joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086d5
Capabilities:
Encode data using xor

Disassembly:
sbb eax, dword [eax + esi*2 - 0x1a]
leave
mov dh, 0x3c
daa
scasb al, byte es:[edi]
rol edi, 0x99
test ch, ah
test al, 0xfc
stc
jbe 0x4086e2
fmul st(6), st(0)
push esi
adc byte [esi], bl
or byte [esi + 0x1d], al
out 0x50, eax
push 0x20
mov bh, 0x48
pop es
xchg esi, eax
cli
add bh, byte [esi + 0x63a88811]
ror dh, 0x47
out 0xb7, al
pushfd
call 0x8bb6647b
mov cl, 0xb8
mov eax, 0x4683bdaa
movsd dword es:[edi], dword [esi]
jge 0x40869f
in al, dx
invalid
mov eax, 0x4683bdaa
movsd dword es:[edi], dword [esi]
jge 0x40869f
in al, dx
jbe 0x408705
xchg ebp, eax
mov ah, byte [ebp - 0x21]
mov dl, 0x79
or byte [eax - 0x6f65f51b], 0x6c
cld
mov dword [0x7adc491c], eax
jg 0x4086f6
fbstp tbyte gs:[edx - 0x1a777d87]
or bl, byte [edx - 0x5c039370]
sbb al, 0x49
fdivr qword [edx + 0x7f]
add dword [ebx + 0x2e], edi
jnp 0x408725
pop edi
pop edi
test dword [ebx + 0x73], eax
daa
xchg ecx, eax
jp 0x408743
invalid
out dx, eax
xchg byte [ebx - 0x60b9d876], bl
and ch, 0xe4
hlt
xchg edi, eax
test dword [esi - 0x30], ecx
mov dword [0x7c745590], eax
in eax, dx
mov eax, 0x32f8443
add eax, 0xc728e135
sbb byte [esi + 0x76], dh
jbe 0x4087b0
invalid
jbe 0x4087b3
jb 0x408738
stc
das
popal
scasd eax, dword es:[edi]
or dword [ebp - 0x7a], edx
ret 0x812f
push ebp
xchg dl, al
das
add dword [ecx + 0x2221bfb7], 0xc0c1e2f9
inc ecx
mov bl, byte [ebx + 0x4d]
mov dl, 0
sub dword [edi + 0x393250b1], ecx
shr dword [ebp + 0x29], 0xac
fistp word [eax + 0x647c2af8]
inc ebp
mov ah, 0xde
nop
fld dword [eax]
jle 0x40873b
ficom word [0x6a5acbb7]
wait
or ebx, esp
daa
inc edx
daa
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword [esi]
push edi
cmp bl, byte [ebx - 0x1f193b19]
mov eax, dword [0xdab51aa7]
add al, 0xce
adc eax, 0x5bd845f5
invalid
test eax, 0x27099d97
or dword [edi], esp
inc ebx
aaa
or dword [eax - 0x656799f], eax
lahf
sbb eax, 0x52ba4119
invalid

Function at 0x427445
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx - 0x40d9417d], ecx
loope 0x427476
cmp al, 0x35
adc eax, 0x4ad18e58
int1
push es
in al, dx
aad 0x87
movsb byte es:[edi], byte [esi]
cmp byte [0x4348169b], 0x51
enter 0x4772, 0xffffffffffffff9f
adc al, 0xfa
dec ebp
inc esi
xor byte [edi + 9], 0x8f
aaa
test dword [ecx], 0xc8291eea
pushfd
sbb dword [eax], ebp
sbb eax, esp
jb 0x4274bc
sub byte [ecx], bl
loopne 0x4274ec
inc ecx
push esi
outsb dx, byte [esi]
sub byte [esi], cl
sbb byte [ebp - 0x42], 0x9f
std
xchg dword [ecx], edi
mov bh, 0xf3
int3
out 0xf9, eax
sub eax, 0xeefec9f8
invalid
adc esp, edx
xor byte ss:[edi], ch
xchg edx, eax
pop ds
cmp dword [edx + ebp], eax
pop edi
mov byte [edx + 0x6778d633], ah
xor edx, esi
js 0x427564
dec edx
inc edi
push ebp
xchg byte [eax - 0x63], bh
cdq
mov bh, 0x40
pop ss
xor dword [edx - 0x6859ad1f], ecx
sti
fst dword [edi - 0x5738f70f]
aad 0x27
mov edi, 0xe7cd3411
pop ss
neg cl
ja 0x4274f9
xchg ecx, eax
push esi
fild word [ebx + 0x29b7b9a7]
iretd
mov eax, 0xb71b5714
dec ebp
cmp ah, dh
invalid
Function at 0x44a210
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x85bc30
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x44a280
mov edx, dword [0x65ba60]
push 0x65b778
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalSsyOpt
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
mov dword [0x65ba5c], eax
pop esi
add esp, 0x14
ret

Function at 0x59c875
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
add bh, bl
mov esi, 0x44b8d147
jmp 0xdaead4b1
jmp 0xc9f5f1a3
jne 0x59c823
cdq
add eax, 0xfc7971e3
xchg edx, eax
popal
out 0x1e, al
stosd dword es:[edi], eax
aad 0x4e
or dword [ecx - 0xd5160d4], 0xd26e09ee
inc ebx
ror dword [esi - 0x43ce5c22], 1
jb 0x59c849
invalid

Function at 0x5c6743
Capabilities:
Encode data using xor

Disassembly:
bound esp, qword [edi - 0xe]
cmp cl, byte [esi - 0x3b]
scasd eax, dword es:[edi]
frstor dword [0x20d37d7]
xor al, 0xf
sbb dword [edi - 0x19], edi
sti
movsd dword es:[edi], dword [esi]
invalid
mov eax, dword [0x331f7e32]
sbb ah, byte [ebp + 0x2e]
aas
xor esp, dword [eax - 0x70]
out 0x59, eax
out dx, eax
and dl, byte [ebp - 0x66f1d4c3]
and dword [ebx], edx
cmpsb byte [esi], byte es:[edi]
inc esi
jle 0x5c66d1
in eax, dx
invalid
and eax, 0xa47701d4
mov dh, 0xb8
test byte [edx], bl
mov dword [0x1fb19999], eax
adc eax, dword [ebp - 0x30]
pop edi
ja 0x5c67cb
cwde
mov dword [0x16332691], eax
rol dword [0x918f40c], 0x89
lahf
fld dword [eax]
inc edx
mov edi, 0x21f90de7
test esp, esp
je 0x5c670a
insb byte es:[edi], dx
adc edi, eax
push 0x4c
and dword [ecx], edi
mov ch, byte [esi*8 - 0x121f1b64]
push esp
outsb dx, byte [esi]
sbb byte [ebp - 0x6c4bef65], ah
cmp eax, 0xd9edaf2f
invalid
push esi
pop edi
popal
or al, 0x54
pop ebx
dec dword [0x65fc6473]
out dx, eax
or ah, byte [edi + 0x19]
mov al, byte [0xc216d1dd]
aam 0xe0
sub byte [ecx - 0x6a8e1faa], dl
outsd dx, dword [esi]
pushfd
push 0xffffffffffffffa5
or ah, 0x87
jmp 0x58cd795e

Function at 0x5d209e
Capabilities:
Encode data using xor

Disassembly:
cli
inc ebx
aad 0x90
mov ebp, 0x1374f671
push esp
mov ebx, 0x979466d5
adc edx, dword [ebx + edi*4 - 0x2b]
xchg sp, ax
xchg edi, eax
xor dword [edx + 0x56], esi
and dword [eax], ecx
jle 0x5d20a6
invalid
Function at 0x5d5ae5
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov cl, 0x86
mov ecx, 0x1e7da63
and esp, dword [ebp + 0x5f3a3737]
mov dword [eax + esi*2 - 0x2de91f24], 0x94c23b51
in al, dx
push esp
sahf
aad 0xe8
push eax
push eax
lcall 0xa018, 0x477d1803
cli
invalid
mov al, byte [0x95928ffa]
xchg ebp, eax
and dword [ecx + 0x65], esi
xor byte [edx], cl
loopne 0x5d5a79
in al, dx
in al, dx
cmc
salc
mov ch, 0x24
aad 0x6b
and dword [esi + 0x40bbcd4], 0x74
movsb byte es:[edi], byte [esi]
ret 0x4968
cmp ebx, edx
push esp
sbb al, 0xce
and ecx, ebp
cld
and eax, 0x84cf8bee
fdivr qword [ebx - 0x2e684347]
pop eax
and al, 0x90
xor al, 0xce
and al, 0x51
aad 0x21
inc esi
dec edi
xchg dword [ecx], edi
mov eax, 0x4541da84
jecxz 0x5d5a75
and ah, bh
shr eax, 0x3d
enter 0x59c9, 0xffffffffffffffc0
xor byte [edx], ah
jbe 0x5d5a4e
jb 0x5d5ad2
jbe 0x5d5a81
and al, 0x65
movsb byte es:[edi], byte [esi]
add dword [edi + edi*2], eax
adc eax, 0x2a713161
push cs
pop es
adc ah, ah
in al, 0x15
add dword [edi + ecx*2 - 0x60beefb5], edx
dec edi
dec ebx
adc byte [ecx - 0x61], al
adc eax, 0x4b4f9401
dec edi
dec ebx
adc byte [ecx - 0x61], al
in al, 0xc8
mov edx, ds
sbb edi, dword [edx + 0x2d375079]
push ss
xor byte [edx - 0x59021a2e], bh
jne 0x5d5ae2
adc dword [edx], ecx
jl 0x5d5b6f
xchg edx, eax
sbb byte [ebx], ah
cmp al, 0xe5
fbld tbyte [ebp + 0x25b0f52b]
add byte [eax + 4], 0xe9
mov byte [ebx], cl
jg 0x5d5a9a
pushal
jl 0x5d5b07
xor eax, 0x15703225
sub eax, 0x59950004
mov esi, 0x8030a4f2
pop ds
xor eax, 0xb5a0b5ca
push es
add al, 0x9f
scasb al, byte es:[edi]
loopne 0x5d5b15
and dword [ebp - 0x40], ebp
cmp bh, dl
cdq
and byte [ebp + 0x3f], dh
inc esp
adc al, 0xd8
sti
out 0xf2, al
in eax, dx
mov ch, 0xdc
movsd dword es:[edi], dword [esi]
vpsubusb ymm0, ymm7, ymm0
mov bh, 0xa0
xchg ecx, eax
mov word [ebp + 0x657d9590], es
push esi
in al, dx
les ebp, [0xcd7461d0]
mov edx, dword [eax + edx*2]
add bl, byte [ecx + 0x49118fe]
std
push ds
pop ecx
mov esp, 0x6a3db19b
or dword [eax + 0x21], 0xfffffff4
and esp, esi
invalid

