joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a3b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 3
mov ebx, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.00442340
lea esi, [ebx + 0x3c]
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x42a3ea
mov eax, dword [esi]
jmp 0x42a3ec
mov eax, esi
push 0x11
push 0x4d7da4
push 0x10
push eax
push 0xa
push str.screenshot
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442060
lea eax, [ebx + 0x54]
add esp, 0x24
cmp dword [eax + 0x14], 0x10
jb 0x42a41a
mov eax, dword [eax]
push 0x11
push eax
push 5
push 0x4d7dbc
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442060
add esp, 0x1c
call fcn.00442270
mov edi, eax
test edi, edi
je 0x42a46f
cmp dword [ebx + 0x38], 0x10
lea eax, [ebx + 0x24]
jb 0x42a44c
mov eax, dword [eax]
push eax
push 0x2712
push edi
call fcn.00442310
push dword [ebp - 8]
push 0x2728
push edi
call fcn.00442310
push edi
call fcn.00442300
add esp, 0x1c
push edi
call fcn.00442250
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x42a480
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x42ce40
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0198
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
push 0x4e4a48
push 1
push 0
push 0x4e4b88
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x42cea6
push eax
push str.CoCreateInstance_CLSID_ShellLink
jmp 0x42cf0e
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae edx, dword [ebp + 0x38]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x4e4b38
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x42ceed
push eax
push str.pShellLink__QueryInterface
jmp 0x42cf0e
mov eax, dword [ebp - 0x18]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 1
cmovae edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jns 0x42cf24
push eax
push str.pPersistFile__Save
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
xor bl, bl
jmp 0x42cf26
mov bl, 1
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test eax, eax
je 0x42cf37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test eax, eax
je 0x42cf48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x1c], 8
jb 0x42cf59
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x42cf7e
push dword [ebp + 0x20]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
cmp dword [ebp + 0x4c], 8
mov dword [ebp + 0x30], 0
mov word [ebp + 0x20], ax
jb 0x42cfa3
push dword [ebp + 0x38]
call fcn.0047a557
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 0x48
Function at 0x42e9d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d038e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fe080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00431060
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00431060
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x42eae4
test dl, 0x10
jne 0x42eae4
mov eax, 1
jmp 0x42eae6
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.00433c10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x433440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x433471
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x433460
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4359e0
Capabilities:
Check if file exists
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0a0b
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00409860
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x450]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov edx, eax
cmp dword [edx + 0x14], 8
jb 0x435a3d
mov edx, dword [edx]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x435a40
lea edi, [ebp - 0x420]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x435a56
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [ebp - 0x43c], 8
rep movsb byte es:[edi], byte [esi]
jb 0x435a87
push dword [ebp - 0x450]
call fcn.0047a557
add esp, 4
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
cmp word [ebp - 0x218], ax
jne 0x435aca
xor ecx, ecx
jmp 0x435ae2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435ad3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.004116f0
push 9
push str.isup.exe
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], 0
call fcn.00411400
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435b48
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x424], 8
jb 0x435b5f
push dword [ebp - 0x438]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x435b80
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0a48
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x3c], eax
lea edi, [eax + 0x1420]
xor esi, esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435cb1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x435c0f
cmp esi, 0x4b0
jge 0x435bf3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x435bd1
cmp esi, 0x4b0
jne 0x435c0f
push 0
call fcn.00409310
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
mov ecx, dword [ebp - 0x3c]
call fcn.00437af0
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call fcn.004174a0
mov dword [ebp - 4], 0
call fcn.00425d90
mov ecx, eax
call fcn.00425e10
test al, al
je 0x435c97
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push 0x4d52f8
push 0x14
push dword [ebp - 0x18]
call fcn.0047b025
add esp, 0x18
push str._Old_exe_deleted.
push dword [ebp - 0x18]
push 0x509f20
call fcn.00402055
add esp, 8
push eax
call fcn.00402055
push eax
call fcn.004172e0
add esp, 0xc
push dword [ebp - 0x18]
mov dword [ebp - 0x38], vtable.CTime.0
call fcn.0047b041
push dword [ebp - 0x14]
call fcn.0047b041
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x4365c0
Capabilities:
Enumerate process modules
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0aeb
mov eax, dword fs:[0]
push eax
mov eax, 0x1434
call fcn.0047bc80
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1440], ecx
xor eax, eax
mov dword [ebp - 0x1428], 7
mov dword [ebp - 0x142c], 0
mov word [ebp - 0x143c], ax
mov dword [ebp - 4], eax
call fcn.00409860
mov edx, eax
cmp word [edx], 0
jne 0x436629
xor ecx, ecx
jmp 0x43663f
mov ecx, edx
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436630
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x143c]
call fcn.004116f0
push 0x17
push 0x4d97a0
lea ecx, [ebp - 0x143c]
call fcn.00411400
cmp dword [ebp - 0x1428], 8
lea ecx, [ebp - 0x420]
push 0x208
lea eax, [ebp - 0x143c]
cmovae eax, dword [ebp - 0x143c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x1424]
push eax
push 0x1000
lea eax, [ebp - 0x1420]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x436793
mov esi, dword [ebp - 0x1424]
shr esi, 2
test esi, esi
je 0x436793
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea esp, [esp]
push dword [ebp + esi*4 - 0x1424]
dec esi
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x43678b
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x436784
mov eax, dword [ebp - 0x1440]
lea ecx, [ebp - 0x218]
add eax, 0x1218
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x436736
test dx, dx
je 0x436732
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x436736
add eax, 4
add ecx, 4
test dx, dx
jne 0x436710
xor eax, eax
jmp 0x43673b
sbb eax, eax
or eax, 1
test eax, eax
je 0x43677f
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x420]
jmp 0x436750
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x436776
test dx, dx
je 0x436772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x436776
add eax, 4
add ecx, 4
test dx, dx
jne 0x436750
xor eax, eax
jmp 0x43677b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x436784
push 2
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x4366c0
cmp dword [ebp - 0x1428], 8
jb 0x4367aa
push dword [ebp - 0x143c]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x4367d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
call fcn.0040b030
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x436856
lea eax, [ebp - 0x20]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
cmp dword [eax + 0x14], 8
jb 0x43681b
mov eax, dword [eax]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0xc], 8
mov esi, eax
jb 0x436838
push dword [ebp - 0x20]
call fcn.0047a557
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x436856
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040dca0
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0047b06c
mov esp, ebp
pop ebp
ret

Function at 0x436880
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0b28
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
call fcn.0040d660
mov edx, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x4368d0
xor ecx, ecx
jmp 0x4368e4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4368d5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004116f0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436985
lea eax, [ebp - 0x44]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
cmp dword [eax + 0x14], 8
jb 0x436933
mov eax, dword [eax]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x30], 8
mov esi, eax
jb 0x436950
push dword [ebp - 0x44]
call fcn.0047a557
add esp, 4
test esi, esi
je 0x436978
push esi
call fcn.0040db50
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43699e
push dword [ebp - 0x2c]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43699e
push eax
call fcn.0040dc00
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
cmp dword [ebp - 0x14], 8
jb 0x4369af
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x4369d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov edi, ecx
push eax
push 0xf003f
push 0
call fcn.0040b030
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436a80
add edi, 0x1218
mov esi, edi
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x436a10
lea eax, [ebp - 0x20]
sub esi, ecx
push eax
sar esi, 1
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x436a39
mov ecx, dword [ecx]
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0xc], 8
mov esi, eax
jb 0x436a63
push dword [ebp - 0x20]
call fcn.0047a557
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
pop esi
jne 0x436a80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
push 0
call fcn.00408960
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
call fcn.00408a00
push eax
lea ecx, [ebp - 0x18]
call fcn.00435850
push 0x4f6328
lea eax, [ebp - 0x18]
push eax
call fcn.0047b07b
int3
Function at 0x436ac0
Capabilities:
Check if file exists
Download url
Move file
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0b58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x1420]
lea eax, [edi + 0x1218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
call fcn.004338b0
mov ecx, eax
call fcn.0042f620
push 0
push 0
lea esi, [edi + 0x1218]
mov dword [ebp - 0x3c], eax
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
push esi
mov dword [ebp - 0x40], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436b42
push 0
mov ecx, edi
call fcn.00437ba0
jmp 0x436c05
push dword [ebp - 0x40]
call fcn.004093f0
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call fcn.004174a0
mov dword [ebp - 4], 0
call fcn.00425d90
mov ecx, eax
call fcn.00425e10
test al, al
je 0x436bdd
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push 0x4d52f8
push 0x14
push dword [ebp - 0x18]
call fcn.0047b025
add esp, 0x18
push str._Failed_to_download_new_exe_file.
push dword [ebp - 0x18]
push 0x509f20
call fcn.00402055
add esp, 8
push eax
call fcn.00402055
push eax
call fcn.004172e0
add esp, 0xc
push esi
lea eax, [edi + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 0x18]
mov dword [ebp - 0x38], vtable.CTime.0
call fcn.0047b041
push dword [ebp - 0x14]
call fcn.0047b041
add esp, 8
push dword [ebp - 0x3c]
call fcn.0047b041
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 4
Function at 0x437160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0c02
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xe0]
push eax
push 0xf003f
push 0
lea eax, [ecx + 0x1830]
mov dword [ebp - 0xe8], edi
push eax
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xe4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xe4], 1
test eax, eax
jne 0x43725e
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0xc8
push eax
lea eax, [ebp - 0xd8]
push eax
push ecx
push ecx
call fcn.004094f0
push eax
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xe0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43725e
cmp word [ebp - 0xd8], si
jne 0x43722f
xor ecx, ecx
jmp 0x43724f
lea ecx, [ebp - 0xd8]
lea edx, [ecx + 2]
jmp 0x437240
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437240
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.004116f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 4
Function at 0x4377f0
Capabilities:
Create directory
Delete registry value
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0ceb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x800
lea esi, [ebx + 0x1218]
lea edi, [ebx + 0x10]
push esi
push edi
call fcn.0047f055
add esp, 0xc
test eax, eax
jne 0x437843
xor al, al
jmp 0x4379ef
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
call fcn.00409860
mov edx, eax
cmp word [edx], 0
jne 0x437874
xor ecx, ecx
jmp 0x437893
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x234], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437880
sub ecx, dword [ebp - 0x234]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.004116f0
push 0x17
push str.InterstatInterstat.exe
lea ecx, [ebp - 0x230]
call fcn.00411400
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
push 0x208
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x218], 0
jne 0x4378e7
xor ecx, ecx
jmp 0x4378ff
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4378f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004116f0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x800
cmovae eax, dword [ebp - 0x230]
push eax
push edi
call fcn.0047f055
add esp, 0xc
test eax, eax
jne 0x4379d4
push eax
lea eax, [ebx + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
sub edi, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [edi + esi - 2], ax
test ax, ax
jne 0x437955
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push 0
call fcn.0040b030
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4379a5
push str.Interstat
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00425280
mov ecx, eax
call fcn.00425010
call fcn.00425280
mov ecx, eax
call fcn.004258f0
call fcn.00425280
mov ecx, eax
call fcn.00425ad0
mov ecx, ebx
call fcn.004369d0
xor bl, bl
jmp 0x4379d6
mov bl, 1
cmp dword [ebp - 0x21c], 8
jb 0x4379ed
push dword [ebp - 0x230]
call fcn.0047a557
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret