joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e093c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5e09b6
mov eax, dword [ebx + 8]
call fcn.00530ff8
mov ecx, eax
mov dl, 1
mov eax, dword [0x53d28c]
call fcn.0052b3b8
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00541a40
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5e0234
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00530ff8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00530ff8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5e0a2c
mov eax, dword [ebx + 8]
call fcn.00530ff8
mov ecx, eax
mov dl, 1
mov eax, dword [0x53d28c]
call fcn.0052b3b8
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00541a40
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5e0280
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00530ff8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00530ff8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5e0a98
mov eax, dword [ebx + 8]
call fcn.00530ff8
mov ecx, eax
mov dl, 1
mov eax, dword [0x53dd00]
call fcn.0052b3b8
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00530ff8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00530ff8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5e3ae0
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xffffffdc
xor ebx, ebx
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.004070fc
push esp
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [esp]
cmp ax, 9
je 0x5e3b0a
cmp ax, 6
jne 0x5e3b0c
mov bl, 1
mov eax, ebx
add esp, 0x24
pop ebx
ret

Function at 0x5e7ce8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x641bdc], 0
jne 0x5e7cff
call fcn.005e7ca4
mov eax, edi
dec eax
test eax, eax
jl 0x5e7d27
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6417dc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5e7d09
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5eaa1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5eaab6.0
jmp dword [ecx*4 + 0x5eaa4f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5eaa81
sub dl, 8
je 0x5eaa90
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea6e8
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea73c
jmp case.0x5eaab6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5eaab6.0
movzx ecx, byte [ecx + 0x5eaabd]
jmp dword [ecx*4 + 0x5eaace]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea7dc
jmp case.0x5eaab6.0
cmp dl, 3
jne 0x5eaafb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea834
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea7f0
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea878
jmp case.0x5eaab6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5eab26
sub dl, 8
je 0x5eab32
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea8a4
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea908
jmp case.0x5eaab6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5eab51
sub dl, 8
je 0x5eab5d
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea9b8
jmp case.0x5eaab6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ea9e0
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5eabff
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005e9c30
test eax, eax
je 0x5eabff
mov eax, ebx
call fcn.005eac08
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5eab98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5eac08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5eac39
dec al
je 0x5eac74
dec al
je 0x5eacb1
dec al
je 0x5ead1a
jmp 0x5eada4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5eada4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5eac49
jmp 0x5eada4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5eada4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x5eac84
jmp 0x5eada4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5eada4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5eace0
xor ebp, ebp
jmp 0x5eacf0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5eacf9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5eacc1
jmp 0x5eada4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5eada4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5ead73
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005e7d30
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ead2e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f291c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5f294a
mov eax, ebx
call fcn.005f33d8
cmp dword [ebx + 0x40], 0
je 0x5f2943
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5f29bb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5f29ad
cmp dword [ebx + 8], 0
je 0x5f296c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5f297e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5f29ad
cmp dword [ebx + 8], 0
je 0x5f295f
cmp eax, 3
je 0x5f2991
dec eax
jne 0x5f295f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5f295f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5f295f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5f29d9
cmp dword [ebx + 0x14], 0xcc
je 0x5f29d9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005f29e4
pop ebx
ret

Function at 0x613fbc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x61400d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x613ff4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x613fe4
jmp 0x61400d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x613ff5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x625d50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x625b04]
call fcn.00407678
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x625de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 8], esi
mov eax, dword [ebp - 8]
add eax, 4
mov edx, ebx
call fcn.004097b8
mov eax, dword [ebp - 8]
add eax, 0xc
mov edx, edi
call fcn.004097b8
mov eax, dword [ebp - 8]
movzx edx, byte [ebp + 8]
mov byte [eax + 0x10], dl
mov eax, dword [ebp - 8]
push eax
push 0x625c5c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 8]
cmp byte [eax + 0x11], 0
je 0x625dcb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625de8
mov eax, dword [ebp - 8]
call fcn.004076a8
ret

