joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060dc
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0x48
mov eax, 0x46e6e8
call fcn.00452680
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea edi, [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x49], bl
call fcn.00406310
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x40610c
lea eax, [ebp - 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4061b7
push 1
lea edi, [ebp - 0x2c]
call fcn.00406310
pop ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004067c7
test al, al
pop ecx
jne 0x40618a
mov eax, edi
push eax
call fcn.004067c7
test al, al
pop ecx
je 0x40618a
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x40615e
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40616a
lea eax, [ebp - 0x28]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40618a
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406183
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406196
lea eax, [ebp - 0x28]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call esi
push ebx
push 1
lea esi, [ebp - 0x2c]
mov edi, eax
call fcn.00407311
cmp edi, 0xffffffff
je 0x4061ea
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x10
jb 0x4061e3
push ebx
lea eax, [ebp - 0x50]
push eax
push esi
push dword [ebp - 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4061e3
cmp dword [ebp - 0x50], esi
jne 0x4061e3
mov byte [ebp - 0x49], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00407311
mov al, byte [ebp - 0x49]
call fcn.00452703
ret 4
Function at 0x406204
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x46e6e8
call fcn.00452680
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea edi, [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x49], bl
call fcn.00406310
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x406234
lea eax, [ebp - 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x406288
push 1
lea edi, [ebp - 0x2c]
call fcn.00406310
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x406267
lea eax, [ebp - 0x28]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call esi
push ebx
push 1
lea esi, [ebp - 0x2c]
mov edi, eax
call fcn.00407311
cmp edi, 0xffffffff
je 0x4062ae
push ebx
lea eax, [ebp - 0x50]
push eax
push 0x10
push dword [ebp - 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4062a7
cmp dword [ebp - 0x50], 0x10
jne 0x4062a7
mov byte [ebp - 0x49], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00407311
mov al, byte [ebp - 0x49]
call fcn.00452703
ret 4

Function at 0x406310
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x230
mov eax, 0x46e6ad
call fcn.00452680
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x220], edi
mov word [edi + 4], bx
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push ebx
mov dword [ebp - 4], ebx
inc esi
push eax
mov dword [ebp - 0x21c], esi
call fcn.0044a540
mov al, byte [ebp + 8]
add esp, 0xc
neg al
push esi
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x23
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4063e1
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x23c]
call fcn.00406931
push 0xffffffffffffffff
mov dword [ebp - 4], esi
push ebx
mov esi, edi
call fcn.00407c92
push ebx
push 1
lea esi, [ebp - 0x23c]
mov byte [ebp - 4], bl
call fcn.00407311
cmp byte [ebp + 8], bl
je 0x4063b9
push 0x47c8ac
jmp 0x4063be
push 0x47c8d4
push edi
call fcn.00406986
mov ecx, edi
call fcn.004063e9
test al, al
jne 0x4063d6
mov ecx, edi
call fcn.004064b7
push 0x47c8f8
push edi
call fcn.00406986
mov eax, edi
call fcn.00452703
ret
Function at 0x409dc6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x48f5fc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edx, [ebp - 0x214]
push edx
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x409ee3
xor eax, eax
cmp dword [ebp - 0x210], esi
je 0x409e34
push dword [ebp - 0x210]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0x214]
mov edi, eax
mov dword [ebp - 0x210], ecx
jne 0x409ee3
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ecx
jmp 0x409ea7
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00409dc6
cmp eax, esi
mov dword [ebp - 0x214], eax
jne 0x409f06
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], pe_nt_image_headers32
call edi
test eax, eax
je 0x409e6c
cmp dword [ebp - 0x210], esi
je 0x409ecd
push dword [ebp - 0x210]
call ebx
mov dword [ebp - 0x210], esi
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x210], esi
je 0x409ef3
push dword [ebp - 0x210]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a0e3
leave
ret 4
cmp dword [ebp - 0x210], esi
je 0x409f16
push dword [ebp - 0x210]
call ebx
mov eax, dword [ebp - 0x214]
jmp 0x409ef5

Function at 0x409f4d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x48f5fc]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0044a540
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x409fa1
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
je 0x409faf
cmp dword [ebp - 0x7c], 6
jne 0x409faf
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
jae 0x409fb1
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
pop esi
call fcn.0044a0e3
add ebp, 0xa0
leave
ret
Function at 0x409fc7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x48f5fc]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push esi
xor esi, esi
cmp edi, esi
je 0x40a066
lea ecx, [ebp - 0x7c]
push ecx
push 0x20019
push esi
push eax
push 0x80000002
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a066
cmp dword [ebp - 0x7c], esi
je 0x40a066
push 0x20a
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.0044a540
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x20b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a059
push 0x103
lea eax, [ebp - 0x78]
push eax
push edi
call fcn.0044deed
add esp, 0xc
inc esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40a068
xor eax, eax
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
pop esi
call fcn.0044a0e3
add ebp, 0x198
leave
ret

Function at 0x40a07e
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48f5fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test byte [0x493c60], 1
mov dword [ebp - 0x214], esi
jne 0x40a0ca
mov eax, dword [0x492934]
or dword [0x493c60], 1
mov ecx, 0x492934
call dword [eax + 0xc]
add eax, 0x10
push 0x46fd2a
mov dword [0x493c48], eax
call fcn.0044a306
pop ecx
mov eax, dword [0x493c48]
cmp dword [eax - 0xc], esi
jne 0x40a14e
push edi
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.0044a540
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
mov edi, 0x493c48
push edi
call fcn.004015be
mov eax, dword [0x493c48]
cmp dword [eax - 0xc], esi
jle 0x40a14d
call fcn.00409f1e
push str.TencentQQPCMgr_
push edi
call fcn.004019f0
push dword [0x493c48]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a14d
push esi
push dword [0x493c48]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop edi
mov eax, dword [0x493c48]
add eax, 0xfffffff0
call fcn.00401651
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [ebx], eax
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.0044a0e3
leave
ret
Function at 0x40de35
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40de48
push 0x80004005
call fcn.00401998
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40de4f
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x413a54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [esp + 0x18]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebx + 0x1f4], 0
je 0x413b44
mov dword [esp + 0x10], 1
mov esi, dword [ebx + 0x1f4]
mov ecx, dword [esi + 8]
add esi, 4
test ecx, ecx
je 0x413b44
mov eax, dword [esi + 8]
mov edi, dword [esp + 0x10]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x413b44
call fcn.004146cc
mov esi, dword [ebx + 0x1f4]
add esi, 4
xor edi, edi
mov dword [esp + 0x14], eax
call fcn.004146cc
mov ecx, dword [esp + 0x14]
push dword [ecx]
push dword [eax]
call fcn.00413257
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x413b3b
push 0x28
call fcn.0044b99c
test eax, eax
pop ecx
je 0x413af1
call fcn.00429b41
mov esi, eax
jmp 0x413af3
xor esi, esi
test esi, esi
mov dword [esp + 0x14], esi
je 0x413b33
push dword [ebx + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esi]
push 0
push edi
push edi
mov ecx, esi
call dword [eax + 0x38]
mov eax, dword [esi]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
mov ecx, esi
call dword [eax + 0x1c]
lea esi, [ebx + 0x1e4]
lea ebx, [esp + 0x14]
call fcn.004146eb
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
inc dword [esp + 0x10]
jmp 0x413a86
push 0x34
call fcn.0044b99c
test eax, eax
pop ecx
je 0x413b59
mov edi, eax
call fcn.0042a29e
jmp 0x413b5b
xor eax, eax
test eax, eax
mov dword [ebx + 0x78], eax
je 0x413bb5
push dword [ebx + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [ebx + 0x78]
mov eax, dword [ecx]
xor esi, esi
inc esi
push esi
push 0x481b88
call dword [eax + 0x38]
mov ecx, dword [ebx + 0x78]
mov eax, dword [ecx]
push esi
push 0
push 0
push 9
push 0x48131c
call dword [eax + 0x3c]
mov ecx, dword [ebx + 0x78]
mov edx, dword [ecx]
push esi
mov eax, 0x494949
push eax
push eax
call dword [edx + 0x40]
mov ecx, dword [ebx + 0x78]
mov eax, dword [ecx]
push esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xd8
push 0xf
call dword [eax + 0x1c]
push 0x30
call fcn.0044b99c
mov esi, eax
test esi, esi
pop ecx
je 0x413bde
call fcn.00429989
xor eax, eax
mov dword [esi], vtable.CVirProgress.0
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
jmp 0x413be0
xor esi, esi
test esi, esi
mov dword [ebx + 0x7c], esi
je 0x413c28
push dword [ebx + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebx + 0x7c]
mov eax, dword [ecx]
push 1
push 0xc5
push 0xc4
call dword [eax + 0x38]
mov ecx, dword [ebx + 0x7c]
mov eax, dword [ecx]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xbd
push 0xf
call dword [eax + 0x1c]
mov ebx, dword [ebx + 0x7c]
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x3c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41449a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46d075
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x48f5fc]
xor eax, esp
mov dword [esp + 0x45c], eax
push esi
push edi
mov eax, dword [0x48f5fc]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
mov edi, 0x208
xor esi, esi
push edi
lea eax, [esp + 0x25a]
push esi
push eax
mov word [esp + 0x260], si
call fcn.0044a540
add esp, 0xc
push edi
lea eax, [esp + 0x4a]
push esi
push eax
mov word [esp + 0x50], si
call fcn.0044a540
add esp, 0xc
jmp 0x4145ba
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x414684
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0040134a
mov dword [esp + 0x478], esi
mov eax, dword [esp + 0x10]
push 2
pop ecx
cmp dword [eax - 0xc], ecx
jl 0x414591
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
call fcn.0040141d
xor eax, eax
push esi
mov dword [esp + 0x18], esi
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
mov edi, dword [esp + 0x24]
push esi
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [esp + 0x18], esi
ja 0x414603
jb 0x414589
cmp dword [esp + 0x14], 0x6400000
jae 0x414603
lea eax, [edi - 0x10]
call fcn.00401980
push 0x40
push 0x481cf0
push 0x481cfc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [esp + 0x478], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401980
push 7
xor eax, eax
pop ecx
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x254]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 0x481ce0
mov dword [esp + 0x38], 0x43
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, esi
jne 0x414513
jmp 0x414684
lea eax, [edi - 0x10]
call fcn.00401980
lea eax, [esp + 0x10]
call fcn.0040a293
lea edi, [esp + 0x10]
call fcn.00401391
mov esi, edi
call fcn.0040a271
cmp eax, 0xffffffff
lea eax, [esp + 0x44]
push eax
jne 0x41465c
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x44]
push eax
mov eax, edi
push eax
call fcn.004015be
push str.QQPCMgr
mov eax, edi
push eax
call fcn.004019f0
mov eax, edi
mov edi, 0x493928
call fcn.00401391
jmp 0x414666
push 0x493928
call fcn.004015be
push dword [0x493928]
push dword [ebx + 0x88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401980
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x45c]
xor ecx, esp
call fcn.0044a0e3
mov esp, ebp
pop ebp
ret
Function at 0x41510a
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x48f5fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push str.RT_RCDATA
xor esi, esi
push 0x69
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x41513f
xor eax, eax
jmp 0x41518b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x41513b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x41513b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x415188
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415199
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044a0e3
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4151b8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x41518a
xor esi, esi
inc esi
jmp 0x4151ad

Function at 0x415b33
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 8], 0
push ebx
push edi
xor eax, eax
and dword [ebp - 0x10], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044a700
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 8]
mov ebx, 0x3ec
sub eax, ebx
je 0x415ba5
sub eax, 3
je 0x415b9a
dec eax
dec eax
jne 0x415c23
mov ecx, esi
call fcn.00417866
jmp 0x415c23
push 0
mov edi, esi
call fcn.00416654
jmp 0x415c23
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x20]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x415bf2
push 1
call edi
and ax, 0xff00
cmp ax, 0xff00
je 0x415bf2
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x415bfe
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp dword [esi + 0xf8], 0
je 0x415c23
push 1
call edi
and ax, 0xff00
cmp ax, 0xff00
mov eax, esi
je 0x415c1e
call fcn.0041746e
jmp 0x415c23
call fcn.00417408
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret 8
Function at 0x417317
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x46f5b8
call fcn.00452617
lea ecx, [ebp - 0x14]
call fcn.004151bd
lea ecx, [ebp - 0x10]
push 0x481fa4
push ecx
xor esi, esi
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.004039ab
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401980
push dword [ebp - 0x10]
call fcn.0041510a
cmp eax, esi
pop ecx
jne 0x41737e
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41737e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401980
mov eax, esi
call fcn.004526ef
ret
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
call fcn.00406931
mov byte [ebp - 4], 3
call 0x46be40
lea ecx, [ebp - 0x34]
mov ebx, eax
call 0x46c050
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
call fcn.00407311
cmp byte [0x4937ab], bl
mov esi, dword [0x49387c]
setne al
mov byte [0x49388e], al
call 0x46be40
push 0x493870
mov dword [eax], 0x7e6
mov dword [eax + 4], ebx
mov dword [eax + 0x10], esi
call 0x46be40
mov edi, eax
call fcn.00418697
cmp dword [ebp - 0x18], ebx
je 0x4173f7
call 0x46be40
mov edi, eax
call 0x46bfe0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
jmp 0x41736b
Function at 0x417675
Capabilities:
Accept command line arguments

Disassembly:
push 0xe8
mov eax, 0x46f295
call fcn.00452680
mov eax, dword [ebp + 8]
mov ebx, ecx
xor edi, edi
mov dword [ebx], edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], eax
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x47cb18
lea eax, [ebp - 0xd8]
call fcn.00406931
push eax
push 0x481fb4
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], edi
call fcn.00406931
push eax
push 0x481fb8
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 1
call fcn.00406931
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0xa0], esp
push esi
mov byte [ebp - 4], 2
call fcn.00406931
lea ecx, [ebp - 0x78]
call fcn.0040a5df
push edi
push 1
lea esi, [ebp - 0xf4]
mov byte [ebp - 4], 4
call fcn.00407311
push edi
push 1
lea esi, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.00407311
push edi
push 1
lea esi, [ebp - 0xd8]
mov byte [ebp - 4], 6
call fcn.00407311
push str.supplyid
lea eax, [ebp - 0x9c]
call fcn.00406931
push ebx
lea eax, [ebp - 0x9c]
push eax
mov ecx, ebx
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.00418715
push edi
push 1
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.00407311
push str.target
lea eax, [ebp - 0x9c]
call fcn.00406931
mov ecx, dword [ebp - 0x7c]
push ecx
lea eax, [ebp - 0x9c]
push eax
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 8
call fcn.00418715
mov byte [ebp - 4], 6
push edi
push 1
lea esi, [ebp - 0x9c]
call fcn.00407311
push 0x481fe4
lea eax, [ebp - 0x9c]
call fcn.00406931
mov ebx, 0x490be4
push ebx
lea eax, [ebp - 0x9c]
push eax
mov ecx, ebx
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 9
call fcn.00418803
push edi
push 1
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.00407311
push str.productname
lea eax, [ebp - 0x9c]
call fcn.00406931
mov edi, 0x493908
push edi
lea eax, [ebp - 0x9c]
push eax
mov ecx, edi
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 0xa
call fcn.00418803
push 0
push 1
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.00407311
mov eax, dword [ebp - 0x80]
mov dword [eax], 0x3e9
mov eax, dword [ebp - 0x7c]
mov esi, str.http:__c.pc.qq.com_fcgi_bin_downurlquery_id1001guid_sver_s
push esi
mov dword [eax], 1
call fcn.0044a0cd
pop ecx
mov ecx, esi
mov esi, ebx
call fcn.00407e10
mov esi, 0x481cf0
push esi
call fcn.0044a0cd
pop ecx
mov ecx, esi
mov esi, edi
call fcn.00407e10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0040a6e9
call fcn.00452703
ret 4