joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
lea eax, [esp + 0x28]
push ebx
push esi
push edi
mov esi, dword [esp + 0x74]
push eax
push esi
call fcn.0044e630
lea ecx, [esp + 0x14]
lea edx, [esp + 0x3c]
add esp, 8
lea eax, [esi + 0x14]
push ecx
push eax
push edx
call fcn.0044e2f0
xor dx, dx
add esp, 0xc
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [eax + esi]
xor ecx, dword [esp + eax + 0xc]
mov dword [esp + eax + 0x20], ecx
movsx eax, dx
cmp eax, 5
jb 0x4553b1
lea eax, [esp + 0x48]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0044dfa0
lea ecx, [esp + 0x50]
add esp, 8
push ecx
call fcn.0044df00
mov edx, dword [esp + 0x80]
add esp, 4
cmp word [edx], 0
je 0x455420
xor cx, cx
mov edi, dword [esp + 0x78]
movsx eax, cx
shl eax, 2
inc cx
mov ebx, dword [eax + edx + 2]
xor ebx, dword [esp + eax + 0x20]
xor ebx, dword [esp + eax + 0x48]
mov dword [eax + edi], ebx
movsx eax, cx
cmp eax, 5
jb 0x4553ff
jmp 0x455442
xor dx, dx
mov edi, dword [esp + 0x78]
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor ecx, dword [esp + eax + 0x48]
mov dword [eax + edi], ecx
movsx eax, dx
cmp eax, 5
jb 0x455427
xor cx, cx
mov edx, 0xffffffff
movsx eax, cx
inc cx
mov dword [esp + eax*4 + 0xc], edx
movsx ebx, cx
cmp ebx, 5
jb 0x45544a
and dword [esp + 0xc], 0x3fffffff
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor dword [esp + eax + 0xc], ecx
movsx eax, dx
cmp eax, 5
jb 0x455466
lea eax, [esp + 0x5c]
lea ecx, [esp + 0xc]
push eax
push edi
push ecx
call fcn.0044e2f0
lea ecx, [esp + 0x40]
add esp, 0xc
push ecx
push esi
call fcn.0044dfa0
lea ecx, [esp + 0x3c]
add esp, 8
push ecx
call fcn.0044df00
xor dx, dx
add esp, 4
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x5c]
xor ecx, dword [esp + eax + 0x34]
mov dword [eax + edi + 0x14], ecx
movsx eax, dx
cmp eax, 5
jb 0x4554af
pop edi
pop esi
pop ebx
add esp, 0x64
ret

Function at 0x4554e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
xor di, di
call fcn.0044dfa0
lea ecx, [esp + 0x24]
add esp, 8
push ecx
call fcn.0044df80
add esp, 4
movsx eax, di
inc di
lea ecx, [eax*4]
mov edx, dword [esi + ecx + 0x14]
lea eax, [esi + ecx]
xor edx, dword [eax]
movsx eax, di
mov dword [esp + ecx + 0x1c], edx
cmp eax, 5
jb 0x455507
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call fcn.00455210
add esp, 0x10
pop edi
pop esi
add esp, 0x28
ret
Function at 0x457bac
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
dec eax
je 0x457c73
dec eax
jne 0x457cab
and dword [0x4b0fb4], 0
cmp dword [ebp - 0x90], 4
ja 0x457bf4
push 3
jmp 0x457c70
push 5
pop eax
cmp dword [ebp - 0x90], eax
jne 0x457c5c
cmp dword [ebp - 0x8c], 0
je 0x457cad
cmp dword [ebp - 0x8c], 1
jne 0x457c19
push 7
jmp 0x457c70
cmp dword [ebp - 0x8c], 2
jne 0x457cab
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x457c4a
lea ecx, [ebp - 0xb8]
push ecx
call eax
xor eax, eax
cmp word [ebp - 0xb8], 9
sete al
add eax, 8
leave
ret
cmp dword [ebp - 0x90], 6
jne 0x457cab
cmp dword [ebp - 0x8c], 0
jne 0x457cab
push 0xa
pop eax
leave
ret
push 4
mov dword [0x4b0fb4], 1
pop eax
cmp dword [ebp - 0x90], eax
jb 0x457cab
cmp dword [ebp - 0x8c], 0
jne 0x457c95
push 2
jmp 0x457c70
cmp dword [ebp - 0x8c], 0xa
je 0x457cad
cmp dword [ebp - 0x8c], 0x5a
jne 0x457cab
push 6
jmp 0x457c70
xor eax, eax
leave
ret

Function at 0x4586c6
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0045fae0
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push esi
push ecx
call fcn.0045faa0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jl 0x45873a
jg 0x458738
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jb 0x45873a
jmp 0x45873c
jmp 0x45870a
pop esi
leave
ret 4
Function at 0x458875
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x46df20], esi
push edi
mov dword [ebp - 0x10], esi
jne 0x458892
xor ax, ax
jmp 0x458a31
or word [0x4b2fb2], 0xffff
cmp dword [0x46e1c8], esi
mov dword [ebp - 8], esi
jne 0x4588c0
movsx eax, word [ebp + 0xc]
push eax
call fcn.0045c7ac
cmp ax, si
jl 0x458a31
push 1
pop edi
mov dword [ebp - 0x10], edi
jmp 0x4588c3
push 1
pop edi
mov ax, word [0x4b2fb2]
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.00458be4
call fcn.00458c67
cmp dword [0x4b0fd0], esi
jne 0x4588ef
push 0x4d
call fcn.00458a37
mov dword [0x4b0fd0], eax
push ebx
call fcn.0045916b
test ax, ax
je 0x4589f7
mov dword [ebp - 8], esi
call fcn.00458cec
push esi
push edi
push 0x35
call fcn.00458e54
test eax, eax
jne 0x458917
or dword [ebp - 8], 0xffffffff
push esi
push esi
call fcn.00458f01
push esi
push esi
mov byte [ebp - 1], al
call fcn.00458f01
mov bl, al
mov byte [ebp - 2], bl
call fcn.00458dcd
cmp byte [0x4b0fd9], 0x15
mov dword [0x46e068], edi
jb 0x4589f7
call fcn.00458cec
push esi
push edi
push 0x49
call fcn.00458e54
test eax, eax
jne 0x45895b
or dword [ebp - 8], 0xffffffff
cmp word [ebp - 8], 0xffff
je 0x45899c
lea esi, [ebp + 8]
mov dword [ebp - 0xc], 4
not bl
mov al, byte [esi]
push edi
xor al, byte [ebp - 1]
push edi
inc esi
add al, bl
push eax
call fcn.00458e54
dec dword [ebp - 0xc]
jne 0x45896e
push dword [0x46e068]
push 0
call fcn.00458f01
mov bl, al
add bl, byte [ebp - 2]
inc bl
xor bl, byte [ebp - 1]
jmp 0x45899f
mov bl, byte [ebp + 0xf]
call fcn.00458dcd
cmp word [ebp - 8], 0
jne 0x4589f5
cmp bl, 1
jne 0x4589f5
call fcn.00458cec
push dword [0x46e068]
push edi
push 0x4c
call fcn.00458e54
test eax, eax
je 0x4589ea
push 8
mov esi, 0x4b2fa8
pop edi
push dword [0x46e068]
push 0
call fcn.00458f01
add al, byte [ebp - 2]
inc al
xor al, byte [ebp - 1]
mov byte [esi], al
inc esi
dec edi
jne 0x4589cf
call fcn.00458dcd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
xor esi, esi
call fcn.0045ab2c
call fcn.00458b71
mov ax, word [0x4b2fb2]
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.00458c24
cmp dword [ebp - 0x10], esi
pop ebx
je 0x458a24
movsx eax, word [ebp + 0xc]
push eax
call fcn.0045c9fb
cmp word [ebp - 8], si
jge 0x458a2d
mov dword [ebp - 8], esi
mov ax, word [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x458a37
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x4b0fb8], 0
push esi
push edi
jne 0x458b56
lea eax, [ebp - 0x94]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x94]
push 0x46e078
push eax
call esi
lea eax, [ebp - 0x94]
push str.MATRIX.INI
push eax
call esi
lea eax, [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
and dword [0x4b0fd4], 0
push eax
lea eax, [ebp - 0x40]
push 0x1f
push eax
push 0x46e084
push str.HiRes
push 0x46e090
call esi
cmp byte [ebp - 0x40], 0x4e
je 0x458b00
cmp byte [ebp - 0x40], 0x6e
je 0x458b00
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x46e098
push str.hrwert
push 0x46e0a4
call esi
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atol
pop ecx
mov edi, eax
call fcn.004586ac
test ax, ax
jle 0x458b00
test edi, edi
mov dword [0x4b0fd4], 1
jne 0x458afc
push 1
pop edi
mov eax, edi
jmp 0x458b58
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x1f
push eax
push 0x46e0ac
push str.wert
push str.DELAY
call esi
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atol
test eax, eax
pop ecx
jg 0x458b58
mov esi, 0x640
cmp word [ebp + 8], 0x4d
jne 0x458b3f
call fcn.0045916b
jmp 0x458b46
push 1
call fcn.00458f83
test ax, ax
jne 0x458b5e
add esi, 0x64
cmp esi, 0x1b58
jle 0x458b31
xor eax, eax
pop edi
pop esi
leave
ret 4
call fcn.0045ab2c
call fcn.00458b71
lea eax, [esi + esi*2 + 0x3e8]
jmp 0x458b58

Function at 0x458e54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push 8
pop esi
test byte [esp + 8], 1
je 0x458e66
call fcn.00458df0
jmp 0x458e6b
call fcn.00458d00
call fcn.00458e22
call fcn.00458e22
shr byte [esp + 8], 1
call fcn.00458d99
dec esi
jne 0x458e58
cmp dword [esp + 0xc], 0
je 0x458edb
push ebx
push edi
call fcn.00458b71
call fcn.00458e22
call fcn.00458b71
cmp dword [esp + 0x18], 0
je 0x458ec5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x32
ja 0x458ec0
call fcn.00458ee2
test eax, eax
jne 0x458ecc
jmp 0x458eac
push 1
pop ebx
jmp 0x458ecc
call fcn.00458ee2
mov ebx, eax
call fcn.00458d99
pop edi
test ebx, ebx
pop ebx
je 0x458edb
xor eax, eax
jmp 0x458ede
push 1
pop eax
pop esi
ret 0xc

Function at 0x458f01
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
call fcn.00458df0
push 8
xor ebx, ebx
pop esi
call fcn.00458e22
sar ebx, 1
and ebx, 0x7f
call fcn.00458ee2
test eax, eax
je 0x458f23
or bl, 0x80
call fcn.00458d99
dec esi
jne 0x458f0d
cmp dword [esp + 0xc], 0
je 0x458f39
call fcn.00458df0
jmp 0x458f3e
call fcn.00458d00
call fcn.00458b71
call fcn.00458e22
call fcn.00458b71
cmp dword [esp + 0x10], 0
je 0x458f72
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call fcn.00458ee2
test eax, eax
jne 0x458f71
call esi
sub eax, edi
cmp eax, 0x32
jb 0x458f5f
pop edi
call fcn.00458d99
call fcn.00458df0
mov al, bl
pop esi
pop ebx
ret 8
Function at 0x459477
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word [0x4b2fb2]
push esi
push edi
push 2
pop edi
xor esi, esi
push edi
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
test al, 1
jne 0x4594b0
mov ax, word [0x4b2fb2]
push esi
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
and al, 7
cmp al, 7
jge 0x4594b3
push 1
pop esi
mov ax, word [0x4b2fb2]
push 0
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
or al, 7
push eax
mov ax, word [0x4b2fb2]
push 0
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb22
mov ax, word [0x4b2fb2]
push edi
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
and ax, 0xde
push eax
mov ax, word [0x4b2fb2]
push edi
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb22
test esi, esi
je 0x459559
mov ax, word [0x4b2fb2]
push 0
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
mov word [0x4b0fca], ax
mov ax, word [0x4b2fb2]
push edi
push eax
mov ax, word [0x4b2fb0]
push eax
call fcn.0045cb5c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [0x4b0fc8], ax
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x78
jb 0x459550
pop edi
pop esi
ret

Function at 0x45b095
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x45b0b6
movsx ecx, word [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
add dl, byte [ebp + 0x10]
inc dl
xor dl, byte [ebp + 0x14]
mov byte [eax], dl
inc eax
dec ecx
jne 0x45b0a6
pop ebp
ret 0x10

Function at 0x45b148
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0xc], 0
jle 0x45b16d
mov cl, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
movsx esi, word [ebp + 0xc]
not cl
mov dl, byte [eax]
xor dl, byte [ebp + 0x14]
add dl, cl
mov byte [eax], dl
inc eax
dec esi
jne 0x45b15f
pop esi
pop ebp
ret 0x10

Function at 0x45c0d6
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
lea eax, [ebp - 0xa4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa4]
push 0x46e214
push eax
call esi
mov edi, str.IWPORT
lea eax, [ebp - 0xa4]
push edi
push eax
call esi
lea eax, [ebp - 0xa4]
push 0x46e228
push eax
call esi
xor esi, esi
lea eax, [ebp - 0xa4]
push esi
push esi
push str.Parallel_arbitrator
push esi
push str.Extended_base
push eax
push 1
push 2
push 1
push 0xf01ff
push edi
push edi
push dword [0x46e1c4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
cmp edi, esi
jne 0x45c166
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x45c169
push 1
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x45c176
Capabilities:
Get common file path
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push edi
mov edi, str.IWPORT
push 0xf01ff
push edi
xor ebx, ebx
push dword [0x46e1c4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x45c234
push esi
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
push 0x80
neg eax
sbb eax, eax
inc eax
or dword [ebp - 4], eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xac]
push 0x46e214
push eax
call esi
lea eax, [ebp - 0xac]
push edi
push eax
call esi
lea eax, [ebp - 0xac]
push 0x46e228
push eax
call esi
push edi
push ebx
push ebx
push str.Parallel_arbitrator
push ebx
lea eax, [ebp - 0xac]
push str.Extended_base
push eax
push 1
push 2
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x45c23b
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x46e1c4], eax
je 0x45c293
push esi
push edi
push 0xf01ff
push str.IWPORT
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x45c289
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov ebx, eax
call edi
push dword [0x46e1c4]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x45c2f9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [0x4b0fb4], ebx
lea eax, [ebp - 0x16c]
push 0x46e238
push eax
je 0x45c364
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x16c]
push str..VXD
push eax
call esi
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x46e1b8], eax
jmp 0x45c47c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x16c]
push str.IWPORT
push eax
call esi
mov eax, dword [ebp + 8]
inc eax
push eax
lea eax, [ebp - 8]
push 0x46e240
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
push 1
mov edi, 0x80
pop eax
push ebx
push edi
push 3
mov dword [0x46e1bc], eax
mov dword [0x46e1c0], eax
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x46e1b8], eax
jne 0x45c47c
lea eax, [ebp - 0x6c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x6c]
push 0x46e214
push eax
call esi
lea eax, [ebp - 0x6c]
push str.IWPORT
push eax
call esi
lea eax, [ebp - 0x6c]
push 0x46e228
push eax
call esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCRT.dll__access
pop ecx
test eax, eax
pop ecx
jne 0x45c47c
push 0xf003f
push ebx
push ebx
mov dword [0x46e1c0], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [0x46e1c4], eax
je 0x45c47c
call fcn.0045c176
test eax, eax
jne 0x45c453
mov dword [0x46e1bc], ebx
call fcn.0045c0d6
test eax, eax
je 0x45c470
call fcn.0045c176
test eax, eax
je 0x45c470
push ebx
push edi
push 3
push ebx
push ebx
lea eax, [ebp - 0x16c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x46e1b8], eax
push dword [0x46e1c4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45de07
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test ax, ax
jne 0x45de37
and dword [ebp - 4], 0
and byte [ebp - 0x148], al
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test ax, ax
jne 0x45de58
and dword [ebp - 8], 0
and byte [ebp - 0x18], al
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.0045df5b
test ax, ax
jle 0x45def1
mov ecx, dword [ebp + 0xc]
movsx edx, cx
movsx eax, ax
dec edx
cmp eax, edx
jle 0x45de84
lea eax, [ecx - 1]
movsx eax, ax
and byte [ebp + eax - 0x34], 0
mov edx, dword [ebp - 4]
lea esi, [ecx - 1]
lea edx, [eax + edx + 1]
cmp edx, esi
jle 0x45dec8
sub ecx, eax
sub ecx, 2
mov dword [ebp - 4], ecx
jns 0x45dea1
xor ecx, ecx
mov dword [ebp - 4], ecx
and byte [ebp + ecx - 0x148], 0
lea eax, [ebp + ecx - 0x148]
cmp ecx, 3
jle 0x45dec8
push 3
add eax, 0xfffffffd
push 0x46e254
push eax
call sub.MSVCRT.dll_strncpy
add esp, 0xc
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x45dee2
lea eax, [ebp - 0x148]
push 0x46e258
push eax
call esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x148]
push eax
call esi
jmp 0x45df46
mov esi, dword [ebp + 0xc]
push ebx
lea ebx, [esi - 1]
cmp dword [ebp - 4], ebx
jge 0x45df2c
cmp dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jle 0x45df1e
cmp dword [ebp - 8], 0
jle 0x45df1e
lea eax, [ebp - 0x148]
push 0x46e25c
push eax
call edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x148]
push eax
call edi
pop edi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
pop ebx
jle 0x45df46
and byte [ebp + esi - 0x149], 0
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
leave
ret 8
Function at 0x45ec40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0xa8]
xor edi, edi
push 0x80
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa8]
push str.SYSTEM32DRIVERS_
push eax
call esi
cmp dword [0x4b2fb4], 9
jne 0x45ec87
push str.IWUSB_X64
jmp 0x45ec8c
push str.IWUSB
lea eax, [ebp - 0xa8]
push eax
call esi
lea eax, [ebp - 0xa8]
push str..SYS
push eax
call esi
push str.VERSION.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
call fcn.00457aa0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeA
push ebx
call esi
lea ecx, [ebp - 0x10]
mov dword [0x4b1348], eax
push ecx
lea ecx, [ebp - 0xa8]
push ecx
call eax
cmp eax, edi
mov dword [ebp - 4], eax
je 0x45eddc
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push str.GetFileVersionInfoA
push ebx
mov edi, eax
call esi
push edi
lea ecx, [ebp - 0xa8]
push dword [ebp - 4]
mov dword [0x4b134c], eax
push dword [ebp - 0x10]
push ecx
call eax
push 0x46e444
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x4b1350], eax
push ecx
lea ecx, [ebp - 0x24]
push ecx
push str.VarFileInfoTranslation
push edi
call eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
movzx eax, word [eax]
shr ecx, 0x10
push ecx
push eax
lea eax, [ebp - 0x10c]
push str.StringFileInfo_04hX_04hXFileVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.VerQueryValueA
push ebx
call esi
lea ecx, [ebp - 0x28]
mov dword [0x4b1350], eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push edi
call eax
test eax, eax
jne 0x45ed78
xor edi, edi
jmp 0x45edc3
and byte [ebp - 0x20], 0
and byte [ebp - 0x18], 0
push 1
lea eax, [ebp - 0x20]
push dword [ebp - 0xc]
push eax
call sub.MSVCRT.dll_strncat
mov eax, dword [ebp - 0xc]
push 2
add eax, 2
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MSVCRT.dll_strncat
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_atoi
xor edx, edx
mov dh, al
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], edx
call sub.MSVCRT.dll_atoi
mov ecx, dword [ebp - 4]
add esp, 0x20
or ecx, eax
mov edi, ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00457b25
mov ax, di
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push 1
push str.totalcmd.exe__I_.wincmd.ini___F_.wcx_ftp.ini_
call sub.kernel32.dll_WinExec
push 0
call sub.kernel32.dll_ExitProcess
int3
Function at 0x40b48a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040b63a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40b588
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40b52b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40b56e
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40b542
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40b55d
test al, 0x40
je 0x40b554
mov ecx, dword [edi + 0x20]
jmp 0x40b55b
test al, 0x80
je 0x40b56e
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40b56e
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40b4fa
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret