joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x19c
mov eax, dword [esp + 0x1a0]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1b4]
push edi
push 0x76697275
push str.killer
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x1b8]
mov eax, dword [ecx + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x405c8b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push 0
push edx
push eax
call fcn.004053c0
add esp, 0xc
test eax, eax
je 0x405c78
mov eax, dword [esi + 8]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
jne 0x405bfa
mov eax, dword [esi + 8]
push 0x2f2f
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x405c78
inc eax
lea ecx, [esp + 0xa8]
push eax
mov eax, dword [esp + 0x1b8]
push eax
push str.typeth_sname_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x20]
push ebp
push str.ITEM_d
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esi + 8]
add esp, 0xc
lea ecx, [esp + 0x20]
push edi
push eax
push str.file
push ecx
call ebx
lea edx, [esp + 0x84]
push edi
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00405ca0
add esp, 8
lea ecx, [esp + 0x24]
push eax
push 0x41a650
push ecx
call ebx
lea edx, [esp + 0xa8]
push edi
push edx
lea eax, [esp + 0x28]
push 0x41a64c
push eax
call ebx
inc ebp
mov ecx, dword [esp + 0x1bc]
mov esi, dword [esi]
cmp esi, dword [ecx + 4]
jne 0x405bb6
pop ebx
xor eax, eax
pop edi
test ebp, ebp
pop esi
pop ebp
setne al
add esp, 0x19c
ret

Function at 0x405dd0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x41ec8c]
test eax, eax
jne 0x405e8d
push esi
push edi
push str.WINTRUST.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CryptCATAdminAcquireContext
push esi
call edi
push str.CryptCATAdminReleaseContext
push esi
mov dword [0x41ec74], eax
call edi
push str.CryptCATAdminCalcHashFromFileHandle
push esi
mov dword [0x41ec78], eax
call edi
push str.CryptCATAdminEnumCatalogFromHash
push esi
mov dword [0x41ec7c], eax
call edi
push str.CryptCATAdminReleaseCatalogContext
push esi
mov dword [0x41ec80], eax
call edi
push str.WinVerifyTrust
push esi
mov dword [0x41ec84], eax
call edi
mov ecx, dword [0x41ec74]
pop edi
test ecx, ecx
mov dword [0x41ec88], eax
pop esi
je 0x405e83
mov ecx, dword [0x41ec78]
test ecx, ecx
je 0x405e83
mov ecx, dword [0x41ec7c]
test ecx, ecx
je 0x405e83
mov ecx, dword [0x41ec80]
test ecx, ecx
je 0x405e83
mov ecx, dword [0x41ec84]
test ecx, ecx
je 0x405e83
test eax, eax
je 0x405e83
mov eax, 1
mov dword [0x41ec8c], eax
ret
mov eax, 2
mov dword [0x41ec8c], eax
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, ecx
ret
Function at 0x406290
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4062ee
mov eax, dword [esp]
lea ecx, [esp + 8]
push eax
push ecx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4062ee
add esp, 0x10c
ret
mov ecx, dword [esp + 0x114]
push esi
cmp ecx, 0x7fffffff
ja 0x406337
mov eax, dword [esp + 0x114]
mov esi, ecx
test ecx, ecx
je 0x406337
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x40632f
mov byte [eax], cl
inc eax
dec esi
jne 0x406311
dec eax
pop esi
mov byte [eax], 0
mov eax, 1
add esp, 0x10c
ret
test esi, esi
jne 0x406334
dec eax
mov byte [eax], 0
mov eax, 1
pop esi
add esp, 0x10c
ret

Function at 0x406390
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
call edi
test eax, eax
jne 0x4063b5
pop edi
pop esi
add esp, 0x208
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
test eax, eax
je 0x406460
call fcn.00406240
test eax, eax
je 0x406447
lea eax, [esp + 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push 0
push str._del_
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 8]
push 1
push eax
push esi
call edi
test eax, eax
push 4
push 0
je 0x406436
lea ecx, [esp + 0x10]
push ecx
call edi
pop edi
mov eax, 2
pop esi
add esp, 0x208
ret
push esi
call edi
pop edi
mov eax, 2
pop esi
add esp, 0x208
ret
push esi
call fcn.00406470
add esp, 4
neg eax
sbb eax, eax
pop edi
neg eax
inc eax
pop esi
add esp, 0x208
ret
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
Function at 0x4065a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push 0x103
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x406672
cmp eax, 0x103
ja 0x406672
push esi
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xb], 0x5c
je 0x406638
mov ecx, 0x104
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x4065f4
inc eax
dec ecx
jne 0x4065e9
jmp 0x406638
test ecx, ecx
je 0x406638
lea edx, [esp + 8]
test edx, edx
je 0x406609
mov eax, 0x104
sub eax, ecx
jmp 0x40660d
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0xc]
je 0x406638
mov esi, 0x41a7e0
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x406630
mov byte [eax], cl
inc eax
dec edx
jne 0x406621
jmp 0x406634
test edx, edx
jne 0x406635
dec eax
mov byte [eax], 0
mov esi, dword [esp + 0x118]
mov edi, dword [esp + 0x114]
lea eax, [esp + 0xc]
push str.wininit.ini
push eax
push 0x41a564
push esi
push edi
call fcn.00406680
add esp, 0x14
mov byte [edi + esi - 1], 0
mov eax, 1
pop edi
pop esi
add esp, 0x108
ret
xor eax, eax
add esp, 0x108
ret

Function at 0x4066f0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406711
pop esi
add esp, 0x208
ret
push esi
call fcn.00406390
add esp, 4
call fcn.00406240
test eax, eax
je 0x4067ae
mov dl, byte [0x41eb28]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x114]
push 0x41a7e4
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
pop edi
je 0x4067ae
push 4
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 1
pop esi
add esp, 0x208
ret
Function at 0x4067c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x554
push ebp
push esi
mov esi, dword [esp + 0x564]
test esi, esi
je 0x4069a6
cmp byte [esi], 0
je 0x4069a6
cmp byte [esi + 1], 0x3a
jne 0x4069a6
mov eax, dword [esp + 0x560]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea ecx, [esp + 0x45c]
push esi
push ecx
mov dword [esp + 0x18], 0x80
call ebp
lea edx, [esp + 0xc]
lea eax, [esp + 0x458]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x4069a6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
cmp byte [esp + 0x40], 0x2e
jne 0x406856
mov al, byte [esp + 0x41]
test al, al
je 0x406977
cmp al, 0x2e
jne 0x406856
mov al, byte [esp + 0x42]
test al, al
je 0x406977
test byte [esp + 0x14], 0x10
jne 0x406916
mov dl, byte [0x41eb28]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], dl
mov byte [esp + 0x154], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x155]
lea edx, [esp + 0x258]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x40]
stosw word es:[edi], ax
push ecx
push esi
push edx
stosb byte es:[edi], al
call ebp
lea eax, [esp + 0x154]
push 0x104
lea ecx, [esp + 0x25c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x154]
push edx
call ebx
test eax, eax
jne 0x406977
lea eax, [esp + 0x154]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x154]
push ecx
call ebx
test eax, eax
jne 0x406977
mov eax, dword [esp + 0x574]
test eax, eax
je 0x406977
lea edx, [esp + 0x154]
push edx
call fcn.00406390
add esp, 4
jmp 0x406977
mov eax, dword [esp + 0x570]
test eax, eax
je 0x406977
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x35c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x35c]
push eax
push esi
push ecx
call ebp
mov edx, dword [esp + 0x574]
mov eax, dword [esp + 0x570]
push edx
mov edx, dword [esp + 0x56c]
lea ecx, [esp + 0x360]
push eax
push ecx
push edx
call fcn.004067c0
add esp, 0x10
lea eax, [esp + 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406833
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x554
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x554
ret
Function at 0x4069c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x248
mov al, byte [0x41eb28]
push ebx
push ebp
push edi
mov byte [esp + 0x10], al
mov ebx, dword [esp + 0x258]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._s.
lea ecx, [esp + 0x18]
push 0x103
push ecx
stosb byte es:[edi], al
xor ebp, ebp
call fcn.00406680
add esp, 0x10
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x406a2b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x248
ret
mov edi, dword [esp + 0x25c]
push esi
mov esi, dword [esp + 0x264]
cmp byte [esp + 0x144], 0x2e
jne 0x406a66
mov al, byte [esp + 0x145]
test al, al
je 0x406afe
cmp al, 0x2e
jne 0x406a66
mov al, byte [esp + 0x146]
test al, al
je 0x406afe
mov al, byte [esp + 0x118]
lea ecx, [esp + 0x144]
test al, 0x10
push ecx
je 0x406aa9
push ebx
push str._s_s
lea edx, [esp + 0x20]
push 0x103
push edx
call fcn.00406680
push esi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.004069c0
add esp, 0x20
mov ebp, eax
test esi, esi
jne 0x406afe
test ebp, ebp
jne 0x406b1f
jmp 0x406afe
push 0x41a7e8
lea edx, [esp + 0x1c]
push 0x103
push edx
call fcn.00406680
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x406afe
test esi, esi
je 0x406b1a
lea ecx, [esp + 0x144]
lea edx, [esp + 0x14]
push ecx
push ebx
push str._s_s
push 0x103
push edx
call fcn.00406680
lea eax, [esp + 0x28]
push eax
call fcn.00406390
add esp, 0x18
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x406b1f
jmp 0x406a3a
mov ebp, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0x248
ret

Function at 0x406e20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x41ee38]
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp eax, esi
jne 0x406e3b
pop edi
mov eax, 1
pop esi
ret 4
call fcn.00406240
test eax, eax
push esi
push 0
je 0x406e4b
push 1
jmp 0x406e50
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406e6e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x407150
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4071b1
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push esi
push esi
lea edx, [esp + 0x10]
push 0x10
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x407240
Capabilities:
Delete file
Delete registry key
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x314
mov dl, byte [0x41eb28]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
mov byte [esp + 0x218], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x219]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0x114]
push eax
push str.SYSTEMCurrentControlSetServices
push str._s_s
push 0x103
push ecx
call fcn.00406680
add esp, 0x14
lea edx, [esp + 0xc]
lea eax, [esp + 0x218]
lea ecx, [esp + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x120]
push str.ImagePath
push edx
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4073e9
lea eax, [esp + 0x218]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x4073e9
mov cl, byte [0x41eb28]
xor eax, eax
mov byte [esp + 0x10], cl
mov ecx, 0x40
lea edi, [esp + 0x11]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
push edx
inc esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x104
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x407347
inc eax
dec ecx
jne 0x40733c
jmp 0x40738b
test ecx, ecx
je 0x40738b
lea eax, [esp + 8]
test eax, eax
je 0x40735c
mov eax, 0x104
sub eax, ecx
jmp 0x407360
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x40738b
mov edi, str.drivers_
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x407383
mov byte [eax], cl
inc eax
dec edx
jne 0x407374
jmp 0x407387
test edx, edx
jne 0x407388
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x40739f
inc eax
dec ecx
jne 0x407394
jmp 0x4073de
test ecx, ecx
je 0x4073de
lea edx, [esp + 8]
test edx, edx
je 0x4073b4
mov eax, 0x104
sub eax, ecx
jmp 0x4073b8
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x4073de
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x4073d6
mov byte [eax], cl
inc eax
dec edx
jne 0x4073c7
jmp 0x4073da
test edx, edx
jne 0x4073db
dec eax
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x114]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
mov eax, 1
pop esi
add esp, 0x314
ret
Function at 0x407440
Capabilities:
Modify service
Stop service

Disassembly:
sub esp, 0x1c
push esi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, dword [esp + 0x24]
push 0xf003f
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40746c
pop esi
add esp, 0x1c
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x407490
pop esi
add esp, 0x1c
ret
lea edx, [esp + 4]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop esi
add esp, 0x1c
ret

Function at 0x4074b0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
sub esp, 0xd0
push ebp
push esi
push edi
mov edi, dword [esp + 0xe0]
push edi
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4075be
push esi
push 0x80
push 3
push esi
push 5
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4075be
push ebx
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x18]
push esi
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0xe8]
mov dword [esp + 0x14], esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x407522
cmp eax, ecx
jne 0x4075aa
mov dword [esp + 0x10], 0
add ebx, 0xc
mov eax, dword [ebx - 4]
test eax, eax
je 0x4075aa
cmp dword [ebx], 0
je 0x4075aa
mov eax, dword [ebx - 8]
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x407583
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push 0
push ecx
lea eax, [esp + 0x20]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407583
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jne 0x407583
mov edi, dword [ebx - 4]
lea esi, [esp + 0x18]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4075a8
mov esi, 1
mov eax, dword [esp + 0x10]
add ebx, 0xc
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jl 0x40752d
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
xor esi, esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
Function at 0x407960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
mov esi, dword [esp + 0x114]
push eax
push 0x20019
push 0
push str.software_tencentqq
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40799b
xor eax, eax
pop esi
add esp, 0x10c
ret
test esi, esi
mov dword [esp + 8], 0x104
jne 0x4079ab
lea esi, [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push esi
push 0
push 0
push str.install
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x10c
ret
Function at 0x407c90
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov al, byte [0x41eb28]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406240
test eax, eax
pop edi
je 0x407d2b
lea ecx, [esp + 4]
lea edx, [esp + 0x10c]
push ecx
lea eax, [esp + 4]
push edx
push eax
push str.DataBasePath
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x407d0f
lea ecx, [esp + 0x10c]
push str.Hosts
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
jmp 0x407d4b
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 8]
push str.DriversetcHosts
push ecx
jmp 0x407d45
lea edx, [esp + 8]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push str.Hosts
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, dword [esp + 0x218]
push esi
cmp ecx, 0x7fffffff
ja 0x407d85
mov eax, dword [esp + 0x218]
mov esi, ecx
test ecx, ecx
je 0x407d85
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x407d7d
mov byte [eax], cl
inc eax
dec esi
jne 0x407d6e
jmp 0x407d81
test esi, esi
jne 0x407d82
dec eax
mov byte [eax], 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
pop esi
je 0x407db0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x407db0
mov eax, 1
add esp, 0x210
ret
xor eax, eax
add esp, 0x210
ret

Function at 0x407ed0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
push esi
push edi
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x407eee
pop edi
pop esi
add esp, 0x5c
ret
mov eax, dword [esp + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407f23
push esi
call fcn.00414a60
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x5c
ret
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.004127e0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push edx
push 0x1000
push esi
push edi
call ebx
test eax, eax
je 0x407f86
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407f86
push eax
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00411ed0
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push ecx
push 0x1000
push esi
push edi
call ebx
test eax, eax
jne 0x407f53
push esi
call fcn.00414a60
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.00411fcf
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x5c
ret
Function at 0x407fc0
Capabilities:
Delete file
Enumerate processes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x230
lea ecx, [esp + 0x12c]
lea eax, [esp + 0x12c]
push ebp
push esi
xor ebp, ebp
mov esi, 0x104
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x407ff2
mov byte [eax], cl
inc eax
dec esi
jne 0x407fe3
jmp 0x407ff6
test esi, esi
jne 0x407ff7
dec eax
lea edx, [esp + 0x134]
push 0x5c
push edx
mov byte [eax], 0
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40801c
pop esi
pop ebp
add esp, 0x230
ret
push ebx
push edi
push 0
push 2
inc esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
push ecx
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4080b9
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov edi, dword [sym.imp.MSVCRT.dll__strlwr]
lea edx, [esp + 0x38]
push edx
call edi
add esp, 4
push eax
push esi
call edi
add esp, 4
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40807f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40804f
jmp 0x4080b9
mov edx, dword [esp + 0x1c]
push edx
call fcn.00406e20
test eax, eax
jne 0x408091
xor ebp, ebp
jmp 0x4080b9
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [esp + 0x244]
push eax
call edi
mov ebp, eax
test ebp, ebp
jne 0x4080b9
push 0xa
call ebx
inc esi
cmp esi, 0x32
jb 0x40809f
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x4080ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop esi
pop ebp
add esp, 0x230
ret