joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4536f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x45373c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x45373c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x453726
push eax
call ebp
test ax, ax
jl 0x453734
inc esi
add edi, 4
cmp esi, 6
jb 0x453718
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004533f0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4572c0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x457320
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x457320
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x457320
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x457320
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x457330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x457340
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x478a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov dword [esp + 0x3c], edi
call fcn.0044fe90
push eax
push edi
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
call ebp
push edi
mov ebx, eax
call ebp
mov ebp, eax
mov dword [esi + 0xa4], edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0xc4]
test eax, eax
je 0x4573b1
mov eax, dword [esi + 0xc4]
test eax, eax
jne 0x4573a7
mov dword [esi + 0xc4], 1
mov eax, dword [esi + 0xc0]
test eax, eax
jne 0x457479
mov ecx, dword [esi + 0xd8]
mov edx, dword [esi + 0xd4]
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0xc0], eax
call ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xdc]
push eax
lea ecx, [esp + 0x50]
call fcn.00470be1
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x4c]
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call ebp
mov edx, dword [esi + 0xd8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0xd4]
push 0xf00021
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push ecx
push edx
call ebp
mov dword [esp + 0x4c], 0x483b10
lea ecx, [esp + 0x4c]
mov dword [esp + 0x5c], 0
call fcn.00470b7b
mov dword [esp + 0x5c], 0xffffffff
jmp 0x45747f
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0xc4], 0
mov dword [esi + 0x84], 4
mov eax, dword [esi + 0xbc]
cmp eax, 1
je 0x457889
Function at 0x46c281
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46c2b9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046a338
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046a310
jmp 0x46c2c5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46d977
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46d9b9
call fcn.004735b6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46d9b9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46d9b0
xor eax, eax
jmp 0x46d9c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046d9c7
pop edi
pop esi
pop ebx
ret 4

Function at 0x473ae6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x473b14
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x473b32
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00473a4c
jmp 0x473b32
mov eax, dword [esi + 0x14]
test eax, eax
je 0x473b32
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00473a4c
test edi, edi
mov eax, edi
jne 0x473b1c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4016d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov dword [esi + 0x14], 0
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [esi + 4], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 4]
mov dword [esi + 0xc], eax
test edx, edx
mov ecx, 1
jne 0x401712
xor ecx, ecx
mov edx, dword [esi + 8]
test edx, edx
jne 0x40171b
xor ecx, ecx
test eax, eax
je 0x401753
test ecx, ecx
je 0x401753
lea eax, [esi + 0x10]
push eax
push 0
push esi
push 0x401470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401753
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 1
pop edi
mov eax, 1
pop esi
ret
mov ecx, esi
call fcn.00401760
pop edi
xor eax, eax
pop esi
ret

Function at 0x401ab0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push edi
mov dword [esp + 0x10], eax
mov edi, ecx
test esi, esi
mov dword [esp + 0x14], eax
mov word [esp + 8], 2
jne 0x401b19
push 0xffffffffffffffff
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov word [esp + 0xa], ax
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push 0x10
push eax
push ecx
push edx
mov ecx, edi
call fcn.00401cf0
pop edi
pop esi
add esp, 0x10
ret 0x14
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x401ae4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401b3d
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
jmp 0x401ae0
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0x14
Function at 0x403e90
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40c046
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x324
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [esp + 0x338]
lea eax, [esp + 0x18]
push eax
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x33c]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x41141c
lea ecx, [esp + 0xc]
mov dword [esp + 0x334], ebx
call fcn.0040b49e
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x10]
push 0x411414
push ecx
mov byte [esp + 0x340], 1
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 4]
mov dword [esp + 4], ebx
push edx
push 0x40eec0
push 1
push ebx
push 0x40eeb0
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40403d
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x340]
mov dword [esp + 0x10], ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0x348]
cmp eax, ebx
je 0x403fa5
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x344]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
push 0x40eed0
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, ebx
jl 0x404008
mov ecx, dword [esp + 8]
lea eax, [esp + 0x120]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x120]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x330], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x404063
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x330], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x328]
pop ebx
mov dword fs:[0], ecx
add esp, 0x330
ret 0x14
Function at 0x404f40
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword fs:[0]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push 0x40c130
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
push esi
push edi
and ecx, 0xffff
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4050be
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x405084
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4050fb
mov edx, dword [esp + 0x24]
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40504a
lea eax, [esp + 0x24]
push 0
push eax
push edi
push ebx
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405001
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42.DLL_CString::CString_3
push edi
lea ecx, [esp + 0x20]
push str.WriteFile_error__d
push ecx
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4050fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
push esi
lea edx, [esp + 0x20]
push str.CreateFile_error__d
push edx
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
jmp 0x4050f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
push esi
lea eax, [esp + 0x20]
push str.LoadResource_error__d
push eax
mov dword [esp + 0x20], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
jmp 0x4050f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x20]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
push esi
lea ecx, [esp + 0x24]
push str.FindResource_error__d
push ecx
mov dword [esp + 0x20], 3
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x405120
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push str.SystemCurrentControlSetServices_blockp
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4051de
mov edx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
lea ecx, [esp + 8]
push 4
push ecx
push 4
push eax
push 0x411820
push edx
mov dword [esp + 0x20], 2
call esi
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.ErrorControl
push ecx
mov dword [esp + 0x20], 0
call esi
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x20], 0
call esi
mov edi, str.filter
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push str.filter
push 1
push eax
push str.Group
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x4051f0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x411760
mov edi, ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4053b3
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push eax
mov esi, 1
push 0x411820
push edx
mov dword [esp + 0x30], esi
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.ErrorControl
push ecx
mov dword [esp + 0x30], esi
call ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x30], 3
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 0x4117a8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4053a3
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push edx
push 0
push 0x411798
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405395
mov ecx, dword [esp + 0x14]
push 0x41178c
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, edi
call fcn.004053d0
test eax, eax
jne 0x40537b
mov edi, 0x41178c
or ecx, 0xffffffff
mov edx, dword [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + edx + 0x23]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x14], esi
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41178c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], edx
mov byte [esp + edx + 0x24], al
inc edx
push edx
mov edx, dword [esp + 0x24]
push ecx
push edx
push eax
mov eax, dword [esp + 0x20]
push 0x411798
push eax
call ebx
test eax, eax
jne 0x40537f
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], 1
push ecx
call ebp
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x118
ret
Function at 0x405440
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x40c150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea ecx, [esp + 0xc]
xor ebx, ebx
xor esi, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x18], ebx
mov dword [esp + 8], ebx
push 0x4112dc
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.00409dd0
test eax, eax
je 0x4054c3
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push 0x411854
call fcn.00409ee0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x4054ba
mov esi, 1
lea ecx, [esp + 8]
call fcn.00409f90
lea ecx, [esp + 8]
mov byte [esp + 0x18], bl
call fcn.00409f90
lea ecx, [esp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x405500
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x40c176
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 4], ebx
push 0x4112dc
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 1
call fcn.00409dd0
test eax, eax
je 0x4055b0
push esi
mov esi, dword [esp + 0x160]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4055a6
test byte [esp + 0x10], 0x10
jne 0x4055a6
lea ecx, [esp + 0xc]
push ecx
push 0x411854
lea ecx, [esp + 0x10]
call fcn.00409ee0
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push edx
push 0x411860
call fcn.00409e50
push esi
push 0x411854
lea ecx, [esp + 0x10]
call fcn.00409e50
lea ecx, [esp + 8]
call fcn.00409f90
pop esi
lea ecx, [esp + 4]
mov byte [esp + 0x154], bl
call fcn.00409f90
lea ecx, [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 0x154], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret 4
Function at 0x4066b0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x40c246
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
push edi
mov dword [esp + 8], 0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x224], 0
push eax
push 0x104
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
lea edx, [esp + 0x114]
rep stosd dword es:[edi], eax
mov edi, dword [0x411e78]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push 0x411a48
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 1
call fcn.0040b49e
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.softwarelychee_barclient
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x10]
call fcn.00409dd0
pop edi
pop esi
test eax, eax
je 0x4067a6
lea ecx, [esp + 8]
push ecx
push 0x411a3c
lea ecx, [esp + 8]
call fcn.00409e50
lea ecx, [esp]
call fcn.00409f90
lea ecx, [esp + 4]
mov byte [esp + 0x218], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x218], 0xffffffff
call fcn.00409f90
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x406ba0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40c2a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x324
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [esp + 0x338]
lea eax, [esp + 0x18]
push eax
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x33c]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x41141c
lea ecx, [esp + 0xc]
mov dword [esp + 0x334], ebx
call fcn.0040b49e
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x10]
push 0x411414
push ecx
mov byte [esp + 0x340], 1
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 4]
mov dword [esp + 4], ebx
push edx
push 0x40eec0
push 1
push ebx
push 0x40eeb0
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x406d4d
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x340]
mov dword [esp + 0x10], ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0x348]
cmp eax, ebx
je 0x406cb5
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x344]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
push 0x40eed0
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, ebx
jl 0x406d18
mov ecx, dword [esp + 8]
lea eax, [esp + 0x120]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x120]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x330], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x406d73
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x330], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x328]
pop ebx
mov dword fs:[0], ecx
add esp, 0x330
ret 0x14