joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2494
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x53e060
xor eax, eax
push ebp
push 0x4e2620
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4de684]
call fcn.004057f8
add esp, 4
mov eax, dword [ebx]
mov edx, 0x4e2638
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 4], 0x53e038
mov eax, dword [ebx]
add eax, 8
mov edx, 0x4e264c
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0xc], 0x53e03c
mov eax, dword [ebx]
add eax, 0x10
mov edx, 0x4e2660
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x53e040
mov eax, dword [ebx]
add eax, 0x18
mov edx, 0x4e2674
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x1c], 0x53e044
mov eax, dword [ebx]
add eax, 0x20
mov edx, 0x4e2688
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x24], 0x53e048
mov eax, dword [ebx]
add eax, 0x28
mov edx, 0x4e26a0
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x2c], 0x53e04c
mov eax, dword [ebx]
add eax, 0x30
mov edx, 0x4e26b8
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x34], 0x53e050
mov eax, dword [ebx]
add eax, 0x38
mov edx, 0x4e26d0
call fcn.00403c4c
mov eax, dword [ebx]
mov dword [eax + 0x3c], 0x53e054
lea ecx, [ebp - 0xc]
mov eax, dword [0x53e05c]
mov eax, dword [eax + 4]
mov edx, dword [ebx]
call fcn.004ded94
lea edx, [ebp - 0xc]
mov eax, 0x53e064
mov ecx, dword [0x4de664]
call fcn.0040486c
lea edx, [ebp - 0x10]
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.004522e4
mov eax, dword [ebp - 0x10]
call fcn.004c6b30
mov dword [0x53b2c4], eax
lea edx, [ebp - 0x14]
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.004522e4
mov eax, dword [ebp - 0x14]
call fcn.0040403c
push eax
call dword [0x53e038]
push 0x53e034
push 0x53b2c0
call dword [0x53e03c]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2627
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403c1c
lea eax, [ebp - 0xc]
mov edx, dword [0x4de664]
call fcn.00404654
ret
Function at 0x4e76f8
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebx
push esi
add esp, 0xfffffe70
mov dl, 2
mov al, 2
call fcn.004078b0
mov esi, eax
push esp
push esi
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4e7722
mov eax, 0x4e77b4
call fcn.004589d8
jmp 0x4e77a0
cmp byte [esp], 2
jne 0x4e7735
mov ax, word [esp]
call fcn.004078d4
cmp al, 2
je 0x4e7746
call sub.wsock32.dll_WSACleanup
mov eax, 0x4e77e0
call fcn.004589d8
jmp 0x4e77a0
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [0x53e174], eax
cmp dword [0x53e174], 0
jge 0x4e776b
mov eax, 0x4e77fc
call fcn.004589d8
jmp 0x4e77a0
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x53bc14]
sub eax, dword [edx]
cmp eax, 0x1f40
jbe 0x4e7797
push 0
push 0
push 0x10
mov eax, dword [0x53bd58]
mov eax, dword [eax]
call fcn.00439da0
push eax
call sub.user32.dll_PostMessageA
mov byte [0x53b348], 1
mov bl, 1
mov eax, ebx
add esp, 0x190
pop esi
pop ebx
ret
Function at 0x4fc62c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp byte [0x53b578], 0
jne 0x4fc7ac
cmp byte [0x53b5ec], 0
je 0x4fc7ac
cmp byte [0x53b54c], 0
jne 0x4fc6ac
mov byte [0x53b5ec], 0
test esi, esi
je 0x4fc7c4
push 5
mov eax, dword [0x53be94]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045189c
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045198c
push 0x43
push 0
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.00439da0
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4fc7c4
mov eax, dword [0x53b91c]
mov eax, dword [eax]
cmp byte [eax + 0x47], 0
jne 0x4fc7c4
push 5
mov eax, dword [0x53be94]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045189c
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045198c
mov eax, dword [0x53b91c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xd8]
dec eax
jne 0x4fc78c
mov eax, dword [0x53b820]
cmp byte [eax], 0
je 0x4fc78c
mov eax, dword [0x53bb88]
cmp dword [eax], 1
setge dl
mov eax, dword [ebx + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [0x53bb88]
cmp dword [eax], 1
setge dl
mov eax, dword [ebx + 0x434]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [0x53bb88]
cmp dword [eax], 1
setge dl
mov eax, dword [ebx + 0x454]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [0x53bb88]
cmp dword [eax], 1
setge dl
mov eax, dword [0x53b910]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e0]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [0x53bb88]
cmp dword [eax], 1
setge dl
mov eax, dword [0x53b910]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4fc655
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.004517fc
push 0
mov eax, dword [0x53be94]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4fc7c4
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045189c
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045198c
pop esi
pop ebx
ret

Function at 0x4fcb20
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov byte [0x53b5ec], 0xff
mov eax, dword [0x53be94]
mov eax, dword [eax]
call fcn.0045189c
push 0x87
push 0
push 0
push 0
push 0
push 1
mov eax, ebx
call fcn.00439da0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [0x53be94]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x501e08
Capabilities:
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x501f2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x103]
push eax
push 0x501f38
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 4]
lea edx, [ebp - 0x103]
mov ecx, 0xfb
call fcn.00403e28
lea eax, [ebp - 4]
call fcn.004bc7a4
lea eax, [ebp - 4]
mov edx, 0x501f48
call fcn.00403e80
lea edx, [ebp - 0x108]
mov eax, dword [0x53bc6c]
mov eax, dword [eax]
call fcn.004f39ac
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 8]
mov ecx, 0x501f5c
call fcn.00403ec4
lea eax, [ebp - 0x10c]
mov edx, dword [0x53b49c]
add edx, 0xe0c
mov ecx, pe_nt_image_headers32
call fcn.00403e28
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
mov al, 2
call fcn.004ead54
test al, al
je 0x501f02
mov eax, dword [ebp - 8]
call fcn.004092c8
test al, al
je 0x501ee1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00501cf8
test eax, eax
je 0x501f02
mov eax, dword [ebp - 8]
call fcn.00409460
push 3
mov eax, dword [ebp - 8]
call fcn.0040403c
push eax
mov eax, dword [ebp - 4]
call fcn.0040403c
push eax
call sub.kernel32.dll_MoveFileExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501f34
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00403c1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c1c
ret
Function at 0x1000e7ab
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x1000e100
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x1000e128
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 4]
push edx
push 0
push 0x100
push 0x8402
lea eax, [ebp - 0xc]
push eax
push 0x444
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000e847
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], 0x10009b30
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
mov dword [edx + 0x40], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x78], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], 0x10009c20
cmp dword [ebp - 0x30], 0
jge 0x1000e86f
cmp dword [ebp - 4], 0
je 0x1000e85d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
mov eax, dword [ebp - 0x30]
jmp 0x1000f7ed
push 0x2000
call dword [sym.imp.ntoskrnl.exe_MmAllocateNonCachedMemory]
mov dword [0x1000b730], eax
cmp dword [0x1000b730], 0
jne 0x1000e892
mov eax, 0xc000009a
jmp 0x1000f7ed
mov edx, dword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
movsx eax, byte [edx]
cmp eax, 2
jl 0x1000e8d2
push 0x20736649
mov ecx, dword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
movsx edx, byte [ecx]
shl edx, 5
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x1000b6f4], eax
cmp dword [0x1000b6f4], 0
jne 0x1000e8d2
mov eax, 0xc000009a
jmp 0x1000f7ed
jmp 0x1003299c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xf5833d
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xf3e877
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xf3e891
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xf3e880
pop esi
jmp 0xf3e89c
ret 4
jmp 0xf3e86a

Function at 0x1052761
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [eax + eax]
rdtsc
xchg word [esp + 1], si
lea esp, [esp + 3]
jmp 0x10527a3
mov ecx, 0xc1dbd802
rdtsc
add esp, 0
not edi
pushal
cmc
jmp 0x105278d

Function at 0x1052a91
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ebp
invalid
mov si, word [esp]
mov bh, 0x25
mov cl, 0x82
neg bl
mov ax, 0xa0b9
xchg di, bp
jmp 0x10529d6
inc dh
mov ax, 0xc3e2
pop di
mov esi, 0xf68bd581
neg ch
shr bx, cl
jmp 0x105297b
bswap edx
lea esp, [esp + 0x14]
call fcn.010529e8
pop ss
xchg edx, eax
add byte [edi - 0x6e], ah
jnp 0x105294b
or ah, byte [ebp + 0x748747d4]
and al, 0x10
xchg dword [esp + 0x10], esi
xchg edx, esi
xchg byte [esp + 0xa], al
mov dword [esp + 0x13], ebp
mov ah, byte [esp + 0x15]
cpuid
jmp 0x10529a6
sete ah
xchg bp, ax
mov dl, byte [esp]
btr dx, ax
xchg cx, ax
pushal
jmp 0x10529bc
pop word [esp]
add esp, 1
rdtsc
mov ecx, esi
dec dl
mov edi, eax
jmp 0x1052992
mov bx, 0x8a0c
lea ebx, [edx + esi]
pop ax
lea esp, [esp + 1]
bsr edx, eax
sete al
jmp 0x1052a06
rdtsc
lea esp, [esp + 0x19]
pop bx
cpuid
cld
jmp 0x1052a5d

Function at 0x1053039
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov dl, bh
neg ebp
std
adc ax, dx
mov dl, byte [esp]
jmp 0x1052ae8
mov bl, 0x9e
xchg al, cl
lea ebp, [edx*4]
btc ax, si
mov ebx, ebp
mov bh, 0xc4
jmp 0x1052a9e
mov cl, dh
mov esi, dword [esp]
sets ah
xchg ecx, edi
call fcn.01052afd
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
aad 0xaf
inc ebx
sal dword [esi + reloc.MSVFW32.dll_DrawDibDraw], cl
xor byte [ebx], dh
mov ebp, ecx
mov al, 0xa6
rdtsc
mov byte [esp], ch
lea esp, [esp]
lea ecx, [esi*4]
jmp 0x1052ac9
mov ebp, dword [esp]
mov dx, word [esp]
rdtsc
cpuid
mov ax, 0x366b
lea edx, [ecx*4]
jmp 0x1052ab4
add esp, 5
xchg ah, cl
cpuid
std
xchg ecx, edi
lea esp, [esp]
jmp 0x1052b16
pop cx
mov bp, ax
cpuid
mov di, bx
xchg word [esp + 2], bx
jmp 0x1052b47
Function at 0x1053136
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.01052231
mov word [esp + 1], ax
xchg ecx, eax
bsr si, bp
pop esi
cmc
inc bx
jmp 0x1053120
rdtsc
sub esp, 0xc
stc
cpuid
xchg dword [esp + 7], edi
bsr bp, sp
jmp 0x105317e
rdtsc
jmp 0x105310c
add esp, 5
call 0x105313a
lea ebx, [edx + edi]
not edi
mov ecx, 0x98ba3837
mov ebx, dword [esp]
pop dx
mov bp, word [esp]
jmp 0x1053195
mov edi, 0x3370dd06
inc bp
mov byte [esp + 9], ch
mov bx, 0xc9c6
lea edi, [ecx + edi]
lea ecx, [esp + ebx]
jmp 0x1053150
cmc
lea esp, [esp]
lea edi, [edx*4]
shr di, cl
mov bl, 4
sub esp, 5
jmp 0x10531ff
rdtsc
bt ax, bp
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
call fcn.010531e5
lea esp, [esp + 2]
push eax
push ecx
push edx
push cx
mov byte [esp + 4], cl
jmp 0x10532c3
mov byte [esp + 2], dl
mov word [esp + 1], si
pop word [esp]
pushal
lea esp, [esp + 2]
mov dword [esp + 0x38], esp
call fcn.01053246
lea esp, [esp + 0x2c]
jmp 0x10532a6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x1053367
mov dword [esp], edx
pushal
lea esp, [esp + 2]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
pushfd
jmp 0x105325c
push eax
jmp 0x105222c
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x1053331

Function at 0x10531e5
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
clc
cld
std
lea esp, [esp + 4]
popfd
jmp 0x1053238
mov byte [esp], ch
jmp 0x10531cf
lea esp, [esp + 4]
push si
mov byte [esp], bl
mov byte [esp], bl
jmp 0x1053213

Function at 0x1053246
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
jmp 0x105328d
mov dword [esp], esi
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
jmp 0x1053277
Function at 0x1002fc1
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x200]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
call esi
push 0x1001df8
lea eax, [ebp - 0x400]
push eax
call esi
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x400]
push eax
mov edi, 0x80000002
push edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x100305e
cmp dword [ebp + 0xc], 0
mov eax, 0x1001db8
jne 0x100304f
mov eax, 0x1001e58
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 8]
push eax
push 0x1001e28
push edi
call esi
test eax, eax
jne 0x1003083
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x10032ee
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
push 0x3ff
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x800]
push eax
mov eax, dword [0x100507c]
push 1
neg eax
sbb eax, eax
add eax, 3
push eax
push 0x10
push 0xf01ff
push dword [0x1005078]
push dword [0x1005074]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
pop edi
pop esi
jne 0x1003362
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret

Function at 0x408110
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x4012a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
call fcn.00406990
mov esi, dword [fcn.00401180]
mov edx, eax
lea ecx, [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x1c]
call dword [fcn.004011a4]
call fcn.00406990
mov edx, eax
lea ecx, [ebp - 0x24]
call esi
mov edi, dword [fcn.00401144]
mov edx, 0x404a00
lea ecx, [ebp - 0x20]
call edi
mov edx, 0x4049a0
lea ecx, [ebp - 0x1c]
call edi
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x28]
push edx
push eax
mov dword [ebp - 0x28], 0x80000001
call fcn.00408210
mov edx, eax
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c]
push edx
push eax
push 3
call dword [fcn.00401148]
add esp, 0x10
push 0x4081f4
jmp 0x4081f3
ret
Function at 0x401bd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x7ab368
push 0x104
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push 0x422700
push str.TName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x20c], si
jne 0x401c26
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
push eax
push 0x41d2a0
push 1
push 0
push 0x41d2c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401c76
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov ecx, 1
cmovns esi, ecx
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00409948
mov esp, ebp
pop ebp
ret

Function at 0x401c90
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040be50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x1a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4226fc
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 0x210]
push str.7k7kLegend_
push 0x104
push eax
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 0x210]
push str.WeiDuanN_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x7ab570
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x401d50
push 0x7ab368
push 0x104
push 0x7ab570
push 0x422700
push str.StartMenuPath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x7ab570
call fcn.004019a0
call fcn.00401bd0
lea ecx, [ebp - 0x210]
call fcn.004019a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret
Function at 0x406c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x340
call fcn.0040a24e
mov edi, eax
add esp, 4
test edi, edi
je 0x406c42
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov dword [edi + 0x134], 0xffffffff
jmp 0x406c44
xor edi, edi
cmp dword [edi], 0
jne 0x406c9a
cmp dword [edi + 4], 0xffffffff
jne 0x406c9a
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4226fc
push 0x104
push esi
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
call fcn.004053c0
add esp, 8
test eax, eax
jne 0x406c8a
mov eax, dword [ebp - 4]
jmp 0x406c9f
mov ecx, eax
call fcn.00405780
mov dword [edi], eax
mov eax, dword [0x7ab780]
jmp 0x406c9f
mov eax, 0x1000000
mov dword [0x7ab77c], eax
test eax, eax
je 0x406cb9
push edi
call fcn.00409943
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
call fcn.0040a24e
add esp, 4
mov dword [eax + 4], edi
pop edi
mov dword [eax], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406e00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x406f4f
push ebx
mov bl, byte [ebp + 0xa]
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x406e20
mov dl, byte [esi + str.aWtsaXQ]
cmp dl, 0x2b
jne 0x406e2f
mov dl, 0x3e
jmp 0x406e5d
cmp dl, 0x2f
jne 0x406e38
mov dl, 0x3f
jmp 0x406e5d
cmp dl, 0x39
jg 0x406e42
add dl, 4
jmp 0x406e5d
cmp dl, 0x3d
je 0x406e5b
cmp dl, 0x5a
jg 0x406e51
sub dl, 0x41
jmp 0x406e5d
cmp dl, 0x7a
jg 0x406e5b
sub dl, 0x47
jmp 0x406e5d
mov dl, 0x40
mov cl, byte [esi + 0x4228b1]
cmp cl, 0x2b
jne 0x406e6c
mov cl, 0x3e
jmp 0x406e9a
cmp cl, 0x2f
jne 0x406e75
mov cl, 0x3f
jmp 0x406e9a
cmp cl, 0x39
jg 0x406e7f
add cl, 4
jmp 0x406e9a
cmp cl, 0x3d
je 0x406e98
cmp cl, 0x5a
jg 0x406e8e
sub cl, 0x41
jmp 0x406e9a
cmp cl, 0x7a
jg 0x406e98
sub cl, 0x47
jmp 0x406e9a
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [edi + edx], al
inc edi
mov al, byte [esi + 0x4228b2]
cmp al, 0x3d
je 0x406ef7
mov bl, al
cmp bl, 0x2b
jne 0x406ec0
mov bl, 0x3e
jmp 0x406ee9
cmp bl, 0x2f
jne 0x406ec9
mov bl, 0x3f
jmp 0x406ee9
cmp bl, 0x39
jg 0x406ed3
add bl, 4
jmp 0x406ee9
cmp bl, 0x5a
jg 0x406edd
sub bl, 0x41
jmp 0x406ee9
cmp bl, 0x7a
jg 0x406ee7
sub bl, 0x47
jmp 0x406ee9
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [edi + edx], al
inc edi
mov al, byte [esi + 0x4228b3]
cmp al, 0x3d
je 0x406f36
cmp al, 0x2b
jne 0x406f09
mov al, 0x3e
jmp 0x406f2b
cmp al, 0x2f
jne 0x406f11
mov al, 0x3f
jmp 0x406f2b
cmp al, 0x39
jg 0x406f19
add al, 4
jmp 0x406f2b
cmp al, 0x5a
jg 0x406f21
sub al, 0x41
jmp 0x406f2b
cmp al, 0x7a
jg 0x406f29
sub al, 0x47
jmp 0x406f2b
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [edi + edx], cl
inc edi
add esi, 4
cmp esi, 8
jb 0x406e20
mov byte [edi + edx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x4078a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x10b8
call fcn.0040a24e
mov edi, eax
add esp, 4
test edi, edi
je 0x4079bd
push str.http:__tj.wudiyou.com:8800_
push 0x824
push edi
call fcn.00409a8d
add esp, 0xc
lea eax, [edi + 0x104c]
push str.7k7k_REPORT
push 0x32
push eax
call fcn.00409a8d
add esp, 0xc
mov dword [edi + 0x10b0], 0x1b
call fcn.004079d0
push 1
mov dword [edi + 0x10b4], eax
call fcn.0040a24e
add esp, 4
mov dword [0x7ab784], eax
mov ecx, edi
call fcn.00407e50
push 0x7ab368
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4079bd
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040be50
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [edi + 0x1048]
push 0x424784
push eax
call fcn.004086e0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x7ab368
push eax
push str.Service_Value
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push dword [edi + 0x10b4]
lea eax, [ebp - 0x210]
push 0x424784
push eax
call fcn.004086e0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x7ab368
push eax
push str.InstallID
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00409948
mov esp, ebp
pop ebp
ret

Function at 0x407bc0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2888
call fcn.00415880
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x407c9d
lea eax, [ebp - 0x2888]
mov dword [ebp - 0x2888], 0x2880
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x407c9d
lea eax, [ebp - 0x2884]
nop
cmp byte [eax + 0x194], 0
jne 0x407c5d
cmp byte [eax + 0x195], 0
jne 0x407c5d
cmp byte [eax + 0x196], 0
jne 0x407c5d
cmp byte [eax + 0x197], 0
jne 0x407c5d
cmp byte [eax + 0x198], 0
jne 0x407c5d
cmp byte [eax + 0x199], 0
jne 0x407c5d
mov eax, dword [eax]
test eax, eax
jne 0x407c10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret 4
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x32
push esi
call fcn.0040b1c1
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409948
mov esp, ebp
pop ebp
ret 4