joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10513058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105131a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1051307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051306a
add dl, dl
jne 0x10513089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105130dc
xor eax, eax
add dl, dl
jne 0x10513096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051317d
add dl, dl
jne 0x105130a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105130d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10513075
mov eax, 1
add dl, dl
jne 0x105130ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105130e1
sub eax, ebx
mov ebx, 1
jne 0x10513128
mov ecx, 1
add dl, dl
jne 0x1051310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10513119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10513105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1051313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1051314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10513136
cmp eax, 0x7d00
jae 0x1051316d
cmp eax, 0x500
jb 0x10513168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
cmp eax, 0x7f
ja 0x10513170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1051319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10513075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x85e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0085e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85e06a
add dl, dl
jne 0x85e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85e0dc
xor eax, eax
add dl, dl
jne 0x85e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85e17d
add dl, dl
jne 0x85e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x85e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x85e075
mov eax, 1
add dl, dl
jne 0x85e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85e0e1
sub eax, ebx
mov ebx, 1
jne 0x85e128
mov ecx, 1
add dl, dl
jne 0x85e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85e136
cmp eax, 0x7d00
jae 0x85e16d
cmp eax, 0x500
jb 0x85e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85e075
cmp eax, 0x7f
ja 0x85e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x85e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10502058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105021a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1050207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1050206a
add dl, dl
jne 0x10502089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105020dc
xor eax, eax
add dl, dl
jne 0x10502096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1050217d
add dl, dl
jne 0x105020a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105020b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105020bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105020c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105020d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10502075
mov eax, 1
add dl, dl
jne 0x105020ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105020f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105020e1
sub eax, ebx
mov ebx, 1
jne 0x10502128
mov ecx, 1
add dl, dl
jne 0x1050210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10502119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10502105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10502075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1050213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1050214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10502136
cmp eax, 0x7d00
jae 0x1050216d
cmp eax, 0x500
jb 0x10502168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10502075
cmp eax, 0x7f
ja 0x10502170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10502075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1050219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10502075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
call fcn.00403570
mov esi, eax
mov eax, dword [esp + 0x10]
and eax, 0xffff
push 0x4060dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4014ec
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x40150b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40152a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401549
call fcn.00402d80
mov ecx, dword [esp + 0x14]
push ebx
push esi
push ecx
call fcn.00403480
add esp, 0xc
mov esi, eax
call fcn.00402de0
test esi, esi
jne 0x401568
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
pop ebx
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
pop ebx
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
pop ebx
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
pop ebx
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0xa6
push esi
call fcn.00402d00
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
Function at 0x4020c0
Capabilities:
Create service

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
push ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x12c]
push ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
push ebx
mov edx, dword [esp + 0x128]
push ebx
push ebx
push eax
push 1
push ecx
push 1
push 0xf01ff
push edi
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40229b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x431
jne 0x402132
xor ebx, ebx
jmp 0x40214d
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x271
push ebx
call fcn.00402d00
add esp, 0xc
test ebx, ebx
jne 0x40228d
push edi
lea eax, [esp + 0x18]
push str.SYSTEMCurrentControlSet_services_sParameters
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esi + 0xa4]
lea edx, [esp + 0x20]
push ecx
push str.ReportTime
push edx
push connect
call fcn.00402ef0
mov eax, dword [esi + 0xa8]
lea ecx, [esp + 0x30]
push eax
push str.CodeID
push ecx
push connect
call fcn.00402ef0
lea edx, [esi + 0xac]
push 6
push edx
lea eax, [esp + 0x48]
push str.GateWayMac
push eax
push connect
call fcn.00402f90
add esp, 0x40
lea ecx, [esi + 0xb4]
lea edx, [esp + 0x14]
push ecx
push str.TempPath
push edx
push connect
call fcn.00403be0
add esi, 0x1b8
push esi
call fcn.004028a0
lea eax, [esp + 0x24]
push eax
push str.c.hxreg.com
call fcn.004029f0
lea ecx, [esp + 0x28]
push ecx
push str.s.hxtec.com.cn
call fcn.004029f0
mov edx, dword [esp + 0x34]
add esp, 0x24
push edx
push str.Status1000x_lX
call fcn.00402cf0
mov eax, dword [esp + 0x14]
add esp, 8
push eax
push str.Status2000x_lX
call fcn.00402cf0
mov esi, dword [esp + 0x18]
add esp, 8
test esi, esi
mov dl, 0x3d
mov cl, 0x93
mov al, 0x7d
jne 0x40223f
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0xaa
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x402258
mov byte [esp + 0xc], dl
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], al
mov byte [esp + 0xf], 0x61
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push str.Status100
push edx
push connect
call fcn.00402ef0
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push str.Status200
push ecx
push connect
call fcn.00402ef0
add esp, 0x20
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40214d
Function at 0x4022b0
Capabilities:
Delete service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push edi
push 0xf01ff
push eax
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4022e8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x402306
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x402330
Capabilities:
Start service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push edi
push 0xf01ff
push eax
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40237c
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4023ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x420
jne 0x40239a
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2d3
push esi
call fcn.00402d00
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
ret 8

Function at 0x4023c0
Capabilities:
Stop service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x1c
push esi
push edi
push 0xf01ff
push eax
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x402405
lea edx, [esp + 8]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402426
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
add esp, 0x1c
ret 8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x2f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret 8
Function at 0x4028a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x218]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402946
cmp byte [esp + ecx + 0xb], 0x5c
je 0x402946
mov edi, 0x4060a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.PubwinClient.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push 0x104
push ecx
push 0x4064a8
push str.BarCode
push str.XunSan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x110]
push 1
push edx
call fcn.00403040
add esp, 8
lea eax, [esp + 0x110]
push eax
push str.szBarCode_s_n
call fcn.00402cf0
lea ecx, [esp + 0x118]
push ecx
push str.RegID
push str.SOFTWAREPubWin2
push connect
call fcn.00403be0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x4029f0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, dword [esp + 0x19c]
push edi
xor edi, edi
push eax
push 0x101
mov dword [esi], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x402a43
mov ecx, dword [esp + 0x19c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402a52
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esi], ecx
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
pop edi
pop esi
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x402be0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x14], ebp
mov ebx, 0x2000
xor esi, esi
mov edi, 0x7a
test edi, edi
je 0x402c8f
cmp edi, 0x7a
jne 0x402cb5
test esi, esi
je 0x402c17
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
push ebx
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
jne 0x402c30
mov dword [esp + 0x14], 8
jmp 0x402bf9
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi], ebx
mov dword [esp + 0x10], ebx
test ebp, ebp
jne 0x402c66
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
jmp 0x402c73
lea ecx, [esp + 0x10]
push ecx
push esi
push ebp
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x402c7e
xor edi, edi
jmp 0x402bf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
mov edi, eax
jmp 0x402bf9
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
push esi
push ebp
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x402c7e
xor edi, edi
jmp 0x402bf9
cmp edi, 0x103
jne 0x402cc5
mov dword [esp + 0x14], 0
test esi, esi
je 0x402cd2
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
test ebp, ebp
je 0x402cdd
push ebp
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x402e50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
test eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
je 0x402ee3
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x402ee3
mov edi, dword [esp + 0x28]
test edi, edi
je 0x402ee3
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x402ecb
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x402ecb
cmp dword [esp + 0x10], 4
je 0x402ecb
mov esi, 0x3f2
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402eda
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
pop edi
pop esi
mov eax, 0x57
pop ebx
add esp, 0xc
ret
Function at 0x402ef0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test edi, edi
je 0x402f5c
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x402f5c
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x402f43
cmp esi, 2
jne 0x402f3f
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
test esi, esi
jne 0x402f72
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push 4
push edx
push 4
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x402f70
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0xb2
push 0x57
call fcn.00402d00
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402f81
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402f90
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
je 0x403007
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403007
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x403007
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x402feb
cmp esi, 2
jne 0x402fe7
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
test esi, esi
jne 0x40301d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push edx
push ebp
push 3
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40301b
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0xee
push 0x57
call fcn.00402d00
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40302c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x403480
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ebp
je 0x403551
mov ebx, dword [esp + 0x18]
cmp ebx, ebp
je 0x403551
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4034fb
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403519
cmp dword [esp + 0x10], edi
jne 0x403543
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x1cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d00
add esp, 0xc
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x1d4
push 0x1d
jmp 0x40352a
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x1c6
push 0x57
call fcn.00402d00
add esp, 0xc
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4035d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, 4
jb 0x40360e
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, 4
mov ecx, 0x4d2c9b51
sub esi, eax
mov ebx, dword [eax]
xor edx, ecx
xor ebx, edx
add ecx, 0x1d95dc
mov dword [eax], ebx
add eax, 4
lea ebx, [esi + eax]
cmp ebx, edi
jbe 0x4035f0
pop esi
pop ebx
xor eax, eax
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x4036d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor esi, esi
push edi
cmp ebx, esi
mov dword [esp + 0x10], esi
je 0x403743
mov edi, dword [esp + 0x20]
cmp edi, esi
je 0x403743
mov ebp, dword [esp + 0x18]
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x403722
add esi, eax
cmp esi, edi
jae 0x403757
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jb 0x4036ef
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x22f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00402d00
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.D:WorkHPServiceShangHaiBackExeStdAfx.cpp
push 0x228
push 0x57
call fcn.00402d00
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret