joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406400
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x40643a
cmp dword [esp + 0x34], esi
je 0x40643a
push 0x200
call fcn.0043d9e8
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x406445
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4065a4
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x40653a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40649d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406513
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406508
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.00406370
cmp edx, edi
jb 0x406508
ja 0x406502
cmp eax, dword [esp + 0x24]
jbe 0x406508
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x406490
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x406550
cmp dword [esp + 0x24], 0
jbe 0x4065a4
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.00403370
add esp, 0xc
test eax, eax
jne 0x406589
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043d1d2
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.00405fb0
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.0043d1d2
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40b780
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x46be2b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x480e68], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.0043f32f
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x40b974
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b81e
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.0043bd90
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.0040b360
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x40b885
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x474b70
push eax
call fcn.0043ef35
add esp, 0xc
cmp eax, 1
jne 0x40b885
mov eax, dword [ebp - 0x14]
mov dword [0x480e68], eax
jmp 0x40b955
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40b89f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40b8b3
push ebx
push esi
call fcn.0040bc20
jmp 0x40b8b5
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x480e68], eax
test eax, eax
jne 0x40b8d7
push 0x479c84
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.0043c5dd
push eax
lea edx, [ebp + 0x84]
push 0x474b70
push edx
mov edi, 1
call fcn.0043d2db
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.0040b4a0
test eax, eax
jne 0x40b94e
push 0x479c84
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.0043c5dd
call fcn.0040b650
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x480e68]
test esi, esi
je 0x40b93f
call fcn.0040be20
mov dword [0x480e68], 0
jmp 0x40b946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x40b94c
ret
mov eax, dword [0x480e68]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x40b974
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x480e68
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.0043bd7f
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x40b9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bdd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x47cfe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x480e68]
xor edi, edi
cmp ecx, edi
jne 0x40ba3b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x40ba48
mov dword [ebp - 0x14], edi
jmp 0x40ba60
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x40baf6
mov ecx, dword [0x480e68]
mov eax, dword [ecx]
cmp eax, edi
je 0x40ba27
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ba27
mov ebx, 0x480e68
mov dword [ebp - 4], edi
call fcn.0040bb10
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x40ba9e
push 0x479c84
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.0043c5dd
mov ecx, dword [0x480e68]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40bab8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x40bae2
push 0x479c84
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.0043c5dd
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x40bad9
call fcn.0040bf70
mov eax, 0x40badf
ret
mov eax, dword [0x480e68]
mov eax, dword [eax]
test eax, eax
je 0x40baf4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb10
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x40bb3d
xor ecx, ecx
jmp 0x40bb49
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x40bbfd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x40bb70
mov dword [esp + 0xc], esi
jmp 0x40bbd0
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x40bbc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40bbbc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x40bbd0
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40bbd0
push 0x474b78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40bbd0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x40bbf3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x40bb62
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x40bc11
mov ecx, dword [ebx]
add ecx, 8
call fcn.0040bea0
test eax, eax
je 0x40bc11
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x40bc20
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x46bdfb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x47cfe8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.0043bd90
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x40bcb8
push 0x479c84
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.0043c5dd
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x40c180
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0043bd90
add esp, 0xc
push 1
push 0x1a
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LudashiComputerZ.set
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x218]
add ecx, 0x10
call fcn.0040cdf0
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp - 0x218]
add ecx, 0x10
call fcn.0040c780
push eax
push 0
push str.vr_show
push 0x46d6ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x40c21b
jmp 0x40c251
mov ecx, dword [ebp - 0x218]
add ecx, 0x10
call fcn.0040c780
push eax
push 0
push 0x46d6b4
push 0x46d6c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x40c243
jmp 0x40c251
mov dword [ebp - 0x214], 1
xor ecx, ecx
jne 0x40c1f3
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret

Function at 0x414820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0043bd90
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.0043bd90
add esp, 0xc
push 0x46e76c
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4148c9
push 0x46e74c
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x418]
push eax
call fcn.0041c7c0
add esp, 4
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret
Function at 0x4193b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00419170
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00419350
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41941b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004191a0
mov eax, dword [ebp - 0x224]
jmp 0x4194ac
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x419481
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004193b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x419478
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004191a0
mov eax, dword [ebp - 0x228]
jmp 0x4194ac
mov dword [ebp - 4], 0x100
jmp 0x419422
lea ecx, [ebp - 0x14]
call fcn.00419290
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00419230
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004191a0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret 4
Function at 0x419aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x419aa9
xor ecx, ecx
jne 0x419aa9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x419aca
mov eax, 0xd
jmp 0x419b25
xor eax, eax
jne 0x419ab1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x419adb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x41c8b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0043d7c0
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1010], 0x800
push 0x1000
push 0
lea eax, [ebp - 0x1008]
push eax
call fcn.0043bd90
add esp, 0xc
push 0x46ee70
push 0x800
lea ecx, [ebp - 0x1008]
push ecx
call fcn.0041d580
push 0x46ee78
push 0x800
lea edx, [ebp - 0x1008]
push edx
call fcn.0041d580
push 0x46ee80
push 0x800
lea eax, [ebp - 0x1008]
push eax
call fcn.0041d580
push 0x46eeac
push 0x800
lea ecx, [ebp - 0x1008]
push ecx
call fcn.0041d580
push str.vL
push 0x800
lea edx, [ebp - 0x1008]
push edx
call fcn.0041d580
mov eax, dword [ebp + 8]
push eax
push 0x800
lea ecx, [ebp - 0x1008]
push ecx
call fcn.0041d580
push 0x46eed8
push 0x800
lea edx, [ebp - 0x1008]
push edx
call fcn.0041d580
push 0x14
push 0x46eef8
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 6
jne 0x41c9c2
push 5
push 0
push 0
push str.http:__dl.ludashi.com_ludashi_ludashisetup.exe
push 0x46ef60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0xc], 0
je 0x41c9cf
push 0
call fcn.0043e0f7
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret

Function at 0x41cc90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18

Function at 0x41ccc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4
Function at 0x41d390
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a594
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov word [ebp - 0x83c], cx
push 0x3fe
push 0
lea edx, [ebp - 0x83a]
push edx
call fcn.0043bd90
add esp, 0xc
xor eax, eax
mov word [ebp - 0x43c], ax
push 0x426
push 0
lea ecx, [ebp - 0x43a]
push ecx
call fcn.0043bd90
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x83c]
push ecx
call fcn.0041d640
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0
jl 0x41d4be
lea edx, [ebp - 0x83c]
push edx
push 0x428
lea eax, [ebp - 0x43c]
push eax
call fcn.0041d5e0
lea ecx, [ebp - 0x43c]
push ecx
push str._pop_
lea ecx, [ebp - 0x844]
call fcn.00413570
mov dword [ebp - 0x84c], eax
mov edx, dword [ebp - 0x84c]
mov dword [ebp - 0x850], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x850]
push eax
lea ecx, [ebp - 0x848]
push ecx
call fcn.0041d690
add esp, 0xc
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x854]
call fcn.0040c780
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x848]
call fcn.0040cdd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.0040cdd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret
Function at 0x41e210
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.0043bd90
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0043bd90
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x620]
push edx
call fcn.0043bd90
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x46f240
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360wpapp.exe
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.LdsLite.exe
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e309
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e309
mov eax, 1
jmp 0x41e33d
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e320
xor eax, eax
jmp 0x41e33d
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e338
mov eax, 2
jmp 0x41e33d
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret
Function at 0x41e680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a606
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x47cfe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00413570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2e8]
call fcn.0041ece0
movzx ecx, al
test ecx, ecx
je 0x41e6fa
mov dword [ebp - 0x368], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.0040cdd0
mov eax, dword [ebp - 0x368]
jmp 0x41e8ad
mov dword [ebp - 0x2ec], 0x168
lea edx, [ebp - 0x2ec]
push edx
lea eax, [ebp - 0x2e4]
push eax
push str.open
push str.http
push 1
push 0
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jl 0x41e865
lea ecx, [ebp - 0x2e4]
push ecx
lea ecx, [ebp - 0x360]
call fcn.0041ed00
mov byte [ebp - 4], 1
push 0
push 0x46f464
lea ecx, [ebp - 0x360]
call fcn.0041edf0
mov dword [ebp - 0x364], eax
mov edx, dword [ebp - 0x364]
cmp edx, dword [0x46f5c8]
je 0x41e78c
lea ecx, [ebp - 0x2e8]
call fcn.0040c780
push eax
push 2
mov eax, dword [ebp - 0x364]
push eax
lea ecx, [ebp - 0x360]
call fcn.0041ed80
jmp 0x41e7b3
push 0x46f46c
lea ecx, [ebp - 0x360]
call fcn.0041ed60
lea ecx, [ebp - 0x2e8]
call fcn.0040c780
push eax
lea ecx, [ebp - 0x360]
call fcn.0041ed60
push 0x44
lea ecx, [ebp - 0x344]
push ecx
call fcn.0041eca0
add esp, 8
push 0x10
lea edx, [ebp - 0x2fc]
push edx
call fcn.0041eca0
add esp, 8
mov dword [ebp - 0x344], 0x44
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [ebp - 0x344]
push ecx
push 0
lea ecx, [ebp - 0x360]
call fcn.0041edd0
push eax
push 0
call fcn.0041e520
add esp, 0x14
test eax, eax
je 0x41e856
mov edx, dword [ebp - 0x2fc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x36c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x360]
call fcn.0041ed40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.0040cdd0
mov eax, dword [ebp - 0x36c]
jmp 0x41e8ad
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x360]
call fcn.0041ed40
push 0xa
push 0
push 0
lea ecx, [ebp - 0x2e8]
call fcn.0040c780
push eax
push 0x46f470
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x370], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.0040cdd0
mov eax, dword [ebp - 0x370]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bd7f
mov esp, ebp
pop ebp
ret

Function at 0x41ffc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x41fff4
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x420000
push 0
push 0
call fcn.0043e4dc
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x420080
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0xc], eax
je 0x4200e8
movzx edx, byte [ebp + 8]
test edx, edx
je 0x4200e8
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x4200e8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x4200e8
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret 8