joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c80
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub esp, 0x20c
push esi
mov esi, ecx
lea ecx, [esp + 8]
lea eax, [esi + 0x54]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x10]
push edx
call fcn.0042c310
lea eax, [esp + 0x14]
push eax
call fcn.00475990
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 0xc], eax
je 0x406dc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406dc1
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00406ba0
test eax, eax
mov dword [0x5bc8c0], eax
je 0x406dc1
lea ecx, [esp + 4]
push edi
push ecx
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov edi, dword [esp + 0x218]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jne 0x406d51
mov ecx, dword [0x5bc8c0]
push eax
mov eax, dword [esi + 0x24]
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret 4
push 0x4ce818
push edi
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x406d8b
mov edx, dword [esi + 0x24]
mov eax, dword [0x5bc8c0]
push 0x1e0000
push 0xffffffffffffffff
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret 4
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x406da1
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406db1
mov ecx, dword [0x5bc8c0]
push edi
push ecx
call fcn.004380d0
add esp, 8
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret 4
xor eax, eax
pop esi
add esp, 0x20c
ret 4

Function at 0x406f60
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], si
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x420]
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x4ce82c
push ecx
call fcn.004378b0
add esp, 0x10
test eax, eax
je 0x40700e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4ce840
push 0x4e6d94
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 8]
push 1
push eax
push 0x4e6b8c
call esi
push 2
lea ecx, [esp + 0x214]
push 0x4e6b8c
push ecx
call esi
lea edx, [esp + 8]
push 1
push edx
call fcn.00476830
add esp, 8
pop edi
pop esi
add esp, 0x410
ret 4
Function at 0x4070e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 4]
push 0x103
push ecx
push 0x4ce82c
push eax
call fcn.004378b0
add esp, 0x10
test eax, eax
pop edi
je 0x407131
lea edx, [esp]
push edx
call fcn.0041dfb0
mov ecx, eax
call fcn.0041fba0
add esp, 0x208
ret 4

Function at 0x407280
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x5bc488]
sub esp, 0x218
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
mov esi, ecx
jne 0x4072f1
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x54]
lea ecx, [esp + 0x1c]
push eax
push str._s_taihang_cookieevent
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x2c]
push edx
call fcn.0042c310
add esp, 0x14
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
mov eax, dword [0x5bc488]
cmp eax, ebx
pop edi
jne 0x4072f1
call fcn.0042ce20
call fcn.0042ce80
call fcn.00430230
lea ecx, [esp + 8]
push ebx
lea edx, [esi + 8]
push ecx
push edx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdiplusStartup
push 1
call fcn.00464000
push section..taihang
call fcn.00470560
add esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [esi + 0x40]
mov dword [esi + 0x3c], eax
call fcn.004135d0
mov ecx, 0x5bae08
call fcn.0045b670
mov ecx, esi
call fcn.00407a80
mov eax, dword [0x5bc474]
pop esi
cmp eax, ebx
pop ebx
je 0x40736a
push str.MFC42U.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, 1
add esp, 0x218
ret
Function at 0x4077f0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x4c], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x407690
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x407832
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004078c0
pop esi
pop ecx
ret 4

