joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f830
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x425a9b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x434100]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x43ba08], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.00410bf4
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x40fa1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f8ce
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.00412670
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.0040f520
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x40f935
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x430720
push eax
call fcn.00423bc8
add esp, 0xc
cmp eax, 1
jne 0x40f935
mov eax, dword [ebp - 0x14]
mov dword [0x43ba08], eax
jmp 0x40fa05
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40f94f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40f963
push ebx
push esi
call fcn.0040fc80
jmp 0x40f965
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x43ba08], eax
test eax, eax
jne 0x40f987
push 0x431884
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.004128dc
push eax
lea edx, [ebp + 0x84]
push 0x430720
push edx
mov edi, 1
call fcn.00410866
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.0040f660
test eax, eax
jne 0x40f9fe
push 0x431884
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.004128dc
call fcn.0040f700
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x43ba08]
test esi, esi
je 0x40f9ef
call fcn.0040fd60
mov dword [0x43ba08], 0
jmp 0x40f9f6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x40f9fc
ret
mov eax, dword [0x43ba08]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x40fa1d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x43ba08
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.004105cc
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x40fa50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4259f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x434100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x43ba08]
xor edi, edi
cmp ecx, edi
jne 0x40fa9b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x40faa8
mov dword [ebp - 0x14], edi
jmp 0x40fac0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x40fb56
mov ecx, dword [0x43ba08]
mov eax, dword [ecx]
cmp eax, edi
je 0x40fa87
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40fa87
mov ebx, 0x43ba08
mov dword [ebp - 4], edi
call fcn.0040fb70
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x40fafe
push 0x431884
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.004128dc
mov ecx, dword [0x43ba08]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40fb18
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x40fb42
push 0x431884
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.004128dc
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x40fb39
call fcn.0040fe80
mov eax, 0x40fb3f
ret
mov eax, dword [0x43ba08]
mov eax, dword [eax]
test eax, eax
je 0x40fb54
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb70
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x40fb9d
xor ecx, ecx
jmp 0x40fba9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x40fc5d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x40fbd0
mov dword [esp + 0xc], esi
jmp 0x40fc30
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x40fc29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40fc1c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x40fc30
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40fc30
push 0x430728
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40fc30
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x40fc53
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x40fbc2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x40fc71
mov ecx, dword [ebx]
add ecx, 8
call fcn.0040fdb0
test eax, eax
je 0x40fc71
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x40fc80
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x425a6b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x434100]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.00412670
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x40fd18
push 0x431884
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.004128dc
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x410125
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4377d8], 0
push esi
jne 0x410098
call fcn.0040ffbe
test eax, eax
je 0x4100db
mov eax, dword [0x4377d8]
cmp eax, 1
jne 0x4100b9
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4100db
pop esi
ret
push eax
call dword [0x4377e0]
test eax, eax
jne 0x410123
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4100df
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4377d8]
call dword [0x4377e0]
mov edi, eax
test edi, edi
je 0x410104
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x410120
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4377d8]
call dword [0x4377dc]
add edi, 0x10
cmp edi, esi
jb 0x41010c
mov eax, edi
pop edi
pop esi
ret
jmp 0x410085

Function at 0x4105cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434100]
jne 0x4105d6
repz ret
jmp fcn.00413c0d

Function at 0x41dcb4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414c63
and dword [ebp - 4], 0
cmp dword [0x4382c4], 0
mov ebx, eax
jne 0x41dd65
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41de16
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41de16
push eax
call fcn.00414bf1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4382c4], eax
call esi
push eax
call fcn.00414bf1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4382c8], eax
call esi
push eax
call fcn.00414bf1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4382cc], eax
call esi
push eax
call fcn.00414bf1
pop ecx
mov dword [0x4382d4], eax
test eax, eax
je 0x41dd65
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00414bf1
pop ecx
mov dword [0x4382d0], eax
mov eax, dword [0x4382d0]
cmp eax, ebx
je 0x41ddbd
cmp dword [0x4382d4], ebx
je 0x41ddbd
push eax
call fcn.00414c6c
push dword [0x4382d4]
mov esi, eax
call fcn.00414c6c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ddbd
test edi, edi
je 0x41ddbd
call esi
test eax, eax
je 0x41ddb4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ddb4
test byte [ebp - 0xc], 1
jne 0x41ddbd
or dword [ebp + 0x10], 0x200000
jmp 0x41ddf6
mov eax, dword [0x4382c8]
cmp eax, ebx
je 0x41ddf6
push eax
call fcn.00414c6c
pop ecx
test eax, eax
je 0x41ddf6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ddf6
mov eax, dword [0x4382cc]
cmp eax, ebx
je 0x41ddf6
push eax
call fcn.00414c6c
pop ecx
test eax, eax
je 0x41ddf6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4382c4]
call fcn.00414c6c
pop ecx
test eax, eax
je 0x41de16
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41de18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422a7a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x422ab5
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x422a9c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x422aad
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x422ab7
inc edi
add eax, 0x28
cmp edi, esi
jb 0x422a92
xor eax, eax
pop edi
pop esi
ret

Function at 0x422cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x422c94
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x422c8e
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x422c7f
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
rol esi, 0x45
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
rol esi, 0x45
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.00422a3a
test dword [esi + 0x7c], esp
jle 0x422c70
inc ebp
test al, 0x50
call fcn.00422a4a
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004229ff
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x422d28
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00422a3a
scasb al, byte es:[edi]
mov eax, 0x458d45b9
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x422df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x458df845]
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00422a4a
push eax
push esi
push dword [ebp + 8]
call fcn.004229ff
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00422a4a
push eax
push esi
push dword [ebp + 8]
call fcn.004229ff
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00422a3a
add al, 0x5c
and bl, ah
invalid
popfd
jl 0x422ebf
Function at 0x401470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
test edi, edi
je 0x40151c
xor edx, edx
cmp edx, ecx
jge 0x4014ac
cmp edi, dword [esi + 0xc]
je 0x4014ac
lea eax, [esi + 0xc]
nop
lea esi, [esi]
add eax, 0x28
inc edx
cmp edx, ecx
jge 0x4014ac
cmp edi, dword [eax]
jne 0x4014a0
cmp edx, ecx
je 0x401520
lea edx, [edx + edx*4]
shl edx, 3
mov ecx, dword [esi + edx + 0x10]
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x40151c
mov eax, dword [esi + edx + 8]
mov dword [ebx], eax
mov eax, dword [esi + edx + 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi + edx + 0x14]
mov dword [ebx + 0xc], eax
cmp ecx, 0x100000
ja 0x401520
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetFilePointer
add esp, 0xfffffff4
push dword [ebx + 8]
call sub.msvcrt.dll_malloc
mov edx, eax
mov dword [ebx + 0x10], edx
add esp, 0x10
test edx, edx
je 0x401520
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push dword [ebx + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x401520
mov al, 1
jmp 0x401522
mov al, 0
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4016a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edi, dword [0x409008]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [ecx - 1]
add esp, 0xfffffff4
push ecx
call fcn.004039cc
mov edi, eax
push 0
push 0
push 0x610
push ebx
call sub.KERNEL32.dll_SetFilePointer
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call sub.KERNEL32.dll_ReadFile
add esp, 0x1c
test eax, eax
je 0x401728
mov byte [esi + edi], 0
add esp, 0xfffffff8
push dword [0x409008]
push edi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
sete dl
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
add esp, 0xfffffff4
push edi
call fcn.0040387c
mov al, 1
jmp 0x401733
add esp, 0xfffffff4
push edi
call fcn.0040387c
mov al, 0
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x402d24
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 8], eax
add esp, 4
test eax, eax
jne 0x402d50
xor eax, eax
jmp 0x402e5e
add esp, 0xfffffffc
push 0xf003f
push dword [0x40a004]
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
add esp, 4
test esi, esi
je 0x402d8c
add esp, 0xfffffff4
push esi
call sub.ADVAPI32.DLL_DeleteService
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0x3e8
call sub.KERNEL32.dll_Sleep
add esp, 0xc
add esp, 0xfffffff4
push 0x402cb2
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff4
push 0
push 0
push 0
push 0
push 0
push dword [0x40a034]
push 0
push 2
push 0x10
push 0xf003f
push ebx
push dword [0x40a004]
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CreateServiceA
mov esi, eax
push ebx
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
push 0x402d01
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_GetModuleHandleA
mov edi, eax
push ebx
call fcn.0040387c
add esp, 0x20
test edi, edi
je 0x402e50
add esp, 0xfffffff4
push 0x402d0e
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff8
push ebx
push edi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
add esp, 0xfffffffc
push ebx
call fcn.0040387c
add esp, 0x20
test edi, edi
je 0x402e50
add esp, 0xfffffff4
push 0x402cd0
call fcn.00401280
mov dword [ebp - 4], eax
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 1
push esi
call edi
add esp, 0xfffffff8
push dword [ebp - 4]
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, esi
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x402e68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add esp, 0xfffffff4
push 0x104
call fcn.004039cc
mov edi, eax
add esp, 0xfffffff8
push dword [0x40901c]
push edi
call sub.msvcrt.dll_strcpy
add esp, 0x20
add esp, 0xfffffff8
push ebx
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push dword [0x40901c]
push edi
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
push dword [0x409018]
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push esi
push edi
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffffc
push 0x10
push 0
lea ebx, [ebp - 0x10]
push ebx
call sub.msvcrt.dll_memset
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0xfffffffc
push edi
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40189c
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00409f50
push 0
push 0
push 0
push 1
push 0xe291e8
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x4018f0
push 0x402280
push 0xe291f4
push 0x1542c00
call fcn.00403240
add esp, 8
mov ecx, eax
call fcn.00402380
xor al, al
jmp 0x401a6a
push 0
push SysReAllocString
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00402350
push eax
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401959
push 0x402280
mov ecx, dword [ebp + 8]
push ecx
push 0xe2920c
push 0x1542c00
call fcn.00403240
add esp, 8
push eax
call fcn.00403550
add esp, 8
mov ecx, eax
call fcn.00402380
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x401a6a
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
call fcn.00402350
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0xffffffff
jne 0x4019d2
push 0x402280
mov eax, dword [ebp + 0xc]
push eax
push 0xe2921c
push 0x1542c00
call fcn.00403240
add esp, 8
push eax
call fcn.00403550
add esp, 8
mov ecx, eax
call fcn.00402380
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x401a6a
lea eax, [ebp - 4]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401a19
cmp dword [ebp - 4], 0
jbe 0x401a19
push 0
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4019d2
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x402280
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe2922c
push 0x1542c00
call fcn.00403240
add esp, 8
push eax
call fcn.00403550
add esp, 8
mov ecx, eax
call fcn.00402380
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x41a12b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41a16d
call fcn.0041f2d3
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41a16d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41a164
xor eax, eax
jmp 0x41a175
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041a17b
pop edi
pop esi
pop ebx
ret 4