joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4150f0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa8
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xb4]
test ebp, ebp
push esi
push edi
je 0x415183
mov ebx, 1
xor edi, edi
cmp dword [0x43c4c0], ebx
jne 0x415131
mov eax, dword [0x43b460]
mov dword [ebp + 4], eax
xor eax, eax
jmp 0x415283
push 0x9c
lea edx, [esp + 0x14]
push 0
push edx
call fcn.00420f50
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x9c
call esi
test eax, eax
jne 0x41518b
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
jne 0x41518b
push str.Fail_to_get_OS_info_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
or eax, 0xffffffff
jmp 0x41528c
movzx edx, word [esp + 0xa4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push str.CSVNFileHelper::GetOSInfo__Get_majorversion:__d__minorversion:__d__buildnumber:__d__servicePack:__d
mov ecx, 0x43b48c
call fcn.0040a090
movzx eax, word [esp + 0xb8]
mov ecx, dword [esp + 0x34]
mov dword [0x43b460], eax
mov eax, ecx
add esp, 0x14
sub eax, 2
je 0x4151e5
push ecx
push str.Unknown_OS_2_osvi.dwPlatformId_d_
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x415270
mov ecx, dword [esp + 0x14]
cmp ecx, 5
mov eax, dword [esp + 0x18]
jne 0x41521b
test eax, eax
jne 0x4151fe
mov dword [0x43b45c], edi
jmp 0x415273
cmp eax, ebx
jne 0x41520e
mov dword [0x43b45c], 2
jmp 0x415273
cmp eax, 2
jne 0x415257
mov dword [0x43b45c], ebx
jmp 0x415273
cmp ecx, 6
jne 0x415257
test eax, eax
jne 0x41523b
xor ecx, ecx
cmp byte [esp + 0xaa], bl
setne cl
add ecx, 3
mov dword [0x43b45c], ecx
jmp 0x415273
cmp eax, ebx
jne 0x415257
mov dl, byte [esp + 0xaa]
sub dl, bl
neg dl
sbb edx, edx
add edx, 5
mov dword [0x43b45c], edx
jmp 0x415273
mov edx, dword [esp + 0x1c]
push edx
push eax
push ecx
push str.Unknown_OS_1_osvi.dwMajorVersion_d___MinorVersion_d__BuildNumber_d
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 0x10
or edi, 0xffffffff
mov eax, dword [0x43b460]
mov dword [ebp + 4], eax
mov dword [0x43c4c0], ebx
mov eax, edi
mov ecx, dword [0x43b45c]
mov dword [ebp], ecx
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041aec3
add esp, 0xa8
ret

Function at 0x415320
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push str.GlobalSVNIEAgentControl
push 0
push 0
mov esi, 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x415355
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x415355
push str.Ocx_or_plugin_do_not_exist_
call fcn.00403400
add esp, 4
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x415670
Capabilities:
Check mutex on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
push 1
push 0x43b464
mov esi, eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push str.GlobalRestartDNSClientControl
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x43b468], eax
jne 0x4156c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_CREATE_mutex_while_restarting_DNS_client__error_code__0x_x__r_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4156e6
call ebx
sub esi, eax
add esi, 0x7530
push esi
call fcn.00415360
add esp, 4
mov edi, eax
mov eax, dword [0x43b468]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x43b468]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov dword [0x43b468], 0
pop ebx
ret
Function at 0x415b30
Capabilities:
Copy file
Create thread
Delete directory
Move file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4298cb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4382c4]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x154]
xor ebx, ebx
push 0xff
lea ecx, [esp + 0x41]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x48], bl
call fcn.00420f50
add esp, 0xc
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x415bbe
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x14], ebx
jne 0x415bdf
push str.svnDrive_X86
push str.Temp
push 0x43ae48
push 0x42fdf0
lea eax, [esp + 0x4c]
push eax
jmp 0x415bf8
push str.svnDrive_X64
push str.Temp
push 0x43ae48
push 0x42fdf0
lea ecx, [esp + 0x4c]
push ecx
call fcn.0041aed2
add esp, 0x14
mov dword [esp + 0x14], vtable.CFindKillProcess.0
push ebx
push 2
mov dword [esp + 0x154], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x415c6d
push ebx
mov esi, eax
mov edi, str.devcon.exe
call fcn.00403eb0
cmp eax, ebx
je 0x415c6d
push eax
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x415c55
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Devcon.exe_exist__kill_it.
push 2
mov ecx, 0x43b48c
call fcn.0040a450
add esp, 8
push 0x64
call ebp
lea eax, [esp + 0x1c]
lea edx, [esp + 0x3c]
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0x43ae48
mov word [esp + 0x30], 0x214
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x43b46c
call esi
push ebx
push ebx
push ebx
push 0x416b90
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x415cc1
push ebx
call ebp
mov ecx, dword [esp + 0x18]
push ecx
push str.SVNDrv
push 1
call fcn.00408fc0
test eax, eax
push ebx
push 0x43b46c
jne 0x415d00
call esi
push 0x43ae48
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push str.install_virtual_adapter_failed
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
or eax, 0xffffffff
jmp 0x415d04
call esi
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0041aec3
add esp, 0x13c
ret 4
Function at 0x415d30
Capabilities:
Copy file

Disassembly:
sub esp, 0x134
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
mov esi, 0x42db80
xor edi, edi
call fcn.00415e70
test eax, eax
je 0x415d6c
push esi
push str.copy__s_to_install_path_failed
mov ecx, 0x43b48c
or edi, 0xffffffff
call fcn.0040a090
add esp, 8
mov esi, 0x43313c
call fcn.00415e70
test eax, eax
je 0x415d90
push esi
push str.copy__s_to_install_path_failed
mov ecx, 0x43b48c
or edi, 0xffffffff
call fcn.0040a090
add esp, 8
push 0xff
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.00420f50
add esp, 0xc
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x415ddc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0xc], 0
jne 0x415dfe
push str.svnDrive_X86
push str.Temp
push 0x43ae48
push 0x42fdf0
lea edx, [esp + 0x40]
push edx
jmp 0x415e17
push str.svnDrive_X64
push str.Temp
push 0x43ae48
push 0x42fdf0
lea eax, [esp + 0x40]
push eax
call fcn.0041aed2
add esp, 0x14
lea edx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x43ae48
mov word [esp + 0x24], 0x214
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0041aec3
add esp, 0x134
ret

Function at 0x415e70
Capabilities:
Copy file

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push edi
push 0x103
lea eax, [esp + 0x119]
push 0
push eax
mov byte [esp + 0x120], 0
call fcn.00420f50
add esp, 0xc
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.00420f50
add esp, 0xc
push esi
push str.Temp
push 0x43ae48
push 0x42fdf0
mov eax, 0x104
lea edi, [esp + 0x124]
or ebp, 0xffffffff
call fcn.0040d050
push esi
push 0x43ae48
push 0x42ced8
mov eax, 0x104
lea edi, [esp + 0x28]
call fcn.0040d050
add esp, 0x1c
push 0
mov edx, edi
push edx
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x415f3c
push esi
push str.Copy__s_from_temp_to_Svn3000_success
call fcn.00403400
add esp, 8
xor eax, eax
pop edi
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0041aec3
add esp, 0x21c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Copy__s_from_temp_to_Svn3000_failed_err_d
mov ecx, 0x43b48c
call fcn.0040a090
mov ecx, dword [esp + 0x22c]
add esp, 0xc
pop edi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0041aec3
add esp, 0x21c
ret
Function at 0x415f70
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x324
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x320], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x119]
push 0
push eax
mov byte [esp + 0x120], 0
call fcn.00420f50
add esp, 0xc
push 0x103
lea ecx, [esp + 0x221]
push 0
push ecx
mov byte [esp + 0x228], 0
call fcn.00420f50
add esp, 0xc
push 0x103
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.00420f50
add esp, 0xc
push 0x104
lea eax, [esp + 0x118]
push eax
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x430168
push str.Temp
push 0x43ae48
push 0x42fdf0
mov eax, 0x104
lea edi, [esp + 0x22c]
call fcn.0040d050
push 0x430168
lea ecx, [esp + 0x128]
push ecx
push str._sdrivers_s
mov eax, 0x104
lea edi, [esp + 0x28]
call fcn.0040d050
add esp, 0x1c
push 0
mov edx, edi
push edx
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41607d
push 0x430168
push str.Copy_file__s_to_system32_success
call fcn.00403400
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.0041aec3
add esp, 0x324
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430168
push str.Copy_file__s_to_system32_failed__err_d
mov ecx, 0x43b48c
call fcn.0040a090
mov ecx, dword [esp + 0x334]
add esp, 0xc
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041aec3
add esp, 0x324
ret

Function at 0x416230
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x324
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x320], eax
push ebp
push edi
push 0x103
lea eax, [esp + 0x119]
push 0
push eax
mov byte [esp + 0x120], 0
call fcn.00420f50
add esp, 0xc
push 0x103
lea ecx, [esp + 0x221]
push 0
push ecx
mov byte [esp + 0x228], 0
call fcn.00420f50
add esp, 0xc
push 0x103
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.00420f50
add esp, 0xc
push 0x104
lea eax, [esp + 0x118]
push eax
or ebp, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push str.Temp
push 0x43ae48
push 0x42fdf0
mov eax, 0x104
lea edi, [esp + 0x22c]
call fcn.0040d050
push esi
lea ecx, [esp + 0x128]
push ecx
push 0x42ced8
mov eax, 0x104
lea edi, [esp + 0x28]
call fcn.0040d050
add esp, 0x1c
push 0
mov edx, edi
push edx
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x416331
push esi
push str.Copy_file__s_to_system32_success
call fcn.00403400
add esp, 8
xor eax, eax
pop edi
pop ebp
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.0041aec3
add esp, 0x324
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Copy_file__s_to_system32_failed__err_d
mov ecx, 0x43b48c
call fcn.0040a090
mov ecx, dword [esp + 0x334]
add esp, 0xc
pop edi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0041aec3
add esp, 0x324
ret
Function at 0x416370
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x429beb
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
push esi
push edi
mov eax, dword [0x4382c4]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00420f50
lea ecx, [esp + 0x20]
add esp, 0xc
test ecx, ecx
je 0x41648b
mov edi, ecx
call fcn.00413aa0
test eax, eax
jne 0x41648b
push 0x42cfc8
mov edx, edi
push 0x104
push edx
call fcn.0041af88
add esp, 0xc
push str.NemService.exe
mov eax, edi
push 0x104
push eax
call fcn.0041af88
add esp, 0xc
mov dword [esp + 0x10], vtable.CFindKillProcess.0
push 0
push 2
mov dword [esp + 0x130], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x416475
push 0
mov esi, eax
mov edi, str.NemService.exe
call fcn.00403eb0
mov esi, eax
test esi, esi
je 0x416475
push str.Service_still_exist_Terminate_in_force.
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x416475
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebp
mov ecx, str.svnnem.zip
call fcn.004160c0
cmp eax, 0xffffffff
jne 0x4164a5
push str.Unzip_service_to_temp_failed
jmp 0x416490
push str.Get_service_path_failed
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
or eax, 0xffffffff
jmp 0x41654b
mov esi, str.NemService.exe
call fcn.00415e70
cmp eax, 0xffffffff
jne 0x4164bb
push str.Copy_service_to_install_path_failed
jmp 0x416490
mov esi, str.vistaHelper.dll
call fcn.00415e70
cmp eax, 0xffffffff
jne 0x4164d1
push str.Copy_vistaHelper.dll_to_install_path_failed
jmp 0x416490
push str.SERVICE_MANGER_EVENT
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
jne 0x4164ef
push str.SVN_Manager_Create_Event_failed
jmp 0x416490
push 5
push 0
push str._service
lea ecx, [esp + 0x20]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x416521
push str.Register_service_from_command_failed
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x416546
push str.Wait_for_Nemservice_Install_timeout
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push esi
call ebp
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0041aec3
add esp, 0x11c
ret
Function at 0x416580
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x18c
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push ebp
push esi
push 0xff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00420f50
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
xor esi, esi
push 0
push 0
push str.__all
push str.ipconfig
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x110]
push ecx
lea ebx, [esp + 0x14]
call fcn.00409ab0
add esp, 4
test eax, eax
jne 0x416620
push 0x1388
mov dword [edi], 1
call ebp
add esi, 1
cmp esi, 0xc
jl 0x4165b8
cmp dword [edi], 0
je 0x416638
mov edx, dword [esp + 0x19c]
push edx
call fcn.00416660
add esp, 4
test eax, eax
jne 0x416654
call fcn.00416900
jmp 0x41663a
push str.Get_drive_name_ok
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
mov dword [edi], 0
xor eax, eax
mov ecx, dword [esp + 0x194]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041aec3
add esp, 0x18c
ret 4
or eax, 0xffffffff
jmp 0x41663a

Function at 0x416780
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x428
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
push ebp
mov ebp, dword [esp + 0x434]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x11d]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x124], bl
call fcn.00420f50
add esp, 0xc
push 0x103
lea ecx, [esp + 0x32d]
push ebx
push ecx
mov byte [esp + 0x334], bl
call fcn.00420f50
add esp, 0xc
push 0x103
lea edx, [esp + 0x15]
push ebx
push edx
mov byte [esp + 0x1c], bl
call fcn.00420f50
add esp, 0xc
push 0x103
lea eax, [esp + 0x225]
push ebx
push eax
mov byte [esp + 0x22c], bl
call fcn.00420f50
add esp, 0xc
push 0x104
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push str.Temp
push 0x43ae48
push 0x42fdf0
mov eax, 0x104
lea edi, [esp + 0x338]
call fcn.0040d050
push esi
lea edx, [esp + 0x12c]
push edx
push 0x42ced8
mov eax, 0x104
lea edi, [esp + 0x2c]
call fcn.0040d050
add esp, 0x1c
push ebp
lea eax, [esp + 0x11c]
push eax
push 0x42ced8
mov eax, 0x104
lea edi, [esp + 0x22c]
call fcn.0040d050
add esp, 0xc
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.0041b0e5
add esp, 8
cmp eax, 0xffffffff
je 0x4168d3
push 1
mov edx, edi
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4168d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
push ecx
lea edx, [esp + 0x18]
push edx
push str.Failed_to_rename__s_to__s__error:_d
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 0x10
or eax, 0xffffffff
jmp 0x4168d8
call fcn.00416230
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041aec3
add esp, 0x428
ret 4
Function at 0x416900
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41693d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fail_to_reboot_computer__erro_code:__d
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
or eax, 0xffffffff
pop esi
add esp, 0x18
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x416987
call esi
jmp 0x416922
push 0x80030003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x416983
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x4169a0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x9c
lea eax, [esp + 4]
push 0
push eax
call fcn.00420f50
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x416b70
mov ecx, dword [esp + 0x10]
sub ecx, 0
je 0x416b66
mov eax, 1
sub ecx, eax
je 0x416aec
sub ecx, eax
jne 0x416b70
mov ecx, dword [esp + 4]
cmp ecx, 5
jne 0x416a7d
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x416a35
mov dword [0x4390d0], 7
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
cmp ecx, eax
jne 0x416a58
mov dword [0x4390d0], 6
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
neg ecx
sbb ecx, ecx
and ecx, 5
add ecx, 5
mov dword [0x4390d0], ecx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
cmp ecx, 6
jne 0x416acd
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x416ab2
cmp byte [esp + 0x9a], al
jne 0x416acd
mov dword [0x4390d0], 8
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
cmp ecx, eax
jne 0x416acd
cmp byte [esp + 0x9a], al
mov dword [0x4390d0], 9
je 0x416b72
mov dword [0x4390d0], 4
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
cmp dword [esp + 4], 4
jne 0x416b70
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x416b17
mov dword [0x4390d0], eax
xor eax, eax
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
cmp ecx, 0xa
jne 0x416b3d
mov dword [0x4390d0], 2
xor eax, eax
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
xor edx, edx
cmp ecx, 0x5a
sete dl
xor eax, eax
lea edx, [edx + edx + 1]
mov dword [0x4390d0], edx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
mov dword [0x4390d0], 0
xor eax, eax
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0041aec3
add esp, 0xa0
ret
Function at 0x416ed0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor esi, esi
test ebx, ebx
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xff
je 0x416f28
mov eax, dword [ebx + 8]
cmp eax, 1
mov esi, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
jne 0x416f10
call fcn.00417660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x416f23
call fcn.00417980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 5
je 0x416f33
cmp dword [ebp + 0xc], 0
je 0x416f33
call fcn.004171c0
push 0
push 0
push esi
push 0
push 0x101e
push str.SVNIDHST.exe
mov ecx, 0x43b5d0
call fcn.00404e60
push 0
push 0
push esi
push 0
push 0x101e
push str.CPFMHST.exe
mov ecx, 0x43b5d0
mov edi, eax
call fcn.00404e60
push 0
push 0
push esi
push 0
push 0x101e
push 0x432638
mov ecx, 0x43b5d0
mov dword [esp + 0x28], eax
call fcn.00404e60
call fcn.00417660
cmp edi, 0xfffffffa
je 0x416f9b
cmp dword [esp + 0x10], 0xfffffffa
jne 0x417014
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jne 0x416fb9
push str.send_a_null_point_to_stop_CPFM.
call fcn.00403400
add esp, 4
jmp 0x416fbe
call fcn.00417980
call fcn.00417e40
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x417014
push 0
mov esi, eax
mov edi, str.NemService.exe
call fcn.00403eb0
test eax, eax
je 0x417014
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x417014
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CNem_process_is_killed
call fcn.00403400
add esp, 4
cmp dword [esp + 0xc], 0x20
jne 0x417030
mov ecx, dword [esp + 0x14]
push ecx
mov esi, ebx
call fcn.00417040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4170a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x429b3b
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov eax, dword [0x4382c4]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
push str.enter_StartProxySet
push 0
mov ecx, 0x43b48c
call fcn.0040a450
add esp, 8
mov dword [esp + 0x10], vtable.CFindKillProcess.0
push 0
push 2
mov dword [esp + 0x130], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x417120
push 0
mov esi, eax
mov edi, 0x432638
call fcn.00403eb0
test eax, eax
jne 0x41718e
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00420f50
add esp, 0xc
push 0x432638
push 0x43ae48
push 0x42ced8
mov eax, 0x104
lea edi, [esp + 0x20]
call fcn.0040d050
add esp, 0xc
push 0
push 0
push 0
mov ecx, edi
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x41718e
mov edx, edi
push edx
push str.Start_proxySet_failed__filename:_s
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
or eax, 0xffffffff
jmp 0x417190
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0041aec3
add esp, 0x120
ret