joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ce0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
push edi
mov eax, 0x133c
push esi
push ebx
call fcn.00421710
mov edx, 0xa
sub esp, eax
mov eax, dword [0x44508c]
call dbg.checkTimer
test eax, eax
jne 0x408d10
add esp, 0x133c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
lea edi, [esp + 0x330]
call sym._time
mov dword [esp], str.Enumerating_process_list_for_malware_analysis..._r_n
mov dword [0x44508c], eax
call dbg.logEvent
lea eax, [esp + 0x20]
mov dword [esp + 4], 0x1000
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._EnumProcesses_12
sub esp, 0xc
test eax, eax
je 0x408e31
mov esi, dword [esp + 0x20]
mov dword [esp], str.Number_of_processes_enumerated___d_r_n
shr esi, 2
mov dword [esp + 4], esi
call dbg.logEvent
test esi, esi
je 0x408ea2
xor ebx, ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
jmp 0x408d97
add ebx, 1
cmp esi, ebx
je 0x408df9
mov eax, dword [edi + ebx*4]
test eax, eax
je 0x408d90
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
test eax, eax
mov ebp, eax
je 0x408e51
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x104
mov dword [esp], ebp
mov dword [esp + 4], eax
call sym._GetProcessImageFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x408e60
add dword [esp + 0x18], 1
mov dword [esp], ebp
add ebx, 1
call sym._CloseHandle_4
sub esp, 4
cmp esi, ebx
jne 0x408d97
mov eax, dword [esp + 0x18]
mov dword [esp], str.Number_of_processes_successfully_opened_checked___d__failed___d_r_n
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], 0
call sym._time
mov dword [0x44508c], eax
add esp, 0x133c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
mov dword [esp], str.Failed_on_call_to_EnumProcesses_in_getProcessListForMalwareAnalaysis___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x133c
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [esp + 0x18], 1
jmp 0x408d90
lea eax, [esp + 0x24]
mov dword [esp + 8], str.__GLOBALROOT_s
mov dword [esp + 4], 0x208
add dword [esp + 0x1c], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x128]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [esp + 0x128]
mov edx, 1
call dbg.addPathnameToMalwareScanQueue
jmp 0x408de7
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
jmp 0x408df9
Function at 0x409880
Capabilities:
Parse pe header

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
cmp word [edx], 0x5a4d
mov dword [esp + 0x24], ecx
je 0x4098b0
mov dword [esp], str.DOS_signature__MZ__not_found_r_n
call dbg.logEvent
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, edx
mov dword [esp], str.DOS_signature__MZ__matched_r_n
mov ebp, eax
call dbg.logEvent
mov esi, dword [ebx + 0x3c]
mov eax, ebp
call dbg.lengthOfFile
mov dword [esp + 0x2c], eax
sub eax, 0xf8
cmp eax, esi
jb 0x409945
add esi, ebx
cmp dword [esi], 0x4550
je 0x409900
mov dword [esp], str.PE_signature__PE__not_found_r_n
call dbg.logEvent
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.PE_signature__PE__matched_r_n
call dbg.logEvent
movzx eax, word [esi + 6]
movzx edi, word [esi + 0x14]
mov dword [esp], str.No._sections:__d_r_n
mov dword [esp + 4], eax
mov dword [esp + 0x28], eax
call dbg.logEvent
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x409960
mov dword [esp + 4], ebp
mov dword [esp], str.Traversal_of__s_complete_r_n
call dbg.logEvent
jmp 0x4098a1
mov dword [esp], str.Invalid_header__not_a_PE_file___r_n
call dbg.logEvent
jmp 0x4098a1
movzx eax, di
imul edi, dword [esp + 0x28], 0x208
lea esi, [esi + eax + 0x18]
mov dword [esp], edi
call sym._malloc
mov edx, dword [esp + 0x24]
mov byte [eax], 0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [edx], eax
lea eax, [edi - 1]
xor edx, edx
mov ebp, edx
mov dword [esp + 0x3c], eax
jmp 0x4099b5
mov dword [esp + 4], esi
mov dword [esp], str.Skipping_section__s_as_ptr__or_ptrsize__extends_beyond_file_length__incomplete_file___r_n
call dbg.logEvent
add ebp, 1
add esi, 0x28
cmp dword [esp + 0x28], ebp
je 0x409a80
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x409a62
mov eax, dword [esi + 0x14]
mov dword [esp + 0x30], eax
add eax, ebx
cmp dword [esp + 0x2c], eax
jb 0x409995
lea edi, [esp + 0x40]
xor eax, eax
mov ecx, 0x10
mov edx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x30]
lea ecx, [esp + 0x40]
call dbg.md5Checksum
test eax, eax
je 0x4099a5
lea eax, [esp + 0x40]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], str.ptr___d__size___d__name_s__md5_s_r_n
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call dbg.logEvent
mov edi, dword [esp + 0x24]
mov edi, dword [edi]
mov dword [esp], edi
call sym._strlen
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x40]
add edi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 8], str.AVFILE__s_PE:_d__d__s
mov dword [esp + 0x18], ecx
mov dword [esp], edi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x3c]
sub edx, eax
mov dword [esp + 4], edx
call sym.___mingw_snprintf
jmp 0x4099a5
mov dword [esp + 4], esi
mov dword [esp], str.Skipping_section__s_as_size_is__0_bytes_r_n
call dbg.logEvent
jmp 0x4099a5
mov ebp, dword [esp + 0x38]
jmp 0x409930
Function at 0x40a0c0
Capabilities:
Check internet connectivity via wininet

Disassembly:
cmp dword [0x4454c4], 1
je 0x40a0d0
ret
cmp dword [0x44d1d8], 1
je 0x40a0c9
sub esp, 0x1c
mov eax, dword [0x445088]
test eax, eax
je 0x40a160
mov edx, 0x3c
call dbg.checkTimer
test eax, eax
jne 0x40a100
add esp, 0x1c
repz ret
mov dword [esp], str.Checking_Internet_connection..._r_n
call dbg.logEvent
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.http:__www.google.com
call sym._InternetCheckConnectionA_12
sub esp, 0xc
test eax, eax
je 0x40a180
mov dword [esp], str.We_seem_to_have_a_valid_Internet_connection__www.google.com__is_accessible_r_n
mov dword [0x445084], 1
call dbg.logEvent
mov dword [esp], 0
call sym._time
mov dword [0x445088], eax
add esp, 0x1c
jmp 0x40a0f6
mov dword [esp], 0
call sym._time
sub eax, 0x3c
mov dword [0x445088], eax
jmp 0x40a0e5
call sym._GetLastError_0
mov dword [esp], str.We_dont_appear_to_have_a_valid_Internet_connection__call_to_InternetCheckConnection___has_returned_error__d__r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [0x445084]
test eax, eax
je 0x40a145
mov dword [0x445084], 0
call dbg.getInternetDownCount
add eax, 1
call dbg.setInternetDownCount
jmp 0x40a145

Function at 0x40a230
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x48
lea eax, [esp + 0x38]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000002
mov dword [esp + 0x1c], eax
call sym._RegCreateKeyExA_36
sub esp, 0x24
test eax, eax
je 0x40a2c0
test ebx, ebx
mov edx, str.enable
je 0x40a2b0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.Unable_to_open_create_registry_key_to__s_secure_desktop__due_to_error_code__d_r_n
call dbg.logEvent
add esp, 0x48
pop ebx
ret
mov edx, str.disable
jmp 0x40a292
xor eax, eax
test ebx, ebx
mov dword [esp + 0x14], 4
setne al
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], str.PromptOnSecureDesktop
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x40a340
test ebx, ebx
mov edx, str.enable
jne 0x40a314
mov edx, str.disable
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.Unable_to__s_PromptOnSecureDesktop__due_to_error_code__d_r_n
call dbg.logEvent
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
add esp, 0x48
pop ebx
ret
test ebx, ebx
mov eax, str.enabled
jne 0x40a34e
mov eax, str.disabled
mov dword [esp + 4], eax
mov dword [esp], str.PromptOnSecureDesktop__s_r_n
call dbg.logEvent
jmp 0x40a328
Function at 0x40a400
Capabilities:
Create process on windows

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
sub esp, 0x19c
lea ebx, [esp + 0x8c]
call dbg.enableOrDisableSecureDesktop
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x40a450
mov dword [esp], str.Unable_to_get_module__exe__pathname__call_to_GetModuleFileName_failed__r_n
call dbg.logEvent
add esp, 0x19c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x48]
mov dword [esp], str.Starting_background_process..._r_n
call dbg.logEvent
mov edi, ebp
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [esp], 0x104
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x50], str.winsta0default
call sym._malloc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.__s___b
mov esi, eax
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [esp + 0x38]
mov dword [esp], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
call sym._CreateProcessA_40
sub esp, 0x28
mov ebx, eax
mov dword [esp], esi
call sym._free
test ebx, ebx
jne 0x40a522
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateProcess_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x19c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x38]
mov dword [esp], str.Process_HANDLE___d_successfully_launched_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x38]
mov dword [0x446d78], eax
mov eax, dword [esp + 0x3c]
mov dword [0x446d74], eax
mov eax, dword [esp + 0x40]
mov dword [0x446d70], eax
add esp, 0x19c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ac80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [0x446d78]
test eax, eax
je 0x40ad52
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x40acf0
mov eax, dword [0x446d6c]
test eax, eax
jle 0x40acbe
mov edx, 0x3c
call dbg.checkTimer
test eax, eax
jne 0x40acc2
add esp, 0x1c
ret
mov dword [esp], str.No_entry_received_in_mailslot_from_control_BKG_process_for_past_60_seconds._Terminating_process..._r_n
call dbg.logEvent
mov eax, dword [0x446d78]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
add esp, 0x1c
ret
mov dword [esp], str.Control_connection_BKG_process_doesnt_appear_to_be_running__but_should_be_._Resetting_process_handle_and_session_ID_so_as_to_re_launch..._r_n
call dbg.logEvent
mov eax, dword [0x446d78]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [0x446d74]
sub esp, 4
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [0x446d78], 0
mov dword [0x446d74], 0
mov dword [0x446d70], 0
mov dword [0x446d6c], 0
mov dword [0x430030], 0xffffffff
add esp, 0x1c
ret
mov dword [esp], str.No_control_connection_process_currently_running__handle_is_NULL_._Skipping_check_to_see_if_running._r_n
call dbg.logEvent
add esp, 0x1c
ret

Function at 0x40b000
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
call dbg.checkControlConnectionBackgroundProcessStillRunning
add esp, 0xc
jmp dbg.checkProxyBackgroundProcessesStillRunning

Function at 0x40b010
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [0x446d78]
test eax, eax
je 0x40b0c4
mov dword [esp + 4], eax
mov dword [esp], str.Terminating_control_connection_process__with_HANDLE__d_..._r_n
call dbg.logEvent
mov eax, dword [0x446d78]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
test eax, eax
je 0x40b0a4
mov dword [esp], str.Control_process_successfully_terminated_r_n
call dbg.logEvent
mov eax, dword [0x446d78]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [0x446d74]
sub esp, 4
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [0x446d78], 0
mov dword [0x446d74], 0
mov dword [0x446d70], 0
mov dword [0x446d6c], 0
add esp, 0x1c
ret
call sym._GetLastError_0
mov dword [esp + 8], eax
mov eax, dword [0x446d78]
mov dword [esp], str.Unable_to_terminate_control_process__with_HANDLE__d__due_to_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40b058
mov dword [esp], str.No_control_connection_process_currently_running_to_terminate__handle_is_NULL__r_n
call dbg.logEvent
add esp, 0x1c
ret
Function at 0x40b0e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4454c0]
test eax, eax
jle 0x40b1f5
push esi
push ebx
xor esi, esi
xor ebx, ebx
sub esp, 0x24
mov eax, dword [ebx + 0x445480]
mov dword [esp + 4], esi
mov dword [esp], str.Terminating_proxy_process__d_with_HANDLE__d__PID__d..._r_n
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x4454a0]
mov dword [esp + 8], eax
call dbg.logEvent
mov eax, dword [ebx + 0x4454a0]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
test eax, eax
je 0x40b1c3
mov eax, dword [ebx + 0x4454a0]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0x445490]
sub esp, 4
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0x4454b0]
sub esp, 4
test eax, eax
je 0x40b16f
mov dword [esp], eax
call sym._free
mov dword [ebx + 0x4454b0], 0
mov dword [ebx + 0x4454a0], 0
add esi, 1
mov dword [ebx + 0x445490], 0
mov dword [ebx + 0x445480], 0
add ebx, 4
mov dword [ebx + 0x44546c], 0
cmp dword [0x4454c0], esi
jg 0x40b0f6
mov dword [0x4454c0], 0
add esp, 0x24
pop ebx
pop esi
ret
call sym._GetLastError_0
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x445480]
mov dword [esp + 4], esi
mov dword [esp], str.Unable_to_terminate_proxy_process__d_with_HANDLE__d__PID__d_owing_to_error_code__d_r_n
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x4454a0]
mov dword [esp + 8], eax
call dbg.logEvent
jmp 0x40b13b
mov dword [0x4454c0], 0
ret

Function at 0x40b200
Capabilities:
Create mailslot

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str..mailslot_remotely_mailslot
call sym._CreateMailslotA_16
sub esp, 0x10
cmp eax, 0xffffffff
mov dword [0x445f08], eax
je 0x40b244
mov dword [esp], str.Mailslot_created_for_monitoring_background_process_r_n
call dbg.logEvent
add esp, 0x1c
ret
call sym._GetLastError_0
mov dword [esp], str.CreateMailslot_failed_with__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x1c
ret
Function at 0x40b750
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov dword [esp + 0xc], str.Remotely_Mailslot_Event
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
call sym._CreateEventA_16
sub esp, 0x10
test eax, eax
mov dword [esp + 0x2c], eax
je 0x40b939
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x30]
lea ebp, [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x445f08]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp], eax
call sym._GetMailslotInfo_20
sub esp, 0x14
test eax, eax
je 0x40b944
cmp dword [esp + 0x30], 0xffffffff
jne 0x40b88f
jmp 0x40b92a
mov edi, 0x4332c1
mov ecx, 4
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40b973
mov dword [esp + 4], str.SPAWN
mov dword [esp], ebx
call sym._strstr
test eax, eax
je 0x40b980
xor esi, esi
cmp byte [ebx + 5], 0
je 0x40b838
lea esi, [ebx + 6]
mov dword [esp], str.Request_received_through_mailslot_from_BKG_process_to_SPAWN_an_additional_BKG_process__server_wants_to_start_a_PROXY_session_to_connect_a_technician__r_n
call dbg.logEvent
call sym._WTSGetActiveConsoleSessionId_0
mov edx, esi
call dbg.launchProxyConnectionBackgroundProcess
mov dword [esp], ebx
call sym._GlobalFree_4
sub esp, 4
lea eax, [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x445f08]
mov dword [esp], eax
call sym._GetMailslotInfo_20
sub esp, 0x14
test eax, eax
je 0x40b915
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40b92a
lea eax, [esp + 0x50]
mov dword [esp], eax
call sym._lstrlenA_4
sub esp, 4
add eax, dword [esp + 0x30]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call sym._GlobalAlloc_8
sub esp, 8
test eax, eax
mov ebx, eax
je 0x40b92a
lea eax, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [0x445f08]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
jne 0x40b801
call sym._GetLastError_0
mov dword [esp], str.Mailslot_ReadFile_failed_with__d._r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40b850
call sym._GetLastError_0
mov dword [esp], str.GetMailslotInfo_failed___d__r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
mov dword [esp], str.GetMailslotInfo_failed_with__d._r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
call dbg.simulateCtrlAltDelete
jmp 0x40b850
mov eax, ebx
call dbg.updateLastTickReceiveTimeForSubProcess
jmp 0x40b850
Function at 0x40bbd0
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x224
lea ebx, [esp + 0x18]
mov dword [esp + 8], 0x104
mov dword [esp], 0
mov dword [esp + 4], ebx
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x40bc04
add esp, 0x224
pop ebx
pop esi
ret
lea esi, [esp + 0x11c]
mov eax, ebx
mov edx, esi
call sym._pathnameOfDifferentFileInSameFolder.constprop.7
mov dword [esp], esi
call sym._DeleteFileA_4
sub esp, 4
test eax, eax
je 0x40bbfb
mov dword [esp + 4], esi
mov dword [esp], str.Successfully_deleted_old_version_of_EXE___s_r_n
call dbg.logEvent
add esp, 0x224
pop ebx
pop esi
ret
Function at 0x40bc40
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x2848
call fcn.00421710
sub esp, eax
test ecx, ecx
mov ebx, edx
mov eax, dword [esp + eax]
mov edi, ecx
mov esi, eax
mov eax, 0x433dad
je 0x40bc68
mov eax, str.and_appending_to
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.Downloading_file__s__s__s..._r_n
call dbg.logEvent
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.Remotely_Client
call sym._InternetOpenA_20
sub esp, 0x14
test eax, eax
mov dword [esp + 0x28], eax
je 0x40bdf0
mov dword [esp + 4], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80003000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._InternetOpenUrlA_24
sub esp, 0x18
test eax, eax
mov esi, eax
je 0x40be09
test edi, edi
mov eax, 0x431a38
je 0x40bdc0
mov dword [esp], ebx
mov dword [esp + 4], eax
lea ebp, [esp + 0x3c]
call sym._fopen
lea ebx, [esp + 0x40]
mov edi, eax
jmp 0x40bd44
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x40bdd0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._fwrite
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x2800
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._InternetReadFile_16
sub esp, 0x10
test eax, eax
mov edx, eax
jne 0x40bd20
mov dword [esp + 0x2c], eax
call sym._GetLastError_0
mov dword [esp], str.Call_to_InternetReadFile_failed_in_downloadFile___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov edx, dword [esp + 0x2c]
mov dword [esp], edi
mov dword [esp + 0x2c], edx
call sym._fclose
mov dword [esp], esi
call sym._InternetCloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sym._InternetCloseHandle_4
sub esp, 4
mov edx, dword [esp + 0x2c]
add esp, 0x284c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4313ab
jmp 0x40bd01
mov dword [esp], str.File_successfully_downloaded_r_n
mov dword [esp + 0x2c], edx
call dbg.logEvent
mov edx, dword [esp + 0x2c]
jmp 0x40bd82
call sym._GetLastError_0
mov dword [esp], str.Call_to_InternetOpen_failed_in_downloadFile___with_error__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
xor edx, edx
jmp 0x40bdac
mov dword [esp], str.Call_to_InternetOpenUrl_failed_r_n
call dbg.logEvent
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sym._InternetCloseHandle_4
xor edx, edx
sub esp, 4
jmp 0x40bdac
Function at 0x40be30
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareImage_Retail_Solutions_LtdRemotely
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 0x20
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x40bea0
test ebx, ebx
je 0x40be82
add esp, 0x30
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_contract_ID_from_registry__RegOpenKeyExA_call_failed_with_error_code__d__r_n
call dbg.logEvent
call dbg.registryIsAvailable
test eax, eax
jne 0x40be79
call dbg.immediatelyExitProcess
lea eax, [esp + 0x28]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.ContractID
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
mov edi, eax
je 0x40bf00
test ebx, ebx
mov byte [esi], 0
je 0x40bf20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._RegCloseKey_4
xor eax, eax
sub esp, 4
test edi, edi
sete al
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x28]
test ebx, ebx
mov byte [esi + eax], 0
jne 0x40bee0
mov dword [esp + 4], esi
mov dword [esp], str.Contract_ID_read_from_registry___s_r_n
call dbg.logEvent
jmp 0x40bee0
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_obtain_contract_ID_from_registry__RegQueryValueExA_failed_with_error_code__d__r_n
call dbg.logEvent
call dbg.registryIsAvailable
test eax, eax
jne 0x40bee0
jmp 0x40be9b

Function at 0x40bfd0
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0x18
call dbg.deleteOldExecutableIfPresent
call dbg.makeMailslot
jmp 0x40bff4
call dbg.readMailslot
call dbg.checkBackgroundProcessesStillRunning
mov eax, ebx
or eax, dword [0x446d68]
jne 0x40c040
mov dword [esp], 0x3e8
call sym._Sleep_4
sub esp, 4
call sym._WTSGetActiveConsoleSessionId_0
cmp eax, 0xffffffff
je 0x40c01a
cmp eax, dword [0x430030]
je 0x40c01a
call dbg.activeSessionHasChanged
call dbg.upgradeFileDetected
test eax, eax
mov ebx, 1
jne 0x40bfe0
xor ebx, ebx
call dbg.contractIdChanged
test eax, eax
setne bl
jmp 0x40bfe0
test ebx, ebx
jne 0x40c052
call dbg.terminateControlConnection
add esp, 0x18
pop ebx
jmp dbg.terminateProxyBackgroundProcesses
mov dword [esp], 0xbb8
call sym._Sleep_4
sub esp, 4
call dbg.terminateControlConnection
call dbg.terminateProxyBackgroundProcesses
call sym._GetCurrentProcess_0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
add esp, 0x18
pop ebx
ret

Function at 0x40ce10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov dword [esp], str._TEMP__rmwdbase.sigs
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
add esp, 0x1c
ret