joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4122e8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
neg esi
sbb esi, esi
lea eax, [esp + 0xc]
push eax
and esi, 0xffffff00
add esi, 0xf023f
push esi
xor edi, edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x412385
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x412347
push dword [ebp + 0x10]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call fcn.004122e8
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x41238c
lea eax, [esp + 0x18]
push eax
push edi
push edi
push edi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x28]
mov dword [esp + 0x30], 0x200
call ebx
test eax, eax
je 0x41232b
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004122a4
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
jmp 0x412385

Function at 0x41239c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push esi
push 0x206
mov esi, eax
lea eax, [ebp - 0x206]
push 0
push eax
call fcn.0046eea0
add esp, 0xc
mov ecx, 0x4cd420
call fcn.004073d2
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x412421
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0040d2cf
push str.kcm_
push esi
call fcn.00401d83
push dword [esi]
call fcn.00411010
mov dword [esp], str.kcmsetup.log
push esi
call fcn.00401d83
jmp 0x412426
call fcn.0040d10e
mov eax, esi
pop esi
leave
ret

Function at 0x41242b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00405c67
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x4124d8
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x4124d7
lea eax, [edi + 1]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
call fcn.00405cde
mov esi, eax
mov dword [ebp - 8], esi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4124d7
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4124d7
sub dword [ebp - 4], eax
add dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
jne 0x412488
mov byte [esi + edi], bl
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
jne 0x4124c2
xor eax, eax
jmp 0x4124c9
push eax
call fcn.0046f250
pop ecx
mov edx, esi
call fcn.00405ca6
mov dword [ebp - 0x10], 1
pop edi
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret
Function at 0x412554
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 8]
push eax
push 0x2001f
push edi
push 0x4b43e8
push SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], edi
mov word [ebp - 0x24], di
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x41261f
mov eax, dword [ebp - 8]
push 0x4b3b30
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041ce02
mov ebx, eax
push ebx
push str.DeleteUUIDex_RecurseDeleteKey_:_d
mov esi, 0x4ce834
call fcn.00426876
cmp ebx, edi
pop ecx
pop ecx
jne 0x41261f
lea eax, [ebp - 0x28]
call fcn.004121a8
push str.hg.dat
lea eax, [ebp - 0x28]
push eax
call fcn.00413eb0
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4125e5
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0046efa1
test eax, eax
pop ecx
pop ecx
jne 0x412618
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4125fe
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, eax
push ebx
push str.DeleteFile_hg.dat_return:_d
call fcn.00426876
cmp ebx, edi
pop ecx
pop ecx
je 0x41261f
mov dword [ebp - 0xc], 1
push edi
push 1
lea esi, [ebp - 0x28]
call fcn.0041490f
cmp dword [ebp - 4], edi
je 0x412638
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412850
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x412872
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop esi
leave
ret
mov dword [ebp - 4], 0x110
call fcn.004225d7
cmp eax, 8
jne 0x412894
call fcn.0042294d
cmp eax, 2
jne 0x412894
mov dword [ebp - 4], 0x10
push ebx
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
push 1
push 2
push dword [ebp - 4]
push 0x32
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
cmp edi, esi
jne 0x412931
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebx
cmp eax, 0x431
je 0x4128e0
call ebx
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, esi
pop ebx
jmp 0x41286f
push 2
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
je 0x4128cd
push dword [ebp + 0x10]
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
push 1
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x412931
call ebx
push dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00412765
add esp, 0x18
jmp 0x4128cf
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x41294d
cmp word [eax], si
je 0x41294d
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4128d1
Function at 0x412959
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push str.CreateShellLink_start...
mov esi, 0x4ce834
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.00426876
pop ecx
lea eax, [ebp - 4]
push eax
push 0x4a974c
push 1
push edi
push 0x4a975c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
jl 0x412a2d
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4129bd
cmp word [eax], di
je 0x4129bd
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x4a97ac
push eax
call dword [ecx]
test eax, eax
jl 0x412a1b
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
call fcn.0040d2a4
lea eax, [ebp - 0xc]
call fcn.00410f1d
mov edi, dword [ebp - 0xc]
push edi
call fcn.00411010
pop ecx
lea eax, [edi - 0x10]
call fcn.00405cc6
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
mov ebx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
test ebx, ebx
setge al
mov edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push str.CreateShellLink_return:_d__file:_ws__cmd:_ws__link:_ws
call fcn.00426876
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x412a4b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4cd420]
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
mov ecx, 0x4cd420
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.0041f054
lea edi, [ebp - 4]
call fcn.0040d365
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00405cc6
push str.cmmenu.dll
mov eax, edi
push eax
call fcn.00401d83
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412ad4
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x412ad4
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x412ad4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call edi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebx - 0x10]
call fcn.00405cc6
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412c54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x4cd420
call fcn.004073d2
xor esi, esi
push 0x206
lea eax, [ebp - 0x206]
push esi
push eax
mov word [ebp - 0x208], si
call fcn.0046eea0
add esp, 0xc
push esi
push 0x19
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, esi
pop esi
je 0x412cbe
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0040d2cf
mov eax, dword [ebp + 8]
leave
ret

Function at 0x417377
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
lea ebp, [edi + 4]
lea esi, [ebp + 0x10]
call fcn.0041d08b
lea esi, [ebp + 0x28]
call fcn.0041d08b
or dword [ebp + 0x40], 0xffffffff
xor ebx, ebx
mov dword [ebp], 1
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ebx
mov byte [ebp + 0x44], bl
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], 0x2710
cmp dword [0x4cd180], ebx
je 0x4173cd
push 0x4ccff0
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x4cd180], eax
fld dword [0x4ba960]
lea esi, [edi + 0x54]
mov dword [edi], vtable.ATL::CAtlHttpClientT_class_ATL::ZEvtSyncSocket_.0
fstp dword [esi + 0xc]
fld dword [0x4ba964]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0x10]
mov dword [esi], ebx
fld dword [0x4ba968]
mov dword [esi + 4], ebx
fstp dword [esi + 0x14]
mov dword [esi + 8], 0x11
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00403767
fld dword [0x4ba960]
lea esi, [edi + 0x84]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0xc]
fld dword [0x4ba964]
mov dword [esi], ebx
fstp dword [esi + 0x10]
mov dword [esi + 4], ebx
fld dword [0x4ba968]
mov dword [esi + 8], 0x11
fstp dword [esi + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00403767
lea eax, [edi + 0xb4]
lea esi, [edi + 0xc8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.0041879e
lea esi, [edi + 0x10d8]
call fcn.0040feb1
lea esi, [edi + 0x3544]
mov ecx, 0x4cd420
call fcn.004073d2
lea esi, [edi + 0x3548]
mov ecx, 0x4cd420
call fcn.004073d2
mov esi, ebp
call fcn.00410a04
call fcn.00419eae
mov dword [edi + 0xc4], ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41ce02
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ecx]
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x2001f
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x41cec9
xor eax, eax
cmp dword [ebp - 8], esi
je 0x41ce4b
push dword [ebp - 8]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov dword [ebp - 8], ecx
jne 0x41cec9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push ecx
jmp 0x41ce9f
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 8]
call fcn.0041ce02
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x41cedc
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x100
call edi
test eax, eax
je 0x41ce73
cmp dword [ebp - 8], esi
je 0x41ceb9
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 8], esi
je 0x41ced3
push dword [ebp - 8]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], esi
je 0x41cee6
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x41ced5

Function at 0x41d409
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [esp + 8], 0
jne 0x41d414
xor eax, eax
jmp 0x41d439
lea ecx, [eax + 0x1004]
push ecx
push eax
add eax, 0x1000
push eax
mov eax, dword [esp + 0x10]
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x41d63c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0041d591
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, eax
cmp edi, ebx
je 0x41d6b5
push ebx
call esi
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 4], edi
mov word [ebp - 0x20c], bx
call fcn.0046eea0
mov eax, dword [ebp + 8]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x4b4800
push 0x4b4808
push edi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
je 0x41d6b5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
push dword [ebp - 4]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x41d6c3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
lea eax, [ebp - 4]
push eax
push 0x20219
xor esi, esi
push esi
push str.SOFTWAREcmpc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41d79f
push ebx
mov ebx, dword [ebp - 4]
push edi
push 0x40e
lea eax, [ebp - 0x416]
push esi
push eax
mov dword [ebp - 8], ebx
mov word [ebp - 0x418], si
call fcn.0046eea0
add esp, 0xc
push str.ProgramPath
lea eax, [ebp - 8]
push eax
lea esi, [ebp - 4]
lea edi, [ebp - 0x418]
mov dword [ebp - 4], 0x208
call fcn.0040c983
test eax, eax
jne 0x41d78b
cmp dword [ebp - 4], eax
je 0x41d78b
mov eax, dword [0x4cd420]
mov ecx, 0x4cd420
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040d2cf
push str.lang.dat
lea eax, [ebp - 4]
push eax
call fcn.00401d83
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d7a3
lea eax, [esi - 0x10]
call fcn.00405cc6
test ebx, ebx
je 0x41d796
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 4
xor eax, eax
jmp 0x41d79a
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.0040d365
lea eax, [esi - 0x10]
call fcn.00405cc6
test ebx, ebx
je 0x41d7c1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x41d798

Function at 0x41d969
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0xc], edi
jne 0x41d990
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 1
call fcn.0041d7c6
mov eax, dword [eax]
pop ecx
push eax
lea eax, [ebp - 8]
call fcn.0040d2a4
test byte [ebp - 0xc], 1
je 0x41d9aa
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cc6
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], edi
jne 0x41d9b9
push str.v1.0
jmp 0x41da2e
push str.ressrcchsuplive.svr
lea eax, [ebp - 4]
call fcn.0040d2a4
mov esi, dword [ebp - 4]
push dword [esi - 0xc]
lea eax, [ebp - 8]
push esi
call fcn.00406c3a
lea eax, [esi - 0x10]
call fcn.00405cc6
push 0x206
lea eax, [ebp - 0x212]
push edi
push eax
mov word [ebp - 0x214], di
call fcn.0046eea0
mov esi, dword [ebp - 8]
add esp, 0xc
push esi
push 0x208
lea eax, [ebp - 0x214]
push eax
push edi
push str.Version
push str.common
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jne 0x41da27
push ebx
call fcn.0041d8e3
pop ecx
jmp 0x41da35
lea eax, [ebp - 0x214]
push eax
mov eax, ebx
call fcn.0040d2a4
lea eax, [esi - 0x10]
call fcn.00405cc6
pop edi
mov eax, ebx
pop esi
leave
ret
Function at 0x41db53
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
xor ebx, ebx
push esi
inc ebx
test eax, eax
push edi
jne 0x41db76
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call fcn.0041da43
mov eax, dword [eax]
pop ecx
push eax
lea eax, [ebp - 0xc]
call fcn.0040d2a4
test byte [ebp - 4], bl
je 0x41db8f
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00405cc6
mov eax, dword [0x4cd420]
mov ecx, 0x4cd420
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call fcn.0041d885
push dword [eax]
mov esi, dword [ebp - 0xc]
push esi
push str._sressrcchsuplive.svr
lea eax, [ebp - 4]
call fcn.0040cd21
mov eax, dword [ebp - 8]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00405cc6
mov edi, dword [ebp - 4]
push edi
push 0
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov ebx, eax
lea eax, [edi - 0x10]
call fcn.00405cc6
lea eax, [esi - 0x10]
call fcn.00405cc6
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x41df9c
Capabilities:
Create thread

Disassembly:
push esi
call fcn.0040151d
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
mov dword [0x4ce63c], eax
mov eax, dword [esp + 0xc]
mov dword [0x4ce634], eax
mov eax, dword [0x4ce648]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x41dfd9
mov eax, 0xe000001f
call fcn.00412640
xor eax, eax
jmp 0x41e006
push esi
push esi
push 0x4ce630
push 0x41e5ac
push esi
push esi
mov dword [0x4ce640], esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x4ce644], eax
jne 0x41e003
mov eax, 0xe0000020
jmp 0x41dfd0
xor eax, eax
inc eax
pop esi
ret 8

Function at 0x41e3a4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4cd420]
and dword [ebp - 4], 0
push esi
push edi
mov ecx, 0x4cd420
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0xc]
mov dword [ebp - 8], eax
call fcn.0041f054
push str.cmtray.exe
push dword [eax]
lea eax, [ebp - 8]
push str.__s_s___autorun
call fcn.0040cd21
mov eax, dword [ebp - 0xc]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00405cc6
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 4]
call fcn.004012bc
mov edi, dword [ebp - 8]
mov esi, eax
test esi, esi
je 0x41e41a
push edi
push str.cmsc
lea esi, [ebp - 4]
call fcn.0040130a
mov esi, eax
lea eax, [edi - 0x10]
call fcn.00405cc6
cmp dword [ebp - 4], 0
je 0x41e431
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x41e437
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.0046eea0
mov eax, dword [0x4cd420]
add esp, 0xc
mov ecx, 0x4cd420
call dword [eax + 0xc]
mov edi, eax
lea eax, [ebp - 0x20c]
push eax
add edi, 0x10
push 0x104
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
mov esi, 0x4ce64c
je 0x41e4ed
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0040d2cf
push str.kcm_
push esi
call fcn.00401d83
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push 0x4b4b78
lea eax, [ebp - 4]
call fcn.0040cd21
mov edi, dword [ebp - 4]
pop ecx
pop ecx
push dword [edi - 0xc]
mov eax, esi
push edi
call fcn.00406c3a
push dword [0x4ce64c]
call fcn.00411010
test eax, eax
pop ecx
je 0x41e4ed
inc ebx
jmp 0x41e4f2
call fcn.0040d10e
lea eax, [edi - 0x10]
call fcn.00405cc6
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x41ef41
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov edi, 0x4cd420
mov esi, eax
mov ecx, edi
call fcn.004073d2
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20e]
push ebx
push eax
mov word [ebp - 0x210], bx
call fcn.0046eea0
mov eax, dword [0x4cd420]
add esp, 0xc
mov ecx, edi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
push 0x4b236c
mov dword [ebp - 4], edi
call fcn.00470882
pop ecx
push eax
push esi
call fcn.0040d2cf
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x41efc8
push ebx
push 0x26
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
je 0x41f045
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0040d2cf
mov eax, esi
call fcn.0040dcc8
call fcn.00410ed9
push str.cmcmClean_Master_
push esi
call fcn.00401d83
lea eax, [ebp - 8]
push eax
call fcn.00469222
pop ecx
lea eax, [ebp - 8]
lea edi, [ebp - 4]
call fcn.0040d365
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00405cc6
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], ebx
je 0x41f045
xor ecx, ecx
inc ecx
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040d1ec
lea edi, [ebp - 4]
call fcn.0040d365
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00405cc6
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], ebx
jge 0x41f03a
push 0x80070057
call fcn.0040d1c8
movzx eax, word [edi]
push eax
xor ebx, ebx
call fcn.0041873a
lea eax, [edi - 0x10]
call fcn.00405cc6
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x41f533
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc