joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92459c
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
jmp 0x9245a3
not bx
xchg dword [esp + 4], ebx
stc
mov ax, word [esp + 8]
lea esp, [esp + 3]
mov dh, byte [esp + 6]
jmp 0x9245f6
mov dh, byte [esp + 0xa]
cmc
xchg bh, dh
lea eax, [eax*4]
inc dx
rdtsc
jmp 0x924649
push edx
inc bl
xchg dword [esp + 4], edx
rdtsc
xor dl, ch
mov byte [esp + 9], ah
jmp 0x9245de
pop ebx
bsr ax, bp
pop ebx
pop ebx
lea edx, [esi - 0xf5]
btr eax, esp
jmp 0x92465f
push dword [esp + 0xa]
mov bx, 0xa073
push word [esp + 0xe]
and bx, 0x8472
mov al, 0xd6
xchg bh, dh
jmp 0x924607
mov eax, dword [esp + 6]
mov bh, byte [esp + 0xa]
xchg dword [esp + 1], ebx
lea eax, [esp + eax]
not bh
bt eax, esp
jmp 0x92461e
mov bh, byte [esp]
mov edx, 0x7f586e78
mov dx, word [esp + 4]
push word [esp]
xchg dword [esp], ebx
pop word [esp]
jmp 0x9246c9
neg ebx
cld
mov byte [esp + 0x1d], ch
mov ah, byte [esp + 0x11]
mov bx, di
add al, dh
jmp 0x924691
rdtsc
rdtsc
sub esp, 0x1c
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
push word [esp + 6]
jmp 0x9246aa

Function at 0x924b50
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
jmp 0x924b85
mov word [esp], sp
mov byte [esp + 2], dh
lea esp, [esp + 1]
mov word [esp], sp
lea esp, [esp]

Function at 0x927bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x18
mov cx, word [esp + 6]
bswap eax
mov ax, bx
and ecx, ecx
mov di, bx
jmp 0x927b9f
btr esi, esp
lea esi, [eax + 1]
shr eax, 0xb
mov dl, dh
xchg ah, bl
inc dx
jmp 0x927b75
pop word [esp + 7]
mov esi, eax
xchg dh, al
mov eax, ecx
push esp
mov dx, 0xf0a9
jmp 0x927bc7
sub esp, 8
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
pushal
neg cx
jmp 0x927b8e
pop dword [esp + 2]
and dx, 0x278a
push dword [esp + 8]
push dword [esp + 0x14]
mov dx, word [esp + 0x18]
xchg dword [esp + 4], ebp
jmp 0x927c25
popal
bsf bx, ax
not bh
stc
rdtsc
cpuid
jmp 0x927c54
sub esp, 0xe
not cx
mov eax, ebp
xchg ah, bl
neg ch
xchg ebp, eax
jmp 0x927bf3
push dword [esp + 0x1a]
lea esp, [esp + 0xf]
mov eax, 0x6909bf06
cpuid
mov cl, 0xaa
cpuid
jmp 0x927c0e
push dword [esp + 3]
bswap edx
push word [esp + 0xa]
mov al, ah
pop dword [esp + 5]
sub esp, 0x14
jmp 0x927d13
mov edi, 0x78d277e2
sub esp, 0xa
mov ah, byte [esp + 7]
mov dword [esp + 4], ecx
neg si
jmp 0x927c3a
xchg esi, eax
rdtsc
mov byte [esp + 0x19], dh
xchg bp, di
mov dl, 0x5c
add esp, 0x16
jmp 0x927c74
mov al, ah
push word [esp + 0x10]
pop word [esp + 1]
pop eax
neg cx
push dword [esp + 0x13]
jmp 0x927c97
inc dx
setne ch
mov esi, dword [esp + 0x15]
sete ah
cpuid
mov si, sp
jmp 0x927ce5

Function at 0x927f3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
pop di
jmp 0x927f4b
rol di, cl
ror dh, 7
lea esi, [edx + ebx]
mov di, word [esp]
not dh
push edx
jmp 0x927fd5
mov cx, 0x73bd
bsf bp, si
sub esp, 0x12
rdtsc
lea esp, [esp + 0xf]
jmp 0x927f72
mov eax, dword [esp + 3]
push word [esp + 3]
xchg cx, di
mov dword [esp], esi
rdtsc
bsf si, ax
jmp 0x927f8b
mov cl, ch
bsf si, si
mov dx, word [esp + 1]
add esp, 3
pop word [esp + 1]
xchg dword [esp], edx
jmp 0x927fa2
Function at 0x92827d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
inc bl
xchg byte [esp + 0xe], al
push dword [esp + 0x29]
bswap edx
pop si
jmp 0x9282df
jmp 0x928261
pop eax
not ch
bsr bp, cx
mov dh, byte [esp + 0x2e]
lea ebx, [ecx + edx]
rdtsc
jmp 0x92830f
rdtsc
pop si
mov bp, 0x69e1
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
lea edi, [eax*4]
xchg bh, cl
jmp 0x9282c5
push dword [esp + 4]
lea ecx, [esi + edi]
xchg word [esp + 0x11], si
mov word [esp + 0x12], sp
jmp 0x92836b
mov dl, dh
pop word [esp + 0x22]
popal
lea edi, [esp + esi]
lea ecx, [edx + ebp]
jmp 0x9282f8
not edi
lea ebx, [esi*4]
push edx
push word [esp + 0x12]
pop edi
mov al, ah
jmp 0x928335
rdtsc
rdtsc
mov dword [esp + 8], ebp
pop ebp
mov cx, 0xddd5
lea ecx, [eax + 0x29]
jmp 0x92834c
Function at 0x928dba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 6], bx
pop dword [esp]
sub esp, 2
lea ecx, [esp + ebp]
xchg ebx, ecx
mov cl, ch
jmp 0x928a4e
push dword [esp]
mov ax, 0x2033
mov esi, dword [esp + 4]
mov di, word [esp + 4]
push word [esp + 8]
jmp 0x9289d7
not esi
lea ecx, [ebx*4]
mov di, word [esp + 1]
mov edi, ecx
xchg ch, dl
pop cx
jmp 0x9289fc
mov bh, byte [esp]
mov bl, 0x38
sub esp, 0
mov bp, di
not ax
pop dx
jmp 0x928abc
mov di, word [esp]
mov al, 0xb6
pop word [esp + 3]
pop ebp
xchg byte [esp], bl
btr ecx, esp
jmp 0x928a30
bsr di, cx
popal
xchg word [esp + 1], dx
mov bh, byte [esp + 5]
bswap eax
mov si, bx
jmp 0x928a1a
xchg dh, al
not ecx
lea ecx, [edi*4]
btc edx, edi
jmp 0x928b02
mov edi, ecx
mov bh, byte [esp]
xchg byte [esp], cl
xchg byte [esp], dl
setle ah
xchg di, ax
jmp 0x928a84
btc ecx, edi
setne ch
mov dl, 0x9c
mov al, ah
mov bp, 0x4bf5
mov byte [esp], dh
jmp 0x928a9b
cmc
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
xor dx, 0xdcac
setns ah
jmp 0x928ccb
xchg byte [esp], dl
mov dl, 0x44
not dh
lea ebp, [edx + esi]
lea eax, [esi*4]
xchg bp, dx
jmp 0x928acf
lea edi, [ebx*4]
mov dx, word [esp]
sub eax, eax
setp ch
lea ebx, [ebx*4]
xchg byte [esp], cl
jmp 0x928ae6
cpuid
xchg edx, ebx
bswap ebp
mov esi, 0x25c516ba
mov dl, dh
xchg word [esp + 8], cx
jmp 0x928b75
mov ebx, 0x7a2dc892
sub esp, 0x1a
push word [esp + 0xc]
mov bl, bh
mov dl, 0x2c
push word [esp + 5]
jmp 0x928b1e
setns dh
inc bx
xchg edi, eax
lea esi, [ebx*4]
pushal
jmp 0x928bc1
bsf dx, si
push esp
mov dh, byte [esp + 4]
mov dword [esp + 0x1a], eax
mov bp, 0xbc35
jmp 0x928b5d
mov eax, dword [esp + 3]
btc edi, ebx
add esp, 0xa
mov byte [esp], bh
mov dl, 0x54
lea edx, [ebp*4]
jmp 0x928b45
sub esp, 4
mov cl, 0x22
mov cl, 0x2a
mov dh, byte [esp + 3]
mov ebp, 0xdf4f08f8
mov ebx, dword [esp + 1]
jmp 0x928bd7
lea esp, [esp + 0x43]
setae dh
mov edx, eax
cpuid
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
setae dh
jmp 0x928ba5
btc eax, ebx
mov edx, eax
and di, 0x464a
xchg dh, al
lea ecx, [eax*4]
jmp 0x928c29
mov dl, 0xa4
lea esp, [esp + 0x1a]
push dword [esp + 1]
mov dword [esp], ecx
mov ax, 0x327
push word [esp + 7]
jmp 0x928b8d
mov dx, 0xb827
mov byte [esp], ch
add esp, 0
xchg bp, cx
setae ah
mov bp, sp
jmp 0x928c3d
mov ax, word [esp]
pop si
mov ch, byte [esp + 1]
xchg dh, al
add esp, 1
xchg byte [esp], cl
jmp 0x928c08
sub esp, 0x10
xchg word [esp + 5], bx
lea ecx, [ebp - 0xef]
cld
xor di, 0x80e4
jmp 0x928c9c
lea ebx, [esp + ecx]
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
push word [esp + 0x19]
cpuid
rcr ecx, 0xf
lea esi, [edx*4]
jmp 0x928bf0
mov ebx, 0x5b2a4404
lea esp, [esp + 7]
add esp, 5
rdtsc
mov eax, esi
mov bp, bx
jmp 0x928cb4
mov dx, word [esp + 0x10]
pop dword [esp]
mov si, 0x567
lea eax, [eax + edx]
rcr esi, 0xf
xchg dword [esp + 3], ebx
jmp 0x928c76
mov bl, bh
rdtsc
xchg edi, esi
mov ecx, esi
mov bl, 0xf0
call fcn.00928d2f
out 0x77, ax
adc ah, cl
setp ch
mov ch, byte [esp]
sub esp, 0x18
push dword [esp + 0x12]
mov ebx, 0x64172e3a
not dh
lea edx, [edx + ebp]
jmp 0x928c57
btc ebp, edi
rdtsc
mov edi, dword [esp + 0x24]
xchg dh, al
jmp 0x928a6f
Function at 0x9290ab
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 0xc], ch
pop word [esp + 9]
mov byte [esp + 0x12], bh
push word [esp + 0x13]
jmp 0x929009
Function at 0x401f40
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x40ab66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x520
mov eax, dword [esp + 0x530]
push edi
push eax
call fcn.00402da0
add esp, 4
lea ecx, [esp + 0x318]
push str.SoftwareMaxthon2_
push 0x80000001
call fcn.00403dc0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x114]
mov dword [esp + 0x530], 0
push ecx
push str.Folder
push 0x4110ac
lea ecx, [esp + 0x328]
call fcn.00403e00
test eax, eax
je 0x4020fd
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x110]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x10]
push str._sSharedAccountConfigMxSpeedDialSpeedDial.ini
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.00401000
push str.http:__caipiao.qvod.com
push 0x40e47c
push 0x40e478
lea ecx, [esp + 0x10]
mov byte [esp + 0x538], 1
call fcn.004010e0
push 0x40e460
push str.title
push 0x40e478
lea ecx, [esp + 0x10]
call fcn.004010e0
push 0x40e478
push str.picture_name
push 0x40e478
lea ecx, [esp + 0x10]
call fcn.004010e0
push str.http:__caipiao.qvod.com
push str.UrlUserInput
push 0x40e478
lea ecx, [esp + 0x10]
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x110]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x10]
push str._sSharedAccountConfigMxSpeedDialThumbnailPic6.bmp
push eax
call fcn.00404394
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x220]
add esp, 0xc
rep stosd dword es:[edi], eax
push 0x4110b0
lea ecx, [esp + 0x218]
push str._sPic6.bmp
push ecx
call fcn.00404394
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x214]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [esp + 8]
mov byte [esp + 0x52c], 0
test eax, eax
mov dword [esp + 4], 0x40b188
je 0x4020f5
push eax
call fcn.004042b4
add esp, 4
mov dword [esp + 8], 0
lea ecx, [esp + 0x318]
mov dword [esp + 0x52c], 0xffffffff
call fcn.00403df0
mov ecx, dword [esp + 0x524]
xor eax, eax
pop edi
mov dword fs:[0], ecx
add esp, 0x52c
ret
Function at 0x4021d0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x40ab7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x11c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 0x114]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40230d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x11c]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ecx
push eax
push 0x1f0fff
call edi
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call fcn.00402330
add esp, 8
test eax, eax
jne 0x402296
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
lea eax, [esp + 0x114]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40230d
mov ecx, dword [esp + 0x11c]
push ecx
push 0
push 0x1f0fff
call edi
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call fcn.00402330
add esp, 8
test eax, eax
je 0x402258
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dl, byte [esp + ecx + 0x10]
lea eax, [esp + ecx + 0x10]
cmp dl, 0x5c
je 0x4022c4
mov edx, ecx
dec ecx
test edx, edx
jle 0x4022c4
mov byte [eax], 0
mov dl, byte [eax - 1]
dec eax
cmp dl, 0x5c
jne 0x4022b1
lea ecx, [esp + 0x23c]
call fcn.00403d80
lea eax, [esp + 0x10]
lea ecx, [esp + 0x23c]
push eax
push str.Insertpath
push str.Insert
mov dword [esp + 0x45c], 0
call fcn.004041e0
lea ecx, [esp + 0x23c]
mov dword [esp + 0x450], 0xffffffff
call fcn.00403df0
mov ecx, dword [esp + 0x448]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x444
ret

Function at 0x402330
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x110c
call fcn.004048b0
push ebx
push ebp
mov ebp, dword [esp + 0x1118]
xor ebx, ebx
cmp ebp, ebx
mov dword [esp + 8], ebx
jne 0x402358
pop ebp
xor eax, eax
pop ebx
add esp, 0x110c
ret
push esi
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x120]
push 0x1000
push ecx
push ebp
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40241f
test dword [esp + 0x14], 0xfffffffc
jbe 0x40241f
lea esi, [esp + 0x11c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0x104
push edx
push eax
push ebp
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4023d3
lea ecx, [esp + 0x18]
push ecx
call fcn.00404830
lea edx, [esp + 0x1c]
push str.qvodupdate.exe
push edx
call fcn.004047ba
add esp, 0xc
test eax, eax
jne 0x4023f1
mov eax, dword [esp + 0x14]
inc ebx
shr eax, 2
add esi, 4
cmp ebx, eax
jb 0x40238f
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x1124]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret
Function at 0x402430
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x128
push ebp
push 0
push 2
mov dword [esp + 0xc], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 4]
push eax
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4024a4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1f0fff
call edi
mov esi, eax
push esi
call fcn.004024b0
add esp, 4
test eax, eax
je 0x40248a
push 4
push esi
call ebx
lea edx, [esp + 0x10]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402468
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x128
ret
xor eax, eax
pop ebp
add esp, 0x128
ret

Function at 0x4024b0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x110c
call fcn.004048b0
push ebx
push ebp
mov ebp, dword [esp + 0x1118]
xor ebx, ebx
cmp ebp, ebx
mov dword [esp + 8], ebx
jne 0x4024d8
pop ebp
xor eax, eax
pop ebx
add esp, 0x110c
ret
push esi
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x120]
push 0x1000
push ecx
push ebp
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40260d
test dword [esp + 0x14], 0xfffffffc
jbe 0x40260d
lea esi, [esp + 0x11c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0x104
push edx
push eax
push ebp
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4025e3
lea ecx, [esp + 0x18]
push ecx
call fcn.00404830
lea edx, [esp + 0x1c]
push str.qvodinsert.dll
push edx
call fcn.004047ba
add esp, 0xc
test eax, eax
jne 0x402605
lea eax, [esp + 0x18]
push str.qvodplayer.exe
push eax
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
lea ecx, [esp + 0x18]
push str.qvodterminal.exe
push ecx
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
lea edx, [esp + 0x18]
push str.qvodtvplayer.exe
push edx
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
lea eax, [esp + 0x18]
push str.mencoder.exe
push eax
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
lea ecx, [esp + 0x18]
push str.qvodnetbar.exe
push ecx
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
lea edx, [esp + 0x18]
push str.qvodtip.exe
push edx
call fcn.004047ba
add esp, 8
test eax, eax
jne 0x402605
mov eax, dword [esp + 0x14]
inc ebx
shr eax, 2
add esi, 4
cmp ebx, eax
jb 0x40250f
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret

Function at 0x402620
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x40263a
add esp, 0x1c
ret
push 0x20
push str.Qvod_Terminal
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x402650
add esp, 0x1c
ret
lea ecx, [esp]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
neg eax
sbb eax, eax
neg eax
add esp, 0x1c
ret
Function at 0x402910
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
push str.QvodPlayer.exe
push esi
lea eax, [esp + 0x10]
push str._s_s
push eax
call fcn.00404394
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00402b30
add esp, 0x18
lea edx, [esp + 8]
push str.QvodTerminal.exe
push esi
push str._s_s
push edx
call fcn.00404394
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00402b30
add esp, 0x18
lea ecx, [esp + 8]
push str.Qupdate.exe
push esi
push str._s_s
push ecx
call fcn.00404394
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00402b30
add esp, 0x18
lea eax, [esp + 8]
push str.zh_TW.dll
push esi
push str._slang_s
push eax
call fcn.00404394
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00402b30
add esp, 0x18
lea edx, [esp + 8]
push str.en_US.dll
push esi
push str._slang_s
push edx
call fcn.00404394
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00402b30
add esp, 0x18
lea ecx, [esp + 8]
push str.ColorFilter.ax
push esi
push str._sCodecs_s
push ecx
call fcn.00404394
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00402b30
add esp, 0x18
lea eax, [esp + 8]
push str.QvodInsert.dll
push esi
push str._s_s
push eax
call fcn.00404394
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00402b30
add esp, 0x18
push str.NetAgent.dll
push esi
lea edx, [esp + 0x10]
push str._s_s
push edx
call fcn.00404394
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00402b30
add esp, 0x18
lea ecx, [esp + 8]
push str.QvodNetBar.exe
push esi
push str._s_s
push ecx
call fcn.00404394
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00402b30
add esp, 0x18
lea eax, [esp + 8]
push str.QvodBand.dll
push esi
push str._s_s
push eax
call fcn.00404394
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00402b30
add esp, 0x18
lea edx, [esp + 8]
push str.ShareModule.dll
push esi
push str._s_s
push edx
call fcn.00404394
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00402b30
add esp, 0x18
lea ecx, [esp + 8]
push str.QvodExtend.dll
push esi
push str._s_s
push ecx
call fcn.00404394
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x10c]
stosw word es:[edi], ax
push str.QvodExtend.dll
push esi
push str._sCodecs_s
push edx
stosb byte es:[edi], al
call fcn.00404394
add esp, 0x10
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0x402b30
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402b48
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402b59
push esi
call fcn.00402c60
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402b6e
push eax
push esi
call fcn.00402b70
add esp, 8
pop esi
ret
Function at 0x402bb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x30c
mov ecx, 0x82
xor eax, eax
push esi
push edi
lea edi, [esp + 0x10c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x402c51
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push 0
push str.update
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x402c0e
pop edi
pop esi
add esp, 0x30c
ret
mov ecx, dword [esp + 0x31c]
mov esi, dword [esp + 0x318]
lea eax, [esp + 0x10c]
push 1
push eax
push ecx
call esi
test eax, eax
jne 0x402c36
pop edi
pop esi
add esp, 0x30c
ret
push 4
lea edx, [esp + 0x110]
push 0
push edx
call esi
test eax, eax
jne 0x402c51
pop edi
pop esi
add esp, 0x30c
ret
pop edi
mov eax, 1
pop esi
add esp, 0x30c
ret
Function at 0x403b20
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x128
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
mov dword [esp + 4], eax
ja 0x403b56
xor eax, eax
pop edi
add esp, 0x128
ret
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
push esi
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x13c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea ebx, [esp + 0x34]
and ecx, 3
mov dword [esp + 0x14], eax
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x40e7ac
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
mov ebp, ecx
inc ebp
call fcn.004048df
add esp, 8
test eax, eax
je 0x403c30
push 0x40e7a8
push ebx
call fcn.004048df
add esp, 8
test eax, eax
je 0x403c30
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x403c30
mov eax, dword [esp + 0x20]
push 1
push 0
push 0
push eax
call fcn.00404970
mov ecx, dword [esp + 0x1c]
xor edi, edi
add eax, ecx
adc edx, edi
cmp edx, esi
jb 0x403c30
ja 0x403c00
cmp eax, dword [esp + 0x14]
jbe 0x403c30
mov dword [esp + 0x14], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x18], edx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x13c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add ebx, ebp
sub eax, ebp
test eax, eax
mov dword [esp + 0x10], eax
ja 0x403b89
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x128
ret
Function at 0x403c60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x110]
push ecx
push str._s_system32driversetchosts
push edx
call fcn.00404394
add esp, 0xc
lea eax, [esp + 0xc]
push 0x180
push 0x102
push eax
call fcn.00404dd6
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x403d74
push esi
call fcn.00404d5e
push esi
mov ebx, eax
call fcn.00404cab
add esp, 8
test ebx, ebx
jle 0x403d74
push ebx
call fcn.004042bf
lea ecx, [esp + 0x10]
push 0x40e7bc
push ecx
mov edi, eax
call fcn.00404c98
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403d6b
push esi
push ebx
push 1
push edi
call fcn.00404b90
push str.qvod.com
push edi
mov ebx, eax
call fcn.004042d0
add esp, 0x18
test eax, eax
je 0x403d62
mov ecx, eax
mov edx, 0x30303030
add eax, 8
push str.qvod.com
mov dword [ecx], edx
push eax
mov dword [ecx + 4], edx
call fcn.004042d0
add esp, 8
test eax, eax
jne 0x403d2c
push eax
push eax
push esi
call fcn.00404b04
push esi
push ebx
push 1
push edi
call fcn.004049fa
add esp, 0x1c
push esi
call fcn.004049a4
add esp, 4
push edi
call fcn.004042b4
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x403e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
xor eax, eax
lea edx, [esp + 0xc]
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x224]
lea ecx, [esi + 4]
push eax
push ecx
push str._s_s
push edx
xor ebp, ebp
call fcn.00404394
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 0x20019
push ebp
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403ee5
mov esi, dword [esp + 0x228]
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ebp
push ecx
push ebp
push esi
push edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x403eda
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x403e94
cmp eax, 2
jne 0x403eda
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x403eda
push ebx
push eax
call fcn.004042bf
mov ecx, dword [esp + 0x234]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x234]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push ebp
push esi
push eax
call edi
test eax, eax
jne 0x403ed0
mov ebp, 1
push ebx
call fcn.004042b4
add esp, 4
pop ebx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x214
ret 0x10