joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c2b80
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00597f5f
mov eax, dword [0x714010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x717880]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x6c2d6b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x6c2cb6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x6c2cb6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x6c2c92
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x6c2c09
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6c2d24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x6c2d8b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x6c2d66
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x6c2d8b
jmp 0x6c2be2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059945e
mov esp, ebp
pop ebp
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040826a
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040826a
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40826a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x408279
pop dword [ebp - 0xc]
mov eax, 0x1959774e
add eax, 0xe6e70b2b
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4096d
push 0
mov eax, 0xd3e2e7fb
add eax, 0x2c609835
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x5fae
mov edx, eax
mov esi, 0x44c600
add esi, dword [ebp - 0xc]
mov ebx, 0x3b29fd6a
add ebx, 0x33809698
xor dword [ebp - 4], edx
mov edi, dword [esi]
xor dword [ebp - 4], ebx
add edi, ebx
mov dword [ebp - 8], 0x6b5ec31c
mov dword [edx], edi
sub dword [ebp - 4], 0x70c82322
add edx, 0x76e684e4
add edx, 0x89197b20
add esi, 0xb04aff1c
sub esi, 0xb04aff18
loop 0x4082cc
add eax, 0x1718b
mov ebx, eax
add eax, 5
mov ecx, 0xf39a9e89
add ecx, 0xca56177
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401806
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40186f
cmp dword [ebp + 0x10], 1
je 0x401847
cmp dword [ebp + 0x10], 2
je 0x401847
push 0xd
pop eax
jmp 0x40186f
mov eax, dword [ebp - 4]
test edi, edi
je 0x401869
test eax, eax
je 0x401864
test al, 1
jne 0x401842
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x401869
jmp 0x401842
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4021fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x402267
cmp word [ebp - 0x20c], si
je 0x402267
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00401530
xor eax, eax
inc eax
jmp 0x402269
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00421350
leave
ret
Function at 0x40255c
Capabilities:
Get disk information

Disassembly:
push 0x248
mov eax, 0x421fbb
call fcn.0042147b
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x240], eax
xor eax, eax
push 6
mov dword [ebp - 0x24c], ebx
pop ecx
lea edi, [ebp - 0x2a]
mov word [ebp - 0x2c], ax
rep stosd dword es:[edi], eax
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x244], ebx
cmp esi, ebx
jne 0x4025b1
push 0x10
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x244], edi
cmp esi, ebx
je 0x402613
push esi
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, ebx
je 0x4025c3
cmp eax, 0x720
jne 0x402604
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
cmp eax, ebx
jne 0x402604
cmp dword [ebp - 0x23c], ebx
je 0x402604
push dword [ebp - 0x23c]
lea eax, [ebp - 0x2c]
push 0xc
push eax
call fcn.00402434
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x244], ebx
je 0x402613
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
push ebx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x248]
push eax
push 0x104
lea eax, [ebp - 0x238]
push eax
push 0x425800
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x240]
push 0x436718
call fcn.004040ca
push dword [ebp - 0x248]
lea eax, [ebp - 0x2c]
push eax
push str._s__lX
push dword [ebp - 0x240]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24c], edi
call fcn.00401557
mov eax, dword [ebp - 0x240]
add esp, 0x10
call fcn.004214fe
ret
Function at 0x40269b
Capabilities:
Get file version info
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x158], esi
cmp eax, edi
je 0x4028cd
cmp word [eax], di
je 0x4028cd
cmp esi, edi
je 0x4028cd
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
xor ecx, ecx
push eax
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14c], eax
cmp eax, 0xffffffff
je 0x4028cd
push edi
push dword [ebp - 0x144]
mov dword [ebp - 0x154], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x148], eax
cmp eax, edi
je 0x4027ba
push eax
call fcn.0042129f
pop ecx
push eax
push dword [ebp - 0x148]
mov dword [ebp - 0x140], eax
push edi
push dword [ebp - 0x144]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4027ae
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x42579c
push dword [ebp - 0x140]
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x148], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4027ae
mov eax, dword [ebp - 0x144]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push ebx
push esi
call dword [sym.imp.MSVCR100.dll__snwprintf]
add esp, 0x1c
mov dword [ebp - 0x154], 1
push dword [ebp - 0x140]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
xor eax, eax
push esi
mov word [esi + ebx*2 - 2], ax
call dword [sym.imp.MSVCR100.dll_wcslen]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
pop ecx
push edi
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x150]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x14c]
call esi
test eax, eax
je 0x4028b9
cmp dword [ebp - 0x150], 0x40
jne 0x4028b9
push edi
push edi
push dword [ebp - 8]
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x150]
push eax
mov edi, 0xf8
push edi
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x14c]
call esi
test eax, eax
je 0x4028b9
cmp dword [ebp - 0x150], edi
jne 0x4028b9
cmp ebx, dword [ebp - 0x140]
jbe 0x4028b9
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.MSVCR100.dll__gmtime32]
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x17c]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
push dword [ebp - 0x178]
mov ecx, dword [ebp - 0x158]
push dword [ebp - 0x174]
inc eax
push dword [ebp - 0x170]
push eax
mov eax, dword [ebp - 0x168]
add eax, 0x76c
push eax
mov eax, dword [ebp - 0x140]
sub ebx, eax
push 0x4258c0
lea eax, [ecx + eax*2]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll__snwprintf]
add esp, 0x28
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x154]
jmp 0x4028cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret
Function at 0x403dcb
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
xor esi, esi
push 0x20
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403e4e
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp + 8]
neg eax
push esi
sbb eax, eax
push esi
and eax, 2
push 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00421350
leave
ret

Function at 0x404869
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1078
call fcn.00421610
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x1078], 0
push ebx
mov dword [ebp - 0x1074], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1070]
push eax
call fcn.00415fc0
mov dword [esp], 0x427288
push esi
call dword [sym.imp.MSVCR100.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x404914
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push ebx
mov edi, 0x1000
push edi
lea eax, [ebp - 0x1014]
push 1
push eax
call esi
add esp, 0x10
jmp 0x404908
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1070]
push eax
call fcn.00416670
push ebx
push edi
lea eax, [ebp - 0x1014]
push 1
push eax
call esi
add esp, 0x1c
test eax, eax
jne 0x4048e4
push ebx
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00416983
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1074]
call fcn.004047d5
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1074]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret
Function at 0x40562f
Capabilities:
Check os version

Disassembly:
push 0x1f4
mov eax, 0x422293
call fcn.0042147b
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x1f4], esi
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f8], esi
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x200]
mov dword [ebp - 4], esi
call fcn.004017b7
test eax, eax
jne 0x4056e7
push 0xc8
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xda]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0xdc]
push eax
push 0x427ab8
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x1f4], 0x64
call fcn.00401806
lea ecx, [ebp - 0x200]
call fcn.0040179c
cmp word [ebp - 0xdc], si
je 0x4056e7
lea eax, [ebp - 0xdc]
push eax
mov ecx, edi
call fcn.00401652
jmp 0x405883
push 0x436718
lea ecx, [ebp - 0x1f4]
call fcn.004040ca
push 0x110
lea eax, [ebp - 0x1ec]
push esi
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1f0], 0x114
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x1e0]
sub eax, esi
je 0x405857
dec eax
je 0x4057cf
dec eax
jne 0x405867
cmp dword [ebp - 0x1ec], 4
ja 0x405756
push str.Microsoft_Windows_NT
jmp 0x40585c
cmp dword [ebp - 0x1ec], 5
jne 0x405797
cmp dword [ebp - 0x1e8], esi
jne 0x405771
push str.Microsoft_Windows_2000
jmp 0x40585c
cmp dword [ebp - 0x1e8], 1
jne 0x405784
push str.Microsoft_Windows_XP
jmp 0x40585c
cmp dword [ebp - 0x1e8], 2
jne 0x4057c5
push str.Microsoft_Windows_Server_2003
jmp 0x40585c
cmp dword [ebp - 0x1ec], 6
jne 0x4057c5
cmp dword [ebp - 0x1e8], esi
jne 0x4057b2
push str.Microsoft_Windows_Vista
jmp 0x40585c
cmp dword [ebp - 0x1e8], 1
jne 0x4057c5
push str.Microsoft_Windows_Longhorn_Server
jmp 0x40585c
push str.Microsoft_Windows_Vista_Later
jmp 0x40585c
cmp dword [ebp - 0x1ec], 4
jne 0x405850
cmp dword [ebp - 0x1e8], esi
jne 0x40580b
push str.Microsoft_Windows_95
lea ecx, [ebp - 0x1f4]
call fcn.00401530
cmp word [ebp - 0x1da], 0x43
je 0x405804
cmp word [ebp - 0x1da], 0x42
jne 0x405867
push str._OSR2
jmp 0x405833
cmp dword [ebp - 0x1e8], 0xa
jne 0x405840
push str.Microsoft_Windows_98
lea ecx, [ebp - 0x1f4]
call fcn.00401530
cmp word [ebp - 0x1da], 0x41
jne 0x405867
push 0x4278d4
lea ecx, [ebp - 0x1f4]
call fcn.004020a5
jmp 0x405867
cmp dword [ebp - 0x1e8], 0x5a
jne 0x405850
push str.Microsoft_Windows_Me
jmp 0x40585c
push str.Microsoft_Windows_Me_later
jmp 0x40585c
push str.Microsoft_Win32s
lea ecx, [ebp - 0x1f4]
call fcn.00401530
mov esi, dword [ebp - 0x1f4]
add esi, 0xfffffff0
push esi
call fcn.00401382
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00401171
lea ecx, [ebp - 0x200]
call fcn.0040179c
mov eax, edi
call fcn.004214fe
ret
Function at 0x405a2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x624
mov eax, 0x42233b
call fcn.0042147b
mov ebx, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x62c], esi
push 0x400
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x624], esi
call sub.MSVCR100.dll_memset
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
mov dword [ebp - 0x628], 0x200
call sub.MSVCR100.dll_memset
add esp, 0x18
push 0x4257c8
mov ecx, ebx
call fcn.00401652
mov dword [ebp - 4], esi
mov dword [ebp - 0x62c], 1
call fcn.00407943
neg eax
sbb eax, eax
and eax, 0x200
lea ecx, [ebp - 0x624]
push ecx
inc eax
push eax
push esi
push str.S_1_5_21_602162358_1965331169_725345543_1003SoftwareTencentQQPhonemanager
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x405b36
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x620]
push eax
push esi
push esi
push str.InstallPath
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405b2a
push 0x104
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.00401530
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.004214fe
ret
Function at 0x405e39
Capabilities:
Get file version info

Disassembly:
push 0x4c
mov eax, 0x4223dd
call fcn.004214b1
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x436718
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x40], eax
call fcn.004040ca
mov eax, dword [esi]
lea ecx, [ebp - 0x54]
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x405e91
mov dword [ebp - 0x4c], 1
push 0x430b64
lea eax, [ebp - 0x4c]
push eax
call sub.MSVCR100.dll__CxxThrowException
push edi
call fcn.0042129f
pop ecx
mov dword [ebp - 0x38], eax
cmp eax, ebx
jne 0x405eb0
mov dword [ebp - 0x44], 1
push 0x430b64
lea eax, [ebp - 0x44]
jmp 0x405e8b
mov esi, dword [esi]
push eax
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x405ed0
mov dword [ebp - 0x50], 1
push 0x430b64
lea eax, [ebp - 0x50]
jmp 0x405e8b
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x42579c
push dword [ebp - 0x38]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x405efa
mov dword [ebp - 0x48], 1
push 0x430b64
lea eax, [ebp - 0x48]
jmp 0x405e8b
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, edx
mov eax, esi
shr eax, 0x10
shr ecx, 0x10
movzx edi, dx
movzx edx, si
cmp eax, ebx
jne 0x405f38
cmp edx, ebx
jne 0x405f38
cmp ecx, ebx
jne 0x405f23
cmp edi, ebx
je 0x405f4d
push edi
push ecx
lea eax, [ebp - 0x34]
push 0x4257e4
push eax
call fcn.00401557
add esp, 0x10
jmp 0x405f4d
push edx
push eax
push edi
push ecx
lea eax, [ebp - 0x34]
push str._d._d._d._d
push eax
call fcn.00401557
add esp, 0x18
push dword [ebp - 0x38]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov dword [esp], 0x104
call fcn.004013e0
push 0x105
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00404fb7
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.0040506d
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040439d
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call fcn.00402904
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00401171
mov al, 1
jmp 0x405ff2
call fcn.0042150d
ret

Function at 0x40714f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0xc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
mov dword [esi + 1], eax
mov eax, dword [ebp + 8]
sub eax, esi
sub eax, 0xa
mov dword [esi + 6], eax
mov byte [esi], 0xb9
mov byte [esi + 5], 0xe9
mov eax, esi
pop esi
leave
ret
Function at 0x40729f
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4072e0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4072e0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4072c8
xor eax, eax
inc eax
jmp 0x4072e2
test al, 1
je 0x4072d7
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4072e2
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4073eb
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor ecx, ecx
push 2
mov eax, 0x104
pop edx
mov dword [ebp - 4], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042129f
mov esi, eax
pop ecx
test esi, esi
je 0x407470
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 4]
push eax
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x407456
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042129f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40746e
lea eax, [ebp - 4]
push eax
push esi
call edi
mov ebx, eax
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 0x10
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret