joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call 0x1002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [0x10010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call 0x1002cc3
ret
Function at 0x43c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43ca20
test edx, edx
je 0x43ca20
call fcn.0043c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d469
Function at 0x45dea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cdf0a
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp - 0x148]
mov byte [eax], 0
mov ecx, dword [ebp - 0x148]
add ecx, 4
mov dword [ebp - 0x14c], ecx
push 0x5d7391
mov ecx, dword [ebp - 0x14c]
call fcn.0045c2c0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x148]
add edx, 0x1c
mov dword [ebp - 0x150], edx
push 0x5d7391
mov ecx, dword [ebp - 0x150]
call fcn.0045c2c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x148]
add eax, 0x34
mov dword [ebp - 0x154], eax
push 0x5d7391
mov ecx, dword [ebp - 0x154]
call fcn.0045c2c0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x148]
mov dword [ecx + 0x4c], 0
mov edx, dword [ebp - 0x148]
mov dword [edx + 0x50], 0
mov eax, dword [ebp - 0x148]
mov byte [eax + 0x54], 0
mov ecx, dword [ebp - 0x148]
mov byte [ecx + 0x55], 0
mov edx, dword [ebp - 0x148]
mov byte [edx + 0x56], 0
mov eax, dword [ebp - 0x148]
mov byte [eax + 0x57], 0
mov ecx, dword [ebp - 0x148]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x148]
add ecx, 4
call fcn.00461d20
nop
push 0
push 0x3a
mov ecx, dword [ebp + 8]
call fcn.00470c90
cmp eax, 0xffffffff
jne 0x45e047
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.0045c2c0
mov byte [ebp - 4], 3
push 0x5d869c
lea ecx, [ebp - 0x12c]
call fcn.00463920
nop
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x144]
push ecx
call fcn.0044b0a0
add esp, 0xc
mov dword [ebp - 0x158], eax
mov edx, dword [ebp - 0x158]
push edx
mov ecx, dword [ebp - 0x148]
add ecx, 4
call fcn.00461cb0
lea ecx, [ebp - 0x144]
call fcn.00460c70
nop
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.00460c70
nop
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x1c
call fcn.00461d20
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x148]
add ecx, 0x34
call fcn.00461d20
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x4c], eax
mov ecx, dword [ebp - 0x148]
mov edx, dword [ebp + 0x18]
mov dword [ecx + 0x50], edx
mov ecx, dword [ebp - 0x148]
call fcn.00467b30
nop
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret 0x14
Function at 0x463660
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x46367f
mov ecx, dword [ebp - 8]
call fcn.0046bff0
nop
jmp 0x463693
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x463693
mov ecx, dword [ebp - 8]
call fcn.0046be50
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x465d50
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce97d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0045e100
nop
lea eax, [ebp - 0x28]
push eax
call fcn.00465be0
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
lea ecx, [ebp + 0x20]
call fcn.0046da70
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.0046d350
mov ecx, eax
call fcn.0046da70
mov dword [ebp - 0x44], eax
lea ecx, [ebp + 8]
call fcn.0046da70
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x40]
push ecx
push 0
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00460c70
nop
cmp dword [ebp - 0x2c], 0
jne 0x465e0d
push 0x5d2ccc
call fcn.00479bf0
add esp, 4
jmp 0x465e4e
cmp dword [ebp - 0x2c], 0x8007000e
jne 0x465e25
push str.Buffer_length_invalid__or_insufficient_memory_n
call fcn.00479bf0
add esp, 4
jmp 0x465e4e
cmp dword [ebp - 0x2c], 0x800c0008
jne 0x465e3d
push str.URL_is_invalid_n
call fcn.00479bf0
add esp, 4
jmp 0x465e4e
mov ecx, dword [ebp - 0x2c]
push ecx
push str.Other_error:__d_n
call fcn.00479bf0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00460c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00460c70
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret
Function at 0x465f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x310], 0x5d27a3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30c], eax
mov ecx, dword [ebp - 0x30c]
mov dl, byte [ecx]
mov byte [ebp - 0x305], dl
mov eax, dword [ebp - 0x310]
cmp dl, byte [eax]
jne 0x465fb4
cmp byte [ebp - 0x305], 0
je 0x465fa8
mov ecx, dword [ebp - 0x30c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x306], dl
mov eax, dword [ebp - 0x310]
cmp dl, byte [eax + 1]
jne 0x465fb4
add dword [ebp - 0x30c], 2
add dword [ebp - 0x310], 2
cmp byte [ebp - 0x306], 0
jne 0x465f56
mov dword [ebp - 0x314], 0
jmp 0x465fbf
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x314], ecx
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x31c], edx
cmp dword [ebp - 0x31c], 0
jne 0x466076
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x318], eax
push 0
push 0xff
lea eax, [ebp - 0x104]
push eax
push 0x400
mov ecx, dword [ebp - 0x318]
push ecx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5d3110
lea ecx, [ebp - 0x204]
push ecx
call fcn.00479c80
add esp, 0x10
push 0x10
push 0x5d311c
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
mov dword [ebp - 0x320], 0xbb8
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x32c]
call fcn.00449cc0
push eax
call fcn.00459bd0
add esp, 4
mov ecx, dword [ebp - 0x318]
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x4660e7
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s:__s
lea ecx, [ebp - 0x304]
push ecx
call fcn.00479c80
add esp, 0x10
push 0x10
push str.BOSS_HAX
lea edx, [ebp - 0x304]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
mov dword [ebp - 0x324], 0xbb8
lea eax, [ebp - 0x324]
push eax
lea ecx, [ebp - 0x334]
call fcn.00449cc0
push eax
call fcn.00459bd0
add esp, 4
push 0x5d313c
mov ecx, dword [0x65af40]
call fcn.00469160
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret

Function at 0x466190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4661ba
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x4661ba
mov dword [ebp - 8], 1
jmp 0x4661c1
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4667a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1114
call fcn.005c9b00
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1110], eax
cmp dword [ebp - 0x1110], 0
je 0x46689c
lea ecx, [ebp - 0x1114]
push ecx
push 0x1000
lea edx, [ebp - 0x1108]
push edx
mov eax, dword [ebp - 0x1110]
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x46688e
mov dword [ebp - 0x110c], 0
jmp 0x46681d
mov ecx, dword [ebp - 0x110c]
add ecx, 1
mov dword [ebp - 0x110c], ecx
mov edx, dword [ebp - 0x1114]
shr edx, 2
cmp dword [ebp - 0x110c], edx
jae 0x46688e
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x110c]
mov edx, dword [ebp + ecx*4 - 0x1108]
push edx
mov eax, dword [ebp - 0x1110]
push eax
call sub.KERNEL32.dll_K32GetModuleBaseNameA
test eax, eax
je 0x46688c
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x46688c
mov eax, dword [ebp - 0x1110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x110c]
mov eax, dword [ebp + ecx*4 - 0x1108]
jmp 0x46689e
jmp 0x46680e
mov edx, dword [ebp - 0x1110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret

Function at 0x466970
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4669f4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4669dd
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x466a03
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4669b3
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret
Function at 0x466a20
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffff
jne 0x466a54
xor eax, eax
jmp 0x466b41
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x466b32
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x238], eax
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x234]
mov al, byte [edx]
mov byte [ebp - 0x229], al
mov ecx, dword [ebp - 0x238]
cmp al, byte [ecx]
jne 0x466ae2
cmp byte [ebp - 0x229], 0
je 0x466ad6
mov edx, dword [ebp - 0x234]
mov al, byte [edx + 1]
mov byte [ebp - 0x22a], al
mov ecx, dword [ebp - 0x238]
cmp al, byte [ecx + 1]
jne 0x466ae2
add dword [ebp - 0x234], 2
add dword [ebp - 0x238], 2
cmp byte [ebp - 0x22a], 0
jne 0x466a84
mov dword [ebp - 0x23c], 0
jmp 0x466aed
sbb edx, edx
or edx, 1
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x466b17
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x214]
jmp 0x466b41
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x466a6f
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret
Function at 0x4688c0
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5d32c0
mov ecx, dword [0x65af40]
call fcn.00469160
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5d32c8
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
pop ebp
ret

Function at 0x469160
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
push 0x10022
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret 4
Function at 0x469a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0
push 0x80
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp + 0x10]
call fcn.0046da70
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x469ab9
xor al, al
jmp 0x469b06
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
je 0x469afc
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jne 0x469afc
mov dword [ebp - 0xc], 1
jmp 0x469b03
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x469b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cecf0
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044a110
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00470b70
add esp, 4
mov byte [ebp - 0x41], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00461a40
movzx edx, byte [ebp - 0x41]
test edx, edx
je 0x469ba7
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
call fcn.0044a110
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
push ecx
call fcn.00475130
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00461a40
nop
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4c], eax
push 0xa
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x469ca6
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x469ca6
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x58], 0
je 0x469ca6
cmp dword [ebp - 0x54], 0
jbe 0x469ca6
push 1
push 0x40
push 0x20
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
call fcn.0045bf10
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x108]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
movzx eax, al
test eax, eax
je 0x469c93
mov ecx, dword [ebp - 0x54]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x108]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [ebp - 0x108]
call fcn.0046de00
nop
mov byte [ebp - 0x42], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.00463a00
mov al, byte [ebp - 0x42]
jmp 0x469ca8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.00463a00
nop
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret