joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a50
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x498b64
lea ecx, [ebp - 8]
call fcn.00405690
xor ebx, ebx
push str.SOFTWAREBaiduBaiduBrowser
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00405690
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x412a8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x412a9d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x412b23
lea eax, [edi - 0x10]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412ad9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x412aea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x412afb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412b1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.SetAsDefault
lea ecx, [ebp - 0xc]
call fcn.00405690
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
lea eax, [esi - 0x10]
sete byte [ebp - 1]
lea edx, [eax + 0xc]
or ecx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412b60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412b7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x412b8d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x412b9e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412bbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413fb0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push edi
mov edi, eax
mov eax, dword [0x4ae214]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ae214
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41401a
push 0x499c3c
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x41401a
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, byte [eax + 3]
movzx ecx, byte [eax + 2]
push edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push edx
push eax
push 0x499c24
call fcn.00407650
add esp, 0x14
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x416f60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4ae214]
mov edx, dword [eax + 0xc]
push ebx
push esi
push edi
mov ecx, 0x4ae214
call edx
movsx esi, byte [ebp + 0xc]
add eax, 0x10
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.._c:
push eax
call fcn.00417920
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 0xc
push 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push ebx
call edi
cmp eax, 1
jne 0x416ff6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
push ecx
push str._08X
push edx
call fcn.00417920
lea eax, [ebx - 0x10]
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416fea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 4]
push str._c:_
push ecx
call fcn.00417920
mov esi, dword [ebp - 4]
add esp, 0xc
push 0x20
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push esi
call edi
cmp eax, 1
jne 0x417064
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
push edx
push str._08X
push eax
call fcn.00417920
add esi, 0xfffffff0
add esp, 0xc
lea ecx, [esi + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417058
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417080
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419270
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor eax, eax
push ebx
xor ebx, ebx
mov word [ebp - 0x30], ax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
cmp dword [ebp + 8], eax
je 0x419325
cmp dword [ebp + 0xc], eax
je 0x419325
push edi
push 1
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x419322
push esi
push 0x14
push str.BaiduUpdater
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x41931a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xa
push 0x10
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__itow_s]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x30]
add esp, 0x10
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 4
push esi
mov dword [ebp - 0x10], str.elevate
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x419313
mov ebx, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x419330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea eax, [esi + 1]
jne 0x419388
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4198b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
xor eax, eax
push 0x206
push eax
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
mov word [ebp - 0x208], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
lea ecx, [esi + 4]
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x419905
sub eax, edi
sar eax, 1
push eax
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
call fcn.004069f0
mov eax, dword [esi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x419944
push 0x104
mov ecx, esi
call fcn.00406eb0
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41996a
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
test eax, eax
js 0x419991
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x419991
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
push esi
mov word [ecx + eax*2], dx
call fcn.00419b30
test eax, eax
je 0x41998c
push esi
call fcn.004199a0
pop edi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0040b800
int3
Function at 0x4199a0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x4972f0
push 1
push edi
push 0x497340
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x419ada
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x419add
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x497370
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jne 0x419ada
cmp dword [ebp - 8], edi
je 0x419aef
push 0x206
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x210], cx
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.baidubrowser.exe
push ecx
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push str.___privacy
push eax
call edx
push 0x206
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
xor eax, eax
push edi
push ecx
mov word [ebp - 0x418], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
push 0x17
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x419ada
push 0x206
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
xor eax, eax
push edi
push ecx
mov word [ebp - 0x620], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x499fc0
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, edi
je 0x419af2
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x419b01
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x419b16
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
cmp eax, edi
pop edi
pop esi
je 0x419b27
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa338
push 0x4933da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x30
push 0x1fc
xor ebx, ebx
push ebx
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x100
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push str.BUGREPORT_HANDLER_ADDR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x41a8d8
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x1c]
push edx
push 0x49a1ec
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call dword [sym.imp.MSVCR100.dll_swscanf_s]
add esp, 0xc
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x5c44], bl
je 0x41a8d1
cmp byte [eax + 0x5c45], bl
jne 0x41a8d1
cmp dword [eax + reloc.NETAPI32.dll_NetApiBufferFree], 0x5e640
jne 0x41a8d1
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a8f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4afaac]
sub esp, 0x200
test eax, eax
jne 0x41a96f
call fcn.0041a800
mov dword [0x4afaac], eax
test eax, eax
jne 0x41a96f
push 0x5c64
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x41a932
push esi
mov esi, eax
call fcn.0041a7b0
mov dword [0x4afaac], eax
pop esi
jmp 0x41a93c
mov dword [0x4afaac], 0
push 0x4afaac
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push 0x49a1ec
push eax
or edx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041eab0
add esp, 0xc
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push str.BUGREPORT_HANDLER_ADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x4afaac]
mov esp, ebp
pop ebp
ret
Function at 0x41a980
Capabilities:
Accept command line arguments

Disassembly:
push ebx
lea ebx, reloc.NETAPI32.dll_NetApiBufferFree
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x5c44], 0
je 0x41a9a5
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x810a0001
pop ebx
ret
push edi
push 0x104
lea edi, reloc.NETAPI32.dll_NetApiBufferFree
push edi
push 0
mov byte [esi + 0x5c44], 1
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push edi
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x41a9e7
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, 0x810a0002
pop ebx
ret
mov edi, dword [sym.imp.MSVCR100.dll_wcsncpy_s]
mov ecx, eax
sub ecx, esi
sub ecx, 0x583c
push 0xffffffffffffffff
sar ecx, 1
mov edx, 0x104
push str._bdcrashreport.exe
sub edx, ecx
push edx
push eax
call edi
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xffffffffffffffff
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push 0x1000
push eax
call edi
push 0xffffffffffffffff
push str.baiduBrowserUtil
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push 0x40
push ecx
call edi
push 0xffffffffffffffff
push 0x498b64
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push 0x40
push edx
call edi
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push str.bdbugreport__u
push eax
or edx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041eab0
add esp, 0xc
push 0x41ab30
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi], eax
cmp eax, 0x41ab30
jne 0x41aa84
mov dword [esi], 0
push 0x41aab0
call dword [sym.imp.MSVCR100.dll__set_invalid_parameter_handler]
push 0x41ab00
call dword [sym.imp.MSVCR100.dll__set_purecall_handler]
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop ebx
ret
Function at 0x41ae10
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
xor eax, eax
cmp ebx, reloc.NETAPI32.dll_NetApiBufferFree
je 0x41aecb
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x41ae69
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x10], eax
jne 0x41aeb5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x41aeb5
push ecx
push 0
push 0x1fffff
call edi
mov esi, eax
test esi, esi
je 0x41aed2
cmp dword [ebp + 8], 0
push esi
je 0x41aea8
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x41aeae
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x41ae71
pop esi
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e8b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x41e958
mov eax, dword [edi + 8]
test eax, eax
je 0x41e8d5
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x41e8ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
push esi
lea esi, [ebp - 0x14]
mov dword [edi + 0xc], 0
call fcn.0041a700
mov ecx, dword [ebp + 8]
push ecx
push 0x5834
push 0
push 4
add eax, 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x41e92e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 4]
test eax, eax
je 0x41e958
push 0x5834
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x41e960
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov dword [edi + 0xc], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41f2f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push pe_nt_image_headers32
xor esi, esi
lea eax, [ebp - 0x118]
push esi
push eax
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x11c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x118]
cmp eax, 6
jne 0x41f344
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 2
jb 0x41f34b
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
ja 0x41f34d
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f950
Capabilities:
Create shortcut via ishelllink
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x49b16c
push 1
push 0
push 0x497340
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x41fae3
mov eax, dword [ebp - 4]
test eax, eax
je 0x41faf2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [ebp - 8], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
call fcn.0041f2f0
test eax, eax
je 0x41fa81
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x41fa81
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
test eax, eax
je 0x41fa81
mov edx, dword [ebx]
sub eax, edx
sar eax, 1
jne 0x41fa81
cmp dword [ebp - 0x10], 0
je 0x41fa81
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41fa30
sub eax, edi
sar eax, 1
mov ecx, eax
mov eax, dword [edx - 0xc]
sub eax, ecx
push ebx
lea edx, [ebp - 0x14]
call fcn.00405c40
lea eax, [ebp - 0x14]
mov ebx, str._ProgramFiles_x86__
lea edi, [ebp - 0xc]
call fcn.0041fd50
lea ecx, [ebp - 0x14]
call fcn.00405660
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x44]
push 0
push ecx
push eax
call edx
mov ecx, edi
call fcn.00405660
jmp 0x41fa91
mov eax, dword [ebp - 4]
mov edx, dword [ebx]
mov ecx, dword [eax]
push 0
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x49b14c
push eax
mov eax, dword [ecx]
call eax
mov edi, eax
test edi, edi
js 0x41fad4
mov eax, dword [ebp - 8]
test eax, eax
je 0x41fae3
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov edx, dword [eax]
push 1
push ecx
push eax
mov eax, dword [edx + 0x18]
call eax
mov edi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x41fae3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
test eax, eax
je 0x41faf2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4225f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x800
call fcn.004928c4
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
jne 0x422615
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4ae214]
mov edx, dword [eax + 0xc]
push edi
mov ecx, 0x4ae214
mov dword [ebp - 4], ebx
call edx
lea edi, [eax + 0x10]
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREBaiduBaiduBrowser
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4226ae
cmp dword [ebp - 4], ebx
je 0x4226ae
push 0xa
push str.installDir
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0x400
call fcn.004069f0
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4226ae
mov eax, esi
lea edx, [eax + 2]
jmp 0x422690
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422690
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.004069f0
mov ebx, 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
lea eax, [edi - 0x10]
add esp, 4
lea ecx, [eax + 0xc]
or edx, reloc.NETAPI32.dll_NetApiBufferFree
lock xadd dword [ecx], edx
dec edx
pop edi
test edx, edx
jg 0x4226e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret