joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404810
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov al, byte [0x4128cc]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00402e40
test eax, eax
pop edi
je 0x4048ab
lea ecx, [esp + 4]
lea edx, [esp + 0x10c]
push ecx
lea eax, [esp + 4]
push edx
push eax
push str.DataBasePath
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40488f
lea ecx, [esp + 0x10c]
push str.Hosts
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
jmp 0x4048cb
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 8]
push str.DriversetcHosts
push ecx
jmp 0x4048c5
lea edx, [esp + 8]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push str.Hosts
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, dword [esp + 0x218]
push esi
cmp ecx, 0x7fffffff
ja 0x404905
mov eax, dword [esp + 0x218]
mov esi, ecx
test ecx, ecx
je 0x404905
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x4048fd
mov byte [eax], cl
inc eax
dec esi
jne 0x4048ee
jmp 0x404901
test esi, esi
jne 0x404902
dec eax
mov byte [eax], 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
pop esi
je 0x404930
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x404930
mov eax, 1
add esp, 0x210
ret
xor eax, eax
add esp, 0x210
ret

Function at 0x404940
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
mov esi, dword [esp + 0x10c]
push esi
push str.CLSID_s
push 0x104
push eax
call fcn.00403280
add esp, 0x10
lea ecx, [esp + 4]
push ecx
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
pop esi
add esp, 0x104
ret
Function at 0x404a70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
push esi
push edi
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x404a8e
pop edi
pop esi
add esp, 0x5c
ret
mov eax, dword [esp + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404ac3
push esi
call fcn.0040a920
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x5c
ret
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.0040a120
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push edx
push 0x1000
push esi
push edi
call ebx
test eax, eax
je 0x404b26
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404b26
push eax
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00409810
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push ecx
push 0x1000
push esi
push edi
call ebx
test eax, eax
jne 0x404af3
push esi
call fcn.0040a920
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0040990f
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x5c
ret

Function at 0x404d10
Capabilities:
Delete registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40c028
push eax
mov dword fs:[0], esp
sub esp, 8
push str.SYSTEMCurrentControlSetServicescnsminkp
push 0x80000002
call fcn.00402e50
add esp, 8
test eax, eax
jne 0x404d54
push str.SYSTEMCurrentControlSetServicesyaskp
push 0x80000002
call fcn.00402e50
add esp, 8
test eax, eax
je 0x404d9f
push esi
lea ecx, [esp + 4]
call fcn.0040a150
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call fcn.0040a1f0
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SYSTEMCurrentControlSetServicescnsminkp
push 0x80000002
call esi
push str.SYSTEMCurrentControlSetServicesyaskp
push 0x80000002
call esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040a180
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x405070
Capabilities:
Check if file exists
Delete registry key
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x210
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x218]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.ImagePath
push edi
push 0x80000002
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x405178
push esi
push 0xc
lea eax, [esp + 0x14]
push str.rundll32.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x405154
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [esp + 0x10]
push str..log_start
push ecx
call esi
test eax, eax
je 0x405154
lea edx, [esp + 0x1d]
push str._start
push edx
call esi
test eax, eax
je 0x405154
mov byte [eax], 0
lea eax, [esp + 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x1d]
lea edx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405154
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x405154
lea edx, [esp + 0x114]
push edx
call fcn.00402f90
add esp, 4
push edi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop esi
mov dword [0x4127b8], 1
mov eax, 1
pop edi
add esp, 0x210
ret
mov eax, 1
pop edi
add esp, 0x210
ret

