joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a32d61e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35670e
call fcn.2a3041d5
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32d83f
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a3243b3
add esp, 0x10
test eax, eax
js 0x2a32d839
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32d6c2
push edi
call fcn.2a32eb0c
pop ecx
test al, al
je 0x2a32d6c2
mov eax, edi
call fcn.2a3534e0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32d6d4
push edi
lea ecx, [ebp - 0x424]
call fcn.2a3243b3
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a3243b3
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32d839
push 0x60
push ebx
push eax
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32d72c
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32d72c
call fcn.2a32be19
mov ebx, eax
jmp 0x2a32d808
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32d753
call fcn.2a32be19
jmp 0x2a32d7fb
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32d749
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32d786
mov ebx, 0x8007000e
jmp 0x2a32d7fd
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3243b3
jmp 0x2a32d7ac
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32d77f
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a3243b3
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a3243b3
mov ebx, eax
test edi, edi
je 0x2a32d808
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32d821
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d831
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d827
mov eax, ebx
jmp 0x2a32d86d
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32d854
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d864
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d85a
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30420f
ret 0x10
Function at 0x110e0
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x110ee
call dword [0x1a02c]
or eax, eax
je 0x110ef
ret
mov al, 1
jmp fcn.00011160

Function at 0x110f8
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x11106
call dword [0x1a030]
or eax, eax
jne 0x11107
ret
mov al, 2
jmp fcn.00011160

Function at 0x11110
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x11148
test edx, edx
je 0x11132
push eax
mov eax, ecx
call dword [0x1a034]
pop ecx
or eax, eax
je 0x11141
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00011160
mov dword [eax], edx
mov eax, ecx
call dword [0x1a030]
or eax, eax
jne 0x1112b
ret
mov al, 1
jmp fcn.00011160
test edx, edx
je 0x1115c
push eax
mov eax, edx
call dword [0x1a02c]
pop ecx
or eax, eax
je 0x11141
mov dword [ecx], eax
ret

Function at 0x11204
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_ReadFile
movzx eax, word [ebp - 0x10]
imul eax, eax, 0x3c
add ax, word [ebp - 0xe]
imul eax, eax, 0x3c
xor edx, edx
mov dx, word [ebp - 0xc]
add eax, edx
imul eax, eax, 0x3e8
mov dx, word [ebp - 0xa]
add eax, edx
mov dword [0x1b01c], eax
mov esp, ebp
pop ebp
ret

Function at 0x11288
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1b01c], 0x8088405
inc edx
mov dword [0x1b01c], edx
mul edx
mov eax, edx
ret

Function at 0x11524
Capabilities:
Write file on windows

Disassembly:
mov dword [0x1b010], eax
jmp fcn.00011434
pop dword [0x1b018]
jmp 0x11518

Function at 0x11a04
Capabilities:
Write file on windows

Disassembly:
mov al, 1
jmp fcn.00011160
test ecx, ecx
je fcn.00011944
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x1192c
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x11a90
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x11aa4
push eax
push 0
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x1192c
ret
Function at 0x11ad4
Capabilities:
Write file on windows

Disassembly:
cmp ecx, 0
je 0x11bbd
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x11b24
cmp al, 0xb
je 0x11b3e
cmp al, 0xc
je 0x11b57
cmp al, 0xd
je 0x11b67
cmp al, 0xe
je 0x11b85
cmp al, 0xf
je 0x11b9b
cmp al, 0x11
je 0x11baa
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00011160
cmp ecx, 1
mov eax, ebx
jg 0x11b35
call fcn.00011530
jmp 0x11bb9
mov edx, ecx
call fcn.00011554
jmp 0x11bb9
cmp ecx, 1
mov eax, ebx
jg 0x11b4d
call dword [0x1a004]
jmp 0x11bb9
mov edx, ecx
call dword [0x1a008]
jmp 0x11bb9
mov eax, ebx
add ebx, 0x10
call dword [section.DATA]
dec edi
jg 0x11b57
jmp 0x11bb9
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00011ad4
dec edi
jg 0x11b6a
pop ebp
jmp 0x11bb9
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00011aa8
dec edi
jg 0x11b88
pop ebp
jmp 0x11bb9
mov eax, ebx
add ebx, 4
call fcn.00011c70
dec edi
jg 0x11b9b
jmp 0x11bb9
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00011c04
dec edi
jg 0x11baa
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x11bc0
Capabilities:
Write file on windows

Disassembly:
mov ecx, 1
jmp fcn.00011ad4

Function at 0x11c88
Capabilities:
Write file on windows

Disassembly:
test edx, edx
je fcn.00011c70
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x11ca2
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x11cb1
mov al, 0x17
jmp fcn.00011160
ret

Function at 0x1256c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x125b4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x125b4
cmp dword [ebp - 0x10], 4
je 0x125b9
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x125c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00011850
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete byte [ebp - 1]
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x12668
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x126aa
mov eax, dword [ebp - 0xc]
call fcn.0001169c
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00011850
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x126ae
xor eax, eax
jmp 0x126b0
mov al, 1
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x126d8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x12706
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12710
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x1273e
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12748
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1277c
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x12780
xor eax, eax
jmp 0x12782
mov al, 1
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x14714
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00011850
push eax
call fcn.000120f8
mov dword [ebp - 0xc], eax
push 0
push 0x80000022
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.00011850
push eax
call fcn.000120f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x147f9
cmp dword [ebp - 0x10], 0xffffffff
je 0x147f9
mov dword [ebp - 0x14], 0xfff
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LocalAlloc
cmp dword [ebp - 0x14], 0
jbe 0x147e1
mov eax, dword [ebp - 0x14]
add eax, 1
jae 0x147b1
call fcn.000112a8
dec eax
cmp eax, 0xfff
jbe 0x147be
call fcn.000112a0
inc eax
mov byte [ebp + eax - 0x1019], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [ebp - 0x14], 0
jne 0x1477d
mov eax, dword [ebp - 0xc]
push eax
call fcn.000120f0
mov eax, dword [ebp - 0x10]
push eax
call fcn.000120f0
mov esp, ebp
pop ebp
ret

Function at 0x16434
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x1653a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call fcn.00012150
mov eax, 0x16550
mov dword [ebp - 0x12c], eax
mov eax, 0x16560
mov dword [ebp - 0x128], eax
mov eax, 0x1656c
mov dword [ebp - 0x124], eax
mov eax, 0x16578
mov dword [ebp - 0x120], eax
mov eax, 0x16588
mov dword [ebp - 0x11c], eax
mov eax, 0x16594
mov dword [ebp - 0x118], eax
mov eax, 0x165a0
mov dword [ebp - 0x114], eax
mov eax, 0x165b0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x12c]
lea ecx, [ebp - 0x10c]
mov edx, 7
call fcn.00013188
mov eax, dword [ebp - 0x10c]
call fcn.00011850
push eax
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_TlsSetValue
lea edx, [ebp - 0x130]
xor eax, eax
call fcn.000122fc
mov eax, dword [ebp - 0x130]
call fcn.00011850
lea edx, [ebp - 0x105]
call fcn.000163a8
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16541
lea eax, [ebp - 0x130]
call fcn.00011530
lea eax, [ebp - 0x10c]
call fcn.00011530
ret
Function at 0x4057a2
Capabilities:
Access peb ldr_data
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4057b7
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004035f3
and al, 0x86
sti
movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004035f3
test eax, 0x49a02b67
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4057e0
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4057e0
call fcn.004035f3
xchg ebp, eax
mov eax, 0x5a8bf009
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004035f3
fst st(0)
mov al, byte [0x875ff78]
push dword [ebp + 4]
push dword [ebp]
call fcn.00403df3
or ebp, dword [eax + 0x14]
nop
inc eax
add byte [edi - 0x18], dl
mov ebp, 0x57000007
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40590f
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.0040599d
cmp byte [eax], 0
je 0x40587f
cmp byte [ebp - 0x1c], 0
je 0x40587f
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405895
mov al, byte [esi + 1]
test al, al
je 0x4058ee
cmp al, 0x2e
jne 0x405895
cmp byte [esi + 2], 0
je 0x4058ee
push esi
push ebx
call fcn.00405fda
test byte [ebp - 0x14c], 0x10
je 0x4058ba
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4058ee
push dword [ebp + 0xc]
push edi
call fcn.004057a2
jmp 0x4058ee
push dword [ebp - 4]
push edi
call fcn.0040575a
test eax, eax
jne 0x4058e6
cmp dword [ebp - 4], eax
je 0x4058de
push edi
push 0xfffffffffffffff1
call fcn.00405101
push 0
push edi
call fcn.00405db9
jmp 0x4058ee
inc dword [0x4237a8]
jmp 0x4058ee
push edi
push 0xfffffffffffffff2
call fcn.00405101
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40585d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405919
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40596b
cmp dword [ebp - 0xc], esi
jne 0x40592d
inc dword [0x4237a8]
jmp 0x40596b
push edi
call fcn.004062dd
test eax, eax
je 0x40596b
push edi
call fcn.00405972
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040575a
test eax, eax
jne 0x405963
cmp dword [ebp - 4], esi
je 0x405925
push edi
push 0xfffffffffffffff1
call fcn.00405101
push esi
push edi
call fcn.00405db9
jmp 0x40596b
push edi
push 0xffffffffffffffe5
call fcn.00405101
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4026a0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push 0x50f970
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4026f6
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 4
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0048d530
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x50f7a0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4027f2
push esi
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0048d530
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4027a0
lea eax, [ebp - 0x20c]
mov ecx, 0x10
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x4026e3
lea ecx, [ebp - 0x20c]
mov eax, ecx
sub ebx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x4027e0
jmp 0x40281c
lea ecx, [ebp - 0x414]
mov eax, ecx
sub ebx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x402800
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.00413c46
mov esp, ebp
pop ebp
ret 4
Function at 0x402840
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0
push 0
push eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
call fcn.0048d530
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0x20019
push 0
push 0x50f8cc
push SysReAllocString
call esi
test eax, eax
je 0x4028c7
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x4028b6
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x4028b6
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x50f7a0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0049034c
push 0x50f96c
push eax
call fcn.0048c8e4
add esp, 0xc
test eax, eax
je 0x4028b6
lea esi, [eax + 2]
push 0x50f96c
push esi
call fcn.0048c8e4
add esp, 8
test eax, eax
je 0x4028b6
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00413c46
mov esp, ebp
pop ebp
ret
Function at 0x402a50
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa4
call fcn.00413c60
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
push edi
push 0x800
push 0
push eax
call fcn.0048d530
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.0048d530
add esp, 0x18
lea eax, [ebp - 0x1fa4]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, 0x17
lea edi, [ebp - 0x1fa0]
mov esi, str.Program_FilesInternet_Exploreriexplore.exe
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
nop
movzx ecx, word [ebp + eax - 0x1fa4]
lea eax, [eax + 2]
mov word [ebp + eax - 0x1006], cx
test cx, cx
jne 0x402ac0
lea edx, [ebp - 0x804]
mov ecx, ebx
sub edx, ebx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402ae2
mov edx, ebx
mov esi, ebx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402af6
lea edi, [ebp - 0x1fa4]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402b10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 1
push 0
push 0
push ebx
mov ecx, edx
and ecx, 3
push str.open
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
cmp eax, 0x20
ja 0x402b60
push 0
push 0
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0047c4aa
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 4
Function at 0x4044b0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508550
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0xac]
call fcn.00482bee
cmp dword [ebx + 0x190], 8
lea esi, [ebx + 0x17c]
jb 0x4044fe
mov eax, dword [esi]
jmp 0x404500
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404608
cmp dword [esi + 0x14], 8
jb 0x404517
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404608
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xb0], eax
inc eax
push eax
mov dword [ebp - 0xb4], eax
call fcn.00413c8d
mov edi, eax
add esp, 4
test edi, edi
je 0x404608
push dword [ebp - 0xb4]
push 0
push edi
call fcn.0048d530
add esp, 0xc
lea eax, [ebp - 0xb8]
push 0
push eax
push dword [ebp - 0xb0]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
push edi
call fcn.0048358d
push edi
call fcn.00413ca0
add esp, 4
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xac]
push eax
call fcn.00482df7
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0047d8fc
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022b0
cmp dword [ebp - 0x18], 0
jbe 0x404600
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push str.FileMD5
push str.QJSetting
call fcn.0047f63e
lea ecx, [ebp - 0x28]
call fcn.004022f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret