joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415d60
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
lea ebx, [esi + 0x2c]
mov edi, 0x80004005
call fcn.00416670
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x28], eax
je 0x415e59
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminAcquireContext
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x28]
push str.CryptCATAdminReleaseContext
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.CryptCATAdminReleaseCatalogContext
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x28]
push str.CryptCATCatalogInfoFromContext
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x28]
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.CryptCATAdminEnumCatalogFromHash
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x28]
push str.WinVerifyTrust
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
push str.WTHelperProvDataFromStateData
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.WTHelperGetProvSignerFromChain
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 0x28]
push str.WTHelperGetProvCertFromChain
push edx
mov dword [esi + 0x1c], eax
call edi
cmp dword [esi], 0
mov dword [esi + 0x20], eax
je 0x415e51
cmp dword [esi + 4], 0
je 0x415e51
cmp dword [esi + 8], 0
je 0x415e51
cmp dword [esi + 0xc], 0
je 0x415e51
cmp dword [esi + 0x10], 0
je 0x415e51
cmp dword [esi + 0x14], 0
je 0x415e51
cmp dword [esi + 0x24], 0
je 0x415e51
cmp dword [esi + 0x18], 0
je 0x415e51
cmp dword [esi + 0x1c], 0
je 0x415e51
test eax, eax
je 0x415e51
pop edi
xor eax, eax
pop ebx
ret
pop edi
mov eax, 0x80004005
pop ebx
ret
mov eax, edi
pop edi
pop ebx
ret
Function at 0x416960
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x575916
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x2f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x310]
mov dword fs:[0], eax
xor ebx, ebx
push 0xd2
lea eax, [esp + 0x2a]
push ebx
push eax
mov esi, ecx
mov word [esp + 0x30], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, ebx
jne 0x4169cf
xor eax, eax
jmp 0x416b12
cdq
and edx, 3
add eax, edx
push 0x208
lea edx, [esp + 0x102]
mov edi, eax
push ebx
push edx
sar edi, 2
mov word [esp + 0x108], bx
call sub.MSVCR80.dll_memset
add esi, 4
mov word [esp + 0x310], bx
mov ebx, dword [esi + 8]
add esp, 0xc
cmp dword [esi + 4], ebx
lea ebp, [esp + 0x24]
jbe 0x416a15
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
mov dword [esp + 0x14], eax
jbe 0x416a2b
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
push esi
lea eax, [esp + 0x24]
push eax
mov ebx, esi
call fcn.00417840
xor ebx, ebx
cmp edi, ebx
jle 0x416b0d
mov dword [esp + 0x14], edi
or edi, 0xffffffff
jmp 0x416a52
xor ebx, ebx
push 0x104
lea ecx, [esp + 0x100]
push ecx
push ebp
mov word [ebp + 4], bx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x416aff
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x100]
call fcn.0040ff50
mov dword [esp + 0x318], ebx
lea ebx, [esp + 0x1c]
call fcn.004176f0
mov dword [esp + 0x318], edi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416ab9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call fcn.0040ff50
lea ebx, [esp + 0x20]
mov dword [esp + 0x318], 1
call fcn.004176f0
mov dword [esp + 0x318], edi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416aff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x416a50
mov eax, 1
mov ecx, dword [esp + 0x310]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2f8]
xor ecx, esp
call fcn.00569ed6
add esp, 0x308
ret
Function at 0x416b70
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 0x14], 0
jne 0x416bff
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x18], eax
je 0x416bff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x18]
push str.EnumProcesses
push eax
call edi
mov ecx, dword [esi + 0x18]
push str.GetModuleBaseNameW
push ecx
mov dword [esi], eax
call edi
mov edx, dword [esi + 0x18]
push str.GetModuleFileNameExW
push edx
mov dword [esi + 4], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x18]
push str.GetProcessImageFileNameW
push eax
call edi
cmp dword [esi], 0
mov dword [esi + 0x10], eax
pop edi
je 0x416bfa
cmp dword [esi + 4], 0
je 0x416bfa
cmp dword [esi + 8], 0
je 0x416bfa
cmp dword [esi + 0xc], 0
je 0x416bfa
test eax, eax
je 0x416bfa
mov eax, 1
mov dword [esi + 0x14], eax
ret
xor eax, eax
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
ret

Function at 0x416fc0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5bd3a8
push 0x56a94d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
je 0x41706e
lea ecx, [ebp - 0x28]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, esi
je 0x41706e
mov edi, 1
mov dword [ebp - 0x38], edi
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 2
push esi
push esi
push esi
lea ecx, [ebp - 0x38]
push ecx
push esi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, esi
je 0x41706e
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.00417091
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4170b0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push eax
xor edi, edi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4170d5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x4170e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x668
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x664], eax
mov eax, dword [esp + 0x66c]
push ebx
push ebp
xor ecx, ecx
cmp ecx, str.zkremote.exe
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
je 0x417157
push ecx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417157
push 0x228
lea edx, [esp + 0x20]
push 0
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov ebp, 0x22c
push ebx
mov dword [esp + 0x20], ebp
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x41715b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4171bb
mov esi, dword [sym.imp.MSVCR80.dll__wcsnicmp]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
jmp 0x417170
push 0x104
lea ecx, [esp + 0x40]
push ecx
call edi
push eax
push str.zkremote.exe
call esi
add esp, 0xc
test eax, eax
je 0x4171d4
push ebp
lea edx, [esp + 0x1c]
push 0
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x20], ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417170
mov ebp, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00569ed6
add esp, 0x668
ret
mov ecx, dword [esp + 0x20]
push ecx
push 8
mov ebp, 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4171b2
push 0x424
lea edx, [esp + 0x250]
push 0
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x248]
push eax
push esi
mov dword [esp + 0x250], 0x428
call sub.KERNEL32.dll_Module32FirstW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x468]
call fcn.00410020
jmp 0x4171b2
Function at 0x418290
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x572b88
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
xor ebx, ebx
lea eax, [esp + 0x34]
push ebx
push eax
xor ebp, ebp
call sub.MSVCR80.dll_memset
mov edx, dword [0x5e736c]
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x5e736c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 1
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push ecx
push edx
push 0x58cec8
lea edi, [esp + 0x24]
mov dword [esp + 0x90], ebx
call fcn.00410c00
mov edx, dword [esp + 0xa8]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
push ebx
push ebx
neg esi
push ebx
sbb esi, esi
push ebx
and esi, 0xa
mov word [esp + 0x78], si
mov esi, dword [esp + 0x34]
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x418394
mov eax, dword [esp + 0x94]
cmp eax, ebx
je 0x41838f
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x98]
cmp eax, ebx
je 0x41838f
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebp, 1
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4183a9
push eax
call edi
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4183b8
push eax
call edi
mov dword [esp + 0x20], ebx
lea eax, [esi - 0x10]
mov dword [esp + 0x84], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4183df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x418400
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x572b52
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x228], edi
mov dword [esp + 0xc], edi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
mov dword [esp + 0x10], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x206
lea eax, [esp + 0x1a]
mov dword [esp + 0x22c], edi
push edi
push eax
mov dword [esp + 0x18], 1
mov word [esp + 0x20], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4184a0
sub eax, edx
sar eax, 1
lea edx, [esp + 0x14]
mov ebx, eax
push edx
mov eax, esi
call fcn.00410570
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00569ed6
add esp, 0x220
ret

Function at 0x4184f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x572c02
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x22c], edi
mov dword [esp + 0x10], edi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x5e736c
mov dword [esp + 0x14], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x206
lea eax, [esp + 0x1e]
mov dword [esp + 0x230], edi
push edi
push eax
mov dword [esp + 0x1c], 1
mov word [esp + 0x24], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x418590
sub eax, edx
sar eax, 1
lea edx, [esp + 0x18]
mov ebx, eax
push edx
mov eax, esi
call fcn.00410570
call fcn.00412840
mov eax, esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00569ed6
add esp, 0x220
ret
Function at 0x418600
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x41865b
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
je 0x418738
mov eax, dword [esp + 0x18]
mov ecx, 1
sub eax, ecx
je 0x418725
sub eax, ecx
je 0x418677
xor esi, esi
jmp 0x418738
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x4186f2
mov eax, dword [esp + 0x10]
cmp eax, 4
jne 0x418691
lea esi, [eax + 0xb]
jmp 0x418738
cmp eax, 3
jne 0x4186ac
xor eax, eax
cmp byte [esp + 0x122], cl
setne al
add eax, 0xd
mov esi, eax
jmp 0x418738
cmp eax, 2
jne 0x4186c4
xor edx, edx
cmp byte [esp + 0x122], cl
setne dl
add edx, 0xb
mov esi, edx
jmp 0x418738
cmp eax, ecx
jne 0x4186db
xor eax, eax
cmp byte [esp + 0x122], cl
setne al
add eax, 9
mov esi, eax
jmp 0x418738
test eax, eax
jne 0x418738
xor edx, edx
cmp byte [esp + 0x122], cl
setne dl
add edx, 7
mov esi, edx
jmp 0x418738
cmp eax, 5
jne 0x418719
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x418705
lea esi, [eax + 3]
jmp 0x418738
cmp eax, ecx
jne 0x418710
mov esi, 6
jmp 0x418738
test eax, eax
jne 0x418738
lea esi, [eax + 3]
jmp 0x418738
cmp eax, 4
ja 0x418738
mov esi, 4
jmp 0x418738
mov eax, dword [esp + 0x14]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb esi, esi
add esi, 2
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00569ed6
add esp, 0x120
ret

Function at 0x4196d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x570c18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.00419f30
mov dword [esp + 0x30], 0
mov edx, dword [esi]
mov edx, dword [edx + 0x40]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call edx
mov ecx, dword [esp + 0x18]
add ecx, 8
push edi
call fcn.0041a080
mov eax, dword [esp + 0x20]
cmp eax, 0x5e96c0
je 0x419742
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x5e96c0
je 0x419756
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 0x5e96c0
je 0x41976a
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x419920
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor ebx, ebx
push edi
mov esi, ebp
mov dword [esp + 0x14], ebx
call fcn.00410760
mov eax, dword [esp + 0x1c]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x419a0e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x200000
ja 0x419a0e
mov eax, dword [ebp]
sub eax, 0x10
mov dword [esp + 0x10], ebx
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea ecx, [esi + 1]
sub eax, ecx
or edx, eax
mov edi, esi
jge 0x41999f
mov eax, ebp
call fcn.00410ad0
mov ebx, dword [ebp]
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419a0a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x419a0a
sub edi, eax
add ebx, eax
test edi, edi
jne 0x4199a6
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], 0
mov ecx, dword [ebp]
test ecx, ecx
jne 0x4199e1
xor eax, eax
jmp 0x4199f3
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4199e6
sub eax, esi
js 0x419a27
cmp eax, dword [ecx - 8]
jg 0x419a27
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp]
mov byte [eax + ecx], 0
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x20]
test edi, edi
je 0x419a19
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
push 0x80070057
call fcn.0040fcd0
int3

Function at 0x41a310
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a37e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x41a34f
cmp eax, 2
jne 0x41a36a
test esi, esi
mov eax, dword [esp]
je 0x41a378
test eax, eax
je 0x41a373
test al, 1
jne 0x41a36a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41a378
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x41a6c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x578a10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 0
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov byte [esp + 0x28], 1
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x28], 2
call fcn.0041a600
test eax, eax
je 0x41a7e7
lea esi, [esp + 0x1c]
call fcn.0041a6a0
lea edi, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.004101e0
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a783
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
je 0x41a7e7
lea ecx, [esp + 0x10]
push ecx
mov edx, str.binTimwp.exe
call fcn.00410530
mov esi, dword [esp + 0x10]
push 0
push esi
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 8
test eax, eax
jne 0x41a7e7
push ebx
push str.tencent:__message__uin_sSiteijinshan.comMenuyes
lea edi, [esp + 0x20]
call fcn.00410c00
mov ebp, dword [esp + 0x20]
add esp, 8
push 1
push 0
push ebp
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edx, edx
cmp eax, 0x20
setg dl
mov edi, edx
test edi, edi
jne 0x41a81b
push ebx
push str.http:__wpa.qq.com_msgrd_v3uin_ssiteijinshan.commenuyes
lea edi, [esp + 0x1c]
call fcn.00410c00
mov eax, dword [esp + 0x1c]
add esp, 8
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov edi, ecx
lea eax, [ebp - 0x10]
mov byte [esp + 0x28], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41a83c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a85d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a885
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x41a980
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
je 0x41a9d5
test edx, edx
je 0x41a9d5
mov eax, dword [esp + 0x14]
xor ecx, ecx
xor esi, esi
test edx, edx
jbe 0x41a9d5
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.0056a580
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov ebp, ecx
shrd ebx, ebp, 0x13
mov edx, esi
and edx, 3
xor bl, byte [esp + edx + 0x14]
add esi, 1
xor byte [esi + edi - 1], bl
shr ebp, 0x13
cmp esi, dword [esp + 0x10]
jb 0x41a99b
pop esi
pop ebp
pop ebx
ret

Function at 0x41b6d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [eax]
push esi
xor esi, esi
test eax, eax
mov dword [esp + 4], 4
je 0x41b71f
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b71f
cmp dword [esp + 0x10], 4
jne 0x41b71f
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
lea eax, [esi + 1]
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x41b730
Capabilities:
Set registry value

Disassembly:
mov edx, dword [eax]
push ebx
xor ebx, ebx
test edx, edx
je 0x41b76f
mov eax, edi
push esi
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b740
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push ecx
push edi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
mov eax, 1
je 0x41b771
mov eax, ebx
pop ebx
ret 4