp fcn.004032dd

Function at 0x404411
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x404434
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
invalid
inc ebp
int3
Function at 0xc2df9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.00c2f249
jmp 0xc13d6a
jmp 0xc13d8d
Function at 0xc339e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov bh, 0x50
sub esp, 3
jg 0xc33a1a
jle 0xc33a04
dec edx
in eax, 0x14
xchg esp, ecx
aam 0xa4
out dx, eax
aam 0xa6
ljmp 0xd4eb
jmp 0xc339be
mov si, bx
jmp 0xc339cf
rdtsc
lea esp, [esp + 3]
mov cx, word [esp]
jmp 0xc33a2d
rdtsc
lea esp, [esp + 3]
mov cx, word [esp]
mov ah, byte [esp]
jmp 0xc33a64
mov ah, byte [esp]
mov eax, 0x933fc6fd
jmp 0xc33a69
add esp, 0
jno 0xc33a74
lea esp, [esp + 2]
mov esi, dword [esp]
pushfd
jmp 0xc33c7c
mov eax, 0x933fc6fd
btr ecx, eax
push bx
mov bh, byte [esp + 1]
jmp 0xc33a4e
lea esp, [esp + 2]
mov esi, dword [esp]
jmp 0xc33aa2
lea esp, [esp + 8]
dec dh
jmp 0xc33aa9

Function at 0xc339ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov bh, 0x50
sub esp, 3
jg 0xc33a1a
jle 0xc33a04
dec edx
in eax, 0x14
xchg esp, ecx
aam 0xa4
out dx, eax
aam 0xa6
ljmp 0xd4eb
jmp 0xc339be
mov si, bx
jmp 0xc339cf
rdtsc
lea esp, [esp + 3]
mov cx, word [esp]
jmp 0xc33a2d
rdtsc
lea esp, [esp + 3]
mov cx, word [esp]
mov ah, byte [esp]
jmp 0xc33a64
mov ah, byte [esp]
mov eax, 0x933fc6fd
jmp 0xc33a69
add esp, 0
jno 0xc33a74
lea esp, [esp + 2]
mov esi, dword [esp]
pushfd
jmp 0xc33c7c
mov eax, 0x933fc6fd
btr ecx, eax
push bx
mov bh, byte [esp + 1]
jmp 0xc33a4e
lea esp, [esp + 2]
mov esi, dword [esp]
jmp 0xc33aa2
lea esp, [esp + 8]
dec dh
jmp 0xc33aa9

Function at 0xc65798
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc66fa2
mov ebx, eax
mov ebx, eax
mov ebx, dword [esp + 0x20]
lea esp, [esp + 0x24]
jmp fcn.00c2f298
lea esp, [esp + 1]
mov esi, dword [esp + 0x1c]
mov bh, 0x49
mov ebx, dword [esp]
mov ebx, edx
mov bx, word [esp]
jmp 0xc6579d
Function at 0xc679a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
push ebx
jmp 0xc6951a
push 0xffffffffffffffff
call fcn.00c29fb7
cmc
test eax, eax
call fcn.00c67ad0
mov edx, dword [edi]
stc
jno 0xc69211
bsf eax, ebp
jmp 0xc69214
bsf eax, ebp
jmp 0xc69245
lea esp, [esp + 3]
sub edi, 2
bswap ecx
lea ecx, reloc.KERNEL32.DLL_WriteFile
dec cx
jmp 0xc69605
mov al, byte [edi + 4]
mov cl, 0xdb
lea ecx, [ecx + esi]
sub esp, 0x13
jl 0xc69216
jge 0xc697fd
lea esp, reloc.KERNEL32.DLL_WriteFile
fidiv dword [reloc.KERNEL32.DLL_WriteFile]
in al, dx
mov dword [reloc.KERNEL32.DLL_WriteFile], eax
push ss
and esp, ebp
aam 0x76
lcall 0x25f9, 0xbe579dd1
lea esp, [esi + 0x51]
jge 0xc69253
and eax, 0x7d51668d
in eax, 0x11
push ds
adc dword [esi], ebx
bound edi, qword [edx - 0x41961d80]
inc esi
mov dword [reloc.KERNEL32.DLL_WriteFile], eax
salc
in eax, dx
sti
pop esi
mov ebx, 0xb75a4a43
les esp, [edx - 0x4d]
test al, 0x44
mov bl, 0xc0
add al, 0xb5
jnp 0xc69268
in eax, 0x1a
retf
sub esp, 0x1c
mov word [esp + 4], sp
lea esp, [esp + 0x1c]
push dword [ebp + 8]
jmp 0xc691e4
push cs
in al, 0xcf
push esi
rol dword [eax - reloc.KERNEL32.DLL_WriteFile], 0xdd
invalid
jg 0xc69580
adc esp, dword [edx + 0x32]
cmpsb byte [esi], byte es:[edi]
invalid
jnp 0xc69659
jp 0xc69659
push edi
sbb eax, 0x50658155
jl 0xc6959a
js 0xc695c3
wait
mov dword [ebx], reloc.KERNEL32.DLL_WriteFile
in eax, 0xfe
or ah, byte [ebp + 0x24047d4]
cli
in eax, 0x11
cmc
sub eax, 0xa0744418
lodsd eax, dword [esi]
fnsave dword [reloc.KERNEL32.DLL_WriteFile]
bound edi, qword [edi + 0x5c44e7d7]
invalid
xchg ecx, eax
call fcn.00c695cf
adc cl, byte [ebp - 0x618590e4]
push ss
loope 0xc696d3
ja 0xc69605
mov ah, 0x69
xchg esp, eax
lodsd eax, dword [esi]
sub ebx, esp
add al, 0xb9
fsubr dword [edi]
adc eax, 0x86b28574
pop ss
sar esi, 1
pop ds
arpl word [ebp + 0x14], si
xchg edi, eax
mov edx, 0x7f0b838d
add byte [eax], al
sub esp, 0x11
lea esp, [esp + 1]
jmp 0xc696af
mov eax, dword [esi]
mov edx, 0x7518184c
mov dx, 0xe6aa
xchg edx, ebx
jmp 0xc6986c
fdivr st(2)
clc
fst qword [ebp + 0x3a32a8b7]
mov bl, 0xa
inc ecx
sbb ah, ch
pushal
lmsw word [edi - 0x1d]
pop ecx
iretd
lea esp, [esp + 3]
jmp 0xc6921a
mov dl, byte [esi + 4]
lea ebx, [edx + edi]
mov bx, 0xf907
mov bh, cl
jmp 0xc69889
sub esi, 2
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0xc698e2
xchg edx, ecx
lea ebx, reloc.KERNEL32.DLL_WriteFile
mov bl, 0xbe
jmp 0xc69944
rol eax, cl
mov bx, word [esp]
mov bh, 0x4e
mov ebx, 0x307d0d4
mov ebx, dword [esp]
jmp 0xc698b0
xchg edx, ecx
xchg bh, bl
mov bx, word [esp]
lea ebx, [eax*4]
jmp 0xc698c6
mov dword [esi + 4], eax
xchg al, ah
xchg dx, bx
call fcn.00c69909
lodsd eax, dword [esi]
mov esp, 0x1df5168f
mov word [eax + 0x713814ce], cs
mov eax, 0x14a6a372
add dh, ah
pop ecx
shl dword [esi + 0x43], cl
or bh, 0xac
in eax, dx
pop eax
stc
sbb byte [esi - 0x54], bl
sbb byte [ebx - 0x16], bh
invalid

Function at 0xc6958b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
push word [esp]
jmp 0xc695e1
rdtsc
lea esp, [esp + 2]
jmp fcn.00c49cef
jge 0xc695a9
rdtsc
lea esp, [esp + 2]
jmp fcn.00c49cef
Function at 0xc695cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dl
push dword [esp + 2]
jo 0xc69586
mov dword [esp], edi
jmp 0xc69589
rol edx, cl
pushfd
xchg ecx, eax
push edi
jmp 0xc6952e
mov dword [edi + 4], edx
mov dh, 0xc2
call fcn.00c69552
outsb dx, byte [esi]
mov ch, 0x36
cmpsd dword [esi], dword es:[edi]
inc esi
mov edx, 0x2fc95e8c
jp 0xc6958d
mov dword [esp], edi
jmp 0xc69568
mov word [esp + 1], dx
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xc6954b

Function at 0xc7555d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xdb53d4a1
mov eax, dword [edi + 4]
mov ecx, ebp
mov ecx, dword [esp]
jmp 0xc754b3
lea ecx, [ecx + 0x7b]
jmp 0xc754d2
sub edi, 4
bsf cx, dx
jmp 0xc75527
mov ecx, 0xeb9c93cc
push bp
call 0xc75504
test dword [edi], esi
dec esi
call 0x6ca97630
sbb dword [0x38d98ff6], edi
mov ebx, dword [ebp - 0xc]
xor al, bl
call fcn.00c754cb
lea esp, [esp + 2]
jmp 0xc7550e
imul edx
mov cx, word [esp]
not cx
jmp 0xc75579
jnp 0xc754df
mov ecx, 0xeb9c93cc
push bp
jmp 0xc754e6
lea ecx, [ecx + 4]
mov dword [ecx], edx
call fcn.00c75532
mov dword [edi + 8], eax
mov edx, ecx
call 0xc7555d
ja 0xc755c4
push ecx
lea esp, [esp + 2]
jmp 0xc755a1
pushal
mov dword [esp + 0x18], edi
popal
jmp 0xc75548
mov edx, dword [esp]
jmp fcn.00c33eb7
pushfd
pop dword [edi]
xchg cx, ax
setnp cl
bswap eax
jmp 0xc75581
call 0xc755ae
Function at 0xd0da19
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, ecx
xchg byte [esp], al
sub esp, 0x14
mov cl, 0xce
pop word [esp + 2]
mov eax, dword [esp + 4]
jmp 0xd0da1f
std
xchg dword [esp], ecx
jmp 0xd0d9f9
bsf bx, dx
mov si, word [esp + 0x15]
cpuid
xchg al, cl
mov ah, byte [esp + 0x15]
xchg cl, dh
jmp 0xd0da70
add esp, 0xe
xchg edi, ecx
mov si, 0xc7e6
bsf edi, ecx
jmp 0xd0dc5d
pop word [esp + 2]
cld
bsf ax, si
sets ch
rcr bp, cl
pop edi
jmp 0xd0da5a
mov bx, 0xe3a0
add esp, 0
rdtsc
bsf edx, edx
jmp 0xd0dada
add esp, 2
mov dh, byte [esp]
add esp, 0
mov si, word [esp]
xchg esi, ebx
cmc
jmp 0xd0dab2
lea ebx, reloc.KERNEL32.DLL_WriteFile
xchg ecx, edx
sbb ecx, 0x387b7b69
bsr eax, ebp
mov esi, dword [esp]
xchg al, ch
jmp 0xd0db25
cld
mov di, 0x1270
neg ah
xchg word [esp], dx
mov word [esp], bp
mov ah, dl
jmp 0xd0dac8
mov byte [esp], bh
bsf ebp, edi
xchg byte [esp], dh
lea edx, reloc.KERNEL32.DLL_WriteFile
jmp 0xd0dc2e
mov ebx, 0x54abc30b
cld
dec edi
mov dx, 0x601f
mov ebp, 0x5ecf1444
xchg bp, ax
jmp 0xd0db0e
cld
cld
mov bl, 0xe0
setp dl
mov byte [esp], dl
lea eax, [edi + ebp]
jmp 0xd0dba0
mov eax, dword [esp]
mov ebx, eax
mov al, byte [esp]
mov cx, word [esp]
xchg dh, bl
bswap esi
jmp 0xd0db39
adc eax, 0x6e3a623d
xchg dh, bh
xchg edx, eax
neg edi
add esp, 4
jmp 0xd0dbc8
pop word [esp + 3]
mov ecx, edx
mov bx, 0x7230
mov byte [esp + 3], bh
bsr bp, sp
sbb al, dl
jmp 0xd0db61
mov byte [esp], ch
sub esp, 0x11
pop dword [esp + 6]
mov bl, 0xb6
mov ch, cl
pop edx
jmp 0xd0db77
xchg word [esp], cx
pop si
lea edx, [ebx*4]
mov edi, dword [esp]
jmp 0xd0dbe2
lea ebp, [edi*4]
pop ax
push word [esp]
mov ebp, 0x8bafa8ec
lea esi, [ebp - 0x7c]
rol al, 4
jmp 0xd0dbb1
btr ebp, edx
not edi
lea edx, [esi + edi]
mov eax, 0x8ee2d283
rdtsc
sete ch
jmp 0xd0dc10
div ch
mov dh, bl
clc
and ah, 0x34
setnp bh
mov si, ax
mov ch, 0xe0
jmp 0xd0db4f
mov dl, bh
cld
push word [esp + 1]
mov ebx, ebp
mov cx, word [esp + 1]
xchg di, si
jmp 0xd0dc3e
bsr edx, edx
add esp, 0
xchg byte [esp], al
stc
dec esi
not bx
jmp 0xd0dbfd
or ebx, 0xf81752ac
mov ecx, 0x52dfabfa
lea esp, [esp + 1]
call int.00d0de10
add eax, 0x897a1f8f
jl 0xd0dbfb
invalid
push word [esp + 2]
xchg ebp, esi
mov ebx, dword [esp + 4]
pop ax
clc
clc
jmp 0xd0dafb
Function at 0x4057b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x5341c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.00470cd0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.UltraUninstallerInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x405897
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405864
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4fd904
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x405852
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044666a
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x405882
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x40588f
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.004052a0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0044666a
mov esp, ebp
pop ebp
ret