Function at 0x405190
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40523a
mov ax, word [0x4107a4]
mov cl, byte [0x4107a6]
mov ebx, dword [sym.imp.MSVCRT.dll__mbstok]
mov word [esp + 0x10], ax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x1a], cl
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x40523a
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 2
push 0x4107a0
push esi
call edi
test eax, eax
jne 0x405228
push str..LOG
push esi
call ebp
test eax, eax
jne 0x405247
lea ecx, [esp + 0x10]
push ecx
push 0
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x40520e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40c
ret
Function at 0x4054a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov dl, byte [0x4128cc]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x108]
lea edx, [esp + 4]
push ecx
push str._s_realplayer.exe
push 0x104
push edx
call fcn.00403280
lea eax, [esp + 0x14]
push eax
call fcn.00402f50
add esp, 0x14
test eax, eax
pop edi
je 0x405528
mov eax, 1
add esp, 0x208
ret
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push str._s_nbbho.dll
push 0x104
push edx
call fcn.00403280
lea eax, [esp + 0x10]
push eax
call fcn.00402f50
add esp, 0x14
test eax, eax
je 0x405561
mov eax, 1
add esp, 0x208
ret
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push str._s_brlmon.dll
push 0x104
push edx
call fcn.00403280
lea eax, [esp + 0x10]
push eax
call fcn.00402f50
add esp, 0x14
test eax, eax
je 0x40559a
mov eax, 1
add esp, 0x208
ret
push str.CLSID295CD217_AD34_4B66_91BA_48D5EFD9CA20
push 0x80000000
call fcn.00402e50
add esp, 8
test eax, eax
je 0x4055bc
mov eax, 1
add esp, 0x208
ret
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push str._sIeFilter.dll
push 0x104
push edx
call fcn.00403280
lea eax, [esp + 0x10]
push eax
call fcn.00402f50
add esp, 0x14
test eax, eax
je 0x4055f5
mov eax, 1
add esp, 0x208
ret
lea ecx, [esp + 0x104]
push 0x104
push ecx
call fcn.00402e90
add esp, 8
lea edx, [esp + 0x104]
lea eax, [esp]
push edx
push str._sTencentQQMessenger.exe
push 0x104
push eax
call fcn.00403280
lea ecx, [esp + 0x10]
push ecx
call fcn.00402f50
add esp, 0x14
neg eax
sbb eax, eax
neg eax
add esp, 0x208
ret
Function at 0x405640
Capabilities:
Delete registry key
Delete registry value
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
call fcn.004054a0
test eax, eax
je 0x405875
mov dl, byte [0x4128cc]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x230]
mov dword [ebp - 0x28], str.realplayer.exe
push eax
mov dword [ebp - 0x24], str.RavMon.dll
mov dword [ebp - 0x20], str.nbbho.dll
mov dword [ebp - 0x1c], str.brlmon.dll
mov dword [ebp - 0x18], str.gnimatmd.bat
mov dword [ebp - 0x14], str.IeFilter.dll
mov dword [ebp - 0x10], str.Maxthonz.dll
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x12c]
push ecx
push str._s_realplayer.exe
push 0x103
push edx
call fcn.00403280
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0x10
push 0
call esi
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00403a70
add esp, 0xc
push 0
call esi
push eax
push str.TencentQQMessenger.exe
call fcn.00403a70
add esp, 0xc
lea esi, [ebp - 0x28]
mov edi, 7
mov ecx, dword [esi]
lea edx, [ebp - 0x230]
push ecx
push edx
push str._s_s
lea eax, [ebp - 0x12c]
push 0x103
push eax
call fcn.00403280
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00402f90
add esp, 0x18
add esi, 4
dec edi
jne 0x405725
push str.realplayer.exe
call fcn.00403fd0
push str.Messenger.exe
call fcn.00403fd0
lea edx, [ebp - 0x230]
push 0x104
push edx
mov dword [ebp - 0xc], str.Messenger.exe
mov dword [ebp - 8], str.Messenger.dll
mov dword [ebp - 4], str.RTraveler.dll
call fcn.00402e90
add esp, 0x10
lea esi, [ebp - 0xc]
mov edi, 3
mov eax, dword [esi]
lea ecx, [ebp - 0x230]
push eax
push ecx
push str._sTencentQQ_s
lea edx, [ebp - 0x12c]
push 0x103
push edx
call fcn.00403280
lea eax, [ebp - 0x12c]
push eax
call fcn.00402f90
add esp, 0x18
add esi, 4
dec edi
jne 0x40579f
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SoftwareMicrosoft_NT
push 0x80000002
call esi
push str.Clsid295CD217_AD34_4B66_91BA_48D5EFD9CA20
push 0x80000000
call esi
mov ecx, dword [str.about:blank]
mov eax, dword [0x4108cc]
mov edx, dword [0x4108c8]
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x32c], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x328]
push str.Start_Page
mov dword [ebp - 0x330], edx
push str.softwaremicrosoftinternet_explorermain
push 0x80000001
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
nop
lea edi, [ebp - 0x334]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [ebp - 0x334]
push ecx
push 1
push str.Start_Page
push str.softwaremicrosoftinternet_explorermain
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
mov dword [0x4127bc], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405b00
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40c04b
push eax
mov dword fs:[0], esp
sub esp, 0x108
push esi
mov esi, dword [esp + 0x11c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405bad
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x405bad
lea eax, [esp + 8]
push eax
push 0
push 0x410bc8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405ba2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405ba2
lea ecx, [esp + 4]
call fcn.0040a450
push 0x1f01ff
push 0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0
call fcn.0040a650
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 4]
mov dword [esp + 0x114], 0xffffffff
call fcn.0040a480
jmp 0x405bad
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x10c]
pop esi
mov dword fs:[0], ecx
add esp, 0x114
ret

Function at 0x405bd0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push str._c_rd___s___s__q
push 0x104
push ecx
call fcn.00403280
add esp, 0x10
lea edx, [esp]
push 0
push 0
push edx
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x104
ret

Function at 0x405c20
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
mov edi, dword [esp + 0x118]
mov esi, 0x410b2c
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push eax
push edi
push ecx
call ebx
test eax, eax
je 0x405c91
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
je 0x405c91
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x405c84
lea ecx, [esp + 0x10]
push ecx
call fcn.00405b00
lea edx, [esp + 0x14]
push edx
call fcn.00405bd0
add esp, 8
jmp 0x405c91
lea eax, [esp + 0x10]
push eax
call fcn.004032f0
add esp, 4
add esi, 4
cmp esi, 0x410b3c
jb 0x405c42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x405cb0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov al, byte [0x4128cc]
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
stosb byte es:[edi], al
call fcn.00402e90
add esp, 8
test eax, eax
je 0x405d0e
lea edx, [esp + 0x14]
push str.360Safe
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x14]
push eax
call fcn.00405b00
lea ecx, [esp + 0x18]
push ecx
call fcn.00405c20
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x405d5d
lea edx, [esp + 0x14]
push edx
call fcn.00405b00
lea eax, [esp + 0x18]
push eax
call fcn.00405c20
add esp, 8
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, 0x410b3c
mov ecx, dword [esi]
lea edx, [esp + 0x118]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push 0x103
push edx
call fcn.00403280
add esp, 0x10
lea eax, [esp + 0x118]
push eax
push 0x80000002
call edi
add esi, 4
cmp esi, str.mmc.exe
jb 0x405d68
lea ecx, [esp + 8]
push 1
push ecx
mov dword [esp + 0x10], str..360safe.com
call fcn.004045b0
add esp, 8
pop edi
pop esi
add esp, 0x214
ret
Function at 0x405ef0
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov eax, 0x1108
call fcn.0040aab0
push ebx
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x104
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x405f3c
inc eax
dec ecx
jne 0x405f31
jmp 0x405f80
test ecx, ecx
je 0x405f80
lea edx, [esp + 0xc]
test edx, edx
je 0x405f51
mov eax, 0x104
sub eax, ecx
jmp 0x405f55
mov eax, dword [esp + 0xc]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x405f80
mov esi, str.driversetchosts
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x405f78
mov byte [eax], cl
inc eax
dec edx
jne 0x405f69
jmp 0x405f7c
test edx, edx
jne 0x405f7d
dec eax
mov byte [eax], 0
push 0
push 0x80
push 3
push 0
push 1
lea eax, [esp + 0x24]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406023
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x11c]
push 0x1000
push edx
push esi
call edi
test eax, eax
je 0x40601c
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [esp + 0x114]
push str.127.0.0.1
push eax
call ebx
add esp, 8
test eax, eax
je 0x405ff7
lea ecx, [esp + 0x114]
push str.360safe.com
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x40602f
cmp dword [esp + 0xc], 0x1000
jb 0x40601c
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x11c]
push 0x1000
push eax
push esi
call edi
test eax, eax
jne 0x405fcb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1108
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1108
ret
Function at 0x406370
Capabilities:
Get disk information

Disassembly:
push ecx
push 0
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0
push 0x410e34
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x406393
pop ecx
ret
mov eax, dword [esp]
cmp eax, 0x52b
jae 0x4063a5
mov eax, 0x23e73e6
pop ecx
ret
cmp eax, 0xfffffff0
jbe 0x4063b5
xor edx, edx
mov ecx, 0x5f5e100
div ecx
mov eax, edx
pop ecx
ret

Function at 0x406480
Capabilities:
Check if file exists
Delete file
Delete registry key
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x518
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ebx, [esp + eax + 0x14]
mov dword [esp + 0x10], 0x410da0
mov esi, 0x40d33c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x118]
push ecx
mov eax, dword [edx]
push eax
call dword [esi]
lea ecx, [esp + 0x224]
lea edx, [esp + 0x120]
push ecx
push edx
call dword [esi]
lea eax, [esp + 0x330]
lea ecx, [esp + 0x22c]
push eax
push ecx
call dword [esi]
add esp, 0x18
lea edx, [esp + 0x21c]
push edx
push str._s.exe
push 0x104
push ebx
call fcn.00403280
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
cmp eax, 0xffffffff
je 0x406535
mov eax, dword [esp + 0x52c]
test eax, eax
je 0x4065e6
push 4
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebp, 1
lea edx, [esp + 0x320]
push edx
push str._s.dll
push 0x104
push ebx
call fcn.00403280
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
cmp eax, 0xffffffff
je 0x40657f
mov eax, dword [esp + 0x52c]
test eax, eax
je 0x406638
push 4
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebp, 1
lea edx, [esp + 0x118]
lea eax, [esp + 0x424]
push edx
push str.SYSTEMCurrentControlSetServices_s
push 0x104
push eax
call fcn.00403280
add esp, 0x10
lea ecx, [esp + 0x424]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
add esi, 4
cmp esi, 0x40d344
jb 0x4064b3
mov eax, dword [esp + 0x10]
add eax, 4
cmp eax, str.dd33gsd2
mov dword [esp + 0x10], eax
jb 0x4064ae
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x518
ret
mov eax, dword [esp + 0x530]
test eax, eax
je 0x406628
lea edx, [esp + 0x118]
mov esi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x406620
mov byte [eax], cl
inc eax
dec esi
jne 0x4065ff
dec eax
pop edi
pop esi
pop ebp
mov byte [eax], 0
mov eax, 1
pop ebx
add esp, 0x518
ret
test esi, esi
jne 0x406625
dec eax
mov byte [eax], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x518
ret
mov eax, dword [esp + 0x530]
test eax, eax
je 0x40667a
lea edx, [esp + 0x118]
mov esi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x406672
mov byte [eax], cl
inc eax
dec esi
jne 0x406651
dec eax
pop edi
pop esi
pop ebp
mov byte [eax], 0
mov eax, 1
pop ebx
add esp, 0x518
ret
test esi, esi
jne 0x406677
dec eax
mov byte [eax], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x518
ret
Function at 0x406690
Capabilities:
Check if file exists
Delete file
Get disk information
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x12c
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
mov byte [esp + 8], 0x41
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0
je 0x4067f5
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, 1
je 0x4067d4
cmp byte [esp + 0x10], 0x43
jl 0x4067d4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x4067d4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push str._s_autorun.inf
push 0x104
push edx
call fcn.00403280
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x38]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x4067d4
test byte [esp + 0x14], 0x10
jne 0x4067d4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4067d4
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push str._s_auto.exe
push 0x104
push eax
call fcn.00403280
add esp, 0x10
lea ecx, [esp + 0x38]
push ecx
call edi
mov esi, 0x410e74
mov edx, dword [esi]
lea eax, [esp + 0x10]
push edx
push eax
push str._s_s
lea ecx, [esp + 0x44]
push 0x104
push ecx
call fcn.00403280
add esp, 0x14
lea edx, [esp + 0x38]
push edx
call edi
cmp eax, 0xffffffff
je 0x4067c9
test al, 0x10
jne 0x4067c9
test al, 2
je 0x4067c9
mov eax, dword [esp + 0x140]
test eax, eax
je 0x4067c4
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x38]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x38]
push edx
call fcn.00402f90
add esp, 4
mov ebp, 1
add esi, 4
cmp esi, str.autorun.exe
jb 0x40675e
mov cl, byte [esp + 0x10]
shr ebx, 1
inc cl
test ebx, ebx
mov byte [esp + 0x10], cl
jne 0x4066c1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
mov eax, ebp
pop ebp
pop ebx
add esp, 0x12c
ret
Function at 0x406800
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.DisplayName
push str.SYSTEMCurrentControlSetServicesGdi_Server
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x406853
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [esp + eax + 0x14]
mov edx, str.gdisvc.exe
mov edi, 0x104
mov eax, esi
sub edx, esi
mov cl, byte [edx + eax]
test cl, cl
je 0x406884
mov byte [eax], cl
inc eax
dec edi
jne 0x406875
jmp 0x406888
test edi, edi
jne 0x406889
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + 0x14]
push ecx
mov byte [eax], 0
call ebx
cmp eax, 0xffffffff
je 0x4068ad
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
mov edx, str.SoundMan.exe
mov edi, 0x104
mov eax, esi
sub edx, esi
mov cl, byte [edx + eax]
test cl, cl
je 0x4068ca
mov byte [eax], cl
inc eax
dec edi
jne 0x4068bb
jmp 0x4068ce
test edi, edi
jne 0x4068cf
dec eax
lea edx, [esp + 0x14]
mov byte [eax], 0
push edx
call ebx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x210
ret