joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021e0
Capabilities:
Get cpu information
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, eax
call fcn.004022c0
mov eax, esi
call fcn.00402330
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402240
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 0x88]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.MHz
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push 0
shrd edx, eax, 0xa
push 0
push 0
push str.DISPLAY
shr eax, 0xa
mov dword [esi + 0x8c], edx
call dword [sym.imp.GDI32.dll_CreateICA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x90], eax
call ebx
push edi
mov dword [esi + 0x94], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call fcn.004025d0
mov ebx, esi
call fcn.004024a0
call fcn.00402770
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402c20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareNewGTXInfestation_Fantasy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402c48
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402cba
push esi
call fcn.005b36b5
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402cba
jl 0x402cb3
cmp eax, esi
jae 0x402cba
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret
Function at 0x402de0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x402e33
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.005b683c
add esp, 8
test eax, eax
je 0x402e95
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.00406590
add esp, 0x10
push 0x30
push str.Warning
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.005b2ec7
add esp, 0xb14
ret

Function at 0x402f70
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
mov eax, dword [0x6ddde8]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x6dd4b0
mov dword [0x6dddf0], eax
mov dword [0x6d5bf8], 0
call fcn.005b3af0
add esp, 8
test eax, eax
je 0x402fb8
call fcn.00401930
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402d50
test al, al
jne 0x402fa8
call fcn.00402de0
call fcn.00402eb0
test al, al
jne 0x402ff3
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00407140
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x782880
push 0x6a9634
push 0x17
push 0
push 0x68382c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x403027
mov dword [0x782880], 0
push str._cmdLine
push 0x6dd4b0
call fcn.005b3af0
add esp, 8
test eax, eax
je 0x403044
mov byte [0x78287c], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x7827e0], eax
call esi
push 0x209
push 0x782918
push 0x12f
push 0
mov dword [0x7827dc], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x403b30
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x6020de
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x6d6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
cmp byte [0x78287c], 0
je 0x403bb8
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.005b41d5
add eax, 0x20
push eax
push 0x6a96dc
push str.CONOUT_
call fcn.005b41af
call fcn.005b41d5
push eax
push 0x6a9a1c
push str.CONIN_
call fcn.005b41af
add esp, 0x18
mov dword [0x6dde68], 1
jmp 0x403d32
mov eax, 0x783350
call fcn.004021e0
mov eax, dword [0x6ddde8]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x6dddec]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x6dddec]
push 0x800000
push 0
push edx
call fcn.00568370
mov eax, dword [0x6dddec]
push 0xc00000
push 0
push eax
call fcn.00568370
mov ecx, dword [0x6dddec]
add esp, 0x18
push 0x4039a0
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00572b60
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x30e]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x287]
cdq
push 0x287
sub eax, edx
mov edx, dword [0x6dddec]
push 0x30e
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.0056ab90
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x403cab
mov ecx, eax
call fcn.005703d0
jmp 0x403cad
xor eax, eax
mov dword [esp + 0x220], 0xffffffff
mov ecx, dword [0x6dddec]
push 0
push ecx
mov ecx, eax
mov dword [0x6dde54], eax
call fcn.0056bd10
call fcn.00403080
push str.Nov_17_2024_23:19:32
push 0x6d95b0
lea edx, [esp + 0x1c]
push str.Infestation_Launcher__s___s_
push edx
call fcn.004065b0
mov ecx, dword [0x6dddec]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00403460
mov edx, dword [0x6dddec]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x6dde5c]
call fcn.005761c0
mov ecx, dword [0x6dde58]
call fcn.00576400
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.005b2ec7
add esp, 0x214
ret
Function at 0x405370
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push edi
add eax, 0x21638
push eax
lea edi, [esp + 8]
call fcn.0040da30
mov eax, dword [esp + 0x410]
sub eax, 0
pop edi
je 0x4053d1
sub eax, 2
je 0x4053c1
sub eax, 2
jne 0x4053fd
push 5
push eax
push 0x6a9a11
push str.https:__www.facebook.com_groups_680440360100941_
jmp 0x4053f0
push 5
push 0
push 0x6a9a11
push str.https:__instabio.cc_FantasyNewWorld
jmp 0x4053f0
lea eax, [esp]
push str.https:__instabio.cc_FantasyNewWorld
push eax
call fcn.00401ae0
add esp, 8
push 5
push 0
push 0x6a9a11
lea ecx, [esp + 0xc]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.005b2ec7
add esp, 0x404
ret
Function at 0x4055f0
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sub esp, 0x28
sar edx, 4
push ebx
mov eax, edx
shr eax, 0x1f
push ebp
xor ebx, ebx
add eax, edx
push edi
je 0x4057fd
xor ebp, ebp
jmp 0x405620
cmp ebp, 0xfc
jae 0x4057fd
cmp ebx, eax
jb 0x405635
call fcn.005b40c6
mov eax, dword [esi + 0xc]
add eax, ebp
cmp dword [eax + 0x18], 0x10
jb 0x405645
mov eax, dword [eax + 4]
jmp 0x405648
add eax, 4
mov edi, dword [0x7828fc]
mov ecx, eax
push ecx
mov dword [esp + 0x10], eax
call fcn.00403dd0
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
mov dword [esp + 0x20], edx
add esp, 4
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fst dword [esp + 0x28]
fild dword [esp + 0x1c]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
fst dword [esp + 0x2c]
fild dword [0x782908]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld dword [esp + 0x38]
fcom st(1)
fnstsw ax
fld dword [esp + 0x3c]
test ah, 0x41
jp 0x40578c
fld dword [esp + 0x28]
fadd st(2)
fcomp st(3)
fnstsw ax
fstp st(2)
test ah, 1
jne 0x40579c
fild dword [0x78290c]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fcom st(2)
fnstsw ax
test ah, 1
jne 0x405794
fld dword [esp + 0x2c]
fadd st(3)
fcompp
fnstsw ax
test ah, 1
jne 0x40579c
fld1
push 0
push 0
lea edx, [esp + 0x18]
push edx
sub esp, 0x10
fstp dword [esp + 0xc]
mov dword [esp + 0x2c], 0xffffd800
fxch st(3)
fstp dword [esp + 8]
faddp st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 4]
fstp dword [esp]
call fcn.00576560
add esp, 0x1c
cmp dword [0x782910], 0
je 0x405782
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x405755
call fcn.005b40c6
mov ecx, dword [esi + 0xc]
cmp dword [ecx + ebp + 0x34], 0x10
lea eax, [ecx + ebp + 0x1c]
jb 0x405768
mov eax, dword [eax + 4]
jmp 0x40576b
add eax, 4
push 5
push 0
push 0x6a9a11
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
fld dword [esp + 0x38]
fld dword [esp + 0x3c]
jmp 0x4057a0
fstp st(4)
fstp st(2)
fstp st(0)
jmp 0x4057a2
fstp st(4)
fstp st(2)
fstp st(2)
jmp 0x4057a2
fstp st(3)
fstp st(1)
fxch st(1)
mov edx, dword [esp + 0xc]
fxch st(1)
mov ecx, dword [0x7828fc]
push edx
push 0x6a9630
lea eax, [esp + 0x18]
push eax
sub esp, 8
fstp dword [esp + 4]
fstp dword [esp]
push ecx
call fcn.005724d0
fld dword [esp + 0x54]
mov ecx, dword [esi + 0x10]
fadd qword [0x6ab5d8]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
fstp dword [esp + 0x54]
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add esp, 0x18
add ebp, 0x54
cmp ebx, eax
jb 0x405620
pop edi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x405af0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405b1d
xor al, al
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405b22
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405b19
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret

Function at 0x405b60
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNewGTXInfestation_Fantasy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405b8d
xor al, al
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405b92
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405b89
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret
Function at 0x405bd0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x601bfb
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.005b7760
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x1010], eax
push ebx
push esi
push edi
mov eax, dword [0x6d6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x1024]
mov dword fs:[0], eax
push str.Starting_game_n
mov ebx, ecx
call fcn.00568bd0
inc dword [0x6dde80]
add esp, 4
push 6
push 0
mov dword [esp + 0x1034], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.Infestation.exe
call fcn.00569940
add esp, 0xc
test al, al
jne 0x405c62
push str.failed1_n
call fcn.00568bd0
add esp, 4
jmp 0x405c79
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push str._08x__d_n
call fcn.00568bd0
add esp, 0xc
lea esi, [ebx + 0x21638]
push esi
lea edi, [esp + 0x24]
call fcn.0040da30
push esi
lea edi, [esp + 0x424]
call fcn.0040da30
mov esi, edi
call fcn.00405af0
test al, al
je 0x405cc7
push 0xffffffffffffffff
call fcn.00576b40
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.00576b40
add esp, 4
push eax
mov ecx, edi
push str._08X_08X
push ecx
call fcn.00401ae0
add esp, 0x10
lea esi, [esp + 0x20]
call fcn.00405b60
test al, al
je 0x405cfa
push 0xffffffffffffffff
call fcn.00576b40
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.00576b40
add esp, 4
push eax
mov edx, esi
push str._08X_08X
push edx
call fcn.00401ae0
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push 0x6dd4b0
lea ecx, [esp + 0x828]
push str._WOUpdatedOk__s__WOLogin___s_
push ecx
call fcn.00406590
add esp, 0x10
cmp dword [ebx + 0x21cbc], 0
jbe 0x405d6e
lea eax, [esp + 0x820]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405d30
sub eax, edx
cmp dword [ebx + 0x21cc0], 0x10
lea edx, [esp + eax + 0x820]
mov dword [esp + 0x14], edx
jb 0x405d55
mov ebx, dword [ebx + 0x21cac]
jmp 0x405d5b
add ebx, 0x21cac
push ebx
lea eax, [esp + 0x18]
push str.__survey___s_
push eax
call fcn.00406670
add esp, 0xc
push 5
push 0
lea ecx, [esp + 0x828]
push ecx
push str.Infestation.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x405d9f
push eax
push str.failed:__d_n
call fcn.00568bd0
add esp, 8
cmp dword [0x6dde80], 0
je 0x405dae
dec dword [0x6dde80]
mov ecx, dword [esp + 0x1024]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.005b2ec7
add esp, 0x1020
ret
Function at 0x406b80
Capabilities:
Set console window title

Disassembly:
sub esp, 0x218
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040b2f0
call fcn.00568910
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
call fcn.00568960
call fcn.00568910
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x406bd1
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x406c58
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x10], eax
or eax, ecx
mov dword [esp + 0x14], ecx
jne 0x406bf6
fldz
jmp 0x406c1f
fild qword [esi + 0x21600]
fild qword [esp + 0x10]
fdivp st(1)
fstp dword [esp + 0xc]
fld1
fcom dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x406c19
fstp dword [esp + 0xc]
jmp 0x406c1b
fstp st(0)
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
sub esp, 8
fld dword [esp + 0x14]
lea eax, [esi + 0x20df5]
fmul qword [0x6ab668]
lea ecx, [esp + 0x20]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.004065b0
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
jmp 0x406bb0
mov eax, esi
call fcn.0040b410
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x406ca2
sub eax, 1
je 0x406c8c
sub eax, 1
je 0x406caf
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x6a9a04
call fcn.00568ee0
add esp, 0x10
jmp 0x406caf
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.00568bd0
add esp, 8
jmp 0x406caf
push str.Update_ok_n
call fcn.00568bd0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.00568bd0
add esp, 4
call fcn.005b4397
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005b2ec7
add esp, 0x218
ret
Function at 0x407140
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x608], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..new.exe
push ecx
call fcn.005b3af0
add esp, 8
test eax, eax
jne 0x4071b9
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push str._s.new.exe
push eax
call fcn.00401ac0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.005b2ec7
add esp, 0x60c
ret
push str..exe_updated__moving_back_n
mov byte [0x782d2a], 1
call fcn.00568bd0
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax]
mov byte [esp + eax + 0x104], cl
inc eax
test cl, cl
jne 0x4071e0
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4071f5
sub eax, edx
cmp eax, 8
ja 0x407219
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.00568ee0
add esp, 0x10
lea eax, [esp]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407220
push ebx
push ebp
push esi
sub eax, edx
push edi
lea edx, [esp + 0x10]
push edx
push str.exeMain:__s_n
mov byte [esp + eax + 0x10], cl
call fcn.00568bd0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
test eax, eax
jne 0x4072fb
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
call ebp
test eax, eax
jne 0x4072fb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x407257
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x220]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push ecx
call fcn.00401ae0
add esp, 0x10
push 0x30
push str.Updater
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x6a97d8
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4072fd
mov al, 1
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b2ec7
add esp, 0x60c
ret
Function at 0x407320
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00568bd0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push str._s.new.exe
push edx
call fcn.00401ac0
lea eax, [esp + 0x14]
push 0x6a96dc
push eax
call fcn.005b3a90
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x407395
lea ecx, [esp + 4]
push ecx
push str.cant_open__s_for_writing_n
call fcn.00568da0
add esp, 8
mov edx, dword [esp + 0x214]
push esi
push 1
push edx
push edi
call fcn.005b44fe
push esi
call fcn.005b3350
mov eax, dword [0x782884]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push str.executing__s_n
call fcn.00568bd0
add esp, 8
push 5
push 0
push 0x6dd4b0
lea edx, [esp + 0x10]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop esi
jge 0x407401
push eax
lea eax, [esp + 4]
push eax
push str.failed_to_launch__s___d
call fcn.00568da0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.005b2ec7
add esp, 0x20c
ret
Function at 0x407430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x601ba8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x6d6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0040db80
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0040dd10
movzx eax, word [esp + 0x5c]
push 0x6a9c80
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x40756d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40756d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0040de00
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040dd40
push eax
lea ecx, [esp + 0x1c]
call fcn.0040dd70
mov ecx, dword [0x6dde54]
push eax
add ecx, 0x50
call fcn.0056b7b0
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x40756d
mov ecx, dword [0x6dde54]
call fcn.0057b0d0
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.0057ccd0
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.0057cb40
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x40754e
fadd dword [0x6ab594]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x407568
fadd dword [0x6ab594]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0040dc30
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc

Function at 0x407630
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0xf003f
push ebx
push str.SoftwareNewGTXInfestation_Fantasy
mov byte [esi], bl
mov byte [esi + 0x80], bl
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
push SysReAllocString
mov dword [esi + 0x170], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4076a0
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push esi
push ebx
push ebx
push str.username
push edx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebx
add esp, 8
ret