Function at 0x626884
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004093ac
push 0
push esi
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x6268b8
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00409d7c
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x626f14
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, edx
mov eax, ebx
call fcn.004093ac
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x202
call fcn.004070fc
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x626f5a
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00409d7c
add esp, 0x208
pop ebx
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e008]
jne 0x401010
repz ret
jmp fcn.00401798

Function at 0x4082ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f7f
and dword [ebp - 4], 0
cmp dword [0x810774], 0
mov ebx, eax
jne 0x40835c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40840d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40840d
push eax
call fcn.00404f0d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x810774], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x810778], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81077c], eax
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x810784], eax
test eax, eax
je 0x40835c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x810780], eax
mov eax, dword [0x810780]
cmp eax, ebx
je 0x4083b4
cmp dword [0x810784], ebx
je 0x4083b4
push eax
call fcn.00404f88
push dword [0x810784]
mov esi, eax
call fcn.00404f88
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083b4
test edi, edi
je 0x4083b4
call esi
test eax, eax
je 0x4083ab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083ab
test byte [ebp - 0xc], 1
jne 0x4083b4
or dword [ebp + 0x10], 0x200000
jmp 0x4083ed
mov eax, dword [0x810778]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083ed
mov eax, dword [0x81077c]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810774]
call fcn.00404f88
pop ecx
test eax, eax
je 0x40840d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40840f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b790
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x2af88b4], 0x930
jne 0x40b7ad
push str.zukatatuxaweporijoj
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x2af88b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x2af85d0], eax
jne 0x40b7d3
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
mov eax, 0x410948
call fcn.00410480
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push eax
xor ebx, ebx
push 0x4113c8
push 1
push ebx
push 0x4113b8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x4113d8
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x14]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp eax, ebx
jl 0x40111b
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jne 0x40111b
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, ebx
je 0x40111b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, 0x4140b8
lea eax, [ebp - 0x21c]
push edi
push eax
call esi
cmp dword [ebp + 0x10], 0x17
je 0x4010bc
cmp dword [ebp + 0x10], 2
jne 0x4010d4
lea eax, [ebp - 0x21c]
push 0x41bc40
push eax
call esi
lea eax, [ebp - 0x21c]
push edi
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push 0x4140b0
push eax
call fcn.00405cce
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
lea edx, [ebp - 0x21c]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x21c]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x401128
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x401135
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4036d8
Capabilities:
Check os version

Disassembly:
mov eax, 0x410984
call fcn.00410480
sub esp, 0x320
push ebx
push esi
push edi
lea eax, [ebp - 0x124]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403777
cmp dword [ebp - 0x114], 2
jne 0x403777
cmp dword [ebp - 0x120], 6
jb 0x403725
push 1
pop esi
cmp dword [ebp + 8], edi
jne 0x403731
push edi
call fcn.00403075
pop ecx
lea eax, [ebp - 0x32c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403777
push esi
lea eax, [ebp - 0x32c]
push dword [ebp + 8]
push eax
call fcn.004033be
add esp, 0xc
cmp eax, edi
je 0x403777
cmp dword [ebp + 8], edi
je 0x40376c
push 1
call fcn.00403075
pop ecx
push 1
pop eax
jmp 0x403779
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4037e4
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
xor esi, esi
push eax
mov dword [edi], esi
xor ebx, ebx
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4038e4
cmp dword [ebp - 0x10c], 2
jne 0x4038e4
cmp dword [ebp - 0x118], 6
jb 0x403844
push 1
pop ebx
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..IDMWFP
jmp 0x403855
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40386e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
mov dword [edi], eax
jmp 0x4038e6
call fcn.00403037
neg eax
sbb eax, eax
lea ecx, [ebp + 8]
and eax, 0x100
push ecx
add eax, 0x20019
cmp ebx, esi
push eax
mov dword [edi], esi
push esi
je 0x403894
push str.SYSTEMCurrentControlSetServicesIDMWFP
jmp 0x403899
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4038e4
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push str.Start
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4038db
push 1
pop eax
cmp dword [ebp - 4], eax
je 0x4038db
cmp dword [ebp - 4], 2
je 0x4038db
mov dword [edi], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4038eb
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.004037e4
cmp dword [ebp - 0xc], esi
pop ecx
mov dword [ebp - 8], eax
je 0x4039e8
lea eax, [ebp - 0x15c]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x15c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov edi, str.open
mov ebx, str.stop_IDMWFP
je 0x4039b0
cmp dword [ebp - 0x14c], 2
jne 0x4039b0
cmp dword [ebp - 0x158], 6
jb 0x4039b0
cmp dword [ebp - 8], esi
mov dword [ebp - 4], 1
je 0x4039b0
push 0x3c
lea eax, [ebp - 0x48]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], str.net.exe
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4039b0
push 0xbb8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
push 1
push dword [ebp + 8]
call fcn.004033be
add esp, 0xc
cmp dword [ebp - 8], esi
jne 0x4039cf
cmp dword [ebp - 4], esi
je 0x4039e8
push esi
push esi
push ebx
jmp 0x4039db
cmp dword [ebp - 4], esi
je 0x4039e8
push esi
push esi
push str.start_IDMWFP
push 0x415410
push edi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f66
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareDownloadManagerIDMBI
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4040b6
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.idman
push dword [ebp - 4]
call esi
push str.services
push dword [ebp - 4]
call esi
push str.svchost
push dword [ebp - 4]
call esi
push str.lsass
push dword [ebp - 4]
call esi
push str.wininit
push dword [ebp - 4]
call esi
push str.mnmsrvc
push dword [ebp - 4]
call esi
push str.wermgr
push dword [ebp - 4]
call esi
push str.dexplore
push dword [ebp - 4]
call esi
push str.msfeedssync
push dword [ebp - 4]
call esi
push str.navapw32
push dword [ebp - 4]
call esi
push str.vpc32
push dword [ebp - 4]
call esi
push str.SymProxySvc
push dword [ebp - 4]
call esi
push str.morpheus
push dword [ebp - 4]
call esi
push str.ccApp
push dword [ebp - 4]
call esi
push str.avguard
push dword [ebp - 4]
call esi
push str.avgupd
push dword [ebp - 4]
call esi
push str.ccSvcHst
push dword [ebp - 4]
call esi
push str.update
push dword [ebp - 4]
call esi
push str.zlclient
push dword [ebp - 4]
call esi
push str.pcictlui
push dword [ebp - 4]
call esi
push 0x41581c
push dword [ebp - 4]
call esi
push str.avwebgrd
push dword [ebp - 4]
call esi
push str.AvastSvc
push dword [ebp - 4]
call esi
push str.avgnsx
push dword [ebp - 4]
call esi
push str.ekrn
push dword [ebp - 4]
call esi
push str.AdMunch
push dword [ebp - 4]
call esi
push str.TmProxy
push dword [ebp - 4]
call esi
push str.privoxy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x4045c3
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
call fcn.00403037
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, 0x100
push ecx
add eax, 0xf003f
xor esi, esi
push eax
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4046cc
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x804]
push eax
push esi
mov edi, 0x41b558
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push dword [ebp - 4]
mov dword [ebp + 8], 0x800
call esi
test eax, eax
jne 0x40466e
lea eax, [ebp - 0x804]
push eax
call sub.MSVCRT.dll__wcsupr
lea eax, [ebp - 0x804]
mov dword [esp], 0x415b70
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
jne 0x404664
lea eax, [ebp - 0x804]
push str.RUNAS
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
je 0x40466e
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp + 8]
mov edi, 0x41b760
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push edi
push dword [ebp - 4]
mov dword [ebp + 8], 0x800
call esi
test eax, eax
jne 0x4046c2
lea eax, [ebp - 0x804]
push eax
call sub.MSVCRT.dll__wcsupr
lea eax, [ebp - 0x804]
mov dword [esp], 0x415b70
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
je 0x4046c2
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret