joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce40
Capabilities:
Delete file
Move file

Disassembly:
push esi
push ebx
sub esp, 0x334
lea eax, [esp + 0x24]
call sym._malwareSignatureFilePathname.constprop.17
lea eax, [esp + 0x24]
call dbg.fileExists
test eax, eax
je 0x40ce99
lea eax, [esp + 0x24]
call dbg.getFileTime
mov dword [esp], 0
mov ebx, eax
call sym._time
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp + 8], eax
mov dword [esp], str.Timestamp_of_AV_database___d._Current_time___d_r_n
add ebx, 0x1517f
call dbg.logEvent
cmp esi, ebx
jle 0x40cfa0
lea eax, [esp + 0x128]
mov edx, 1
lea ebx, [esp + 0x22c]
call sym._malwareSignatureFilePathname
mov eax, dword [0x4300a0]
mov dword [esp + 0xc], str.remotelysupportsoftware.co.uk
mov dword [esp + 8], str.https:___s:_d_remotely_etc_vdatabase__allbodysigs.dat
mov dword [esp + 4], 0x104
mov dword [esp], ebx
mov dword [esp + 0x10], eax
call sym.___mingw_snprintf
lea edx, [esp + 0x128]
xor ecx, ecx
mov eax, ebx
call sym._downloadFile.constprop.14
test eax, eax
je 0x40cf80
mov eax, dword [0x44546c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, 0xffffff7f
jne 0x40cfc0
lea eax, [esp + 0x24]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x128]
mov dword [esp], eax
call sym._MoveFileA_8
mov ebx, eax
sub esp, 8
mov eax, str.AV_database_successfully_updated_r_n
test ebx, ebx
jne 0x40cf4e
mov eax, str.AV_database_could_not_be_updated__failed_on_MoveFile_r_n
mov dword [esp], eax
call dbg.logEvent
mov eax, dword [0x44546c]
mov dword [esp], eax
call sym._ReleaseMutex_4
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
add esp, 0x334
pop ebx
pop esi
ret
mov dword [esp], str.AV_database_update_failed__could_not_download_virus_signature_file_r_n
call dbg.logEvent
add esp, 0x334
mov eax, 1
pop ebx
pop esi
ret
mov dword [esp], str.AV_database_is_less_than_24_hours_old._Skipping_download._r_n
call dbg.logEvent
add esp, 0x334
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp + 4], eax
mov dword [esp], str.AV_database_update_failed__WaitForSingleObject_on_mutex_failed_with_return_value_of__d_r_n
call dbg.logEvent
add esp, 0x334
mov eax, 1
pop ebx
pop esi
ret
Function at 0x40d350
Capabilities:
Read file via mapping

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [esp + 4], eax
mov dword [esp], str.Deep_check_of__s_as_it_is_a_Portable_Executable__EXE_or_DLL__file..._r_n
call dbg.logEvent
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call sym._CreateFileA_28
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x40d4b3
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov esi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._CreateFileMappingA_24
sub esp, 0x18
test eax, eax
mov edi, eax
je 0x40d4d0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call sym._MapViewOfFile_20
sub esp, 0x14
test eax, eax
mov ebp, eax
je 0x40d4f0
lea ecx, [esp + 0x2c]
mov edx, eax
mov eax, ebx
mov dword [esp + 0x2c], 0
call sym._checkMappedFileForMalwareSignature.constprop.16
test eax, eax
je 0x40d480
mov dword [esp], ebp
call sym._UnmapViewOfFile_4
sub esp, 4
test eax, eax
je 0x40d49c
mov dword [esp], edi
mov ebx, 1
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], esi
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40d471
call sym._sendQueueOfMessages.constprop.19
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [esp + 0x2c]
mov edx, ebp
mov eax, ebx
call dbg.checkMappedFileForMalwareChecksum
mov dword [esp], ebp
call sym._UnmapViewOfFile_4
sub esp, 4
test eax, eax
jne 0x40d449
call sym._GetLastError_0
mov dword [esp], str.Call_to_UnmapViewOfFile_in_deepCheckOfPortableExecutableFile___failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40d449
mov dword [esp], str.CreateFile_failed_in_deepCheckOfPortableExecutableFile___r_n
xor ebx, ebx
call dbg.logEvent
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.CreateFileMapping_failed_in_deepCheckOfPortableExecutableFile___r_n
xor ebx, ebx
call dbg.logEvent
mov dword [esp], esi
call sym._CloseHandle_4
sub esp, 4
jmp 0x40d471
mov dword [esp], str.MapViewOfFile_failed_in_deepCheckOfPortableExecutableFile___r_n
xor ebx, ebx
call dbg.logEvent
mov dword [esp], edi
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], esi
call sym._CloseHandle_4
sub esp, 4
jmp 0x40d471
Function at 0x40d740
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
mov esi, eax
mov edi, edx
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x10], eax
mov dword [esp], esi
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call sym._PeekNamedPipe_24
sub esp, 0x18
test eax, eax
je 0x40d7a0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x40d7b0
mov dword [ebx], 0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str.Bytes_available_on__s_pipe_to_be_read__from_task_process_:__d_r_n
call dbg.logEvent
mov edx, dword [esp + 0x2c]
mov eax, dword [ebx]
cmp eax, edx
jbe 0x40d7d0
mov eax, edx
lea edx, [esp + 0x28]
mov dword [ebx], eax
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov dword [ebx], eax
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Bytes_read_from__s_pipe__from_task_process_:__d_r_n
call dbg.logEvent
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40dd00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
call dbg.isWmicStillRunning
test eax, eax
jne 0x40dd10
add esp, 0x1c
ret
mov eax, dword [0x445ed0]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
test eax, eax
je 0x40dd40
mov dword [esp], str.WMIC_process_successfully_terminated_r_n
call dbg.logEvent
add esp, 0x1c
jmp dbg.cleanupWmicProcess
call sym._GetLastError_0
mov dword [esp], str.WMIC_error:_Unable_to_terminate_process._Error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x1c
jmp dbg.cleanupWmicProcess
Function at 0x414920
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push edi
mov edx, 0x5e6ea9af
push esi
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
movzx ebp, ax
shr eax, 0x10
mov dword [esp + 8], eax
mov eax, edx
mul dword [esp + 0x34]
shr edx, 0xb
imul eax, edx, 0x15b0
sub ecx, eax
test ebx, ebx
mov dword [esp + 0x10], ecx
je 0x414a97
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 8]
test edx, edx
je 0x414a81
cmp dword [esp + 0x10], 7
jbe 0x414a8e
lea esi, [esi]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
sub eax, 8
mov dword [esp + 0x14], eax
shr eax, 3
lea eax, [edi + eax*8 + 8]
mov dword [esp + 0xc], eax
mov eax, edi
lea esi, [esi]
movzx edx, byte [eax]
movzx edi, byte [eax + 2]
add eax, 8
movzx ecx, byte [eax - 2]
lea esi, [edx + ebp]
movzx edx, byte [eax - 7]
movzx ebp, byte [eax - 1]
mov dword [esp], esi
add edx, esi
movzx esi, byte [eax - 4]
add edi, edx
add edx, dword [esp]
mov ebx, edi
movzx edi, byte [eax - 5]
mov dword [esp + 4], ebx
add edx, dword [esp + 4]
add edi, ebx
movzx ebx, byte [eax - 3]
add esi, edi
add edx, edi
add edx, esi
add ebx, esi
add ecx, ebx
add ebx, edx
add ebp, ecx
add ecx, ebx
add ecx, ebp
add dword [esp + 8], ecx
cmp eax, dword [esp + 0xc]
jne 0x4149a0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
and eax, 0xfffffff8
add eax, 8
add dword [esp + 0x30], eax
cmp eax, esi
jae 0x414a37
mov edx, esi
mov ecx, dword [esp + 8]
sub edx, eax
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
lea esi, [esi]
add eax, 1
movzx ebx, byte [eax - 1]
add ebp, ebx
add ecx, ebp
cmp eax, edx
jne 0x414a20
mov dword [esp + 8], ecx
mov dword [esp + 0x30], eax
mov eax, 0x80078071
mov esi, dword [esp + 8]
mul ebp
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebp, edx
mul esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 0x15b0
shr edx, 0xf
imul edx, edx, 0xfff1
sub esi, edx
test eax, eax
mov dword [esp + 8], esi
jne 0x414980
mov eax, esi
add esp, 0x18
shl eax, 0x10
pop ebx
add eax, ebp
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov esi, ecx
jmp 0x414a09
add esp, 0x18
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4211d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x44f3a4
call sym._EnterCriticalSection_4
mov ebx, dword [0x44f39c]
sub esp, 4
test ebx, ebx
je 0x42121b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x421214
test esi, esi
je 0x421214
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4211f0
mov dword [esp], 0x44f3a4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x421400
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x421450
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x421528
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x42148e
cmp eax, 4
jne 0x4214b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x42149e
cmp edx, 4
je 0x42149e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00421400
Function at 0x429731
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x18
mov dword [esp + 4], 2
mov dword [esp], eax
call sym._MapVirtualKeyA_8
test al, al
push edx
push edx
jne 0x42974f
xor ebx, ebx
add esp, 0x18
mov al, bl
pop ebx
ret

Function at 0x429756
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._MapVirtualKeyA_8
push edx
push edx
add esp, 0x1c
ret

Function at 0x42988b
Capabilities:
Shutdown system

Disassembly:
push ebx
sub esp, 0x48
call sym._GetCurrentProcess_0
lea edx, [esp + 0x2c]
mov dword [esp + 4], 0x28
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
jne 0x4298ba
xor eax, eax
jmp 0x4299a0
lea eax, [esp + 0x34]
mov dword [esp + 4], str.SeShutdownPrivilege
mov dword [esp], 0
lea ebx, [esp + 0x30]
mov dword [esp + 8], eax
call sym._LookupPrivilegeValueA_12
sub esp, 0xc
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call sym._AdjustTokenPrivileges_24
sub esp, 0x18
call sym._GetLastError_0
test eax, eax
jne 0x4298b3
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xa
mov dword [esp + 4], str.This_computer_is_restarting_for_essential_maintenance...
mov dword [esp], 0
call sym._InitiateSystemShutdownA_20
sub esp, 0x14
test eax, eax
je 0x4298b3
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x3c], 0
call sym._AdjustTokenPrivileges_24
mov eax, 1
sub esp, 0x18
add esp, 0x48
pop ebx
ret

Function at 0x4299a5
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp], 0x14
call sym._GetKeyState_4
test al, 1
push edx
je 0x4299d8
test ebx, ebx
jne 0x4299db
mov eax, 0x14
call dbg.keyPress
add esp, 0x18
mov eax, 0x14
pop ebx
jmp dbg.keyRelease
dec ebx
je 0x4299c0
add esp, 0x18
pop ebx
ret

Function at 0x4299e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x14
call sym._GetKeyState_4
and eax, 1
push edx
shl eax, 7
cmp dword [0x445ef8], 0
je 0x429a02
or eax, 0x10
add esp, 0x1c
ret

Function at 0x429a06
Capabilities:
Delete file

Disassembly:
push ebx
sub esp, 0x128
lea ebx, [esp + 0x1c]
call dbg.currentTempDirectoryPathname
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._srcflag.dat
mov dword [esp + 4], 0x104
call sym.___mingw_snprintf
mov dword [esp], ebx
call sym._DeleteFileA_4
push eax
add esp, 0x128
pop ebx
ret
Function at 0x429a43
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
push edi
mov ebp, eax
push esi
push ebx
xor eax, eax
sub esp, 0xd8c
lea edi, [esp + 0x4c]
mov dword [esp + 0x38], ecx
mov ecx, 0x41
lea ebx, [esp + 0x4c]
mov dword [esp + 0x34], edx
rep stosd dword es:[edi], eax
lea edi, [esp + 0x150]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [esp + 0x254]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str._TEMP__remotely_task_script.ps1
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea esi, [esp + 0x150]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP__remotely_task_script.vbs
mov dword [esp + 4], esi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea edx, [esp + 0x254]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP__remotely_task_script.bat
mov dword [esp + 4], edx
mov dword [esp + 0x3c], edx
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
mov dword [esp], ebx
call sym._DeleteFileA_4
push eax
mov dword [esp], esi
call sym._DeleteFileA_4
push edx
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
call sym._DeleteFileA_4
push ecx
mov dword [esp + 4], 0x4313ab
mov dword [esp], ebp
call sym._fopen
test eax, eax
je 0x429b92
lea edi, [esp + 0x358]
mov ebp, eax
mov ecx, 0x28a
xor eax, eax
mov edx, dword [esp + 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x358]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], esi
mov dword [esp + 8], str.__echo_off_r_n_cscript___s____Nologo_r_n_unzip.exe__o__q___s__r_n_IF_EXIST___s___powershell__ExecutionPolicy_ByPass__NonInteractive__NoProfile__File___s____nul__r_n_IF_EXIST___s___cscript___Nologo___s___r_n_IF_EXIST___s_____s___r_n
mov dword [esp + 4], 0xa28
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___mingw_snprintf
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sym._fputs
mov dword [esp], ebp
call sym._fclose
mov eax, 1
jmp 0x429b94
xor eax, eax
add esp, 0xd8c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x429cb0
Capabilities:
Get process image filename

Disassembly:
push esi
push ebx
mov esi, edx
sub esp, 0x14
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
call sym._OpenProcess_12
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x429cef
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._GetProcessImageFileNameA_12
sub esp, 0xc
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x429d12
Capabilities:
Create directory
Get common file path
Get program files directory
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, 0x432fa3
sub esp, 0x24c
lea ebx, [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x26
mov dword [esp], 0
mov dword [esp + 0x10], ebx
mov edi, ebx
call sym._SHGetFolderPathA_20
xor eax, eax
or ecx, 0xffffffff
sub esp, 0x14
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
mov ecx, 4
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._CreateDirectoryA_8
push eax
push eax
lea esi, [esp + 0x13c]
mov dword [esp + 8], 0x104
mov dword [esp], 0
mov dword [esp + 4], esi
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x429db3
mov dword [esp], str.Unable_to_get_module__exe__pathname__call_to_GetModuleFileName_failed__r_n
call dbg.logEvent
xor eax, eax
jmp 0x429eb5
mov dword [esp], esi
mov dword [esp + 4], 0x431a35
call sym._fopen
test eax, eax
mov esi, eax
jne 0x429ddc
mov dword [esp], str.Unable_to_open_module_exe_file_for_copying_r_n
call dbg.logEvent
xor eax, eax
jmp 0x429eb5
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._fseek
mov dword [esp], esi
call sym._ftell
mov dword [esp], esi
mov ebp, eax
call sym._rewind
mov dword [esp], ebp
call sym._malloc
test eax, eax
jne 0x429e25
mov dword [esp], str.Call_to_malloc_failed_during_install_r_n
call dbg.logEvent
xor eax, eax
jmp 0x429eb5
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov edi, ebx
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x2c], eax
call sym._fread
mov dword [esp], esi
mov esi, str._remotelyclient.exe
call sym._fclose
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
mov ecx, 5
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
mov dword [esp + 4], 0x4313ab
call sym._fopen
test eax, eax
mov ebx, eax
mov edx, dword [esp + 0x2c]
jne 0x429e90
mov dword [esp], str.Unable_to_open_module_exe_file_for_writing_in_destination_install_folder_r_n
call dbg.logEvent
xor eax, eax
jmp 0x429eb5
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], ebx
call sym._fclose
mov eax, 1
add esp, 0x24c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x429ec0
Capabilities:
Create service
Get common file path
Get program files directory
Modify service
Persist via windows service

Disassembly:
push edi
push esi
mov esi, str.RemotelyClient_remotelyclient.exe
push ebx
sub esp, 0x160
lea ebx, [esp + 0x5c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x26
mov dword [esp], 0
mov dword [esp + 0x10], ebx
mov edi, ebx
call sym._SHGetFolderPathA_20
xor eax, eax
or ecx, 0xffffffff
sub esp, 0x14
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
mov ecx, 0x23
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._OpenSCManagerA_12
sub esp, 0xc
test eax, eax
jne 0x429f54
call sym._GetLastError_0
mov dword [esp], str.OpenSCManager_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
xor eax, eax
jmp 0x42a085
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0
mov esi, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], str.Remotely_Access_Client
mov dword [esp + 4], str.RemotelyClient
mov dword [esp], eax
call sym._CreateServiceA_52
sub esp, 0x34
test eax, eax
mov ebx, eax
jne 0x429fe8
call sym._GetLastError_0
mov dword [esp], str.CreateService_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], esi
call sym._CloseServiceHandle_4
xor eax, eax
push ecx
jmp 0x42a085
mov dword [esp], str.Service_created_successfully_r_n
call dbg.logEvent
lea eax, [esp + 0x40]
mov dword [esp + 4], 2
mov dword [esp], ebx
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 0x1388
mov dword [esp + 0x58], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x3c
mov dword [esp + 0x4c], 0x43315b
mov dword [esp + 0x50], 0x43315b
mov dword [esp + 8], eax
mov dword [esp + 0x54], 1
call sym._ChangeServiceConfig2A_12
sub esp, 0xc
test eax, eax
jne 0x42a062
call sym._GetLastError_0
mov dword [esp], str.ChangeServiceConfig2A_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42a06e
mov dword [esp], str.Service_successfully_configured_for_restart_in_event_of_failure__SC_ACTION_RESTART__r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseServiceHandle_4
push eax
mov dword [esp], esi
call sym._CloseServiceHandle_4
push edx
mov eax, 1
add esp, 0x160
pop ebx
pop esi
pop edi
ret
Function at 0x42a08f
Capabilities:
Delete service

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._OpenSCManagerA_12
sub esp, 0xc
test eax, eax
jne 0x42a0d4
call sym._GetLastError_0
mov dword [esp], str.OpenSCManager_failed___lu__r_n
mov dword [esp + 4], eax
xor ebx, ebx
call dbg.logEvent
jmp 0x42a156
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.RemotelyClient
mov esi, eax
mov dword [esp], eax
call sym._OpenServiceA_12
sub esp, 0xc
test eax, eax
mov edi, eax
jne 0x42a119
call sym._GetLastError_0
mov dword [esp], str.OpenService_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], esi
call sym._CloseServiceHandle_4
push ebx
xor ebx, ebx
jmp 0x42a156
mov dword [esp], eax
call sym._DeleteService_4
test eax, eax
push ecx
mov ebx, eax
jne 0x42a13f
call sym._GetLastError_0
mov dword [esp], str.DeleteService_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42a144
mov ebx, 1
mov dword [esp], edi
call sym._CloseServiceHandle_4
push eax
mov dword [esp], esi
call sym._CloseServiceHandle_4
push edx
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
ret

Function at 0x42a15f
Capabilities:
Simulate ctrl alt del

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], str.sas.dll
call sym._LoadLibraryA_4
test eax, eax
push ecx
jne 0x42a1d1
mov dword [esp + 0xc], 0x2e0003
mov dword [esp + 8], 0
mov dword [esp + 4], 0x312
mov dword [esp], 0xffff
call sym._PostMessageA_16
sub esp, 0x10
mov dword [esp], 0x64
call sym._Sleep_4
push edx
mov dword [esp + 0xc], 0x2e0003
mov dword [esp + 8], 0
mov dword [esp + 4], 0x312
mov dword [esp], 0xffff
call sym._PostMessageA_16
sub esp, 0x10
jmp 0x42a1e6
mov ebx, eax
mov eax, 0x4332c1
call dbg.writeTextToMailslot
mov dword [esp], ebx
call sym._FreeLibrary_4
push eax
add esp, 0x18
pop ebx
ret