joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413890
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
cmp esi, ebp
je 0x413999
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x413999
lea ecx, [esp + 0x14]
push 1
push ecx
lea edx, [esp + 0x20]
lea ecx, [esp + 0x14]
push edx
push ecx
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call fcn.00413c90
add esp, 0x14
test eax, eax
je 0x413999
mov edx, dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
push edx
push 0x11c
call fcn.00439630
mov ebx, eax
add esp, 8
cmp ebx, ebp
je 0x413982
push edi
mov ecx, 0x47
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 0x10], eax
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
mov edx, dword [esp + 0x18]
mov dword [ebx + 4], edx
mov eax, dword [esp + 0x1c]
mov dword [ebx + 8], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
push ebx
and ecx, 3
push 0x413a80
push ebp
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebp
pop edi
jne 0x4139a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00414000
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 0x10
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00414000
add esp, 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebx + 0xc], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x413c90
Capabilities:
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
je 0x413dee
mov al, byte [0x45128a]
test al, al
je 0x413dee
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp], 0
mov ecx, dword [0x44fbec]
test ecx, ecx
push 0
push 0
sete al
push 0
push eax
push str.SangforCS
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi], eax
jne 0x413d0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpen_Failed__u
call fcn.00411930
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
ret
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea ecx, [esp + 0x18]
push 4
push ecx
push 2
push eax
mov dword [esp + 0x28], 0x1d4c0
call edi
mov eax, dword [esi]
lea edx, [esp + 0x18]
push 4
push edx
push 5
push eax
call edi
mov edx, dword [esi]
lea ecx, [esp + 0x18]
push 4
push ecx
push 7
push edx
call edi
mov ecx, dword [esi]
lea eax, [esp + 0x18]
push 4
push eax
push 6
push ecx
call edi
mov dx, word [0x451268]
mov eax, dword [esi]
push 0
push 0
push 3
push 0x44f588
push 0x44f588
push edx
push 0x45128a
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [ebx], eax
pop edi
jne 0x413d8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetConnect_Failed__u
jmp 0x413dde
mov ecx, dword [esp + 0x20]
mov edx, 0x84400000
test ecx, ecx
je 0x413d9c
mov edx, 0x84c01000
test ecx, ecx
mov dword [esp + 0x18], 0
mov ecx, str.POST
jne 0x413db2
mov ecx, 0x44ad84
push 0
push edx
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [ebp], eax
jne 0x413df4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpOpenRequest_Failed__u
call fcn.00411930
push ebp
push ebx
push esi
call fcn.00414000
add esp, 0x14
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x44fc78
push 0x44fbf4
push eax
call fcn.00413bd0
add esp, 0xc
test eax, eax
jne 0x413e26
push str.SetIEProxyInfo_Failed
call fcn.00411930
push ebp
push ebx
push esi
call fcn.00414000
add esp, 0x10
xor eax, eax
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x413e30
Capabilities:
Connect to http server
Create http request

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x413e45
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x2c]
lea ebx, [eax + eax*8]
lea ebx, [ebx + ebx*8]
shl ebx, 1
mov al, byte [ebx + 0x451332]
lea ebp, [ebx + 0x451332]
test al, al
jne 0x413e69
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [0x44fbec]
xor eax, eax
test esi, esi
push 0
push 0
sete al
push 0
push eax
push str.SangforCS
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [esp + 0x1c]
test eax, eax
mov dword [esi], eax
jne 0x413eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpen_Failed__u
call fcn.00411930
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea ecx, [esp + 0x2c]
push 4
push ecx
push 2
push eax
mov dword [esp + 0x3c], 0x1d4c0
call edi
mov eax, dword [esi]
lea edx, [esp + 0x2c]
push 4
push edx
push 5
push eax
call edi
mov edx, dword [esi]
lea ecx, [esp + 0x2c]
push 4
push ecx
push 7
push edx
call edi
mov ecx, dword [esi]
lea eax, [esp + 0x2c]
push 4
push eax
push 6
push ecx
call edi
mov dx, word [ebx + 0x451310]
mov eax, dword [esi]
push 0
push 0
push 3
push 0x44f588
push 0x44f588
push edx
push ebp
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, dword [esp + 0x20]
test eax, eax
mov dword [ebx], eax
jne 0x413f46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetConnect_Failed__u
call fcn.00411930
mov ecx, dword [esp + 0x2c]
push ecx
push ebx
push esi
call fcn.00414000
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x28]
mov edx, 0x84400000
test ecx, ecx
je 0x413f58
mov edx, 0x84c01000
test ecx, ecx
mov dword [esp + 0x10], 0
mov ecx, str.POST
jne 0x413f6e
mov ecx, 0x44ad84
push 0
push edx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, dword [esp + 0x24]
test eax, eax
mov dword [edi], eax
jne 0x413fb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpOpenRequest_Failed__u
call fcn.00411930
push edi
push ebx
push esi
call fcn.00414000
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x44fc78
push 0x44fbf4
push eax
call fcn.00413bd0
add esp, 0xc
test eax, eax
jne 0x413fe9
push str.SetIEProxyInfo_Failed
call fcn.00411930
push edi
push ebx
push esi
call fcn.00414000
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x416610
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, dword [esp + 0x4c]
mov esi, ecx
mov ecx, edi
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esi + 4]
test eax, eax
je 0x4166b4
test byte [eax], 8
je 0x41663e
push str.Ctrl
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esi + 4]
test byte [eax], 4
je 0x416652
push str.Shift
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esi + 4]
test byte [ecx], 0x10
je 0x416666
push str.Alt
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esi + 4]
test byte [eax], 1
je 0x4166a2
xor edx, edx
push 0
mov dx, word [eax + 2]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
lea ecx, [esp + 8]
push 0x40
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edx, [esp + 8]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator_2
pop edi
pop esi
add esp, 0x40
ret 4
cmp word [eax + 2], 0x1b
je 0x4166b4
mov al, byte [eax + 2]
mov ecx, edi
push eax
call fcn.00438f30
pop edi
pop esi
add esp, 0x40
ret 4

Function at 0x418680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a55b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x1c
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
cmp esi, ebx
mov dword [esp + 0x18], ebx
je 0x4186e9
lea ecx, [esi + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [esi + 4], 0x505a0a0
mov dword [esi + 8], ebx
mov byte [esi + 0xd], bl
mov byte [esi + 0xe], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 0x10
mov dword [esi], 0x43e670
mov byte [esi + 0xc], 1
jmp 0x4186eb
xor esi, esi
mov edx, dword [edi + 0x58]
lea ecx, [edi + 0x50]
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
push eax
push 1
push edx
mov dword [esp + 0x18], esi
call fcn.00418a10
mov eax, dword [edi + 4]
push esi
push ebx
push 0x900
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x419c20
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.dbghelp.dll_SymGetModuleBase]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x419c4b
mov eax, dword [ebp - 0x20]
jmp 0x419d1b
push 0x1c
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x419d18
push 0x104
lea edx, [ebp - 0x330]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x22c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x104
lea edx, [ebp - 0x128]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x44b410
lea edx, [ebp - 0x128]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
lea eax, [ebp - 0x330]
and edx, eax
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.dbghelp.dll_SymLoadModule]
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41a550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push edi
mov byte [ebp - 0x508], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x507]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x60c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x60b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x508]
mov dword [ebp - 0x618], eax
mov byte [ebp - 0x404], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x403]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x610], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x610]
push ecx
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
lea edx, [ebp - 0x610]
push edx
call dword [sym.imp.MSVCRT.dll_localtime]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
add edx, 0x76c
push edx
push str.C:SangforCSClient__d_d_d.log
push 0x103
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
push 0x44b48c
mov ecx, dword [ebp - 0x618]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
je 0x41a697
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_asctime]
add esp, 4
push eax
push str._n_n_s_n
push 0x3ff
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov ecx, dword [ebp - 0x614]
push ecx
push 1
lea edi, [ebp - 0x404]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
jmp 0x41a6ab
mov eax, dword [ebp - 0x618]
push eax
push str._OpenCrashLogFile__open_file__s_failed_
call fcn.00411930
add esp, 8
mov eax, dword [ebp - 0x614]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41b0d0
Capabilities:
Read file via mapping

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
lea eax, [esp + 0x408]
lea edx, [esp]
push ebx
push esi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
push str.HTMLManager
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
mov ebx, eax
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x41b13e
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x41b13e
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
pop ebx
add esp, 0x400
ret
Function at 0x41b900
Capabilities:
Create thread
Print debug messages
Resume thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x41b91f
push str.Call_one_of_the_CPictureEx::Load___member_functions_before_calling_Draw___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, esi
call fcn.0041c520
test eax, eax
je 0x41b96b
lea eax, [esp + 8]
push eax
push 4
push esi
push 0x41bea0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x6c], eax
test eax, eax
jne 0x41b95d
push str.Draw:_Couldnt_start_a_GIF_animation_thread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
add esp, 8
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x74]
test eax, eax
je 0x41b918
mov ecx, dword [eax]
lea edx, [esp + 8]
push edi
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x74]
lea edx, [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, dword [esp + 8]
push 0
mov edi, ecx
mov eax, dword [esi + 0x74]
neg edi
push edi
mov edi, dword [esp + 0x14]
push edi
push ecx
mov ecx, dword [esi + 0x2c]
mov edx, dword [eax]
push 0
push ecx
mov ecx, dword [esi + 0x28]
push ecx
mov ecx, dword [esi + 0x54]
push 0
push 0
push ecx
push eax
call dword [edx + 0x20]
test eax, eax
pop edi
jne 0x41b918
mov edx, dword [esi + 4]
push eax
push eax
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x41b9e0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x44b9b0
mov ebp, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x41ba13
push str.Load__file_:_Error_opening_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
add esp, 0x1c
push ebx
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x41ba56
push str.Load__file_:_Error_allocating_memory_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x41ba7c
push str.Load__file_:_Error_locking_memory_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
push esi
push ebx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, ebx
je 0x41baba
mov ecx, dword [esp + 0x14]
push ecx
push str.Load__file_:_Error_reading_the_file__s_n
call fcn.0041b0d0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, ebp
push ebx
push edi
call fcn.0041b260
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41d550
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43a778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
push esi
push edi
mov edi, ecx
push 0x18
call ebp
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CBrush::CBrush
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
mov ebx, dword [esp + 0x30]
neg eax
sbb eax, eax
mov dword [esp + 0x20], 0
and eax, ecx
push eax
mov eax, dword [esi + 4]
push ebx
push eax
call dword [sym.imp.USER32.dll_FillRect]
push 1
mov ecx, esi
call sub.MFC42.DLL_CDC::SetBkMode
mov edx, dword [esi]
push 0x17
mov dword [esp + 0x34], edx
call ebp
mov edx, dword [esp + 0x30]
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [esi]
push eax
call sub.MFC42.DLL_CGdiObject::FromHandle
push eax
mov ecx, esi
call dword [edi + 0x30]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push edx
mov edi, eax
call fcn.00438f24
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edx, dword [esi]
push ebp
mov ecx, dword [eax - 8]
push ebx
push ecx
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call dword [edx + 0x70]
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x30]
mov dword [esp + 0x10], 0x43d5f4
mov dword [esp + 0x20], 2
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x41d870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
test esi, esi
jle 0x41d900
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
sub ebp, edi
mov dword [esp + 0x1c], esi
jmp 0x41d89c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc cl
and ecx, 0xff
mov esi, ecx
mov dword [esp + 0x14], esi
mov ecx, dword [eax + esi*4 + 8]
mov dword [esp + 0x18], ecx
add cl, dl
mov edx, dword [esp + 0x18]
and ecx, 0xff
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + ecx*4 + 8]
mov dword [eax + esi*4 + 8], ecx
mov esi, dword [esp + 0x10]
add cl, dl
and ecx, 0xff
mov dword [eax + esi*4 + 8], edx
mov dl, byte [edi + ebp]
mov cl, byte [eax + ecx*4 + 8]
xor cl, dl
mov byte [edi], cl
mov ecx, dword [esp + 0x1c]
inc edi
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x41d894
mov edx, dword [esp + 0x14]
mov ecx, esi
pop edi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop esi
ret
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
ret
Function at 0x41fa30
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x574
push ebx
push ebp
push edi
xor ebx, ebx
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x171]
mov byte [esp + 0x170], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.CSClient_Ready_Event
push ebx
push 1
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebp, eax
cmp ebp, ebx
je 0x41fbec
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
push str.SOFTWARESangforSSLSangforCSClient
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41fbec
mov ecx, 0x40
lea edi, [esp + 0x6d]
mov byte [esp + 0x6c], bl
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x104
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push str.SangforCSClientPath
push ecx
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fbe1
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41fbe1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x1c], eax
push 0x44fcfc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [0x44fbec]
cmp eax, ebx
jne 0x41fb46
lea ecx, [esp + 0x70]
lea edx, [esp + 0x174]
push ecx
push str.__s___s
push 0x40f
push edx
jmp 0x41fb5d
lea eax, [esp + 0x70]
lea ecx, [esp + 0x174]
push eax
push str.__s___s_EnableProxy
push 0x40f
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edx, [esp + 0x170]
push edx
call fcn.00411930
add esp, 4
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x170]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41fbec
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov edi, eax
call esi
cmp edi, 0x102
pop esi
je 0x41fbec
push str.StartCSClient_success_
call fcn.00411930
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x574
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x574
ret

Function at 0x4235f0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0
push eax
push 0x423570
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x423628
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartSubmitThread_failed__errno___d
call fcn.00411930
add esp, 8
xor eax, eax
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 4