joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4396d0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00438190
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.004380e0
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.00438030
add esp, 4
mov dword [ebp - 0xa40], 0
lea eax, [ebp - 0xa40]
push eax
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0xa3c], eax
lea ecx, [ebp - 0xa38]
push ecx
mov edx, dword [ebp - 0xa40]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xa38]
push edx
push 0x46ff68
push 0x410
push 0x208
lea eax, [ebp - 0x828]
push eax
call fcn.004157ac
add esp, 0x1c
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xa38]
push ecx
push 0x46ff7c
push 0x410
push 0x208
lea edx, [ebp - 0x828]
push edx
call fcn.004157ac
add esp, 0x1c
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xa38]
push edx
push 0x46ff90
push 0x410
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x418]
push ecx
call fcn.00438d00
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x439800
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4398bf
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x439895
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00439800
add esp, 8
test eax, eax
jne 0x43988a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4398c1
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x439897
jmp 0x4398a0
mov ecx, 1
test ecx, ecx
jne 0x439842
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
jmp 0x4398c1
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x4398d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x4822fc], 0xffffffff
jne 0x43993b
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x124], 6
jb 0x439931
mov dword [0x4822fc], 1
jmp 0x43993b
mov dword [0x4822fc], 0
mov eax, dword [0x4822fc]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x4399e0
Capabilities:
Create process on windows
Get installed programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0x608
cmp dword [eax + 0x48c340], 0xffffffff
je 0x439bf4
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x608
add ecx, 0x48bd40
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sProducts97BFC25026D93E24A851ED662C9CC7E3
push 0x208
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.004157ac
add esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
lea ecx, [ebp - 0x218]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439be6
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0x608
add eax, 0x48bd40
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sProducts
push 0x208
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call fcn.004157ac
add esp, 0x14
lea edx, [ebp - 8]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x420]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439b44
cmp dword [ebp + 8], 0
je 0x439b29
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x608
mov edx, dword [ecx + 0x48c340]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x473ddc
push str.export__s_s_QQBackupFile_d_1.reg
push 0x410
push 0x208
lea ecx, [ebp - 0x838]
push ecx
call fcn.004157ac
add esp, 0x1c
push 0
push 0
lea edx, [ebp - 0x838]
push edx
push 0x473ec4
push 0x473ed4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x424], eax
push 0x473ee0
mov eax, dword [ebp - 8]
push eax
call fcn.004376e0
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0xf003f
push 0
push 0x473f28
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439be6
cmp dword [ebp + 8], 0
je 0x439bcb
mov eax, dword [ebp - 4]
imul eax, eax, 0x608
mov ecx, dword [eax + 0x48c340]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall052CFB79_9D62_42E3_8A15_DE66C2C97C3E
push str.HKLM
push str.export__s_s_QQBackupFile_d_2.reg
push 0x410
push 0x208
lea edx, [ebp - 0xc50]
push edx
call fcn.004157ac
add esp, 0x1c
push 0
push 0
lea eax, [ebp - 0xc50]
push eax
push str.reg.exe
push 0x4740ac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x83c], eax
push 0x4740b8
mov ecx, dword [ebp - 8]
push ecx
call fcn.004376e0
add esp, 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x4399fa
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x439c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov eax, dword [ebp + 8]
push eax
push 0x473bd0
push 0x473c44
push 0x208
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.004157ac
add esp, 0x18
lea edx, [ebp - 0x214]
push edx
push 1
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x439c79
xor eax, eax
jmp 0x439cea
mov dword [ebp - 4], 1
mov dword [ebp - 0x424], 0x208
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.ProfileImagePath
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x439cc5
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x439cea
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x424]
shr ecx, 1
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00437870
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x439d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SOFTWARETENCENTQQMusic
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x439d5d
jmp 0x439e3c
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x473ae0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x439d8e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x439e3c
movzx eax, word [ebp - 0x218]
test eax, eax
jne 0x439da8
mov dword [0x48a87c], 0
jmp 0x439e3c
mov word [ebp - 0x428], 0
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x630], 0
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.00415680
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
push ecx
lea edx, [ebp - 0x428]
push edx
push 0x2e
call fcn.00450110
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
call fcn.004155f7
add esp, 4
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x2da
jl 0x439e32
mov dword [0x48a87c], 1
jmp 0x439e3c
mov dword [0x48a87c], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43a650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x618
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x471e54
call fcn.00438b10
add esp, 8
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 0x214], 0x104
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
add eax, 0x208
push eax
push str.Language
lea ecx, [ebp - 0x420]
push ecx
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
je 0x43a6ca
xor eax, eax
jmp 0x43a787
mov dword [ebp - 0x214], 0x104
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
push str.ProductName
lea ecx, [ebp - 0x420]
push ecx
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
je 0x43a700
xor eax, eax
jmp 0x43a787
lea edx, [ebp - 0x210]
push edx
push 0x471e98
call fcn.00438b10
add esp, 8
mov dword [ebp - 0x214], 0x104
lea eax, [ebp - 0x424]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43a749
mov eax, 1
jmp 0x43a787
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x471ec0
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43a782
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43a787
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43a810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x64], eax
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 1
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43a8eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x60], eax
push 0
push 0
lea ecx, [ebp - 0x5c]
push ecx
push 0x400
mov edx, dword [ebp - 0x60]
push edx
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x471c3c
push 0x400
push 0x200
lea ecx, [ebp - 0x468]
push ecx
call fcn.004157ac
add esp, 0x20
lea edx, [ebp - 0x468]
push edx
call fcn.004626a0
add esp, 4
xor eax, eax
jne 0x43a8a6
xor eax, eax
jmp 0x43a94f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x471c78
push 0x400
push 0x200
lea eax, [ebp - 0x868]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x868]
push ecx
call fcn.004626a0
add esp, 4
xor edx, edx
jne 0x43a8eb
cmp dword [ebp + 0x14], 0
je 0x43a936
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43be40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x46f8a0
push 0x46f8c0
push 0x208
push 0x104
push 0x489520
call fcn.004157ac
add esp, 0x14
mov word [ebp - 0x338], 0
push 0x206
push 0
lea eax, [ebp - 0x336]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x12c], 0x104
mov word [ebp - 0x540], 0
push 0x206
push 0
lea ecx, [ebp - 0x53e]
push ecx
call fcn.00415680
add esp, 0xc
push 0
push 0x25
lea edx, [ebp - 0x540]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x43beda
xor eax, eax
jmp 0x43c0ee
lea eax, [ebp - 0x540]
push eax
call fcn.00414d31
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x542]
cmp ecx, 0x5c
je 0x43bf0f
lea edx, [ebp - 0x540]
push edx
call fcn.00414d31
add esp, 4
mov word [ebp + eax*2 - 0x540], 0x5c
lea eax, [ebp - 0x540]
push eax
push str._smsi.dll
push 0x208
push 0x104
lea ecx, [ebp - 0x540]
push ecx
call fcn.004157ac
add esp, 0x14
push 0
push 0
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x540]
push ecx
call sub.Msi.dll_MsiMessageBoxW
test eax, eax
je 0x43bf5d
xor eax, eax
jmp 0x43c0ee
lea edx, [ebp - 0x338]
mov dword [ebp - 0x544], edx
push 0x2e
lea eax, [ebp - 0x338]
push eax
call fcn.004058d0
add esp, 8
mov dword [ebp - 0x544], eax
mov ecx, dword [ebp - 0x544]
add ecx, 2
mov dword [ebp - 0x544], ecx
push 0x2e
mov edx, dword [ebp - 0x544]
push edx
call fcn.004058d0
add esp, 8
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
add eax, 2
mov dword [ebp - 0x544], eax
push 0x2e
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004058d0
add esp, 8
mov dword [ebp - 0x544], eax
mov edx, dword [ebp - 0x544]
lea eax, [ebp - 0x338]
sub edx, eax
sar edx, 1
shl edx, 1
push edx
lea ecx, [ebp - 0x338]
push ecx
push 0x489930
call fcn.00415c30
add esp, 0xc
push 0x11c
push 0
lea edx, [ebp - 0x128]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43c04b
mov dword [ebp - 0x128], 0x114
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43c04b
xor eax, eax
jmp 0x43c0ee
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x548], edx
cmp dword [ebp - 0x548], 0
je 0x43c0c3
cmp dword [ebp - 0x548], 1
je 0x43c0a5
cmp dword [ebp - 0x548], 2
je 0x43c074
jmp 0x43c0df
movzx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x124]
push edx
push str._d._d._d
push 0x208
push 0x104
push 0x489728
call fcn.004157ac
add esp, 0x1c
jmp 0x43c0df
push str.Windows_98_or_95
push 0x208
push 0x104
push 0x489728
call fcn.004157ac
add esp, 0x10
jmp 0x43c0df
push str.Windows_3.1
push 0x208
push 0x104
push 0x489728
call fcn.004157ac
add esp, 0x10
mov dword [0x489ba8], 2
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43c1e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x43c100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x48acac], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x43c210
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
push 9
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c246
xor eax, eax
jmp 0x43c3af
mov cx, word [0x473cec]
mov word [ebp - 0x230], cx
push 0x206
push 0
lea edx, [ebp - 0x22e]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x44c], 0x3fff
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], 0
je 0x43c3a5
mov dword [ebp - 0x10], 0
jmp 0x43c2e4
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jae 0x43c3a5
mov dword [ebp - 0xc], 0xff
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x43c3a0
lea eax, [ebp - 0x438]
push eax
call fcn.00439c10
add esp, 4
lea ecx, [ebp - 0x438]
push ecx
push 0x473cf0
push 0x200
push 0x100
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x608
add edx, 0x48bd40
push edx
call fcn.004157ac
add esp, 0x14
push 0x485c38
push 0x473cf8
push 0x400
push 0x200
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x608
add eax, 0x48bf40
push eax
call fcn.004157ac
add esp, 0x14
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x608
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x48c340], edx
jmp 0x43c2db
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43c3c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
je 0x43c3fa
xor eax, eax
jmp 0x43c5df
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xffffffff
jne 0x43c420
call sub.WS2_32.dll_WSACleanup
xor eax, eax
jmp 0x43c5df
mov word [ebp - 0x2bc], 2
call fcn.00439e50
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x2b8], eax
push 0x1bb
call sub.WS2_32.dll_htons
mov word [ebp - 0x2ba], ax
push 0x10
lea ecx, [ebp - 0x2bc]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x43c471
call sub.WS2_32.dll_WSACleanup
xor eax, eax
jmp 0x43c5df
cmp dword [ebp + 0xc], 0
jle 0x43c4ad
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call sub.WS2_32.dll_send
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2d0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x2d0]
mov dword [ebp + 0xc], ecx
jmp 0x43c471
mov byte [ebp - 0x2a8], 0
push 0x103
push 0
lea edx, [ebp - 0x2a7]
push edx
call fcn.00415680
add esp, 0xc
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 4], 0x104
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x19c]
push edx
mov eax, dword [ebp - 0x2c8]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x19c]
add ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x2d4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jle 0x43c533
cmp dword [ebp - 0x2cc], 0
jg 0x43c4e7
push 0x472f74
lea eax, [ebp - 0x2a8]
push eax
call fcn.004058b0
add esp, 8
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c4], 0
je 0x43c5be
push str.RESULT:
call fcn.00415fa0
add esp, 4
add eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x2c4]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x43c598
mov eax, dword [ebp - 0x2c4]
add eax, 1
mov dword [ebp - 0x2c4], eax
jmp 0x43c579
mov ecx, dword [ebp - 0x2c4]
movsx edx, byte [ecx]
cmp edx, 0x31
jne 0x43c5b2
mov dword [ebp - 0x2c0], 1
jmp 0x43c5bc
mov dword [ebp - 0x2c0], 0
jmp 0x43c5c8
mov dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c8]
push eax
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43c5f0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1658
call fcn.0042a4c0
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x450], 0
push 0x206
push 0
lea ecx, [ebp - 0x44e]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x1658], 0
push 0x206
push 0
lea edx, [ebp - 0x1656]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x1450], 0
push 0xffc
push 0
lea eax, [ebp - 0x144c]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x244], 0
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x43c6cc
jmp 0x43c7d1
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43c6f7
jmp 0x43c7d1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43c711
jmp 0x43c7b6
mov edx, dword [ebp - 0x230]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43c733
jmp 0x43c7b6
lea eax, [ebp - 0x244]
push eax
push 0x1000
lea ecx, [ebp - 0x1450]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x43c755
jmp 0x43c7b6
push 0x208
lea eax, [ebp - 0x1658]
push eax
mov ecx, dword [ebp - 0x1450]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x43c777
jmp 0x43c7b6
push 0x104
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x1658]
push ecx
call fcn.0043a2a0
add esp, 0xc
push str.tencent
lea edx, [ebp - 0x450]
push edx
call fcn.004159fc
add esp, 8
test eax, eax
jne 0x43c7b6
mov dword [ebp - 0x240], 1
jmp 0x43c7d1
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43c6f7
cmp dword [ebp - 0x23c], 0
je 0x43c7f0
cmp dword [ebp - 0x23c], 0xffffffff
je 0x43c7f0
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0
je 0x43c820
lea eax, [ebp - 0x1658]
push eax
call fcn.00414d31
add esp, 4
test eax, eax
je 0x43c820
lea ecx, [ebp - 0x1658]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004172de
add esp, 0xc
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret