joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459208
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4713c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00459147
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00446fa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x459257
cmp dword [ebp - 0x1c], 5
jb 0x45926f
jmp 0x45926b
cmp dword [ebp - 0x10], 1
jne 0x45926f
cmp dword [ebp - 0x1c], 4
ja 0x45926b
jne 0x45926f
cmp dword [ebp - 0x18], 0
jbe 0x45926f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x461944
call fcn.00458ffa
test eax, eax
jge 0x459290
mov byte [0x4759ac], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004414cc
add ebp, 0x78
leave
ret
Function at 0x3c15a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x3c180d
jne 0x3c180d
je 0x3c11e6
jne 0x3c12ed
add byte [eax], al
add byte [eax], al
Function at 0x3c3620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
je 0x3c37a8
jne 0x3c37a8
Function at 0x3c4860
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x3c48b6
jne 0x3c48b6
jmp 0x3ea883b2
inc ebp
cmp ebp, dword [esi + edi + 0x18]
jb 0x3c48d7
xor eax, eax
jmp 0x3c4890
mov eax, dword [esp]
je 0x3c487c
jne 0x3c487c
jmp 0x6848ff8f
movzx ecx, word [eax + ebp*2]
xor eax, eax
cmp dword [esi + edi + 0x14], ecx
jb 0x3c4890
mov eax, dword [esi + edi + 0x1c]
je 0x3c48f9
jne 0x3c48f9
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + edi + 0x24]
mov ebx, dword [esi + edi + 0x20]
xor ebp, ebp
je 0x3c491b
jne 0x3c491b
je 0x3c24da
jne 0x3c140a
push eax
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, dword [edx]
cmp dword [ecx + 0x7c], 0
je 0x3c4890
je 0x3c4938
jne 0x3c4938
je 0x3c369f
jne 0x3c2cb7
je 0x1e74d66
mov eax, dword [ebx + ebp*4]
add eax, esi
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call dword [eax + 0x24]
je 0x3c4907
invalid
jne 0x3c4907
je 0x3c268a
jne 0x3c2922
jmp 0x3ca558a
lea ecx, [esi + ecx*4]
add esi, dword [eax + ecx]
mov eax, esi
je 0x3c4890
jne 0x3c4890
je 0x844c0990
test eax, eax
je 0x3c4874
invalid
je 0x3c4869
jne 0x3c4869
add eax, esi
add ebx, esi
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax]
je 0x3c48d7
jne 0x3c48d7
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + 4]
mov edi, dword [ecx + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x3c4890
cmp dword [esi + edi + 0x14], 0
je 0x3c4890
je 0x3c489c
jne 0x3c489c
push ebp
push ebx
je 0x3c4a05
jne 0x3c4a05
je 0x448a3b
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov ebx, ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
je 0x3c49d8
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ecx + 0x2474ffcb], cl
and bh, bh
je 0x3c49ab
and byte [eax + 0x74], dl
dec ebp
jne 0x3c49d8
je 0x3c13d2
jne 0x3c363b
add byte [eax], al
add byte [eax], al
test edi, edi
je 0x3c49fb
push 0x8000
push 0
push edi
call dword [ebx + 0xc]
je 0x3c49fb
or al, 0x74
dec ebp
jne 0x3c49fb
jmp 0x8178a740
mov ebx, dword [ebp + 0x3c]
cmp dword [ebp + ebx], 0x4550
jne 0x3c49fb
mov edi, dword [esp + 0x14]
add ebx, ebp
push 4
je 0x3c49ca
jne 0x3c49ca
push 0x3000
push 0x14
push 0
je 0x3c4a1c
jne 0x3c4a1c
jmp 0xec7f322d
push ecx
call fcn.003c3620
add esp, 0x10
test eax, eax
je 0x3c49f0
mov esi, edi
mov dword [edi + 0x10], 1
jmp 0x3c49fb
je 0x3c499d
jne 0x3c499d
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop edi
je 0x3c49f4
jne 0x3c49f4
je 0x6cc7a060
push edi
push esi
mov ebp, dword [esp + 0x18]
and al, 0x18
xor esi, esi
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x3c49fb
je 0x3c49b1
jne 0x3c49b1
call dword [edi]
mov ecx, edi
mov dword [eax + 4], ebp
mov dword [eax], ebx
mov edi, eax
mov dword [eax + 0xc], 0
je 0x3c4970
jne 0x3c4970
nop word [eax + eax]
ret
Function at 0x3c7f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1400
call fcn.00404b40
mov eax, dword [esp + 0x1418]
movdqa xmm4, xmmword [0x40a290]
movdqa xmm6, xmmword [0x40a2a0]
mov esi, 0xfffffc00
pxor xmm2, xmm2
nop
movdqa xmm3, xmm4
movdqa xmm7, xmmword [0x40a2c0]
movdqa xmm0, xmm4
movdqa xmm1, xmm4
movdqa xmm5, xmm4
pand xmm3, xmm6
psrld xmm0, 6
pand xmm1, xmmword [0x40a320]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x40a2b0]
pcmpeqd xmm1, xmm2
pand xmm1, xmmword [0x40a330]
pxor xmm0, xmm3
movdqa xmm3, xmm4
pand xmm3, xmm7
movdqa xmm7, xmmword [0x40a2e0]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x40a2d0]
pand xmm5, xmm7
movdqa xmm7, xmmword [0x40a350]
pcmpeqd xmm5, xmm2
pand xmm5, xmmword [0x40a2f0]
pxor xmm3, xmm0
pand xmm0, xmm6
pcmpeqd xmm0, xmm2
pxor xmm1, xmm5
movdqa xmm5, xmm4
pand xmm5, xmmword [0x40a340]
pcmpeqd xmm5, xmm2
pand xmm5, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm4
paddd xmm4, xmmword [0x40a2e0]
pand xmm1, xmmword [str._b_b_b_b]
pxor xmm5, xmm3
pand xmm3, xmmword [0x40a2c0]
pcmpeqd xmm1, xmm2
pcmpeqd xmm3, xmm2
pand xmm1, xmmword [0x40a310]
pand xmm3, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm0
pand xmm0, xmmword [0x40a370]
pandn xmm1, xmmword [0x40a360]
psrld xmm5, 2
por xmm0, xmm1
pxor xmm0, xmm5
pxor xmm0, xmm3
movdqu xmmword [esp + esi + 0x400], xmm0
add esi, 0x10
jne 0x3c7fb0
mov esi, eax
mov eax, 0xfffffc00
shr esi, 2
nop word [eax + eax]
mov ebx, dword [esp + eax + 0x400]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
mov dword [esp + eax + 0x800], ebx
add eax, 4
jne 0x3c80d0
mov eax, dword [esp]
mov edi, dword [esp + 0x400]
xor ebp, ebp
mov ebx, eax
shr ebx, 8
nop
mov ecx, eax
xor ecx, ebp
movzx ecx, cl
mov ecx, dword [esp + ecx*4]
xor ecx, ebx
movzx edx, cl
shr ecx, 8
xor ecx, dword [esp + edx*4]
movzx edx, cl
shr ecx, 8
mov edx, dword [esp + edx*4]
xor edx, edi
xor edx, ecx
mov dword [esp + ebp*4 + 0x800], edx
inc ebp
cmp ebp, 0x100
jne 0x3c8110
movzx eax, al
Function at 0x3c9d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
je 0x3c9fb2
jne 0x3c9fb2
jmp 0x4c9869b

Function at 0x3cadf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
je 0x3cb0ab
jne 0x3cb0ab
je 0x3c93c2
jne 0x3ca2d9
add byte [eax], al
add byte [eax], al
push ebx
push edi
push esi
je 0x3cb126
jne 0x3cb126
add byte [eax], al
add byte [eax], al
Function at 0x3d0d80
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
je 0x3d0e62
jne 0x3d0e62
add byte [eax], al
add byte [eax], al
jmp 0x3d0e82
je 0x3d0e7d
jne 0x3d0e7d
je 0x3d0acf
jne 0x3d0cec
je 0xeb4d5141
fmul qword [edi]
test byte [edi + 0x5b], bl
ret 4
lea ecx, [ebx + 0x14]
push eax
je 0x3d0e55
jne 0x3d0e55
jmp 0x2ea40781
je 0x3d0deb
jne 0x3d0deb
add byte [eax], al
add byte [eax], al
test eax, eax
je 0x3d0e43
je 0x3d0e88
jne 0x3d0e88
jmp 0x894154aa
mov dword [esi + 4], eax
mov eax, esi
pop esi
push 0x3d0db9
ret
call fcn.00404b2a
add esp, 4
mov edi, eax
jmp 0x3d0e14
mov dword [esi], edi
mov eax, dword [ebx + 0x10]
je 0x3d0e1d
jne 0x3d0e1d
jmp 0x3d4bc8b9
push ecx
push edi
call fcn.003c5df0
push 0x3d0eac
ret
je 0x3d0e6a
je 0x3d0ea4
jne 0x3d0ea4
je 0x10616af9
mov ebx, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [ebx + 0x10]
add eax, 3
push eax
jmp 0x3d0e37
mov eax, 0xfffffffe
je 0x3d0e0c
jne 0x3d0e0c
je 0x834d5217
mov eax, dword [ebx + 0x10]
add eax, 2
push 0x3d0e96
ret
rol byte [edx], 0x68
xchg esi, eax
push cs
cmp eax, 0x840fc300
je 0x3d0d98
push 0x3d0df4
ret
jne 0x3d0e6a
jmp 0x3d0e68
Function at 0x3e74a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x1d], ch
test byte [eax + eax], bh
ret
jmp fcn.003e63fd
pop edi
pop ebx
pop ebp
jmp 0x3e6730
setne cl
mov eax, ecx
test eax, eax
je 0x3e6c9f
jne 0x3e6c9f
mov eax, dword [esi + 4]
mov dword [eax + 0x418], 0
je 0x3e6ffc
jmp 0x3e702a
push dword [esi + 4]
call dword [sym.imp.HDWOMH_6aod_OddwmGzmpl_ieUfephml]
mov eax, 1
pop esi
pop edi
je 0x3e6ff8
jne 0x3e6ff8
add esp, 8
push 0x3e723e
ret
ret 8
jmp 0x3e6fda
jne 0x3e6ffc
je 0x3e658a
jmp 0x3e70de
jne 0x3e6964
invalid
jmp 0x3e751a
push ebp
push ebx
je 0x3e7545
jne 0x3e7545
jmp 0x3eb50d8d
push 0x3e7698
ret
push ecx
call fcn.003c4860
add esp, 0xc
jmp 0x3e7790
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov esi, ecx
lea ecx, [esp + 8]
je 0x3e76a5
jne 0x3e76a5
jmp 0xc6fa74
push eax
push ebx
jmp 0x3e7529
mov edi, esp
mov ecx, edi
push 0x41fb6d
call fcn.003d0d80
je 0x3e77e6
jne 0x3e77e6
je 0x3e6fc7
jne 0x3e605b
je 0x3c827f
invalid
push 0x41fb57
call fcn.003d0d80
je 0x3e766a
jne 0x3e766a
add byte [eax], al
add byte [eax], al
push 0x3e7634
ret
lea ecx, [esi + 0x10]
je 0x3e75bf
jne 0x3e75bf
je 0x3e6d05
jne 0x3e694e
jmp 0x3eb4505d
je 0x3e7521
jne 0x3e7521
jmp 0x5e4f3c24
mov ecx, edi
call fcn.003d0f90
je 0x3e76d5
jne 0x3e76d5
add byte [eax], al
add byte [eax], al
push 0x3e76c1
ret
Function at 0x3f2fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov dword [eax + 0x10], esi
mov esi, dword [edx + 4]
mov dword [eax + 0x14], esi
mov esi, dword [edx + 8]
mov dword [eax + 0x18], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0x1c], esi
lea esi, [edx + 0x10]
cmp ecx, 0x100
cmovne esi, edx
mov ecx, str.expand_32_byte_kexpand_16_byte_k
mov edx, 0x40a690
cmove edx, ecx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0x24], ecx
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x3f30f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x78], ecx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x5c], eax
mov ebp, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
mov edi, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x74], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ebp, dword [esp + 0x54]
Function at 0x3fc660
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x3fc6f3
mov dword [eax + 0x48], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x44], 0x5be0cd19
mov dword [eax + 0x40], 0x137e2179
xor eax, eax
ret
mov eax, 1
ret

Function at 0x3fc7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x320
mov eax, 0xffffffc0
nop word cs:[eax + eax]
nop
movsd xmm0, qword [ecx + eax + 0x48]
movsd qword [esp + eax + 0x90], xmm0
add eax, 8
jne 0x3fc810
mov dword [esp + 0x94], ecx
mov eax, 0xffffff80
mov ecx, dword [edx + eax + 0x80]
mov esi, dword [edx + eax + 0x84]
bswap esi
bswap ecx
mov dword [esp + eax + 0x11c], ecx
mov dword [esp + eax + 0x118], esi
add eax, 8
jne 0x3fc830
mov eax, 0xfffffe00
nop word [eax + eax]
mov esi, dword [esp + eax + 0x308]
mov ecx, dword [esp + eax + 0x30c]
mov edi, ecx
shld edi, esi, 0xd
mov edx, esi
shld edx, ecx, 0xd
mov ebx, ecx
shld ebx, esi, 0x1a
xor ebx, edi
mov edi, ecx
shld edi, esi, 3
shld esi, ecx, 3
xor ebx, esi
mov dword [esp + 8], ebx
shr ecx, 6
xor ecx, edx
xor ecx, edi
mov edi, dword [esp + eax + 0x2a0]
mov edx, dword [esp + eax + 0x2a4]
mov esi, edx
shld esi, edi, 0x1f
mov ebx, edx
shld ebx, edi, 0x19
xor ebx, esi
mov esi, edx
shld esi, edi, 0x18
xor ebx, esi
mov esi, edi
shld esi, edx, 0x1f
shld edi, edx, 0x18
shr edx, 7
xor edx, esi
xor edx, edi
mov esi, dword [esp + eax + 0x298]
add esi, dword [esp + eax + 0x2e0]
mov edi, dword [esp + eax + 0x29c]
adc edi, dword [esp + eax + 0x2e4]
add esi, dword [esp + 8]
adc edi, ecx
add esi, ebx
adc edi, edx
mov dword [esp + eax + 0x318], esi
mov dword [esp + eax + 0x31c], edi
add eax, 8
jne 0x3fc860
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], 0
nop word [eax + eax]
Function at 0x3fd690
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
push edi
push esi
sub esp, 0xa0
mov esi, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
push edi
push 0x20
push dword [esp + 0xc0]
call fcn.003fd460
add esp, 0xc
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
mov ebx, esp
push edi
push ebx
call fcn.003f7780
add esp, 8
push ebx
push esi
call fcn.003f7710
add esp, 0xa8
pop esi
pop edi
pop ebx
ret
Function at 0xf798d6c2
Capabilities:
Install driver
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
push 1
call dword [0xf798dd30]
test eax, eax
jge 0xf798d6dd
mov eax, 0xc0000034
jmp 0xf798d732
push esi
mov esi, dword [0xf798dd2c]
push edi
push 4
pop edi
push edi
lea eax, [ebp + 0x10]
push eax
push edi
push 0xf798d6aa
push dword [ebp + 8]
push 1
call esi
test eax, eax
jl 0xf798d730
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [0xf798dd0c]
lea eax, [ebp - 8]
push eax
call dword [0xf798dd28]
push edi
mov ebx, eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0xf798d6b6
push dword [ebp + 8]
mov dword [ebp + 0x10], edi
push 1
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0xf798d8b2
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0xf798d810
push 0xf798d820
call fcn.f798d736
mov edi, eax
test edi, edi
jge 0xf798d8d7
jmp 0xf798d92d
push esi
mov esi, dword [ebp - 4]
test esi, esi
je 0xf798d927
push 4
pop eax
cmp dword [esi + 4], eax
jne 0xf798d91e
cmp dword [esi + 0xc], eax
jne 0xf798d91e
mov ecx, dword [esi + 8]
cmp dword [esi + ecx], eax
je 0xf798d911
push eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0xf798d898
push 0xf798d8a4
push 1
mov dword [ebp - 8], eax
call dword [0xf798dd2c]
mov edi, eax
push 0
push esi
call dword [0xf798dd14]
mov eax, edi
jmp 0xf798d92c
push 0
push esi
call dword [0xf798dd14]
mov eax, 0xc0000001
pop esi
pop edi
leave
ret
Function at 0x402d63
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1b4]
push ebx
push esi
push edi
push 0x4b3140
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.004018f6
lea eax, [ebp - 0x7c]
push eax
call fcn.00402fcd
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00476cc0
mov eax, dword [ebp - 0x78]
add esp, 0x10
cmp dword [ebp - 0x64], 8
jae 0x402dc0
lea eax, [ebp - 0x78]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x4b2fd0
push eax
lea eax, [ebp - 0x60]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x60]
push eax
call edi
test eax, eax
lea eax, [ebp - 0x60]
je 0x402e31
push 0x4b3010
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x60]
push eax
call fcn.00401aaf
mov ecx, dword [ebp - 0x80]
push 0x4b3018
call fcn.004019f8
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00401ad3
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476d3a
add ebp, 0x1ac
leave
ret
push ebx
push 0
push eax
call fcn.00476cc0
mov eax, dword [ebp - 0x78]
add esp, 0xc
cmp dword [ebp - 0x64], 8
jae 0x402e49
lea eax, [ebp - 0x78]
push 0x4b301c
push eax
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call edi
test eax, eax
je 0x402e64
lea eax, [ebp - 0x60]
jmp 0x402de5
lea eax, [ebp - 0x7c]
push eax
call fcn.00403cce
mov ecx, eax
call fcn.00403cf9
push ebx
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00476cc0
mov eax, dword [ebp - 0x78]
add esp, 0xc
cmp dword [ebp - 0x64], 8
jae 0x402e8f
lea eax, [ebp - 0x78]
push 0x4b2fd0
push eax
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call edi
test eax, eax
lea eax, [ebp - 0x60]
jne 0x402de5
push ebx
push 0
push eax
call fcn.00476cc0
mov eax, dword [ebp - 0x78]
add esp, 0xc
cmp dword [ebp - 0x64], 8
jae 0x402ec4
lea eax, [ebp - 0x78]
push 0x4b301c
push eax
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call edi
test eax, eax
je 0x402f18
push 0x4b3010
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x60]
push eax
call fcn.00401aaf
mov ecx, dword [ebp - 0x80]
push 0x4b3018
call fcn.004019f8
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00401ad3
mov eax, esi
jmp 0x402e19
xor esi, esi
jmp 0x402f05
Function at 0x402f1c
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
push esi
mov esi, ecx
push 0x4b3140
lea ecx, [ebp - 0x80]
call fcn.004018f6
lea eax, [ebp - 0x80]
push eax
call fcn.00402d63
pop ecx
test eax, eax
je 0x402fc9
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push eax
call fcn.00476cc0
mov eax, dword [ebp - 0x7c]
add esp, 0xc
cmp dword [ebp - 0x68], 8
jae 0x402f79
lea eax, [ebp - 0x7c]
push str.download_interface.dll
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402fc9
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.00401aaf
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00401ad3
mov ecx, dword [ebp + 0x1a4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00476d3a
add ebp, 0x1a8
leave
ret
xor esi, esi
jmp 0x402fa5

Function at 0x402fcd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x38c], eax
push esi
mov esi, dword [ebp + 0x398]
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.00476cc0
or dword [ebp - 0x78], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push str.instdir
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40307b
lea eax, [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40303d
sub eax, edx
sar eax, 1
je 0x40307b
lea eax, [ebp - 0x74]
push eax
mov ecx, esi
call fcn.00401aaf
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.0040317f
cmp word [eax], 0x5c
je 0x403076
push 0x4b3018
mov ecx, esi
call fcn.004019f8
xor eax, eax
inc eax
jmp 0x40307d
xor eax, eax
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
pop esi
call fcn.00476d3a
add ebp, 0x390
leave
ret
Function at 0x403093
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x38c], eax
push esi
mov esi, dword [ebp + 0x398]
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.00476cc0
or dword [ebp - 0x78], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push str.Path
push str.SOFTWAREThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x403123
lea eax, [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x403103
sub eax, edx
sar eax, 1
je 0x403123
lea eax, [ebp - 0x74]
push eax
mov ecx, esi
call fcn.00401aaf
xor eax, eax
inc eax
jmp 0x403125
xor eax, eax
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
pop esi
call fcn.00476d3a
add ebp, 0x390
leave
ret

Function at 0x403278
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov ebx, eax
cmp dword [ebp + 8], esi
je 0x403303
cmp dword [ebp + 0xc], esi
je 0x403303
cmp ebx, esi
jle 0x403303
push esi
push 0x80
push 2
push esi
push esi
push 7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4032b4
mov eax, 0x80004005
jmp 0x403308
push edi
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edi, edi
push esi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push ebx
add eax, edi
push eax
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4032ec
cmp dword [ebp + 8], esi
jle 0x4032ec
sub ebx, dword [ebp + 8]
add edi, dword [ebp + 8]
cmp ebx, esi
jg 0x4032c1
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x4032f5
mov dword [eax], edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
jmp 0x403308
mov eax, 0x86180008
pop esi
pop ebx
leave
ret

Function at 0x40330c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
mov eax, 0x80
push eax
push 3
push edi
push edi
push eax
push dword [ebp + 8]
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40333c
mov eax, 0x80004005
jmp 0x403355
lea eax, [ebp + 0xc]
push eax
push ebx
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret