joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bb3
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x52b8]
mov eax, 0x5338
call fcn.00448ed0
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x52b4], eax
mov eax, dword [ebp + 0x52c0]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x52c4]
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x52cc]
mov edi, 0x103
xor ebx, ebx
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x51b1]
push ebx
push eax
mov byte [ebp + 0x51b0], bl
call fcn.00446500
lea esi, [edi + 1]
add esp, 0xc
cmp dword [ebp + 0x52c8], esi
jle 0x407c33
xor eax, eax
mov ecx, dword [ebp + 0x52b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464e5
add ebp, 0x52b8
leave
ret
push dword [ebp - 0x78]
lea eax, [ebp + 0x51b0]
push esi
push eax
call fcn.0044a29d
add esp, 0xc
cmp byte [ebp + 0x51b0], bl
je 0x407c60
lea eax, [ebp + 0x51b0]
cmp byte [eax], 0x7c
jne 0x407c5b
mov byte [eax], bl
inc eax
cmp byte [eax], bl
jne 0x407c54
lea eax, [ebp + 0x51b0]
push eax
push dword [ebp - 0x80]
call fcn.0044a070
pop ecx
pop ecx
test eax, eax
je 0x407c19
push edi
lea eax, [ebp + 0x50ad]
push ebx
push eax
mov byte [ebp + 0x50ac], bl
call fcn.00446500
add esp, 0xc
push esi
lea eax, [ebp + 0x50ac]
push eax
push 0x3e9
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
test eax, eax
je 0x407c19
lea eax, [ebp + 0x50ac]
push 0x28
push eax
call fcn.00449fb0
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x407c19
cmp byte [edi + 2], 0x3a
jne 0x407ce3
cmp byte [edi + 3], 0x29
jne 0x407ce3
mov al, byte [edi + 1]
cmp al, 0x61
jl 0x407cdb
cmp al, 0x7a
jle 0x407cf4
cmp al, 0x41
jl 0x407ce3
cmp al, 0x5a
jle 0x407cf4
push 0x28
inc edi
push edi
call fcn.00449fb0
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0x407cc4
cmp edi, ebx
je 0x407c19
push 0x103
lea eax, [ebp + 0x4fa9]
push ebx
push eax
mov byte [ebp + 0x4fa8], bl
call fcn.00446500
movsx eax, byte [edi + 1]
push eax
push str._c:_autorun.inf
lea eax, [ebp + 0x4fa8]
push esi
push eax
call fcn.004464a6
push 0x4663d4
lea eax, [ebp + 0x4fa8]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], ebx
call fcn.00448e74
add esp, 0x28
test eax, eax
jne 0x407c19
cmp dword [ebp - 0x78], ebx
je 0x407c19
push 0x4fff
lea eax, [ebp - 0x57]
push ebx
push eax
mov byte [ebp - 0x58], bl
call fcn.00446500
push dword [ebp - 0x78]
lea eax, [ebp - 0x58]
push 0x5000
push 1
push eax
call fcn.00448d93
push dword [ebp - 0x78]
mov esi, eax
call fcn.00448a77
add esp, 0x20
cmp esi, ebx
jle 0x407c19
push esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407a1b
push ebx
push str.OEMINFOINTERPASS_ABC
lea ecx, [ebp - 0x74]
call fcn.00406d26
xor esi, esi
cmp eax, 0xffffffff
jne 0x407dc5
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004014e8
mov eax, esi
jmp 0x407c1b
inc esi
jmp 0x407db3
Function at 0x40afee
Capabilities:
Create thread

Disassembly:
push 0x8c
mov eax, 0x460e7a
call fcn.00446960
mov dword [ebp - 0x14], ecx
cmp byte [ebp + 8], 0
je 0x40b016
cmp byte [ebp + 8], 1
je 0x40b016
xor eax, eax
call fcn.00446a38
ret 0x14
call fcn.00435924
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [eax + 8]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x460]
mov dword [ebp - 0x24], ecx
mov cl, byte [ebp + 8]
mov byte [ebp - 0x1c], cl
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x20], esi
call fcn.0041dd87
lea eax, [ebp - 0x98]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
mov dword [0x47eca0], esi
call ebx
cmp byte [ebp + 8], 0
mov dword [0x47eca4], eax
mov eax, dword [ebp + 0xc]
jne 0x40b099
mov dword [0x47ec7c], eax
mov eax, dword [ebp + 0x10]
mov dword [0x47ec78], eax
mov eax, dword [ebp + 0x14]
mov dword [0x47ec80], eax
mov eax, dword [ebp + 0x18]
mov dword [0x47ec84], eax
jmp 0x40b0b6
mov dword [0x47f14c], eax
mov eax, dword [ebp + 0x10]
mov dword [0x47f148], eax
mov eax, dword [ebp + 0x14]
mov dword [0x47f150], eax
mov eax, dword [ebp + 0x18]
mov dword [0x47f154], eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push 0x40ab4c
push edi
push edi
mov dword [ebp - 0x10], edi
call fcn.0044aa8e
add esp, 0x18
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
jne 0x40b0f8
push 2
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00431396
mov eax, esi
jmp 0x40b00e
lea ecx, [ebp - 0x98]
call fcn.00431ad4
cmp byte [ebp + 8], 0
jne 0x40b111
mov esi, dword [0x47ec74]
jmp 0x40b0e2
mov esi, dword [0x47f144]
jmp 0x40b0e2
Function at 0x40cad3
Capabilities:
Create thread

Disassembly:
push 0x40
mov eax, 0x46104a
call fcn.004469c9
push dword [ebp + 8]
mov esi, ecx
lea edi, [esi + 0x6bc]
mov ecx, edi
call fcn.0041be5a
push 3
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
cmp byte [esi + 0x6b5], bl
jne 0x40cb15
cmp byte [esi + 0x6b4], bl
jne 0x40cb15
mov ecx, esi
call fcn.00407195
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00401484
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.004199c2
test eax, eax
lea eax, [ebp - 0x4c]
je 0x40cb52
push str.USBKey_is_inserted_
push 0x2710
push eax
call fcn.00425115
add esp, 0xc
mov byte [ebp - 4], 1
jmp 0x40cb69
push str.USBKey_not_recognized_is_inserted_
push 0x2721
push eax
call fcn.00425115
add esp, 0xc
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403a43
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.004014e8
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40cb8c
lea eax, [ebp - 0x28]
push 0xa
push dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.004065dc
lea eax, [ebp - 0x30]
push eax
push ebx
push esi
push 0x40c607
push ebx
push ebx
mov dword [ebp - 0x30], ebx
call fcn.0044aa8e
add esp, 0x18
cmp eax, ebx
je 0x40cbbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004014e8
call fcn.00446a4c
ret 4
Function at 0x410d3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x14
mov eax, 0x4613d8
call fcn.00446960
mov esi, ecx
xor ebx, ebx
push str.SOFTWAREEnterSafeInterPass_ABChina
lea ecx, [ebp]
mov dword [ebp - 0x10], ebx
call fcn.00403c42
push 0x100
lea eax, [ebp + 0x1d]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 4
mov byte [ebp + 0x1c], bl
call fcn.00446500
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 0x10
mov dword [ebp - 0x1c], 0x101
jae 0x410daf
lea eax, [ebp + 4]
lea ecx, [ebp - 0x10]
push ecx
push 1
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410e42
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push ebx
push str.Down_Address
push dword [ebp - 0x10]
call edi
lea eax, [ebp + 0x1c]
push eax
lea ecx, [esi + 0x80]
call fcn.004017f7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.web_option
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x14], ebx
mov ecx, 0x47eae0
setne al
mov dword [esi + 0x78], eax
call fcn.00404a0e
push ebx
mov ecx, esi
mov dword [esi + 0x88], eax
call fcn.0042c13b
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e8
xor eax, eax
inc eax
jmp 0x410e4f
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.004464e5
add ebp, 0x124
leave
ret
Function at 0x410e72
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 1
mov esi, ecx
call fcn.0042c13b
push dword [esi + 0x88]
mov ecx, 0x47eae0
call fcn.00404d5a
xor ebx, ebx
push str.SOFTWAREEnterSafeInterPass_ABChina
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
call fcn.00403c42
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x410ebb
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push ecx
push 2
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410f28
mov eax, dword [esi + 0x80]
push edi
push dword [eax - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 1
push ebx
push str.Down_Address
push dword [ebp - 0x24]
call edi
xor eax, eax
cmp dword [esi + 0x78], ebx
push 4
setne al
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push ebx
push str.web_option
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004014e8
xor eax, eax
inc eax
pop edi
jmp 0x410f35
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004014e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004464e5
leave
ret

Function at 0x4166ec
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x47f7c0], 0
je 0x4166f9
xor eax, eax
inc eax
ret
call fcn.00435924
mov eax, dword [eax + 4]
push 0
push dword [eax + 0x44]
push 0x4164e8
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x47f7c0], eax
mov eax, ecx
ret

Function at 0x4175cb
Capabilities:
Log keystrokes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp edi, esi
je 0x41762c
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 3
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebp
push ebx
call esi
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x41762f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x417842
cmp dword [ebp + 0xc], ebx
je 0x417842
push edi
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x48], ebx
lea edi, [ebp - 0x44]
push ebx
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x2c
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00446500
add esp, 0xc
push ebx
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x48], 0x28
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jle 0x417841
cmp dword [ebp - 0x34], ebx
ja 0x4176ba
movzx eax, word [ebp - 0x3a]
imul eax, dword [ebp - 0x44]
add eax, 0x1f
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
sar eax, 3
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0x3a]
dec eax
mov dword [ebp - 0x38], ebx
je 0x4176dd
sub eax, 3
je 0x4176d9
sub eax, 4
je 0x4176d2
xor edi, edi
jmp 0x4176e0
mov edi, 0x100
jmp 0x4176e0
push 0x10
jmp 0x4176df
push 2
pop edi
lea eax, [edi*4 + 0x2c]
push esi
push eax
call fcn.0044a145
mov esi, eax
lea eax, [edi*4 + 0x2c]
push eax
push ebx
push esi
call fcn.00446500
push 0x28
lea eax, [ebp - 0x48]
push eax
push 0x28
push esi
call fcn.0044604f
push dword [ebp - 0x34]
call fcn.0044a145
add esp, 0x24
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x417815
push ebx
push esi
push eax
push dword [esi + 8]
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x468458
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.00448e74
add esp, 0xc
test eax, eax
je 0x417766
push dword [ebp - 4]
call fcn.0044a20f
push esi
mov dword [ebp - 4], ebx
call fcn.0044a20f
pop ecx
pop ecx
jmp 0x417815
cmp dword [ebp - 8], ebx
je 0x41774e
xor eax, eax
mov word [ebp - 0x16], ax
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x34]
add eax, 0x36
cmp edi, ebx
mov dword [ebp - 0x1a], eax
jle 0x417788
lea eax, [eax + edi*4]
mov dword [ebp - 0x1a], eax
cmp edi, ebx
mov eax, 0x4d42
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x12], 0x36
jle 0x4177a6
lea eax, [edi*4 + 0x36]
mov dword [ebp - 0x12], eax
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
push 1
push 0xe
push eax
call fcn.0044905d
push dword [ebp - 8]
lea eax, [ebp - 0x48]
push 1
push 0x28
push eax
call fcn.0044905d
add esp, 0x20
cmp edi, ebx
jle 0x4177f1
shl edi, 2
push edi
lea eax, [esi + 0x2c]
push 0x80
push eax
call fcn.00446500
push dword [ebp - 8]
lea eax, [esi + 0x2c]
push 1
push edi
push eax
call fcn.0044905d
add esp, 0x1c
push dword [ebp - 8]
push 1
push dword [ebp - 0x34]
push dword [ebp - 4]
call fcn.0044905d
push dword [ebp - 4]
call fcn.0044a20f
push esi
mov dword [ebp - 4], ebx
call fcn.0044a20f
add esp, 0x18
pop esi
cmp dword [ebp - 0xc], ebx
je 0x417825
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 4], ebx
je 0x417833
push dword [ebp - 4]
call fcn.0044a20f
pop ecx
cmp dword [ebp - 8], ebx
je 0x417841
push dword [ebp - 8]
call fcn.00448a77
pop ecx
pop edi
pop ebx
leave
ret
Function at 0x41a24a
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x104
lea ebp, [esp - 4]
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x104], eax
push 0x34
mov eax, 0x461c6d
call fcn.00446960
xor ebx, ebx
push 0x103
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.00446500
add esp, 0xc
call fcn.0041934f
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call fcn.0042c7fd
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x41a3ef
mov edi, 0x104
call fcn.004310e5
push eax
lea ecx, [ebp - 0x10]
call fcn.004013d5
push edi
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00419934
mov esi, dword [ebp - 0x18]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.IEFrame
lea ecx, [ebp - 0x10]
call fcn.0040324d
test eax, eax
jne 0x41a3c0
mov esi, dword [esi + 0x20]
mov dword [ebp - 0x40], str.WorkerW
mov dword [ebp - 0x3c], str.ReBarWindow32
mov dword [ebp - 0x38], str.Address_Band_Root
mov dword [ebp - 0x34], str.ComboBoxEx32
mov dword [ebp - 0x30], str.ComboBox
mov dword [ebp - 0x2c], 0x4687a0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x41a3c0
movzx eax, word [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x40]
push ebx
push eax
push ebx
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
cmp esi, ebx
jne 0x41a356
push str.Address_Band_Root
push dword [ebp - 0x20]
call fcn.00454bb4
pop ecx
pop ecx
test eax, eax
jne 0x41a356
mov esi, dword [ebp - 0x24]
inc dword [ebp - 0x14]
movzx eax, word [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x41a31a
cmp esi, ebx
je 0x41a3c0
push edi
lea eax, [ebp]
push ebx
push eax
call fcn.00446500
add esp, 0xc
lea eax, [ebp]
push eax
push edi
push 0xd
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401a58
push ebx
push str.95599.cn
lea ecx, [ebp - 0x1c]
call fcn.004186af
cmp eax, 0xffffffff
jne 0x41a414
push ebx
push 0x468768
lea ecx, [ebp - 0x1c]
call fcn.004186af
cmp eax, 0xffffffff
jne 0x41a414
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004010f6
mov eax, dword [ebp - 0x18]
push 2
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call fcn.0042c7fd
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov dword [ebp - 0x18], eax
call fcn.004010f6
cmp dword [ebp - 0x18], ebx
jne 0x41a2aa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.004464e5
add ebp, 0x108
leave
ret
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004010f6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010f6
xor eax, eax
inc eax
jmp 0x41a3f1
Function at 0x41a42f
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f8]
sub esp, 0x278
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x1f4], eax
push dword [ebp + 0x200]
mov dword [ebp - 0x1c], ecx
call fcn.004199c2
test eax, eax
je 0x41a5ec
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00446500
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x80], esi
call fcn.00446500
mov esi, 0x103
push esi
lea eax, [ebp + 0xf1]
push ebx
push eax
mov byte [ebp + 0xf0], bl
call fcn.00446500
push esi
lea eax, [ebp - 0x13]
push ebx
push eax
mov byte [ebp - 0x14], bl
call fcn.00446500
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x30
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push str.SOFTWAREEnterSafeInterPass_ABChina
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 4
call esi
test eax, eax
jne 0x41a514
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push str.web_option
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a506
cmp dword [ebp - 0x20], ebx
jne 0x41a514
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41a5e9
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
call fcn.00419ac2
test eax, eax
jne 0x41a5e9
mov ecx, dword [ebp - 0x1c]
call fcn.0041a24a
test eax, eax
jne 0x41a5e9
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push edi
call esi
test eax, eax
jne 0x41a587
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a587
lea eax, [ebp - 0x14]
push eax
mov esi, 0x104
lea eax, [ebp + 0xf0]
push esi
push eax
call fcn.0044a29d
add esp, 0xc
jmp 0x41a58c
mov esi, 0x104
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xf0]
push eax
call fcn.00446130
pop ecx
test eax, eax
je 0x41a5e9
push str.Internet_ExplorerIEXPLORE.EXE
lea eax, [ebp + 0xf0]
push esi
push eax
call fcn.00448976
push str.http:__www.abchina.com
lea eax, [ebp + 0xf0]
push esi
push eax
call fcn.00448976
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0xf0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1f4]
xor ecx, ebp
call fcn.004464e5
add ebp, 0x1f8
leave
ret 4

Function at 0x41c061
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x47f7d0], 0
je 0x41c06e
xor eax, eax
inc eax
ret
call fcn.00435924
mov eax, dword [eax + 4]
push 0
push dword [eax + 0x44]
push 0x41bf18
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x47f7d0], eax
mov eax, ecx
ret
Function at 0x421c0a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], ecx
jb 0x421c20
mov eax, dword [eax + 4]
jmp 0x421c23
add eax, 4
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x421c99
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea edi, [esi + 2]
push edi
call fcn.00429370
push edi
mov ebx, eax
push 0
push ebx
call fcn.00446500
add esp, 0x10
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push esi
push ebx
call fcn.00421a5f
push ebx
mov byte [ebp + 0xb], al
call fcn.00429365
mov al, byte [ebp + 0xb]
pop ecx
pop edi
pop ebx
jmp 0x421c9b
xor al, al
pop esi
leave
ret 4

Function at 0x424f94
Capabilities:
Identify system language via api

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 8
mov eax, 0x462ab6
call fcn.00446960
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], 1
mov byte [esi + 0x29], 1
cmp dword [esi + 0x40], ebx
je 0x424fd5
cmp dword [esi + 0x5c], ebx
jne 0x4250b8
push 0x103
lea eax, [ebp + 0x1d]
push ebx
push eax
mov byte [ebp + 0x1c], bl
call fcn.00446500
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00403c42
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], 0x5c
call fcn.0041f6fc
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x425055
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.004464e5
add ebp, 0x124
leave
ret
cmp dword [esi + 0x40], ebx
jne 0x425068
push eax
push ebx
lea eax, [ebp]
push eax
lea ecx, [esi + 0x2c]
call fcn.00403a43
cmp dword [esi + 0x5c], ebx
jne 0x4250a9
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
sub ecx, eax
dec ecx
push ecx
inc eax
push eax
lea eax, [ebp]
lea edi, [esi + 0x48]
push eax
mov ecx, edi
call fcn.00403a43
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
mov byte [ebp - 0x10], 0x2e
call fcn.0041f6fc
cmp eax, 0xffffffff
je 0x4250a9
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.004034b9
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e8
cmp dword [esi + 0x40], ebx
je 0x425030
cmp dword [esi + 0x5c], ebx
je 0x425030
cmp dword [esi + 0x64], 0x1fffffff
jne 0x4250df
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [esi + 0x64], eax
push dword [esi + 0x64]
lea eax, [esi + 0x48]
push eax
mov ecx, esi
call fcn.00424df5
jmp 0x425032