Function at 0x621045
Capabilities:
Encode data using xor

Disassembly:
aaa
or al, 0x9a
outsb dx, byte [esi]
push cs
sbb al, 0x4b
retf 0xbb9
mov dword [ebx], edx
add byte [eax + edi*4 - 0x49a3be1b], dl
ror byte [esi - 0x17fd147b], 1
test ebx, ebp
add ch, al
in al, dx
xor byte [ebp - 0x6325f756], 0x68
scasd eax, dword es:[edi]
fisub dword [esi - 2]
mov bh, 0xae
mov eax, 0x1526fd2
insd dword es:[edi], dx
insb byte es:[edi], dx
inc ecx
loope 0x621050
imul ebp, dword [edx + 0x6c341835], 0x1860f35c
and dl, bh
sbb byte [ebp - 0x11], cl
mov edi, 0xb66bcce1
jecxz 0x62108a
dec esp
push ebx
xchg ecx, eax
scasb al, byte es:[edi]
in eax, dx
jne 0x621013
sbb dl, byte [eax + ecx*8 - 0x14]
cmp al, 0x5a
push esp
enter 0x3cec, 0x5a
stosb byte es:[edi], al
retf 0x4cbe
Function at 0x64dd5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658348
cmp edx, dword [eax]
je 0x64dd7f
add eax, 8
inc ecx
cmp eax, 0x6583d8
jl 0x64dd70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658348]
jne 0x64dead
mov eax, dword [0xa5bcb4]
cmp eax, 1
je 0x64de87
test eax, eax
jne 0x64ddb0
cmp dword [0x658274], 1
je 0x64de87
cmp edx, 0xfc
je 0x64dead
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64dde7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064ebd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64de2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064ebd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653ccc
push edi
call fcn.00650aa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e750
lea eax, [ebp - 0xa0]
push 0x653cac
push eax
call fcn.0064e750
push dword [esi + 0x65834c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650a14
add esp, 0x2c
pop edi
jmp 0x64dead
lea eax, [ebp + 8]
lea esi, [esi + 0x65834c]
push 0
push eax
push dword [esi]
call fcn.0064ebd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4065b7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4946a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
call fcn.00406533
mov ebx, eax
cmp ebx, esi
je 0x406623
cmp dword [ebp - 0x118], esi
je 0x40661c
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4066bb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40664b
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x118]
call fcn.004065b7
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x4066cc
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x118]
mov dword [ebp - 0x11c], pe_nt_image_headers32
call ebx
test eax, eax
je 0x40662b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], esi
je 0x406696
push dword [ebp - 0x118]
call ebx
mov dword [ebp - 0x118], esi
push dword [ebp - 0x120]
mov dword [ebp - 0x114], esi
call fcn.00406458
mov edi, eax
cmp dword [ebp - 0x118], esi
je 0x4066b9
push dword [ebp - 0x118]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448f97
leave
ret 4
cmp dword [ebp - 0x118], esi
je 0x4066e0
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
jmp 0x4066bb
Function at 0x408e7b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x4946a0]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x247c], ebx
jne 0x408eae
cmp dword [edi + 0x58], ebx
je 0x408eae
xor ecx, ecx
jmp 0x408eb1
xor ecx, ecx
inc ecx
cmp dword [ebp + 0xc], ebx
jne 0x408ef4
mov eax, dword [edi + 0x2478]
cmp eax, ebx
je 0x408ec4
cmp ecx, ebx
je 0x408ef4
mov edx, dword [edi]
push eax
push ecx
push edi
call dword [edx + 0x10]
mov esi, eax
cmp esi, ebx
jne 0x408ee8
push 1
call fcn.0040dcf5
pop ecx
test eax, eax
je 0x408ef4
mov eax, 0x80070204
jmp 0x409022
call fcn.0041032c
mov eax, esi
jmp 0x409022
cmp dword [edi + 0x247c], ebx
je 0x408f27
push 0x104
lea eax, [esp + 0x15c]
push eax
push 0x80
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [edi + 0x24]
lea eax, [esp + 0x158]
push eax
call fcn.0040b0c0
lea edx, [esp + 0x50]
mov ecx, edi
call fcn.004096f8
mov dword [esp + 0xc], eax
cmp eax, ebx
jl 0x40900c
mov esi, str.Download_Status:_Download_Complete
call fcn.00410470
mov eax, dword [edi]
lea ecx, [esp + 0x50]
push ecx
push edi
call dword [eax + 0x1c]
mov dword [esp + 0xc], eax
cmp eax, ebx
jl 0x408f81
push dword [ebp + 0xc]
mov eax, dword [edi]
push 1
lea ecx, [esp + 0x58]
push ecx
push edi
call dword [eax + 0x18]
mov dword [esp + 0xc], eax
cmp eax, ebx
jge 0x40901e
mov esi, str.Download_Status:_Verification_of_Downloaded_File_Signature_Failed
jmp 0x409019
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xf
pop eax
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 0x10
call esi
push 0x74
push ecx
push ebx
mov edi, eax
call esi
push 0x72
mov ecx, eax
lea edx, [esp + 0x1c]
call fcn.0042bdf0
pop ecx
mov ecx, edi
mov edx, eax
call fcn.0042be7c
call fcn.0042bf12
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.004031e0
push ebx
push 1
lea ecx, [esp + 0x18]
call fcn.004031e0
push 0xfffffffffffffffb
call fcn.0040dbac
pop ecx
call fcn.004101c5
mov esi, str.Download_Status:_Verification_of_Downloaded_File_Version_Failed
jmp 0x409019
push 0xffffffffffffffc3
call fcn.0040dbac
pop ecx
mov esi, str.Download_Status:_Download_Failed
call fcn.00410470
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00448f97
mov esp, ebp
pop ebp
ret 8
Function at 0x409039
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x854
mov eax, dword [0x4946a0]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x7ff
lea eax, [esp + 0x5d]
push 0
mov esi, 0x80004005
push eax
mov dword [esp + 0x1c], esi
mov byte [esp + 0x64], 0
call fcn.0044b040
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004017ec
mov eax, dword [esp + 0x1c]
pop ecx
test eax, eax
jne 0x409095
mov eax, esi
jmp 0x409131
lea edx, [eax + 8]
lea ecx, [esp + 0x24]
call fcn.00425e62
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
imul edi, edi, 0xa
mov dword [esp + 0x14], eax
lea eax, [esp + 0x58]
push eax
push 0x800
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x409110
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0x4782ec
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x409110
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
cmp ecx, esi
jg 0x40910b
jne 0x409110
movzx ecx, word [eax + 8]
cmp ecx, dword [esp + 0x14]
jg 0x40910b
jne 0x409110
movzx eax, word [eax + 0xe]
cmp eax, edi
jl 0x409110
and dword [esp + 0x10], 0
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004031e0
mov esi, dword [esp + 0x18]
call fcn.00403a0b
push esi
call fcn.00448f8c
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00448f97
mov esp, ebp
pop ebp
ret 8
Function at 0x40a41d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
xor edi, edi
push 0x3c
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0044b040
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [0x499234], 2
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x140
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], str.runas
jge 0x40a46c
mov dword [ebp - 0x34], str.open
push 6
push edi
mov dword [ebp - 0x24], 1
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40a4be
cmp dword [ebp + 0x10], edi
je 0x40a4b0
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x669
jne 0x40a4b3
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a4c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x40a7c3
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x4946a0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebx, ebx
push ebx
push ebx
mov dword [esi + 0xc], 0xbc2
mov eax, dword [0x498084]
push 1
push ebx
mov dword [esi + 0x18], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x38], eax
call fcn.00410410
mov dword [esi + 0x3c], eax
xor eax, eax
mov byte [ebp - 0x7c], bl
lea edi, [ebp - 0x7b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SunJavaUpdateRecheckUpdateEvent
lea eax, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x64], eax
push ebx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x40], eax
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x38]
call edi
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push 0x40adad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40a8ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebx, 0x104
push ebx
lea eax, [esi + 0x58]
push eax
push 0x7b
push dword [esi + 0x18]
call edi
push ebx
lea eax, [ebp - 0x5c]
push eax
push 0x7c
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.0040aa91
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00448f97
add ebp, 0xac
leave
ret 4
Function at 0x40d674
Capabilities:
Create thread
Delete registry value

Disassembly:
push 0x38
mov eax, 0x469548
call fcn.00451049
call fcn.004104bf
test eax, eax
je 0x40d7b6
xor edi, edi
push edi
lea esi, [ebp - 0x24]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x2c], 0
call fcn.0040b364
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0040fa62
pop ecx
pop ecx
test eax, eax
jne 0x40d6c8
lea esi, [ebp - 0x20]
call fcn.0043df69
xor eax, eax
inc eax
jmp 0x40d7b6
mov ebx, dword [ebp - 0x10]
push str.UpdateDetected
lea eax, [ebp - 0x40]
push eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x3c], ebx
call fcn.0042f05e
neg eax
sbb eax, eax
inc eax
jne 0x40d705
push str.UpdAvailElapsed
lea eax, [ebp - 0x40]
push eax
call fcn.0042f05e
neg eax
sbb eax, eax
inc eax
jne 0x40d705
lea esi, [ebp - 0x40]
call fcn.0042f012
jmp 0x40d6b8
push str.SendUDPing
lea eax, [ebp - 0x40]
push eax
lea edi, [ebp - 0x24]
call fcn.0042f05e
neg eax
sbb esi, esi
push str.SendUAPing
lea eax, [ebp - 0x40]
push eax
inc esi
call fcn.0042f05e
neg eax
sbb eax, eax
xor edi, edi
inc eax
mov dword [ebp - 0x3c], ebx
cmp esi, edi
jne 0x40d763
cmp eax, edi
jne 0x40d763
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.UpdateDetected
push ebx
call esi
push str.UpdAvailNotifyCnt
push ebx
call esi
push str.UpdAvailNotifyTime
push ebx
call esi
push str.UpdAvailElapsed
push ebx
call esi
jmp 0x40d6fb
lea esi, [ebp - 0x40]
call fcn.0042f012
cmp dword [0x499110], edi
jne 0x40d6b8
xor ebx, ebx
inc ebx
cmp dword [ebp + 8], edi
jne 0x40d7a0
push 0x499110
push edi
push edi
push fcn.0040d329
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x40d7ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d7ac
push edi
mov dword [0x499110], ebx
call fcn.0040d329
lea esi, [ebp - 0x20]
call fcn.0043df69
mov eax, ebx
call fcn.00451121
ret
Function at 0x40dbac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4946a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x478a4c
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x210], 3
call esi
lea eax, [ebp - 0x210]
push eax
xor ebx, ebx
mov edi, str.Country
push ebx
lea edx, [ebp - 0x214]
mov ecx, edi
call fcn.0040fba3
push ebx
push edi
push ebx
call fcn.0040fedd
add esp, 0x14
test eax, eax
je 0x40dc16
push str.Country_Code_deleted
call fcn.00429029
pop ecx
push str.country_code_is_deleted_after_checker_fail_to_download
call fcn.00429029
lea eax, [ebp - 0x20c]
mov dword [esp], 0x474e64
push eax
mov dword [ebp - 0x210], pe_nt_image_headers32
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x20c]
mov ecx, str.PostStatusUrl
call fcn.0040fba3
pop ecx
pop ecx
mov edi, 0x478c3c
push edi
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x10c]
mov ecx, str.InstalledJREVersion
mov dword [ebp - 0x210], 0x80
call fcn.0040fba3
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x8c]
mov ecx, str.NewJREVersion
mov dword [ebp - 0x210], 0x80
call fcn.0040fba3
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x478ce0
lea ecx, [ebp - 0x20c]
call fcn.0041078f
mov ecx, dword [ebp - 8]
add esp, 0x24
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448f97
leave
ret