Function at 0x407890
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push ecx
push 0x407850
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4078be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x407a20
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x407a7c
mov eax, dword [0x4ce620]
test eax, eax
je 0x407a7c
mov dword [0x4ce620], 0
call fcn.00406a80
push eax
push 0x4ce4dc
push 0x823
push 0x4e9654
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x4e9654
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x407a76
push 0x4e9654
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407a7c
mov eax, 0x4e9654
ret
xor eax, eax
ret
Function at 0x407a80
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x407aa6
mov eax, dword [0x5c209c]
test eax, eax
je 0x407aa6
call fcn.004152c0
test eax, eax
jne 0x407aa6
push eax
call fcn.00415140
mov ecx, eax
call fcn.00416260
push 1
call fcn.00454960
push 1
push 2
push 9
call fcn.00454930
push 1
push 2
push 0xf
call fcn.00454930
push 1
push 2
push 0xa
call fcn.00454930
push 0
call fcn.00454960
add esp, 0x2c
jmp 0x4386b0
sub esp, 0x214
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.Disable_Script_Debugger
push str.SoftwareMicrosoftInternet_ExplorerMain
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x43873d
lea eax, [esp + 0x14]
push 0x4daa58
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43873d
push 8
push 0x4daa58
push 1
push str.Disable_Script_Debugger
push str.SoftwareMicrosoftInternet_ExplorerMain
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [0x5bc488]
test eax, eax
je 0x4387af
mov eax, dword [0x5c3560]
mov dword [esp + 8], 0
test eax, eax
je 0x438780
push 1
push 0x4e6f9c
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call fcn.004381c0
add esp, 0xc
lea ecx, [esp + 8]
push 4
push ecx
push 4
push str.AllSitesCompatibilityMode
push str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
jmp 0x4387a8
push 0x4e6f9c
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea edx, [esp + 8]
push 4
push edx
push 4
push str.160A
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [0x5bc484]
pop edi
test eax, eax
pop esi
jne 0x4387ce
push 1
push 0x4e6f9c
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SCRIPTURL_MITIGATION
call fcn.004381c0
add esp, 0xc
mov eax, dword [0x5bc474]
test eax, eax
je 0x4387eb
push 0
push 0x4e6f9c
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_INTERNET_SHELL_FOLDERS
call fcn.004381c0
add esp, 0xc
push 0
push 0x4e6f9c
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BLOCK_LMZ_SCRIPT
call fcn.004381c0
add esp, 0x220
ret
Function at 0x407ae0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x407aff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5c01a4]
push 0x208
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
lea edx, [esp + 0x10]
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x407b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x5bc474]
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x407b9a
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
lea edx, [esp + 0x2c]
push edi
push edx
mov dword [esp + 0x34], 0x4df0c730
mov word [esp + 0x38], 0xdf9d
mov word [esp + 0x3a], 0x4ae3
mov byte [esp + 0x3c], 0x91
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x3e], 0xaa
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x82
mov byte [esp + 0x41], 0xe9
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x5a
mov dword [esp + 0x24], 0x8be2d872
mov word [esp + 0x28], 0x86aa
mov word [esp + 0x2a], 0x4d47
mov byte [esp + 0x2c], 0xb7
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0xcc
mov byte [esp + 0x30], 0xa4
mov byte [esp + 0x31], 0xc
mov byte [esp + 0x32], 0x70
mov byte [esp + 0x33], 0x18
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x407c77
mov eax, dword [esp + 8]
cmp eax, edi
je 0x407c77
lea edx, [esp + 0xc]
add esi, 0x25c
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
test eax, eax
jne 0x407c6d
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x407c6d
mov ecx, dword [eax]
push eax
mov edi, 1
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
add esp, 0x28
ret
Function at 0x407da0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
test eax, eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
push edi
mov edx, ecx
jne 0x407e30
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
push str.LoginEnrolLoginEnrol.dll
add edx, 0x25c
push str.Extensions
push edx
stosw word es:[edi], ax
push 0x4ce9f4
lea eax, [esp + 0x20]
push 0x103
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x407e30
push str.GetProfilePath
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407e29
mov edx, dword [esp + 0x224]
dec edx
push edx
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [ebx], 0
jne 0x407e7d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x224]
lea ecx, [esp + 0x10]
push str.360SE
push ecx
dec edx
push 0x4ce9c8
push edx
push ebx
call ebp
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 0xc

Function at 0x40ba00
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push edi
mov eax, dword [esi + 0x2c]
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esi + 4]
push 0x80
push 0xffffffffffffffec
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push edi
push ebx
call ebp
test eax, eax
je 0x40ba4f
push 0
push edi
push ebx
call ebp
mov eax, dword [esi + 4]
push 0x8000080
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.0040bac0
test eax, eax
jne 0x40ba79
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40f540
Capabilities:
Terminate process
Terminate thread

Disassembly:
push esi
push 0
mov esi, ecx
push 0
call fcn.0040ee70
cmp dword [esi + 0x5650], 2
jne 0x40f56d
mov eax, dword [esi + 0x55e8]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
call fcn.0040f1e0
pop esi
ret
mov ecx, dword [esi + 0x55f0]
push edi
push ecx
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x40f598
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x5650]
pop edi
cmp eax, 1
jne 0x40f5b7
mov edx, dword [esi + 0x5648]
push edx
call fcn.0046f5d0
mov ecx, eax
call fcn.0046f9f0
mov ecx, esi
call fcn.0040f1e0
pop esi
ret
Function at 0x412790
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x54eaa0
call fcn.00412ad0
push 0x40
push 0x4bfc98
push 0x54eaa0
push 0x54eaa0
call fcn.004129f0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x41281b
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x4ceea8]
mov ecx, 8
mov esi, eax
mov edi, 0x54ea80
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00412930
mov ecx, dword [0x4ceea4]
mov edx, dword [0x4ceea8]
push 0x20
push ecx
push edx
call fcn.00412a40
mov edi, dword [0x4ceea4]
add esp, 0x14
mov ecx, 8
mov esi, 0x54ea80
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4127cf
jmp 0x412874
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x4ceea4]
mov ecx, 8
mov esi, eax
mov edi, 0x54ea80
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00412930
mov ecx, dword [0x4ceea8]
mov edx, dword [0x4ceea4]
push 0x20
push ecx
push edx
call fcn.00412a40
mov edi, dword [0x4ceea8]
add esp, 0x14
mov ecx, 8
mov esi, 0x54ea80
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x41282a
push 0x40
push 0x4bfcd8
push 0x54eaa0
push 0x54eaa0
call fcn.004129f0
mov eax, dword [esp + 0x24]
push 0x40
push 0x54eaa0
push eax
call fcn.00412b10
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4128b0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x54ea40
call fcn.00412ad0
push 0x38
push str.91__
push 0x54ea40
push 0x54ea40
call fcn.004129f0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x4bfdd0]
mov edx, dword [0x4ceeac]
push ecx
push 0x1c
push edx
call fcn.00412a70
movsx eax, byte [esi + 0x4bfdd0]
mov ecx, dword [0x4ceeb0]
push eax
push 0x1c
push ecx
call fcn.00412a70
push 0x30
push 0x4bfda0
push 0x54ea40
push edi
call fcn.004129f0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4128e2
pop edi
pop esi
ret

Function at 0x412930
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x4bfd18
push esi
push 0x54ea10
call fcn.004129f0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x54ea10
call fcn.00412a40
push 0x54ea10
push esi
call fcn.00412980
push 0x20
push 0x4bfd48
push esi
push esi
call fcn.004129f0
add esp, 0x34
pop esi
ret

Function at 0x412a40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x412a62
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x412a54
pop ebx
pop esi
ret
Function at 0x414050
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
push edi
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x44
lea edx, [esp + 0x10]
push edi
push edx
push 0x44000000
push 0x4e6b30
push str.XWnd
push 0
mov ecx, esi
call fcn.004b6090
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0
push 0xc6
push ecx
push 0x19
push 0x12c
push 0x190
push 0x1f4
push 0x50000300
push 0x39
call fcn.0046a9d0
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
add esp, 4
push eax
push str.Button
push 0
call ebx
lea edi, [esi + 0x44]
push 0
push 0x5aff
push 0xd0721f
mov ecx, edi
mov dword [esi + 0x52c], eax
call fcn.00445560
mov edx, dword [esi + 4]
push 0xc6
push edx
mov ecx, edi
call fcn.00445a50
mov eax, dword [esi + 4]
push 0
push 0
push 0xc7
push eax
push 0x19
push 0x12c
push 0x190
push 0x1f4
push 0x50000300
push 0x3a
call fcn.0046a9d0
add esp, 4
push eax
push str.Button
push 0
call ebx
lea edi, [esi + 0x2b8]
push 0
push 0x5aff
push 0xd0721f
mov ecx, edi
mov dword [esi + 0x530], eax
call fcn.00445560
push 0xc7
mov ecx, dword [esi + 4]
push ecx
mov ecx, edi
call fcn.00445a50
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x414200
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x414220
call fcn.00414180
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4

Function at 0x414250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
jle 0x414280
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4cefa4]
xor eax, edx
inc ecx
dec esi
jne 0x414261
pop ebx
not eax
pop esi
ret
Function at 0x415190
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20c
push esi
call fcn.00415f20
mov esi, dword [esp + 0x214]
test eax, eax
jne 0x41522f
push 0
push str._tp:
mov ecx, 0x4e6b38
call fcn.00406a80
push eax
call fcn.00437820
add esp, 0xc
cmp eax, 2
je 0x41522f
mov ax, word [0x4e6b30]
push edi
mov word [esp + 0xc], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
push esi
push 0x4ce82c
push 2
push str._tp:
push str._s_d__s_d
lea ecx, [esp + 0x20]
push 0x103
push ecx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
lea edx, [esp + 0xc]
push 5
push 0
push edx
push 0x4e6b8c
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
jbe 0x4152b2
test esi, esi
je 0x41523d
mov dword [0x5c2098], 1
call fcn.00416380
push esi
call fcn.00415470
push esi
call fcn.00415890
push esi
call fcn.004155b0
push esi
call fcn.00415c50
add esp, 0x10
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0xa
push 2
push str.SOFTWAREClientsStartMenuInternet
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x5bc47c]
test eax, eax
je 0x4152b2
test esi, esi
je 0x4152ad
call fcn.00478180
pop esi
add esp, 0x20c
ret
call fcn.00478190
pop esi
add esp, 0x20c
ret

Function at 0x415470
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x208
mov ax, word [0x4e6b30]
push edi
mov word [esp + 4], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x210]
test eax, eax
je 0x415562
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x4e6f9c
call esi
add esp, 4
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
shl eax, 1
push eax
push 0x4e6f9c
push 1
push 0x4e6b30
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4e6f9c
push str.SOFTWAREClientsStartMenuInternet
push 0x4cf56c
lea ecx, [esp + 0x18]
push 0x103
push ecx
call ebx
push str.360SE_Browser
call esi
add esp, 0x18
lea edx, [esp + 0xc]
shl eax, 1
push eax
push str.360SE_Browser
push 1
push 0x4e6b30
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.shellopencommand
push 0x4e6f9c
push str.SOFTWAREClientsStartMenuInternet
push str._s_s_s
lea eax, [esp + 0x1c]
push 0x103
push eax
call ebx
push 0x4e6b8c
call esi
add esp, 0x1c
lea ecx, [esp + 0xc]
shl eax, 1
push eax
push 0x4e6b8c
push 1
push 0x4e6b30
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
pop esi
pop ebx
jmp 0x41558f
push str.IEXPLORE.EXE
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
shl eax, 1
push eax
push str.IEXPLORE.EXE
push 1
push 0x4e6b30
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SOFTWAREClientsStartMenuInternet
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
add esp, 0x208
ret