joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433dd0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
xor ebx, ebx
push esi
push esi
push 3
push esi
push 3
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x433f3f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0x1000
jb 0x433f24
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x433f24
mov edx, dword [ebp - 4]
mov eax, 0x5a4d
add edx, esi
cmp word [esi], ax
jne 0x433f24
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0xc]
ja 0x433f24
lea ecx, [eax + 4]
add ecx, esi
lea eax, [ecx + 0x18]
cmp eax, edx
jbe 0x433ea2
push ebx
push ebx
push dword [esi + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x433f24
mov eax, dword [ebp - 4]
test eax, eax
je 0x433f24
lea edx, [eax + esi]
lea ecx, [esi + 4]
lea eax, [ecx + 0x18]
cmp eax, edx
ja 0x433f24
cmp dword [ecx - 4], 0x4550
jne 0x433f24
movzx eax, word [ecx]
mov dword [ebp - 8], 0x14c
mov dword [ebp - 0xc], 0x8664
cmp word [ebp - 8], ax
je 0x433ecf
cmp word [ebp - 0xc], ax
jne 0x433f24
test byte [ecx + 0x12], 2
je 0x433f24
cmp word [ebp - 8], ax
jne 0x433efa
lea eax, [ecx + 0x14]
movzx ecx, word [ecx + 0x10]
add ecx, eax
cmp ecx, edx
ja 0x433f24
mov ecx, 0x10b
cmp cx, word [eax]
jne 0x433f24
cmp dword [eax + 0x80], ebx
jmp 0x433f1d
cmp word [ebp - 0xc], ax
jne 0x433f24
lea eax, [ecx + 0x14]
movzx ecx, word [ecx + 0x10]
add ecx, eax
cmp ecx, edx
ja 0x433f24
mov ecx, 0x20b
cmp cx, word [eax]
jne 0x433f24
cmp dword [eax + 0x90], ebx
je 0x433f24
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x433f3f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437eb0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x224
mov esi, ecx
mov dword [eax], 0
call fcn.004609df
add esp, 4
mov edi, eax
mov dword [ebp - 0xc], edi
push 0
push 0
push 3
push 0
push 1
push closesocket
mov dword [edi], 0x4be6a8
mov dword [edi + 4], 0
push esi
mov byte [edi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x437fcf
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 0x400]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi + 4], eax
test eax, eax
je 0x437fcf
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], esi
jne 0x437fcf
cmp esi, 6
jb 0x437fcf
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [eax]
cmp ecx, 0x4b374454
jne 0x437fb7
test eax, eax
je 0x437fb7
cmp esi, 8
jb 0x437fb7
cmp ecx, ecx
jne 0x437fb7
cmp dword [eax + 4], 1
lea ebx, [esi - 8]
jne 0x437fb4
xor edx, edx
lea esi, [eax + 8]
mov ecx, 0x76dcce6e
test ebx, ebx
je 0x437fa7
nop dword [eax + eax]
xor byte [edx + esi], cl
lea eax, [edx + esi]
shr ecx, 4
inc edx
imul ecx, ecx, 0x82b7831e
cmp edx, ebx
jb 0x437f90
mov eax, dword [ebp - 0xc]
push ebx
push esi
push eax
call fcn.00464a30
add esp, 0xc
mov esi, ebx
mov ebx, dword [ebp - 8]
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
add eax, esi
mov dword [edi + 0x21c], eax
mov esi, 1
mov byte [eax], 0
jmp 0x437fd1
xor esi, esi
test ebx, ebx
je 0x437fdc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
je 0x438010
mov eax, dword [edi + 4]
test eax, eax
je 0x437ff8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ecx
mov ecx, edi
mov dword [edi + 4], 0
call fcn.00437560
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4382f0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
call fcn.0045e060
mov ebx, eax
test ebx, ebx
je 0x438424
push edi
push 0x8000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x43841c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x8000
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push str.UserInfo
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43840c
cmp dword [ebp - 0xc], 3
jne 0x43840c
mov eax, dword [ebp - 4]
cmp eax, 0xfc
jb 0x43840c
mov ecx, dword [edi]
lea edx, [edi + 4]
add eax, edi
mov dword [ebp - 8], edx
mov esi, eax
xor edx, edx
sub esi, dword [ebp - 8]
add esi, 3
shr esi, 2
cmp dword [ebp - 8], eax
lea eax, [edi + 4]
cmova esi, edx
test esi, esi
je 0x4383ad
nop word [eax + eax]
xor dword [eax], ecx
lea eax, [eax + 4]
inc edx
add ecx, 7
cmp edx, esi
jb 0x4383a0
cmp dword [edi + 4], 0x4b375249
jne 0x43840c
mov eax, dword [ebp - 0x14]
lea esi, [edi + 8]
test eax, eax
je 0x4383ca
push 0x40
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4383de
push 0x50
lea eax, [esi + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4383f5
push 0x3c
lea eax, [esi + 0x90]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43840c
push 0x28
lea eax, [esi + 0xcc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov esi, eax
test esi, esi
je 0x4384e0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x438454
push 0x30
push eax
push str.UserPCName
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x438469
push 0x40
push eax
push str.UserVendorId
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x43847e
push 0x20
push eax
push str.UserTelephone
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x438496
push 0x80
push eax
push str.UserCountry
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x4384ae
push 0x80
push eax
push str.UserState
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4384c6
push 0x80
push eax
push str.UserCity
push esi
call fcn.0045e550
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x4384d9
push eax
push str.UserInMails
push esi
call fcn.0045e500
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4385d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, edx
mov ebx, ecx
call fcn.0045e060
mov esi, eax
test esi, esi
jne 0x4385f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x438609
push ebx
push str.AutoUpdate
push esi
call fcn.0045e500
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43861c
push eax
push str.ProxyEnabled
push esi
call fcn.0045e500
test edi, edi
je 0x43862c
push edi
push str.ConnectIdFirst
push esi
call fcn.0045e500
mov eax, dword [ebp + 8]
test eax, eax
je 0x43863f
push eax
push str.ConnectIdSecond
push esi
call fcn.0045e500
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x438657
push 0x3e8
push eax
push str.UpdtLocalMachineName
push esi
call fcn.0045e550
cmp dword [ebp + 0x10], 0
jne 0x43866d
cmp dword [ebp + 0x14], 0
jne 0x43866d
cmp dword [ebp + 0x18], 0
je 0x43878e
push 0x1d0
call fcn.004609df
push 0x1d0
mov edi, eax
push 0
push edi
call fcn.004644e0
add esp, 0x10
push 0x1d0
push edi
push str.ProxyInfo
push esi
call fcn.0045e460
cmp eax, 1
jne 0x438780
movd xmm0, dword [edi + 8]
lea ebx, [edi + 8]
lea eax, [edi + 0xc]
pshufd xmm1, xmm0, 0
movd xmm0, dword [edi + 4]
lea ecx, [edi + 4]
pshufd xmm2, xmm0, 0
lea edx, [eax + 0x1c0]
mov dword [ebp - 4], edx
cmp eax, ecx
ja 0x4386d4
xor edx, edx
cmp dword [ebp - 4], ecx
jae 0x43873b
cmp eax, ebx
ja 0x4386e4
lea ecx, [eax + 0x1c0]
xor edx, edx
cmp ecx, ebx
jae 0x43873b
mov ecx, 7
nop dword [eax]
movups xmm0, xmmword [eax]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
sub ecx, 1
jne 0x4386f0
mov edx, 0xffffff90
add edx, 0x71
nop
mov ecx, dword [ebx]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
mov ecx, dword [edi + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x438740
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x110]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x190]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1d0
push edi
call fcn.004609d1
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a450
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0
push 0
push 3
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], edx
push 0
mov dword [ebp - 0x18], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push 0xc0000000
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43a4da
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x43a4d5
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43a4a0
jmp 0x43a4da
cmp esi, 0xffffffff
je 0x43a539
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x43a52a
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x14
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x43a52a
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
cmp dword [ebp - 8], 4
cmovne eax, ecx
mov dword [ebp - 4], eax
jmp 0x43a52d
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x43a53c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43b010
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x10c], edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
test eax, eax
jns 0x43b042
push str._s_FeatureInfo1.0
jmp 0x43b054
cmp byte [ebp + 0xc], 0
je 0x43b04f
push str.Global_s_FeatureInfo1.0
jmp 0x43b054
push str.Local_s_FeatureInfo1.0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
je 0x43b0de
push edi
push ebx
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x43b0aa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push ebx
push edi
push dword [ebp - 0x10c]
call fcn.0046c5d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x43ca30
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x43cba0
push esi
lea esi, [edi + 0x14]
mov dword [edi], 0x2b47
push str.K7PwdMgr_MasterPasswordState
mov dword [edi + 8], esi
push dword [ebp - 4]
push str.getpmsetting.htm_t_u_n_s_n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push 9
push dword [edi + 8]
mov dword [edi + 4], eax
call fcn.00463610
add esp, 0x18
mov dword [ebp - 8], 0
inc esi
mov dword [ebp - 0xc], 2
mov byte [eax], 0
mov eax, dword [edi + 4]
push 0
push 0
push 3
push 0
add eax, esi
mov dword [edi + 0xc], 0x2000
push 0
push 0xc0000000
mov dword [edi + 0x10], eax
push str..pipeK7SiteRatePipeV1
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43cb28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x43cb23
push 0xffffffffffffffff
push str..pipeK7SiteRatePipeV1
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipeK7SiteRatePipeV1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43cae6
jmp 0x43cb28
cmp esi, 0xffffffff
je 0x43cb67
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x43cb5b
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 0xc]
push dword [edi + 0x10]
push 0x4000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp esi, 0xffffffff
je 0x43cb67
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0xc], 0
pop esi
jbe 0x43cb85
mov eax, dword [edi + 0x10]
cmp byte [eax], 0
je 0x43cb85
push 0xa
push 0
push eax
call fcn.0048e325
add esp, 0xc
mov dword [ebx], eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dc30
Capabilities:
Create service
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x964
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x960], eax
push ebx
push esi
push edi
push closesocket
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x43dc6e
xor esi, esi
jmp 0x43dcda
push 4
push str.K7FWHlpr
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x43dc97
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43dcda
lea eax, [esp + 0x844]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x43dcc0
mov edi, dword [esp + 0x850]
mov esi, 1
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, 1
je 0x43ddae
cmp edi, 5
je 0x43ddae
cmp edi, 0x424
jne 0x43ddae
lea eax, [esp + 0x10]
mov edx, str.K7AVOnLineFileScan
push 0x830
push eax
mov ecx, str.K7RTScan
call fcn.0043b720
add esp, 8
test eax, eax
jne 0x43dd16
cmp dword [esp + 0x24], 1
jmp 0x43dd19
cmp eax, 5
jne 0x43dd2d
push ecx
xor edx, edx
call fcn.0043edc0
add esp, 4
mov ebx, 1
jmp 0x43dd2f
xor ebx, ebx
push str.SystemRoot_system32driversK7FWHlpr.sys
lea eax, [esp + 0x864]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x43dd9c
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x874]
push eax
push 1
push 0
push 1
push 0xf01ff
push str.K7FWHlpr
push str.K7FWHlpr
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x43dd95
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x43ddae
push ecx
mov edx, 1
call fcn.0043edc0
add esp, 4
mov ecx, dword [esp + 0x96c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x43de90
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov dword [esp + 0x1c], edx
push ebx
push ebx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x43e067
push ebx
push ebx
push str.FltMgr
push ebx
push str.FSFilter_Infrastructure
push edi
push 1
push ebx
push 2
push 0xf01ff
push str.K7AntiVirus_MiniFilter_Driver
push str.K7Sentry
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x43e060
cmp dword [esp + 0x18], 0
mov ebx, 1
je 0x43e059
push 0
push str.SystemCurrentControlSetServicesK7Sentry
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e320
mov esi, eax
test esi, esi
je 0x43e055
push 0
push str.Config
push esi
call fcn.0045e090
push 0
push str.Instances
push esi
mov dword [esp + 0x24], eax
call fcn.0045e090
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x43e051
push str.Inst1
push str.DefaultInstance
push edi
call fcn.0045e7c0
push 0
push str.Inst1
push edi
call fcn.0045e090
mov edi, eax
test edi, edi
je 0x43e051
push str.321100
push str.Altitude
push edi
call fcn.0045e7c0
push 0
push str.Flags
push edi
call fcn.0045e790
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43dfab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SystemCurrentControlSetServicesK7SentryConfig
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e320
mov esi, eax
test esi, esi
je 0x43e051
push 0x40
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004644e0
add esp, 0xc
mov dword [esp + 0x20], 0x40
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x43e023
push 0x4c8ca0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x43e023
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call dword [0x4b466c]
call edi
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
shrd ecx, eax, 0xa
push ecx
push str.PhysicalMemoryInKB
push esi
call fcn.0045e790
push dword [esp + 0x24]
push str.MemoryLoad
push esi
call fcn.0045e790
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x64]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x43e830
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
push esi
mov ecx, 0xf4236
mov ebx, edx
call fcn.0043a940
add esp, 4
mov edi, 6
test bl, 1
je 0x43e8a1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 8]
mov ecx, 0x1004f
mov dword [ebp - 0x20], eax
lea edx, [edi - 5]
lea eax, [ebp - 0xc]
push eax
jns 0x43e88d
lea eax, [ebp - 0x20]
push eax
call fcn.00455d80
add esp, 8
jmp 0x43e8a1
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00455a70
add esp, 0x14
push dword [ebp + 8]
mov edx, ebx
mov ecx, esi
call fcn.0043ee60
mov ecx, 5
add esp, 4
cmp eax, ecx
mov edx, ebx
cmove edi, ecx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043ef80
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f0b0
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f180
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f250
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f6e0
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f330
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f410
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043f4f0
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043fb10
add esp, 4
mov edx, ebx
cmp eax, 5
mov ecx, esi
mov eax, 5
cmove edi, eax
push dword [ebp + 8]
call fcn.0043fa30
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043fc10
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043fcb0
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043fd50
add esp, 4
mov edx, ebx
cmp eax, 5
mov eax, 5
cmove edi, eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0043fe10
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.00440260
add esp, 4
mov edx, ebx
cmp eax, 5
mov ecx, esi
mov eax, 5
cmove edi, eax
push dword [ebp + 8]
call fcn.00440390
add esp, 4
mov edx, ebx
cmp eax, 5
mov ecx, esi
mov eax, 5
cmove edi, eax
push dword [ebp + 8]
call fcn.00440670
add esp, 4
cmp eax, 5
mov eax, 5
cmove edi, eax
call fcn.00441e00
cmp eax, 4
je 0x43ea09
cmp eax, 3
je 0x43ea32
call fcn.0043c470
call fcn.0043c4f0
push dword [ebp + 8]
mov edx, ebx
mov ecx, esi
call fcn.0043f990
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043feb0
add esp, 4
mov eax, 5
cmp ebx, 1
cmove edi, eax
push dword [ebp + 8]
mov edx, ebx
mov ecx, esi
call fcn.0043ff50
add esp, 4
mov edx, ebx
mov ecx, esi
push dword [ebp + 8]
call fcn.0043fff0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret