joyce8/EMBER2024-capa huggingface dataset:
Function at 0x632366de
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.63236673
mov eax, 0x63200000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.6320feb0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x6323672d
cmp dword [ebp - 0x1c], 5
jb 0x63236745
jmp 0x63236741
cmp dword [ebp - 0x10], 1
jne 0x63236745
cmp dword [ebp - 0x1c], 4
ja 0x63236741
jne 0x63236745
cmp dword [ebp - 0x18], 0
jbe 0x63236745
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x6324b8b4
call fcn.63236547
test eax, eax
jge 0x63236766
mov byte [0x6325e9f8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6320fb73
add ebp, 0x78
leave
ret

Function at 0x632374a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0xc]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x63237505
lea ecx, [ebp - 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x63237505
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esp, ebp
pop ebp
ret
Function at 0x632379c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63246d65
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x63256ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.63202050
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x63237aee
mov edx, dword [ebp - 0x14]
push edx
call fcn.6320290e
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x63237ad1
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x63237ac6
lea edx, [ebp - 0x34]
push edx
push 0x6325cd3c
push str.VarFileInfoTranslation
mov eax, dword [ebp - 0x2c]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x63237ac4
lea ecx, [ebp - 0x3c]
call fcn.63201e60
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea edx, [ebp - 0x3c]
push edx
call fcn.63201f00
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.63237900
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.63202060
jmp 0x63237acf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
jmp 0x63237ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
push edx
call fcn.63202913
add esp, 4
jmp 0x63237af7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x63237b17
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.63202060
mov eax, dword [ebp - 0x4c]
jmp 0x63237b26
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.63202060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x63237b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], 1
mov eax, 1
test eax, eax
je 0x63237b8e
jmp 0x63237b9b
push str.Start_UpdateExcuteFile
call fcn.63201050
add esp, 4
mov byte [ebp - 0x170], 0
push 0x103
push 0
lea ecx, [ebp - 0x16f]
push ecx
call fcn.6320feb0
add esp, 0xc
push str..dat
push 0x6325d8bc
push str.xghparam_
push str.update_xml_
push str.http:__u.nprotect2.net_xguard_
push str.npupdate.exe
push 0x6325ce48
push str._s_s__s_s_s_s_s
push 0x104
lea edx, [ebp - 0x170]
push edx
call fcn.632026b0
add esp, 0x28
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.6320feb0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.6320feb0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x170]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x63237c4e
mov dword [ebp - 0x174], 0
jmp 0x63237c5a
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret

Function at 0x63237c70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], 1
mov eax, 1
test eax, eax
je 0x63237c9e
jmp 0x63237cab
push 0x6324ba28
call fcn.63201050
add esp, 4
mov byte [ebp - 0x170], 0
push 0x103
push 0
lea ecx, [ebp - 0x16f]
push ecx
call fcn.6320feb0
add esp, 0xc
push 0x6324ba40
push 0x6325d8bc
push str.exceptionparam_
push 0x6324ba58
push 0x6324ba64
push 0x6324ba84
push 0x6325ce48
push 0x6324ba94
push 0x104
lea edx, [ebp - 0x170]
push edx
call fcn.632026b0
add esp, 0x28
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.6320feb0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.6320feb0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x170]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x63237d5a
mov dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret
Function at 0x63237d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], 1
mov byte [ebp - 0x170], 0
push 0x103
push 0
lea eax, [ebp - 0x16f]
push eax
call fcn.6320feb0
add esp, 0xc
push 0x6324b9a8
push 0x6325d8bc
push str.updateparam_
push 0x6324b9c0
push 0x6324b9cc
push 0x6324b9ec
push 0x6325ce48
push 0x6324b9fc
push 0x104
lea ecx, [ebp - 0x170]
push ecx
call fcn.632026b0
add esp, 0x28
mov edx, 1
test edx, edx
je 0x63237df7
jmp 0x63237e0b
lea eax, [ebp - 0x170]
push eax
push str.Update_Server_Command_:__s
call fcn.63201050
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.6320feb0
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.6320feb0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea edx, [ebp - 0x170]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x63237e65
mov dword [ebp - 0x174], 0
jmp 0x63237e71
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret
Function at 0x63237e90
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x538
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x538], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x538]
call fcn.63237b60
test eax, eax
jne 0x63238063
mov eax, 1
test eax, eax
je 0x63237ece
jmp 0x63237edb
push str._ERROR:_UpdateXGHFile_Fail
call fcn.63201050
add esp, 4
mov byte [ebp - 0x428], 0
push 0x103
push 0
lea ecx, [ebp - 0x427]
push ecx
call fcn.6320feb0
add esp, 0xc
mov byte [ebp - 0x320], 0
push 0x103
push 0
lea edx, [ebp - 0x31f]
push edx
call fcn.6320feb0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.http:__u.nprotect2.net_xguard_update_npupdate.zip
lea ecx, [ebp - 0x320]
push ecx
call fcn.63202860
add esp, 8
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea edx, [ebp - 0x217]
push edx
call fcn.6320feb0
add esp, 0xc
push 0x6325ce48
push str._s_npupdate.zip
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.6320fb38
add esp, 0x10
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x320]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x63238063
mov byte [ebp - 0x530], 0
push 0x103
push 0
lea ecx, [ebp - 0x52f]
push ecx
call fcn.6320feb0
add esp, 0xc
push str.npupdate.zip
push 0x6325ce48
push 0x6324bb90
push 0x104
lea edx, [ebp - 0x530]
push edx
call fcn.6320fb38
add esp, 0x14
push 0x6324b922
push 0x6325ce48
lea eax, [ebp - 0x530]
push eax
mov ecx, 0x6325ce48
call fcn.63239d20
lea ecx, [ebp - 0x530]
push ecx
call fcn.632121fb
add esp, 4
push 0x6325ce48
push str._s_npupdate.exe
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.6320fb38
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x6325dc2c
call fcn.6323b8a0
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
je 0x63238058
cmp dword [ebp - 0x534], 0x800b0101
jne 0x63238063
mov ecx, dword [ebp - 0x538]
call fcn.63237b60
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret
Function at 0x632385e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 1
test eax, eax
je 0x632385f4
jmp 0x63238601
push str.NPXGDIsMemGuardLoad_start
call fcn.63201050
add esp, 4
mov dword [ebp - 0xc], 0
push str.global_mutex_npxgd32.exe
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x63238641
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 1
jmp 0x6323865d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x632386bd
mov ecx, 0x6325ce48
call fcn.63239580
cmp eax, 1
jne 0x632386bd
push str.global_mutex_npxgd64.exe
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x632386a5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 1
jmp 0x632386bd
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x632386d4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x632386df
jmp 0x632386ec
push str.NPXGDIsMemGuardLoad_end
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x63238e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.632104e0
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x63238e4d
cmp dword [ebp - 4], 0
jne 0x63238e6c
mov edx, 1
test edx, edx
je 0x63238e58
jmp 0x63238e65
push str._Pipe_Server__Write_Fail
call fcn.63201050
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x63239060
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov al, byte [0x6324b93e]
mov byte [ebp - 0x118], al
push 0x103
push 0
lea ecx, [ebp - 0x117]
push ecx
call fcn.6320feb0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str.SOFTWAREINCAInternet_npxgdupdateEx_s
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.632026b0
add esp, 0x10
lea ecx, [ebp - 0x118]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret 4
Function at 0x63239200
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
push 0
push 0
push 0x8003
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb7c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov esp, ebp
pop ebp
ret 4

Function at 0x632396d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x10], 0
mov al, byte [0x6324b923]
mov byte [ebp - 0x120], al
push 0x103
push 0
lea ecx, [ebp - 0x11f]
push ecx
call fcn.6320feb0
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
push 0x6324c38c
push 0x104
lea eax, [ebp - 0x120]
push eax
call fcn.632026b0
add esp, 0x10
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 1
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x63239858
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dl, byte [0x6324b93d]
mov byte [ebp - 0x228], dl
push 0x103
push 0
lea eax, [ebp - 0x227]
push eax
call fcn.6320feb0
add esp, 0xc
movzx ecx, word [ebp - 0x22c]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
movzx ecx, word [ebp - 0x232]
push ecx
movzx edx, word [ebp - 0x236]
push edx
movzx eax, word [ebp - 0x238]
push eax
push str._04d_02d_02d_02d_02d_02d
push 0x104
lea ecx, [ebp - 0x228]
push ecx
call fcn.632026b0
add esp, 0x24
lea edx, [ebp - 0x228]
push edx
call fcn.632104e0
add esp, 4
push eax
lea eax, [ebp - 0x228]
push eax
push 1
push 0
push str.LastUpdateExDate
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x63239830
mov edx, 1
test edx, edx
je 0x63239823
jmp 0x63239830
push str.RegSetValueEx_Error
call fcn.63201050
add esp, 4
push 0x6325d050
call fcn.632104e0
add esp, 4
push eax
push 0x6325d050
push 1
push 0
push str.LastUpdateFileName
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x63239870
mov ecx, 1
test ecx, ecx
je 0x63239863
jmp 0x63239870
push str.RegCreateKeyEx_FALSE
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret 4
Function at 0x63240ff0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, 1
test ecx, ecx
je 0x63241014
jmp 0x63241021
push str.CheckThreadExitProcess_START
call fcn.63201050
add esp, 4
push 0xffffffffffffffff
mov edx, dword [0x6325d49c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x6325e9f4], 1
jne 0x6324104d
mov dword [0x6325e9f4], 0
mov eax, 1
jmp 0x6324118b
mov ecx, 0x6325ce48
call fcn.632395d0
cmp eax, 1
je 0x6324106f
mov ecx, 0x6325ce48
call fcn.632393c0
cmp eax, 1
jne 0x6324115b
push str..xgd
push 0x6325d257
push 0x6325d157
push 0x6325d154
push str._s_s_s_s
lea eax, [ebp - 0x110]
push eax
call fcn.6320fabd
add esp, 0x18
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 5
jne 0x632410d2
push 4
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x6324dd8c
push 0x6325d257
push 0x6325d157
push 0x6325d154
push str._s_s_s_xgd_s
lea eax, [ebp - 0x110]
push eax
call fcn.6320fabd
add esp, 0x18
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 5
jne 0x63241135
push 4
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 1
test eax, eax
je 0x63241140
jmp 0x6324115b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x110]
push ecx
push str._delete_file_:_theApp.szPath__s______GE_:__d
call fcn.63201050
add esp, 0xc
call fcn.63201040
mov dword [ebp - 0x118], eax
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
mov edx, dword [eax + 0x74]
call edx
mov ecx, eax
call fcn.632014b0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret 4
Function at 0x632411a0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
mov eax, 1
test eax, eax
je 0x632411c4
jmp 0x632411d1
push 0x6324db74
call fcn.63201050
add esp, 4
mov dword [ebp - 0x220], 0x301
cmp dword [ebp + 0xc], 1
jne 0x6324120b
push 0x6324db88
push 0x6325d257
push 0x6325d157
push 0x6325d154
push 0x6324db90
lea ecx, [ebp - 0x110]
push ecx
call fcn.6320fabd
add esp, 0x18
jmp 0x63241233
push 0x6324db9c
push 0x6325d257
push 0x6325d157
push 0x6325d154
push 0x6324dba4
lea edx, [ebp - 0x110]
push edx
call fcn.6320fabd
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.63211a10
add esp, 8
push 0x6324dbb4
lea edx, [ebp - 0x218]
push edx
call fcn.63211a20
add esp, 8
call fcn.63201040
mov eax, dword [eax + 0x48]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.63211a20
add esp, 8
mov edx, 1
test edx, edx
je 0x63241280
jmp 0x63241294
lea eax, [ebp - 0x110]
push eax
push str.ExecuteAndWaitForWin98_szPath_:__s
call fcn.63201050
add esp, 8
mov ecx, 1
test ecx, ecx
je 0x6324129f
jmp 0x632412b3
lea edx, [ebp - 0x218]
push edx
push str.ExecuteAndWaitForWin98_szPathWithCmd_:__s
call fcn.63201050
add esp, 8
push 0x6324dc08
lea eax, [ebp - 0x110]
push eax
call fcn.63210797
add esp, 8
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x632412d8
jmp 0x63241330
mov ecx, 1
test ecx, ecx
je 0x632412e3
jmp 0x632412fd
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 8]
sub ecx, dword [eax + 0xc]
push ecx
push 0x6324dc0c
call fcn.63201050
add esp, 8
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
sub edx, dword [ecx + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.6321198b
add esp, 0x10
mov edx, dword [ebp - 0x21c]
push edx
call fcn.63210de5
add esp, 4
push 0x6325d49c
push 0x6325d458
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x63241373
mov ecx, 1
test ecx, ecx
je 0x63241364
jmp 0x63241371
push str.CreateProcess_TRUE
call fcn.63201050
add esp, 4
jmp 0x6324139c
mov edx, 1
test edx, edx
je 0x6324137e
jmp 0x63241392
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_FALSE_:__d
call fcn.63201050
add esp, 8
mov dword [ebp - 0x220], 0x300
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret 8
Function at 0x632419a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63246e10
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x63256ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x5c], 0
push 0x40
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.6320feb0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.63201e60
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push str._s__s
lea eax, [ebp - 0x14]
push eax
call fcn.63201e30
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.63202050
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x63241b04
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x10007
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xa4]
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x60]
push ecx
push 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x84]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x64], ecx
push 0x1c
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x63241ad5
cmp dword [ebp - 0x70], 0x10000
jne 0x63241aca
jmp 0x63241ad5
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x64], eax
jmp 0x63241aa5
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x64]
sub edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov dword [ebp - 0x88], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.63202060
mov eax, dword [ebp - 0x88]
jmp 0x63241b23
mov dword [ebp - 0x8c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.63202060
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14