joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043f6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
push 1
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xa7c], 0x104
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa78], edi
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 0xa70]
push eax
push 0x20019
push edi
lea eax, [esi + 0x618]
push eax
push 0x80000002
call dword [0x1001004]
cmp eax, edi
mov dword [ebp - 0xa74], eax
jne 0x100464c
push ebx
lea eax, [ebp - 0xa8c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push dword [ebp - 0xa70]
call dword [0x100103c]
test eax, eax
jne 0x1004645
mov ebx, dword [0x1001170]
lea eax, [ebp - 0xa6c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa70]
call dword [0x1001004]
cmp eax, edi
mov dword [ebp - 0xa74], eax
jne 0x100464b
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa84]
push eax
push edi
push 0x100190c
push dword [ebp - 0xa6c]
mov dword [ebp - 0xa78], 0x208
mov word [ebp - 0x20c], di
call dword [0x1001038]
test eax, eax
jne 0x10045e9
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1004516
sub eax, edx
sar eax, 1
je 0x10045e9
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xa84]
push eax
push edi
push 0x1001a64
push dword [ebp - 0xa6c]
mov dword [ebp - 0xa78], 0x654
call dword [0x1001038]
test eax, eax
push 0x103
jne 0x10045c2
lea eax, [ebp - 0xa64]
push eax
lea eax, [esi + 0xa28]
push eax
call ebx
push 0x103
lea eax, [ebp - 0x95c]
push eax
lea eax, [esi + 0xe9c]
push eax
mov word [esi + 0xc2e], di
call ebx
push 0x27
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x10a4]
push eax
mov word [esi + 0x10a2], di
call ebx
push esi
push 1
push 0x80000002
mov word [esi + 0x10f2], di
call fcn.01005fef
add esp, 0x30
jmp 0x10045e9
lea eax, [ebp - 0x414]
push eax
lea eax, [esi + 0xa28]
push eax
call ebx
push esi
push 1
push 0x80000002
mov word [esi + 0xc2e], di
call fcn.01005ea5
add esp, 0x18
cmp dword [ebp - 0xa6c], edi
je 0x1004603
push dword [ebp - 0xa6c]
call dword [entry0]
mov dword [ebp - 0xa6c], edi
inc dword [ebp - 0xa80]
lea eax, [ebp - 0xa8c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], 0x104
push dword [ebp - 0xa70]
call dword [0x100103c]
test eax, eax
je 0x100449f
mov dword [ebp - 0xa74], edi
pop ebx
cmp dword [ebp - 0xa6c], edi
je 0x1004660
push dword [ebp - 0xa6c]
call dword [entry0]
cmp dword [ebp - 0xa70], edi
pop edi
pop esi
je 0x1004676
push dword [ebp - 0xa70]
call dword [entry0]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa74]
xor ecx, ebp
call fcn.01006b3a
leave
ret
Function at 0x100468d
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push str.MSSQLServerADHelper
xor esi, esi
push esi
call dword [fcn.01001048]
mov edi, eax
cmp edi, esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
je 0x10046d4
push esi
lea eax, [ebp - 8]
push eax
push esi
push 2
push esi
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push edi
call dword [fcn.01001044]
push edi
call dword [fcn.01001040]
pop edi
pop esi
leave
ret
Function at 0x10046dd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 1
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
add esi, 0x618
push esi
push 0x80000002
call dword [0x1001004]
cmp eax, edi
mov esi, dword [ebp + 8]
jne 0x1004753
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001bdc
push dword [ebp - 4]
mov dword [ebp - 8], 0xf90
call dword [0x1001038]
push dword [ebp - 4]
mov ebx, eax
mov word [esi + 0xf8e], di
call dword [entry0]
cmp ebx, edi
je 0x1004980
push 0x1001bc8
mov edi, 0x84
push edi
lea eax, [esi + 4]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001bb0
push edi
lea eax, [esi + 0x10c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
mov eax, dword [ebp + 0xc]
add eax, 0x820
push eax
push edi
lea eax, [esi + 0x21c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ba0
push edi
lea eax, [esi + 0x324]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b90
push edi
lea eax, [esi + 0x42c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b7c
push edi
lea eax, [esi + 0x534]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b5c
push edi
lea eax, [esi + 0x648]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ba0
push edi
lea eax, [esi + 0x768]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b10
push 0x28
lea eax, [esi + 0x870]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ac0
push 0x28
lea eax, [esi + 0x8c0]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a70
push 0x28
lea eax, [esi + 0x910]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0x960]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xa68]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xc78]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xb70]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xd80]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xe88]
push eax
call fcn.01002aa5
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x100499d
mov dword [esi + 0x214], 8
mov dword [esi + 0x218], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x644], eax
mov dword [esi + 0x750], eax
mov dword [esi + 0x754], eax
mov dword [esi + 0x758], eax
mov dword [esi + 0x75c], eax
mov dword [esi + 0x760], eax
mov dword [esi + 0x764], eax
xor ebx, ebx
jmp 0x100499d
add esi, 0x324
cmp word [esi], di
jne 0x100499d
push 0x1001ba0
push 0x84
push esi
call fcn.01002aa5
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1006204
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1414
call fcn.01006f00
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x25c]
push edi
push eax
mov dword [ebp - 0x1408], edi
mov dword [ebp - 0x1400], edi
mov dword [ebp - 0x1414], edi
mov dword [ebp - 0x140c], edi
mov dword [ebp - 0x260], edi
call fcn.01006f30
lea eax, [ebp - 0x13fc]
push esi
push eax
call fcn.010046dd
add esp, 0x14
cmp eax, edi
jne 0x1006420
cmp dword [ebp + 0xc], 1
jne 0x1006285
lea eax, [ebp - 0x13fc]
push eax
push esi
call fcn.01003b8c
pop ecx
pop ecx
push edi
push 1
push esi
push 1
push 0x105
lea eax, [ebp - 0x46c]
push eax
push ebx
call fcn.0100572e
add esp, 0x1c
cmp eax, edi
mov dword [ebp - 0x1404], eax
jne 0x10063d2
lea eax, [ebp - 0x1400]
push eax
push 0x10028f8
lea eax, [ebp - 0x46c]
push eax
call dword [0x100a608]
cmp eax, edi
mov dword [ebp - 0x1404], eax
jl 0x10063d2
push esi
push dword [ebp + 0xc]
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 0x1408]
push eax
push 2
push edi
lea eax, [esi + 0x618]
push eax
push ebx
call dword [0x1001004]
test eax, eax
jne 0x1006376
mov eax, dword [ebp - 0x1400]
mov ecx, dword [eax]
lea edx, [ebp - 0x1414]
push edx
push 0x1002918
push eax
call dword [ecx]
test eax, eax
jl 0x1006376
mov eax, dword [ebp - 0x1414]
mov ecx, dword [eax]
lea edx, [ebp - 0x140c]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x140c]
cmp eax, edi
je 0x1006376
lea edx, [ebp - 0x54]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1006339
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100634d
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x54]
push eax
push 1
push edi
push 0x100190c
push dword [ebp - 0x1408]
call dword [0x1001008]
lea eax, [ebp - 0x260]
push esi
push eax
call fcn.01004072
test eax, eax
pop ecx
pop ecx
je 0x1006396
push esi
push str.LocalSystem
call fcn.010040f6
pop ecx
pop ecx
cmp dword [esi + 0x10f4], edi
mov eax, dword [ebp - 0x1400]
lea esi, [ebp - 0x1410]
jne 0x10063b6
push 0x12
pop ecx
push esi
push ecx
push 0x1009ca8
jmp 0x10063c0
push 0x18
pop ecx
push esi
push ecx
push 0x1009ac8
mov dword [ebp - 0x1410], ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
mov dword [ebp - 0x1404], eax
cmp dword [ebp - 0x140c], edi
je 0x10063e6
push dword [ebp - 0x140c]
call dword [0x100119c]
mov eax, dword [ebp - 0x1414]
cmp eax, edi
je 0x10063f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1400]
cmp eax, edi
je 0x1006406
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x1408], edi
je 0x100641a
push dword [ebp - 0x1408]
call dword [entry0]
mov eax, dword [ebp - 0x1404]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b3a
leave
ret
Function at 0x406f90
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x460700]
xor eax, esp
mov dword [esp + 0x64], eax
push 0
push 0x20
push edi
mov dword [esp + 0x10], 0
call fcn.00425ec9
push 0x40
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00438d30
add esp, 0xc
push edi
mov eax, 0x20
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x54], 0x67452301
mov dword [esp + 0x58], 0xefcdab89
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0x10325476
call fcn.00407aa0
push esi
lea ecx, [esp + 0xc]
call fcn.00407810
mov ecx, dword [esp + 0x64]
xor ecx, esp
mov eax, esi
call fcn.004347a8
add esp, 0x6c
ret

Function at 0x407020
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b070
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x460700]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
push 0x40
lea eax, [ebp - 0x470]
push edi
push eax
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x47c], edi
mov dword [ebp - 4], edi
call fcn.00438d30
add esp, 0xc
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x67452301
mov dword [ebp - 0x424], 0xefcdab89
mov dword [ebp - 0x420], 0x98badcfe
mov dword [ebp - 0x41c], 0x10325476
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push 0x400
lea eax, [ebp - 0x418]
push eax
mov ecx, esi
call edx
cmp eax, edi
jle 0x4070d3
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x470]
call fcn.00407aa0
jmp 0x4070a6
push ebx
lea ecx, [ebp - 0x470]
call fcn.00407810
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004347a8
mov esp, ebp
pop ebp
ret
Function at 0x40cf50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x20c]
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x14], ebx
cmp eax, ebp
je 0x40cf76
push eax
call dword [0x44c334]
mov dword [ebx + 0x20c], ebp
mov edi, dword [esp + 0x1c]
lea eax, [ebx + 4]
mov esi, edi
mov edx, 0x104
sub esi, eax
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x40cfa6
movzx ecx, word [esi + eax]
cmp cx, bp
je 0x40cfa6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40cf86
jmp 0x40cfaa
cmp edx, ebp
jne 0x40cfad
sub eax, 2
xor edx, edx
push edx
push 0x80
push 3
push edx
push 1
push 0x80000000
push edi
mov word [eax], dx
mov dword [esp + 0x2c], ebp
call dword [0x44c338]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d044
push 0
push esi
call dword [0x44c358]
push 0
mov ebx, eax
push ebx
push 0
push 2
push 0
push esi
call dword [0x44c330]
mov edi, eax
test edi, edi
je 0x40d02d
push 0
push 0
push 0
push 4
push edi
call dword [0x44c354]
mov ebp, eax
test ebp, ebp
je 0x40d022
mov edx, dword [esp + 0x14]
mov eax, ebx
mov ecx, ebp
call fcn.0040cd50
push ebp
mov dword [esp + 0x14], eax
call dword [0x44c350]
push edi
call dword [0x44c35c]
mov ebp, dword [esp + 0x10]
push esi
call dword [0x44c35c]
test ebp, ebp
jne 0x40d0d6
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
push 0x4545e4
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004355c6
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x40d0d6
push 2
push 0
push eax
call fcn.004372b5
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0043685d
mov edx, dword [esp + 0x2c]
push edx
mov edi, eax
call fcn.004358f4
push edi
call fcn.0043582a
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x40d0a7
mov eax, dword [esp + 0x1c]
push eax
call fcn.004373b1
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
mov ecx, dword [esp + 0x1c]
push ecx
push edi
push 1
push esi
call fcn.004364bf
add esp, 0x10
mov eax, edi
mov ecx, esi
mov edx, ebx
call fcn.0040cd50
push esi
call fcn.0043574d
mov edx, dword [esp + 0x20]
push edx
call fcn.004373b1
add esp, 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x40d890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ac0c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460700]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
lea esi, [ebx + 0x960]
push esi
call fcn.00404760
lea eax, [ebx + 0x978]
push eax
mov dword [esp + 0x30], 0
call fcn.00404760
lea ecx, [ebx + 0x99c]
push ecx
mov byte [esp + 0x30], 1
call fcn.00404760
xor edx, edx
xor eax, eax
xor ecx, ecx
mov word [ebx], dx
mov word [ebx + 0x50], ax
mov word [ebx + 0x348], cx
mov word [ebx + 0x758], dx
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0x40d914
call fcn.00435096
mov ebp, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x18], eax
cmp ebp, dword [esi + 0x10]
jbe 0x40d927
call fcn.00435096
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
push edi
push ecx
push ebp
push eax
lea edi, [esp + 0x28]
call fcn.0040f8c0
xor eax, eax
mov dword [ebx + 0x990], eax
mov dword [ebx + 0x994], eax
mov dword [ebx + 0x998], eax
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x40eb60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x22c
mov eax, dword [0x460700]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
mov ebp, dword [esp + 0x234]
push esi
push ebp
mov esi, ecx
mov dword [esp + 0xc], 1
call dword [0x44c33c]
cmp eax, 0xffffffff
je 0x40eba2
push ebp
call dword [0x44c2dc]
test eax, eax
je 0x40ed18
push 0
push 0
push 0
push 0
push 0x4548a4
mov dword [esp + 0x24], 0
call dword [0x44c63c]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ed14
push ebx
push 0
push 0x4000000
push 0
push 0
push esi
push eax
call dword [0x44c640]
mov ebx, eax
test ebx, ebx
je 0x40ed08
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x13
push ebx
mov word [esp + 0x34], ax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov word [esp + 0x46], ax
mov dword [esp + 0x2c], 0xa
call dword [0x44c634]
mov ecx, 0x4548bc
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ec4e
test dx, dx
je 0x40ec4a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ec4e
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ec28
xor eax, eax
jmp 0x40ec53
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ed01
push 0x4548c4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004355c6
add esp, 0xc
cmp dword [esp + 0x10], 0
je 0x40ed01
cmp dword [esp + 0xc], 0
jbe 0x40ecec
mov esi, dword [0x44c630]
lea ecx, [esp + 0xc]
push ecx
push 0x1ff
lea edx, [esp + 0x3c]
push edx
push ebx
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x3c]
push 1
push edx
call fcn.0043663e
add esp, 0x10
cmp dword [edi + 0x990], 0
je 0x40ece5
mov eax, dword [esp + 0xc]
add dword [0x4653dc], eax
mov dword [0x4653d8], 0
mov ecx, dword [edi + 0x998]
mov edx, dword [edi + 0x990]
push ecx
push 0x4653d8
call edx
add esp, 8
cmp dword [esp + 0xc], 0
ja 0x40ec86
mov eax, dword [esp + 0x10]
push eax
call fcn.004373b1
add esp, 4
mov dword [esp + 0x14], 1
push ebx
call dword [0x44c638]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x44c638]
pop ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x230]
pop esi
pop ebp
xor ecx, esp
call fcn.004347a8
add esp, 0x22c
ret 4
Function at 0x47dce9
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0x80000301
push 0
push 0x50
push reloc.WS2_32.dll_connect
push 0
push str.hzs19.cnzz.com
push 0x10025
push 0x16023bdf
push 0x52023ba9
push 3
mov ebx, 0x486250
call fcn.00482690
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.GET__stat.htm_id4300819_HTTP_1.1_r_nAccept:___r_nReferer:_http:__xs.supan.la_a.html_7.0SP5_ucbug_r_nAccept_Language:_zh_CN_r_nUser_Agent:_Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.0___r_nxxxxxxxxxxxxxxx:_gzip__deflate_r_nHost:_hzs19.cnzz.com_r_nConnection:_Keep_Alive_r_n_r_n
push 0x10025
push 0x16023bdf
push 0x52023ba9
push 2
mov ebx, 0x4862a0
call fcn.00482690
add esp, 0x1c
push 0
push str.xs.supan.la_a.html
push 0xffffffffffffffff
push 0xb
push 0x160266f6
push 0x52023ba9
call fcn.0048268a
add esp, 0x18
push 0
push str.www.luokexs.com_a.html
push 0xffffffffffffffff
push 0xb
push 0x160266b6
push 0x52023ba9
call fcn.0048268a
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x481a4e
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0x80000301
push 0
push 0x50
push reloc.WS2_32.dll_connect
push 0
push str.hzs19.cnzz.com
push 0x10025
push 0x160266ac
push 0x52013925
push 3
mov ebx, 0x486250
call fcn.00482690
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.GET__stat.htm_id4300819_HTTP_1.1_r_nAccept:___r_nReferer:_http:__xs.supan.la_a.html_7.0SP5ucbuggx_r_nAccept_Language:_zh_CN_r_nUser_Agent:_Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.0___r_nxxxxxxxxxxxxxxx:_gzip__deflate_r_nHost:_hzs19.cnzz.com_r_nConnection:_Keep_Alive_r_n_r_n
push 0x10025
push 0x160266ac
push 0x52013925
push 2
mov ebx, 0x4862a0
call fcn.00482690
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4916e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x561ffb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00554555
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x491762
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0055189a
mov eax, dword [eax]
push 0x714244
push eax
call fcn.00542d54
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005547e0
test bl, bl
je 0x491762
push 0x714244
lea ecx, [esp + 0xc]
call fcn.00554bbc
push 0x717df4
lea ecx, [esp + 0xc]
call fcn.00554bbc
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x49179e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005547e0
jmp 0x491869
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x491822
lea edx, [esp + 0x7c]
push 0x717df0
push edx
call fcn.00542d54
add esp, 8
test eax, eax
je 0x491822
lea eax, [esp + 0x7c]
push 0x717dec
push eax
call fcn.00542d54
add esp, 8
test eax, eax
je 0x491822
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4917b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005547e0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x492ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x492b22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x492b30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x56215b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x725828]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x492c68
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x492b96
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005547e0
xor eax, eax
jmp 0x492cdf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00554969
push esi
lea ecx, [esp + 0xc]
call fcn.00554bf8
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x717e2c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x492cbd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00492ac0
test eax, eax
jne 0x492cbd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00492ac0
test eax, eax
jne 0x492cbd
lea eax, [esp + 0x14]
push 0x717e08
push eax
call fcn.00543f40
mov esi, eax
add esp, 8
test esi, esi
jne 0x492c9c
lea ecx, [esp + 0x14]
push 0x717e04
push ecx
call fcn.00543ec0
mov esi, eax
add esp, 8
test esi, esi
jne 0x492c9c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x492c9f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00554919
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x492bae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005547e0
xor eax, eax
jmp 0x492cdf
mov byte [esi], 0
push 0x717e00
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005547e0
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4