joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x10014060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001406f
pop dword [ebp - 0x28]
mov eax, 0xc4a24804
sub eax, 0xb4a10795
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2dce076b
add dword [ebp - 0x38], 0x20843de0
mov dword [ebp - 0x34], 0xbc39d37
add dword [ebp - 0x34], 0x266faf0e
mov dword [ebp - 0x30], 0xfe472aea
sub dword [ebp - 0x30], 0xb1fae6bc
mov dword [ebp - 0x2c], 0xa0bfe1d3
add dword [ebp - 0x2c], 0x5f401e2d
lea eax, [ebp - 0x38]
push eax
mov eax, 0xb5c63fbd
sub eax, 0xa5c4df5d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3c0f508
sub dword [ebp - 0x38], 0x8f4e8bb2
mov dword [ebp - 0x34], 0x67b8eeec
add dword [ebp - 0x34], 0xd9b37289
mov dword [ebp - 0x30], 0xf3ea613f
add dword [ebp - 0x30], 0x6f850b2d
mov dword [ebp - 0x2c], 0x611c7c65
sub dword [ebp - 0x2c], 0x611c7c65
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x37562d1e
add eax, 0xd8ab3346
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36e54
push 0
call eax
mov ecx, 0x453c
mov edx, eax
mov esi, 0xa0a12dbc
add esi, 0x6f610844
add esi, dword [ebp - 0x28]
mov ebx, 0x38812dcb
add ebx, 0xda4087b
mov dword [ebp - 0x20], 0xf9aa2324
mov edi, dword [esi]
add dword [ebp - 0x18], eax
xor edi, ebx
add dword [ebp - 0x1c], ebx
mov dword [edx], edi
sub dword [ebp - 0x1c], ebx
add edx, 0xcf8b394a
add edx, 0x3074c6ba
add esi, 0x1f6bed35
add esi, 0xe09412cf
loop 0x1001418b
add eax, 0xd350220f
add eax, 0x2cb0e5b4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9dac7555
sub ecx, 0x8dac7555
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x406760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406784
xor eax, eax
test eax, eax
je 0x406797
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406797
xor ecx, ecx
jmp 0x40679a
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4068f4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068ce
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406925
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406907
pop edi
not eax
pop esi
ret 0xc

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
inc edi
inc ebp
and bh, byte [edi + 0x38a62c17]
adc cl, ch
scasd eax, dword es:[edi]
test eax, 0x13c78790
in al, 0x24
popfd
invalid
Function at 0x7003301
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x7003310
pop dword [ebp - 0x24]
mov eax, 0x8635635b
sub eax, 0x7f35304b
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x764e0e18
sub dword [ebp - 0x34], 0x27fbc8cd
mov dword [ebp - 0x30], 0xef7b4b03
add dword [ebp - 0x30], 0x42b80142
mov dword [ebp - 0x2c], 0x88f4620f
add dword [ebp - 0x2c], 0xc357e21f
mov dword [ebp - 0x28], 0xb51c00ae
add dword [ebp - 0x28], 0x4ae3ff52
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa7541e7b
sub dword [ebp - 0x34], 0x32e1b525
mov dword [ebp - 0x30], 0x968c40e7
add dword [ebp - 0x30], 0xaae0208e
mov dword [ebp - 0x2c], 0xa90835d2
add dword [ebp - 0x2c], 0xba67369a
mov dword [ebp - 0x28], 0x7f51e1a8
add dword [ebp - 0x28], 0x80ae1e58
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x123337ab
add eax, 0xf4cde889
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3c897
push 0
call eax
mov ecx, 0x39c4ef99
add ecx, 0xc63b6014
mov edx, eax
mov edi, 0xff632cf0
sub edi, 0xf8614cf0
add edi, dword [ebp - 0x24]
mov esi, 0x41a1eafb
sub esi, 0x91d5be04
mov dword [ebp - 0x14], 0x61543050
mov ebx, dword [edi]
mov dword [ebp - 0xc], 0xb49c6864
xor ebx, esi
mov dword [ebp - 0x20], 0x7ff424bb
mov dword [edx], ebx
sub dword [ebp - 0x20], ebx
add edx, 0x7f451610
add edx, 0x80bae9f4
add edi, 0xd65c2fcb
sub edi, 0xd65c2fc7
loop 0x700342d
add eax, 0xd56826db
add eax, 0x2a990aac
mov ebx, eax
add eax, 0x3e3c5168
sub eax, 0x3e3c5163
mov ecx, 0x9c7dae63
add ecx, 0x6a82519d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003301
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003301
int3
Function at 0x7a80d9
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.007a8158
jae 0x7a80e5
xor ecx, ecx
call fcn.007a8158
jae 0x7a810f
xor eax, eax
call fcn.007a8158
jae 0x7a8120
mov al, 0x10
call fcn.007a8158
adc al, al
jae 0x7a8101
jne 0x7a814d
stosb byte es:[edi], al
jmp 0x7a80e6
call fcn.007a8164
dec ecx
loop 0x7a812c
mov eax, ebp
call fcn.007a8162
jmp 0x7a814e
lodsb al, byte [esi]
shr eax, 1
je 0x7a8174
adc ecx, 2
mov ebp, eax
jmp 0x7a814e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.007a8162
cmp eax, 0x7d00
jae 0x7a814c
cmp eax, 0x500
jae 0x7a814d
cmp eax, 0x7f
ja 0x7a814e
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a80e6
pop ebp
ret 8
Function at 0x405640
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x55c
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x55c], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [ebp - 0x55c]
mov dword [ecx + 0xa4], eax
mov dword [ebp - 0x130], 0x128
push 0x124
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.0043b290
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x55c]
call fcn.004057f0
mov dword [ebp - 4], eax
jmp 0x4056ba
lea ecx, [ebp - 0x130]
push ecx
mov ecx, dword [ebp - 0x55c]
call fcn.00405840
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4057da
push 0x400
push 0
lea edx, [ebp - 0x550]
push edx
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x150], 0
push 0x5c
lea eax, [ebp - 0x10c]
push eax
call fcn.00405480
add esp, 8
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x405712
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x150], ecx
jmp 0x405721
mov edx, dword [ebp - 0x150]
add edx, 1
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
push 0x455fd0
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x550]
push eax
call fcn.0043a50c
add esp, 4
push eax
lea ecx, [ebp - 0x14c]
call fcn.00404840
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14c]
call fcn.00406ae0
cmp eax, 0xffffffff
je 0x4057ca
cmp dword [ebp + 0xc], 1
jne 0x4057ad
mov edx, dword [ebp - 0x128]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0
je 0x4057ad
push 1
mov eax, dword [ebp - 0x554]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x558], 1
lea ecx, [ebp - 0x14c]
call fcn.004052a0
mov eax, dword [ebp - 0x558]
jmp 0x4057dc
lea ecx, [ebp - 0x14c]
call fcn.004052a0
jmp 0x4056a5
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret 8
Function at 0x4064d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SOFTWAREqdccbePass2000_FT11
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40651d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406571
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4566e0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406560
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406571
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret 4

Function at 0x406590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftwindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4065e6
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406640
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.ProgramFilesDir
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40662f
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406640
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret 4
Function at 0x406f20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ca0b
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0x455858
mov dword [ebp - 0x38], 0
push 0x455870
lea ecx, [ebp - 0x34]
call fcn.00402330
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00408aa0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x30]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4070c5
mov dword [ebp - 0x148], 0
mov byte [ebp - 0x144], 0
push 0x103
push 0
lea edx, [ebp - 0x143]
push edx
call fcn.0043b290
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.0043b290
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x407055
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x150]
call fcn.00402330
mov byte [ebp - 4], 2
lea edx, [ebp - 0x150]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00408a20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x150]
call fcn.00402f30
mov eax, dword [ebp - 0x148]
add eax, 1
mov dword [ebp - 0x148], eax
jmp 0x407057
jmp 0x407064
mov ecx, 1
test ecx, ecx
jne 0x406fd4
mov dword [ebp - 0x14c], 0
jmp 0x40707f
mov edx, dword [ebp - 0x14c]
add edx, 1
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x148]
jae 0x4070bb
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004089f0
push eax
call fcn.004089b0
add esp, 8
movzx eax, al
test eax, eax
je 0x4070b9
mov dword [ebp - 0x10], 1
jmp 0x4070bb
jmp 0x407070
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x154], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004089d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f30
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret
Function at 0x40b0e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x40b129
cmp dword [ebp - 0x9c], 5
jne 0x40b129
cmp dword [ebp - 0x98], 0
jne 0x40b129
mov al, 1
jmp 0x40b12b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret

Function at 0x40b140
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x40b189
cmp dword [ebp - 0x9c], 5
jne 0x40b189
cmp dword [ebp - 0x98], 2
jne 0x40b189
mov al, 1
jmp 0x40b18b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret

Function at 0x40b800
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [ecx], dl
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
test ecx, ecx
je 0x40b85d
cmp dword [0x479250], 0
je 0x40b852
push str.Wow64DisableWow64FsRedirection
mov edx, dword [0x479250]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x477074], eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call dword [0x477074]
jmp 0x40b85d
push 0x454e98
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x411990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x411999
xor ecx, ecx
jne 0x411999
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x4119ba
mov eax, 0xd
jmp 0x4119e6
xor eax, eax
jne 0x4119a1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x411aa9
xor ecx, ecx
jne 0x411aa9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x411aca
mov eax, 0xd
jmp 0x411b1f
xor eax, eax
jne 0x411ab1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 1
jne 0x411adb
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8
Function at 0x412740
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x14]
call fcn.004128a0
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004126e0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4127ab
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x124], edx
lea ecx, [ebp - 0x14]
call fcn.00412920
mov eax, dword [ebp - 0x124]
jmp 0x41283c
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x412811
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00412740
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x412808
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x128], edx
lea ecx, [ebp - 0x14]
call fcn.00412920
mov eax, dword [ebp - 0x128]
jmp 0x41283c
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x4127b2
lea ecx, [ebp - 0x14]
call fcn.004128d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x130]
call fcn.00412970
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x14]
call fcn.00412920
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret 4
Function at 0x414ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x24]
cmp ecx, 9
je 0x414d02
movzx edx, word [ebp - 0x24]
cmp edx, 6
jne 0x414d0b
mov eax, 1
jmp 0x414d0d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x414f90
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x414fdc
mov ecx, dword [ebp - 4]
and ecx, 0x20
je 0x414fbc
xor eax, eax
jmp 0x414fde
push 0
push 1
push str.http:__www.qdccb.com
call dword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
jne 0x414fd3
xor eax, eax
jmp 0x414fde
mov eax, 1
jmp 0x414fde
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x415a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cd38
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x463444]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
add ecx, 0x304
call fcn.00414c70
push eax
lea ecx, [ebp - 0x18]
call fcn.004028d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040dcb0
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x16c
call fcn.00401150
movzx eax, al
test eax, eax
jne 0x415b1d
push 0
push 0
push str.js.SetDocument___failed.
call fcn.0042d1f7
mov byte [ebp - 0x45], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401780
mov al, byte [ebp - 0x45]
jmp 0x415c12
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x78], edx
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x78], 0x64
jne 0x415b6b
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.0041eef8
mov dword [ebp - 0x3c], 2
lea edx, [ebp - 0x44]
push edx
mov ecx, dword [ebp - 0x4c]
call fcn.0041ef14
mov byte [ebp - 0x46], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401780
mov al, byte [ebp - 0x46]
jmp 0x415c12
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x78], 0x65
jne 0x415b94
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [ebp - 0x47], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401780
mov al, byte [ebp - 0x47]
jmp 0x415c12
mov ecx, dword [ebp - 0x4c]
mov dword [ecx + 0x74], 1
cmp dword [ebp + 8], 4
je 0x415bb0
cmp dword [ebp + 8], 5
je 0x415bb0
cmp dword [ebp + 8], 6
jne 0x415bc5
push str.addResult
mov ecx, dword [ebp - 0x4c]
add ecx, 0x90
call fcn.00402e90
jmp 0x415bd6
push str.PARM_ERR
mov edx, dword [ebp + 0x10]
push edx
call fcn.00402610
add esp, 8
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
push 0x415c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x48], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401780
mov al, byte [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc