joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ecx, 0x451fd8
call fcn.00412950
add eax, eax
mov dword [ebp - 4], 0x451fd8
mov dword [ebp - 8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x41a738
jmp 0x41a710
movzx eax, word [esi + 0x2c]
lea edx, [ebp - 8]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 0x30]
push 1
mov dword [ebp - 0xc], eax
call fcn.00412a30
test al, al
jne 0x41a736
mov esi, dword [esi]
cmp esi, edi
jne 0x41a710
jmp 0x41a738
mov ebx, esi
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test ebx, ebx
je 0x41a75c
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, 0x5a4d
push esi
mov esi, edx
cmp word [ecx], ax
jne 0x41a7c0
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41a7c0
cmp eax, 0x10000000
jae 0x41a7c0
cmp dword [eax + ecx], 0x4550
jne 0x41a7c0
lea edx, [ecx + 0x78]
add edx, eax
mov eax, dword [edx]
test eax, eax
je 0x41a7c0
cmp dword [edx + 4], 0
je 0x41a7c0
push dword [ebp + 8]
add eax, ecx
push esi
push eax
push edx
call fcn.0041a7d0
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41bd30
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 5
push 0x18
lea eax, [ebp - 0x20]
mov esi, edx
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test ecx, ecx
js 0x41bd69
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
Function at 0x41ca70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push ebx
mov ebx, 0x10
push esi
push edi
test edx, edx
je 0x41caaf
movzx eax, word [edx]
mov word [ebp - 0x10], ax
add eax, 2
cmp dword [edx], 0xfffe
mov word [ebp - 0xe], ax
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
jbe 0x41cab7
mov eax, 0xc0000106
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
push 0x100
push 4
push dword [0x458d0c]
mov dword [ebp - 4], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push edi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
jns 0x41cb1f
push edi
push 0
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, 0x80000005
jne 0x41cb24
push dword [ebp - 4]
push 4
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
sub ebx, 1
jne 0x41cad3
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41df00
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x14]
mov edi, ecx
push eax
push edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x41e0cf
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x14]
je 0x41e0cf
cmp dword [esi + 0x1b4], 0
jg 0x41df9d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov eax, dword [esi + 0x1b8]
test eax, eax
jne 0x41df73
mov dword [esi + 0x1b8], ebx
jmp 0x41df85
push 2
push ebx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
test eax, eax
je 0x41e0cf
jmp 0x41e0c4
test dword [esi + 0x20], 0x200000
je 0x41e051
cmp dword [esi + 0x180], 0
jne 0x41e051
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x41e051
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x180], eax
test eax, eax
je 0x41e051
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x18c], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x48]
push eax
mov dword [esi + 0x198], eax
mov eax, dword [esi + 0x194]
inc eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x188], eax
test eax, eax
jne 0x41e030
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x180], 0
jmp 0x41e051
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esi + 0x188]
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x184], eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
test ebx, ebx
je 0x41e0cf
mov ecx, dword [ebp - 0x50]
mov edx, esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x180]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x41e0ba
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00422570
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push 0xcc0020
push edx
push ecx
push dword [esi + 0x180]
sub eax, edx
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x41e0c4
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.00422570
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
Function at 0x421810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x421858
cmp esi, 0x28
je 0x421858
cmp esi, 0x24
je 0x421858
cmp esi, 0x23
je 0x421858
cmp esi, 0x21
je 0x421858
cmp esi, 0x22
je 0x421858
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x4219fa
lea eax, [esi - 0x21]
cmp eax, 7
ja case.0x421874.37
jmp dword [eax*4 + 0x421a10]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x421874.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x421874.36
dec edi
jmp 0x42191e
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x421874.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x42191e
lea edi, [ecx - 1]
jmp 0x42191e
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x4218b5
mov edi, dword [edi + 0x20]
jmp 0x4218b7
xor edi, edi
test byte [ebx + 0x20], 8
je 0x4218c2
mov edx, dword [ebx + 0x58]
jmp 0x4218c4
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x4219fa
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x4219fa
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x4218fd
cmp edi, eax
jbe 0x4218f1
mov edi, eax
jmp 0x42191e
cmp edi, edx
jb case.0x421874.36
sub edi, edx
jmp 0x42191e
xor edi, edi
jmp 0x42191e
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x42190f
mov edi, esi
jmp 0x42191e
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x42191e
mov edi, dword [ebp - 0x1c]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 0x15]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.00421140
test si, si
jns 0x421974
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x421974
lea eax, [ebp - 0x20]
cmp edi, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x421990
cmp byte [ebp - 0x15], 0
jne 0x4219bc
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push edi
mov ecx, ebx
call fcn.00420fd0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.00420d50
test al, al
je 0x4219bc
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.004212f0
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4219fa
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
Function at 0x4218a9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x421858
cmp esi, 0x28
je 0x421858
cmp esi, 0x24
je 0x421858
cmp esi, 0x23
je 0x421858
cmp esi, 0x21
je 0x421858
cmp esi, 0x22
je 0x421858
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x4219fa
lea eax, [esi - 0x21]
cmp eax, 7
ja case.0x421874.37
jmp dword [eax*4 + 0x421a10]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x421874.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x421874.36
dec edi
jmp 0x42191e
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x421874.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x42191e
lea edi, [ecx - 1]
jmp 0x42191e
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x4218b5
mov edi, dword [edi + 0x20]
jmp 0x4218b7
xor edi, edi
test byte [ebx + 0x20], 8
je 0x4218c2
mov edx, dword [ebx + 0x58]
jmp 0x4218c4
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x4219fa
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x4219fa
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x4218fd
cmp edi, eax
jbe 0x4218f1
mov edi, eax
jmp 0x42191e
cmp edi, edx
jb case.0x421874.36
sub edi, edx
jmp 0x42191e
xor edi, edi
jmp 0x42191e
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x42190f
mov edi, esi
jmp 0x42191e
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x42191e
mov edi, dword [ebp - 0x1c]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 0x15]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.00421140
test si, si
jns 0x421974
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x421974
lea eax, [ebp - 0x20]
cmp edi, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x421990
cmp byte [ebp - 0x15], 0
jne 0x4219bc
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push edi
mov ecx, ebx
call fcn.00420fd0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.00420d50
test al, al
je 0x4219bc
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.004212f0
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4219fa
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
Function at 0x428470
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
test byte [0x457b14], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x428554
mov esi, 0x457b14
lock bts dword [esi], 0x1f
jae 0x4284b2
test byte [0x457b14], 1
jne 0x428554
mov ecx, esi
call fcn.00429b00
jmp 0x428554
push str.cryptui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x428504
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x428504
cmp eax, 0x10000000
jae 0x428504
cmp dword [eax + ecx], 0x4550
jne 0x428504
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x428504
cmp dword [edx + 4], 0
je 0x428504
push 0
push str.CryptUIDlgViewSignerInfoW
add eax, ecx
push eax
push edx
call fcn.0041a7d0
jmp 0x428506
xor eax, eax
mov dword [0x458b08], eax
lock bts dword [esi], 0
jb 0x428554
mov esi, dword [0x457b18]
test esi, esi
je 0x428525
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x457b14
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x428554
test esi, esi
je 0x428554
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x457b18], 0
cmp dword [0x458b08], 0
je 0x4285da
push 0x2c
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x30
push 0
push eax
call fcn.0042e280
mov esi, dword [0x458b9c]
add esp, 0xc
mov ecx, esi
push edi
call dword [0x4484cc]
call esi
mov edi, eax
test edi, edi
je 0x4285da
mov esi, dword [0x458b7c]
mov ecx, esi
push 0
push 0
push 0
push edi
call dword [0x4484cc]
call esi
test eax, eax
je 0x4285da
mov ecx, dword [ebx + 0x14]
mov esi, dword [0x458b08]
mov dword [esp + 0x14], ecx
mov ecx, esi
mov eax, dword [eax + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], str.1.3.6.1.5.5.7.3.3
call dword [0x4484cc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
and esi, 0xfffffffe
mov eax, esi
lea edx, [esi + 2]
lock cmpxchg dword [edi], edx
cmp eax, esi
je 0x429551
mov edx, dword [edi]
test dl, 1
jne 0x429640
lea ecx, [edx + 2]
mov eax, edx
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x429551
mov edx, dword [edi]
test dl, 1
je 0x429535
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x458948
call dword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov esi, eax
test esi, esi
je 0x42956b
lock dec dword [0x458950]
jmp 0x429584
mov eax, dword [0x458958]
add eax, 8
push eax
push 4
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
push ebx
push 0
lea ecx, [esi + 8]
lea eax, [ebp - 4]
mov dword [ecx], 0x429650
push eax
push ecx
push 0x4128d0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [ecx + 4], edi
call dword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov ebx, eax
test ebx, ebx
jns 0x4295e5
mov eax, dword [0x458950]
push esi
cmp eax, dword [0x458954]
jae 0x4295d7
push 0x458948
call dword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x458950]
jmp 0x4295e5
push 0
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
test ebx, ebx
pop ebx
js 0x4295ff
inc dword [edi + 0x2c]
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
and edx, 0xfffffffe
mov eax, edx
lea ecx, [edx - 2]
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x429640
mov edx, dword [edi]
test dl, 1
jne 0x42962c
lea ecx, [edx - 2]
mov eax, edx
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x429640
mov edx, dword [edi]
test dl, 1
je 0x429618
and edx, 0xfffffffe
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x429640
lea ecx, [edx + 4]
call fcn.00429ab0
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42a810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
jb 0x42a850
lea edi, [esi + 0xc]
cmp ecx, edi
je 0x42a850
push 0
push 0
sub ecx, esi
lea eax, [ebp - 8]
sub ecx, 0xc
push ecx
push edi
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x42a862
mov dword [esi + 4], edi
mov ecx, edi
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi + 4]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42a870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42a8bb
push 0
push 0
push 0x2000
lea edi, [esi + 0xc]
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x42a8bb
mov eax, dword [ebp - 4]
test eax, eax
je 0x42a8bb
add eax, 0xc
mov dword [esi + 4], edi
add eax, esi
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42a8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42a914
mov eax, dword [esi + 4]
lea edi, [esi + 0xc]
cmp eax, edi
je 0x42a90c
push 0
push 0
sub eax, esi
sub eax, 0xc
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x42a914
mov dword [esi + 4], edi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42cfc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov ecx, 0
push 0
test byte [edi + 4], 8
lea eax, [edi + 8]
cmove eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push edx
push eax
push ecx
push ecx
push ecx
push dword [edi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp ecx, 0x103
jne 0x42d00c
push 0
push 0
push dword [edi]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x42d023
mov ecx, dword [ebp - 8]
test ecx, ecx
js 0x42d021
mov eax, dword [ebp - 4]
add dword [edi + 8], eax
adc dword [edi + 0xc], 0
or dword [edi + 4], 0x80000000
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42d030
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor edx, edx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
mov edi, dword [esi + 0x18]
sub eax, edi
je 0x42d090
sub edi, dword [esi + 0x1c]
xor ecx, ecx
mov eax, edi
cdq
add dword [esi + 8], eax
adc dword [esi + 0xc], edx
test byte [esi + 4], 8
jne 0x42d082
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
push 0xe
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push 8
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
mov edx, eax
test ecx, ecx
js 0x42d088
mov edx, ecx
test ecx, ecx
jns 0x42d090
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x18], 0
mov eax, edx
mov dword [esi + 0x1c], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x412008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.00401000
push 0x40c
xor ebx, ebx
mov dword [ebp - 0x414], 0x22
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00401de0
add esp, 0xc
lea eax, [ebp - 0x412]
mov esi, 0x207
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401259
cmp eax, esi
jae 0x401259
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x412]
push eax
call esi
lea eax, [ebp - 0x412]
push eax
call esi
push str.GoogleUpdate.exe
lea eax, [ebp - 0x412]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401259
push str.___broker
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.00401046
test eax, eax
js 0x40125e
push edi
push 0x40
lea eax, [ebp - 0x464]
mov dword [ebp - 0x468], 0x44
push ebx
push eax
call fcn.00401de0
xor eax, eax
lea edi, [ebp - 0x424]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x401259
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
xor eax, eax
jmp 0x40125e
call fcn.0040102b
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004014b9
leave
ret 0x10