joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c5a
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46b379
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x483260]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
mov eax, dword [0x483260]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push dword [edi]
mov dword [esp + 0x24], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412e0a
mov eax, dword [edi]
push dword [eax - 0xc]
mov esi, edi
call fcn.0040315e
push eax
call fcn.00402520
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop ecx
xor ebx, ebx
push ebx
push eax
call fcn.0040315e
push eax
call fcn.004025eb
lea eax, [esp + 0x1c]
push 0x4768a0
push eax
mov ecx, edi
call fcn.0040bbc2
add esp, 0x10
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28c], ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x412dfe
lea eax, [esp + 0x10]
push 0x474fcc
push eax
mov ecx, edi
call fcn.0040bbc2
pop ecx
pop ecx
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x290], 1
call fcn.0040bc7f
test byte [esp + 0x24], 0x10
lea eax, [esp + 0x50]
je 0x412d7a
push 0x4768a8
push eax
call fcn.0043f6e9
pop ecx
pop ecx
test eax, eax
je 0x412dca
lea eax, [esp + 0x50]
push 0x476040
push eax
call fcn.0043f6e9
pop ecx
pop ecx
test eax, eax
je 0x412dca
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
call fcn.00412c5a
jmp 0x412dca
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402ad3
push 0x4768ac
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x290], 2
call fcn.0040bb10
test eax, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
lea esi, [esp + 0x10]
jne 0x412daf
push 1
jmp 0x412db0
push ebx
push eax
call fcn.0040315e
push eax
call fcn.004025eb
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004031f6
mov byte [esp + 0x288], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.004031f6
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412d0f
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.004031f6
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0043b103
mov esp, ebp
pop ebp
ret 4
Function at 0x412e30
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x46c
mov eax, 0x46b330
call fcn.00443760
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
push str.IsInstalled
push str.SOFTWAREMicrosoftActive_SetupInstalled_ComponentsEF289A85_8E57_408d_BE47_73B55609861A
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x430], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x428], edi
je 0x412e92
xor eax, eax
inc eax
call fcn.004437e3
ret
mov dword [ebp - method.CResourceUnpack.virtual_0], vtable.CResourceUnpack.0
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x434], edi
push str.ROOTSUPD
push 0x104
push edi
lea esi, [ebp - 0x43c]
mov dword [ebp - 4], edi
call fcn.0040b66f
test eax, eax
jne 0x412ec9
xor eax, eax
jmp 0x412e8c
mov ecx, 0x485f6c
lea esi, [ebp - 0x424]
call fcn.00402b4a
push 1
mov eax, esi
push eax
lea eax, [ebp - 0x43c]
push eax
mov byte [ebp - 4], 1
call fcn.0040b831
test eax, eax
jne 0x412f02
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
call fcn.004031f6
jmp 0x412ec5
xor eax, eax
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.0043e180
mov esi, dword [ebp - 0x424]
add esp, 0xc
push str.rootsupd.exe
push esi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x412f4c
lea eax, [esi - 0x10]
call fcn.004031f6
mov eax, edi
jmp 0x412e8c
push 0x38
lea eax, [ebp - 0x474]
push edi
push eax
call fcn.0043e180
lea eax, [ebp - 0x420]
mov dword [ebp - 0x468], eax
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
mov dword [ebp - 0x478], 0x3c
mov dword [ebp - 0x474], 0x440
mov dword [ebp - 0x46c], 0x4769e8
mov dword [ebp - 0x464], 0x4769d8
mov dword [ebp - 0x45c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412f3d
cmp dword [ebp - 0x458], 0x20
jle 0x412f3d
xor edi, edi
inc edi
jmp 0x412f3d

Function at 0x413d7b
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x414311
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, 0x105
call fcn.004144c6
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [esp + 0x10]
mov esi, eax
call fcn.004144e2
mov eax, esi
pop esi
ret

Function at 0x414b09
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414b31
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x414b31
xor al, al
jmp 0x414b4c
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.0045cbe0
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
pop ebp
ret 4
Function at 0x4166c6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
call edi
test eax, eax
je 0x4166f0
xor eax, eax
inc eax
jmp 0x41675a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0043e180
lea edx, [ebp - 0x20c]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x416718
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x41675a
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x416751
lea eax, [ebp - 0x20c]
push eax
call fcn.004166c6
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043b103
leave
ret

Function at 0x416768
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41678a
xor al, al
jmp 0x416803
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0043e180
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
push str._s_d.tmp
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0043f3d3
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x416786
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b103
leave
ret
Function at 0x41680f
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x670], edi
cmp edi, esi
jne 0x41683b
xor eax, eax
jmp 0x4169e2
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416834
push 0x24c
lea eax, [ebp - 0x668]
push esi
push eax
mov dword [ebp - 0x66c], esi
call fcn.0043e180
add esp, 0xc
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push esi
push eax
call fcn.0043e180
add esp, 0xc
push 0x476ae4
push edi
mov edi, 0x475124
push edi
mov esi, 0x103
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0043f3d3
add esp, 0x14
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x674], eax
cmp eax, 0xffffffff
je 0x416834
mov ecx, 0x4768a8
lea eax, [ebp - 0x640]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4168f5
test dx, dx
je 0x4168f1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4168f5
add eax, 4
add ecx, 4
test dx, dx
jne 0x4168cf
xor eax, eax
jmp 0x4168fa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4169a1
mov ecx, 0x476040
lea eax, [ebp - 0x640]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416933
test dx, dx
je 0x41692f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416933
add eax, 4
add ecx, 4
test dx, dx
jne 0x41690d
xor eax, eax
jmp 0x416938
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4169a1
xor eax, eax
push ebx
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.0043e180
add esp, 0xc
test byte [ebp - 0x66c], 0x10
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x670]
lea eax, [ebp - 0x214]
push edi
push esi
push eax
je 0x41698c
call fcn.0043f3d3
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call fcn.0041680f
pop ecx
jmp 0x4169a1
call fcn.0043f3d3
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4168c4
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b103
leave
ret
Function at 0x416e06
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416e5a
xor eax, eax
push 0x50
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
pop ecx
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], esi
mov word [ebp - 0x10], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x416e58
push dword [ebp - 0xa]
call dword [sym.imp.SHELL32.dll_SHFreeNameMappings]
mov eax, esi
pop esi
leave
ret
Function at 0x4179af
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bc7e
mov eax, dword fs:[0]
push eax
mov eax, 0x1234
call fcn.0045fd70
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x224]
push eax
push 0x1000
lea eax, [ebp - 0x1240]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x417a05
or eax, 0xffffffff
jmp 0x417b98
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x23c]
push eax
shr esi, 2
call fcn.00418408
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x220], edi
cmp esi, edi
jbe 0x417ae8
push dword [ebp + edi*4 - 0x1240]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x21c], ebx
test ebx, ebx
je 0x417adf
lea eax, [ebp - 0x240]
push eax
push 4
lea eax, [ebp - 0x220]
push eax
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x417ad8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0043e180
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x417ad8
lea eax, [ebp - 0x218]
push str.360DrvMgr.exe
push eax
call fcn.0043f6e9
pop ecx
pop ecx
test eax, eax
jne 0x417ad8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x23c]
call fcn.0041846f
jmp 0x417adf
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x417a2d
mov ebx, dword [ebp - 0x22c]
sub ebx, dword [ebp - 0x230]
sar ebx, 2
test ebx, ebx
jbe 0x417b7f
xor ecx, ecx
push 4
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043af6d
pop ecx
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x417b61
xor edi, edi
test ebx, ebx
jbe 0x417b41
lea esi, [ebp - 0x23c]
call fcn.00418456
mov eax, dword [eax]
mov ecx, dword [ebp - 0x21c]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x417b26
push 0xbb8
push 1
push dword [ebp - 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x21c]
call fcn.0043e030
pop ecx
xor edi, edi
test ebx, ebx
jbe 0x417b7f
lea esi, [ebp - 0x23c]
call fcn.00418456
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x417b67
lea esi, [ebp - 0x23c]
call fcn.004185a1
push dword [ebp - 0x23c]
call fcn.0043b0f8
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b103
leave
ret
Function at 0x418222
Capabilities:
Delete registry key
Set registry value

Disassembly:
push esi
push edi
push 2
push 0x476b24
push 4
push 0x474f2c
mov edi, str.CLSID1A893393_71A8_4a50_95A1_2B89DE87B24C
push edi
mov esi, SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x418254
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov al, 1
jmp 0x418256
xor al, al
pop edi
pop esi
ret

Function at 0x418259
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x290]
mov eax, 0x1220
call fcn.0045fd70
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push esi
xor esi, esi
mov dword [ebp + 0x78], esi
cmp dword [ebp + 0x298], esi
je 0x418370
lea eax, [ebp + 0x74]
push eax
push 0x1000
lea eax, [ebp - 0xf90]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x418370
push edi
mov edi, dword [ebp + 0x74]
shr edi, 2
mov dword [ebp + 0x7c], esi
mov dword [ebp + 0x80], esi
cmp edi, esi
jbe 0x41836a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4182ca
xor esi, esi
mov eax, dword [ebp + 0x80]
push dword [ebp + eax*4 - 0xf90]
push esi
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41834e
lea eax, [ebp + 0x70]
push eax
push 4
lea eax, [ebp + 0x7c]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41834b
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x84], ax
lea eax, [ebp + 0x86]
push eax
call fcn.0043e180
add esp, 0xc
push 0x104
lea eax, [ebp + 0x84]
push eax
push dword [ebp + 0x7c]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x41834b
lea eax, [ebp + 0x84]
push str.360DrvMgr.exe
push eax
call fcn.0043f6e9
pop ecx
pop ecx
test eax, eax
je 0x418362
push esi
call ebx
inc dword [ebp + 0x80]
cmp dword [ebp + 0x80], edi
jb 0x4182c8
jmp 0x418369
mov dword [ebp + 0x78], 1
pop ebx
mov eax, dword [ebp + 0x78]
pop edi
jmp 0x418372
xor eax, eax
mov ecx, dword [ebp + 0x28c]
xor ecx, ebp
pop esi
call fcn.0043b103
add ebp, 0x290
leave
ret
Function at 0x418cdb
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x469c3f
call fcn.004436f7
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
push eax
push 0x47132c
push 1
push ebx
push 0x472e7c
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x418db6
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0043e180
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x418d57
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp]
push esi
push eax
call fcn.0043e90d
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4732ec
push eax
call dword [ecx]
test eax, eax
jl 0x418db6
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push 2
push edi
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x418db6
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x418dc6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x418dd7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043b103
add ebp, 0x20c
leave
ret
Function at 0x418eee
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1_
mov esi, ecx
mov byte [ebp - 0x71], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x418f41
xor al, al
mov ecx, dword [ebp + 0x390]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b103
add ebp, 0x394
leave
ret
push edi
push ebx
push 0x80080000
push ebx
push ebx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
cmp esi, ebx
jne 0x418f68
push dword [ebp - 0x80]
call edi
mov al, bl
pop edi
jmp 0x418f2a
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x20000013
push esi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0x7c]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x418fc3
push 0x3ff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call fcn.0043e180
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x400
lea eax, [ebp - 0x70]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
setne byte [ebp - 0x71]
push esi
call edi
mov bl, byte [ebp - 0x71]
jmp 0x418f5e
Function at 0x418ffa
Capabilities:
Create thread

Disassembly:
push 0x928
mov eax, 0x46bb9f
call fcn.00443760
xor eax, eax
mov edi, 0x80
mov dword [ebp - 4], 3
push edi
mov word [ebp - 0x124], ax
xor ebx, ebx
lea eax, [ebp - 0x122]
push ebx
push eax
call fcn.0043e180
add esp, 0xc
lea esi, [ebp - 0x124]
call fcn.00416693
xor eax, eax
push edi
mov word [ebp - 0x9c], ax
lea eax, [ebp - 0x9a]
push ebx
push eax
call fcn.0043e180
add esp, 0xc
lea esi, [ebp - 0x9c]
call fcn.004324c0
xor eax, eax
push 0x7fe
mov word [ebp - 0x924], ax
lea eax, [ebp - 0x922]
push ebx
push eax
call fcn.0043e180
lea eax, [ebp - 0x928]
add esp, 0xc
push eax
call fcn.004248a8
pop ecx
mov dword [ebp - 0x934], eax
mov byte [ebp - 4], 4
call fcn.0041f395
call fcn.0041fba5
test eax, eax
je 0x4190a9
xor esi, esi
inc esi
jmp 0x4190b0
call fcn.0041f80d
mov esi, eax
call fcn.0041f395
mov edi, eax
call fcn.0041f395
mov dword [ebp - 0x930], eax
call fcn.0041f395
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x934]
push 1
push dword [eax]
call fcn.0041998d
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x930]
push dword [ebp + 0x10]
neg esi
push dword [ebp + 0x14]
sbb esi, esi
and esi, 0x20
add esi, 0x20
push esi
push dword [edi + 0xc]
lea edi, [ebp - 0x924]
push dword [eax + 8]
mov eax, dword [ebp - 0x92c]
push dword [eax + 4]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 8]
mov eax, 0x800
push 4
push str.http:__res.qhsetup.com_drv_inst.htm_type_de_dmid_sm2_so_d._d._dp_dver_srpid_spid_sf_dg_sdm_d
call fcn.00418b65
mov eax, dword [ebp - 0x928]
add esp, 0x3c
add eax, 0xfffffff0
call fcn.004031f6
push dword [ebp + 0x18]
call fcn.00418b36
push ebx
push ebx
mov eax, edi
push eax
push 0x418fcb
push ebx
push ebx
call fcn.0043eaa5
add esp, 0x18
cmp eax, ebx
je 0x419168
push eax
call fcn.00418fdd
pop ecx
jmp 0x41916f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp + 0x18]
add eax, 0xfffffff0
call fcn.004031f6
call fcn.004437e3
ret
Function at 0x419493
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x46aec4
call fcn.004436f7
xor esi, esi
mov dword [ebp - 0x18], esi
cmp dword [ebp + 0xc], esi
je 0x4195ce
cmp dword [ebp + 0x10], esi
je 0x4195ce
push 0x474f2c
lea eax, [ebp - 0x14]
push eax
call fcn.00402ad3
push 0x486024
xor ecx, ecx
push 2
pop edx
mov eax, 0x105
mul edx
seto cl
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x18], 1
neg ecx
or ecx, eax
push ecx
call fcn.0043eb55
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
je 0x4195ac
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
push esi
push ebx
call fcn.0043e180
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp + 0xc]
push edi
call esi
cmp eax, 0xea
jne 0x419597
push ebx
call fcn.0043e030
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x486024
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043eb55
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4195ac
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
push 0
push ebx
call fcn.0043e180
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call esi
test eax, eax
jne 0x4195a5
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00402c33
push ebx
call fcn.0043e030
pop ecx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00402cca
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, esi
jmp 0x4195de
push 0x474f2c
push dword [ebp + 8]
call fcn.00402ad3
mov eax, dword [ebp + 8]
call fcn.004437cf
ret

Function at 0x4195e4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
je 0x419633
cmp dword [ebp + 0x10], 0
je 0x419633
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
call fcn.00402ad3
mov ecx, dword [ebp - 4]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x41960f
lea eax, [ecx - 0x10]
jmp 0x41962e
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push dword [ebp + 0xc]
push str.SOFTWARE360DrvMgr
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004031f6
leave
ret

Function at 0x41966c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push str.inst_times
push str.SOFTWARE_fbd30ee5_8150_549e_9aed_fd9d444318
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret

Function at 0x4196e6
Capabilities:
Set registry value

Disassembly:
push 8
lea eax, [esp + 0xc]
push eax
push 0xb
push str.inst_time
push str.SOFTWARE_fbd30ee5_8150_549e_9aed_fd9d444318
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret