joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438fda
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x464a76
mov eax, dword fs:[0]
push eax
sub esp, 0x748
push ebx
push esi
push edi
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
call fcn.00455c60
test eax, eax
jl 0x4391f8
cmp dword [esp + 0x10], 0
jne 0x4391f8
push str.FailInstallCryptSvc
mov edi, str.Main
push edi
xor ecx, ecx
call fcn.00424141
pop ecx
pop ecx
mov esi, 0x138a
call fcn.0043317e
inc esi
mov dword [esp + 0x10], eax
call fcn.0043317e
mov esi, 0x138c
mov dword [esp + 0x18], eax
call fcn.0043317e
inc esi
mov dword [esp + 0x20], eax
call fcn.0043317e
lea ebx, [esp + 0x3bc]
mov dword [esp + 0x1c], eax
call fcn.00425e9d
and dword [esp + 0x760], 0
push 6
push dword [esp + 0x14]
mov eax, ebx
push eax
call fcn.004260eb
push 2
mov esi, 0x46ced8
push esi
mov eax, ebx
push eax
call fcn.004260eb
push 0x80000020
push 0
push dword [esp + 0x28]
mov eax, ebx
call fcn.004261fc
cmp eax, 6
jne 0x4391e4
call fcn.00455ad3
test eax, eax
jne 0x4391e4
push 1
push str.FailInstallCryptSvc
push edi
call fcn.0042419b
add esp, 0xc
lea ebx, [esp + 0x24]
call fcn.00425e9d
push 6
push dword [esp + 0x1c]
mov eax, ebx
push eax
mov byte [esp + 0x76c], 1
call fcn.004260eb
push 2
push esi
mov eax, ebx
push eax
call fcn.004260eb
push 0x80000030
xor ebx, ebx
push ebx
push dword [esp + 0x24]
lea eax, [esp + 0x30]
call fcn.004261fc
cmp eax, 6
jne 0x4391d4
mov eax, dword [0x4833bc]
mov ecx, 0x4833bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x764], 2
call fcn.00402030
mov ecx, eax
call fcn.0040215f
push 0x467230
lea eax, [esp + 0x14]
push eax
call fcn.004046e1
push str.KSafe.exe
lea eax, [esp + 0x14]
push eax
call fcn.004046e1
push str._lowexe_http:__bbs.duba.net_forum_6417_1.html
lea eax, [esp + 0x18]
push eax
call fcn.00405099
mov esi, dword [esp + 0x10]
push 5
push ebx
push dword [esp + 0x1c]
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00404929
lea eax, [esi - 0x10]
call fcn.00404929
lea esi, [esp + 0x24]
mov byte [esp + 0x760], bl
call fcn.00426059
or dword [esp + 0x760], 0xffffffff
lea esi, [esp + 0x3bc]
call fcn.00426059
xor eax, eax
jmp 0x439200
lea esi, [esp + 0x24]
mov byte [esp + 0x760], bl
call fcn.00426059
or dword [esp + 0x760], 0xffffffff
lea esi, [esp + 0x3bc]
call fcn.00426059
call fcn.00455b3b
xor eax, eax
inc eax
mov ecx, dword [esp + 0x758]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439359
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push 0x103
xor esi, esi
lea eax, [ebp - 0x7f]
push esi
push eax
mov byte [ebp - 0x80], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.cfg_bksafe.ini
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4393de
lea eax, [ebp - 0x80]
push eax
push esi
push str.p2pready
push str.P2PConifg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4393de
inc esi
mov ecx, dword [ebp + 0x84]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004568ce
add ebp, 0x88
leave
ret

Function at 0x439733
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x464a3a
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, edi
call fcn.0043958f
lea esi, [edi + 0xc]
call fcn.0043958f
push 0x467710
lea eax, [esp + 0xc]
push eax
call fcn.00405099
and dword [esp + 0x18], 0
lea ecx, [esp + 8]
call fcn.004396b3
push str._vulfix.ini
lea eax, [esp + 0xc]
push eax
call fcn.004046e1
push edi
push str.downloadedfiles
push dword [esp + 0x10]
call fcn.0043a6c2
add esp, 0xc
push esi
push str.installedresults
push dword [esp + 0x10]
call fcn.0043a6c2
mov eax, dword [esp + 0x14]
and dword [edi + 0x30], 0
add esp, 0xc
add eax, 0xfffffff0
call fcn.00404929
xor eax, eax
inc eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439ced
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4615d2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
call fcn.00405099
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, dword [edi + 4]
cmp eax, ebx
jle 0x439da4
mov eax, ebx
mov ecx, edi
call fcn.0043a6a1
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00405304
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x467230
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x28], 1
call fcn.004046e1
mov eax, dword [esi + 4]
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x14]
call fcn.00404a46
mov esi, dword [esp + 0xc]
call fcn.004252d7
test eax, eax
je 0x439d91
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [esp + 0x20], 0
call fcn.00404929
inc ebx
cmp ebx, dword [edi + 4]
jl 0x439d32
mov esi, edi
call fcn.0043958f
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00404929
xor eax, eax
inc eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x439dce
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4607cf
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x481028]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
push edi
lea eax, [esp + 0xc]
push eax
call fcn.00405099
and dword [esp + 0x478], 0
push 0x46cfcc
lea eax, [esp + 0xc]
push eax
call fcn.004046e1
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x439ec9
test byte [esp + 0xc], 0x10
jne 0x439eb2
and word [esp + 0x25c], 0
push 0x206
lea eax, [esp + 0x262]
push 0
push eax
call sub.MSVCR80.dll_memset
lea eax, [esp + 0x268]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 0x14
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x80
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x439e48
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
call fcn.00404929
xor eax, eax
inc eax
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x460]
xor ecx, esp
call fcn.004568ce
mov esp, ebp
pop ebp
ret
Function at 0x43a6c2
Capabilities:
Read .ini file

Disassembly:
push 0x10
mov eax, 0x46156c
call fcn.00456faa
mov esi, 0x10000
push esi
call fcn.004567b5
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x14], edi
jne 0x43a6ec
xor eax, eax
jmp 0x43a7b4
push dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x43a7ab
cmp word [edi], bx
je 0x43a7a8
mov esi, dword [sym.imp.MSVCR80.dll_wcslen]
push edi
call esi
push 0x3d
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.MSVCR80.dll_wcschr]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x43a7a5
and word [ebx], 0
inc ebx
inc ebx
movzx eax, word [ebx]
cmp ax, 0x20
je 0x43a72d
cmp ax, 9
je 0x43a72d
push edi
call esi
test eax, eax
pop ecx
jbe 0x43a794
push ebx
call esi
test eax, eax
pop ecx
jbe 0x43a794
mov ecx, 0x4833bc
lea esi, [ebp - 0x18]
call fcn.00404b28
and dword [ebp - 4], 0
push edi
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
mov dword [ebp - 0x1c], eax
push ebx
mov eax, esi
push eax
call fcn.00405232
mov esi, dword [ebp + 0x10]
lea ebx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.0043a5c8
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00404929
mov eax, dword [ebp - 0x10]
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
jne 0x43a70b
mov edi, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, ebx
call fcn.00457082
ret
Function at 0x43b29a
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0045de00
push 0xffffffffffffffff
push 0x460799
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2018
call fcn.0045de00
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x100c]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x46d0bc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x1388
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x24], edi
je 0x43b40a
cmp dword [ebp - 0x18], ebx
je 0x43b346
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [ebp - 0x18]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 5
push edi
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 6
push edi
call esi
push ebx
push 0x4000000
push ebx
push ebx
mov esi, str.http:__dl.ijinshan.com_safe_vulfix_vulfixcfg.xml
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
push 0x1f4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
je 0x43b40a
push esi
push 0x46d0c8
call dword [sym.imp.MSVCR80.dll_wprintf_s]
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
push 0xfff
lea eax, [ebp]
push eax
push edi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax], bl
lea eax, [ebp]
push eax
push 0x46d0d0
call dword [sym.imp.MSVCR80.dll_printf]
pop ecx
lea eax, [ebp - 0x2024]
mov dword [ebp - 0x2028], eax
pop ecx
lea eax, [ebp]
push eax
lea eax, [ebp - 0x2028]
call fcn.0043e8e2
mov byte [ebp - 4], 1
push dword [ebp - 0x2028]
push dword [ebp - 0x20]
call fcn.00405232
lea eax, [ebp - 0x2024]
cmp dword [ebp - 0x2028], eax
je 0x43b3f5
push dword [ebp - 0x2028]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x43b40d
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.004568ce
add ebp, 0x1004
leave
ret 4
Function at 0x43b4a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push esi
push edi
xor esi, esi
push 0x206
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6a]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x6c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x43b4ed
mov edi, dword [edi + 4]
jmp 0x43b4f0
add edi, 4
cmp dword [0x4842e0], 8
mov eax, dword [0x4842cc]
jae 0x43b503
mov eax, 0x4842cc
push edi
push eax
push 0x46d0d4
lea eax, [ebp - 0x6c]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x70]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x6c]
push eax
push SysStringLen
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x43b5e3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x78]
push eax
push esi
mov ebx, str.Name
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
call edi
cmp eax, esi
je 0x43b575
mov esi, eax
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x43b5e2
mov eax, dword [ebp - 0x74]
add eax, 2
push eax
call fcn.004567b5
cmp eax, esi
pop ecx
mov dword [ebp - 0x7c], eax
jne 0x43b590
mov esi, 0xe00c001e
jmp 0x43b568
lea ecx, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push ebx
push dword [ebp - 0x70]
call edi
mov edi, eax
cmp edi, esi
jne 0x43b5ce
cmp dword [ebp - 0x78], 1
jne 0x43b5ce
mov eax, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x80]
push str..Pipe_
mov word [ebx + eax], si
call dword [0x466464]
mov ecx, dword [ebp - 0x80]
push ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7c]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x19c]
pop edi
xor ecx, ebp
pop esi
call fcn.004568ce
add ebp, 0x1a0
leave
ret 4

Function at 0x43b8a2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
jmp 0x43b8d4
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43b8e0
add esi, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
jne 0x43b8ab
xor eax, eax
pop esi
leave
ret 0xc
mov eax, 0xe00c0009
jmp 0x43b8db
Function at 0x43b8e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
jmp 0x43b919
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43b925
add esi, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
jne 0x43b8f0
xor eax, eax
pop esi
leave
ret 0xc
mov eax, 0xe00c000b
jmp 0x43b920

Function at 0x43bc04
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x46383b
call fcn.00456faa
lea ecx, [ebp - 0x10]
call fcn.0043bc8c
and dword [ebp - 4], 0
push str.krcmdmon.dll
lea eax, [ebp - 0x10]
push eax
call fcn.004046e1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43bc79
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [edi], eax
je 0x43bc79
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43bc79
lea esi, [edi + 4]
push esi
mov ecx, 0x46d458
push ecx
push ecx
call eax
test eax, eax
jne 0x43bc79
mov esi, dword [esi]
test esi, esi
je 0x43bc79
mov eax, dword [esi]
push esi
call dword [eax]
mov dword [edi + 8], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
xor eax, eax
call fcn.00457082
ret

Function at 0x43cb3e
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
push 0x6a
mov dword [ebx + 4], 0xf0000001
push dword [0x4833e0]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, dword [ebx + 0x34]
mov edi, eax
mov dword [ebx + 0x54], eax
call fcn.0043bd3e
push dword [ebx + 0x34]
call fcn.0043bec7
pop ecx
push dword [ebx + 0x40]
call fcn.0044b376
mov ecx, dword [ebx + 0x34]
call fcn.0043be14
mov eax, dword [ebx + 0x50]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x6f1
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ecx
ret

Function at 0x43cc45
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 0x50]
push 0
push 0x1bc3
add eax, 0x24
call fcn.004361a1
mov eax, dword [esi + 0x50]
push 5
push dword [eax + 0x50c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x50]
push 0
push 0xea77
add eax, 0x24
call fcn.004361a1
mov eax, dword [esi + 0x50]
push 0
push 0xea76
add eax, 0x24
call fcn.004361a1
mov eax, dword [esi + 0x50]
push 0
push 0xea78
add eax, 0x24
call fcn.004361a1
pop ecx
ret

Function at 0x43cca1
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push eax
push eax
push eax
push str.http:__www.duba.com__fweishi2sld
push str.open
push eax
mov dword [esi + 0xb0], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
call fcn.0043ccda
call fcn.00454314
call fcn.004540cf
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
jmp dword [eax + 0x1c]
Function at 0x445350
Capabilities:
Get mac address on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18f0]
mov eax, 0x1970
call fcn.0045de00
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x18ec], eax
mov eax, dword [ebp + 0x18f8]
push ebx
push 8
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x18fc]
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x80], 0x1950
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x445480
push esi
push edi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
lea esi, [ebp - 0x64]
mov eax, dword [esi + 0x190]
cmp eax, 8
jb 0x4453c8
push 8
pop eax
push eax
mov eax, dword [ebp - 0x78]
add eax, 0x20
push eax
lea edi, [esi + 0x194]
push edi
call sub.MSVCR80.dll_memcmp
add esp, 0xc
test eax, eax
je 0x445439
cmp dword [ebp - 0x74], ebx
je 0x445403
mov eax, dword [esi + 0x190]
cmp eax, ebx
je 0x445403
push eax
push edi
push dword [ebp - 0x74]
call sub.MSVCR80.dll_memcmp
add esp, 0xc
test eax, eax
je 0x445452
lea ebx, [esi + 0x10c]
test ebx, ebx
je 0x445430
mov edi, dword [ebp - 0x78]
and dword [ebp - 0x6c], 0
add edi, 0x28
push dword [edi]
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x445447
inc dword [ebp - 0x6c]
add edi, 4
cmp dword [ebp - 0x6c], 2
jb 0x445417
cmp dword [ebp - 0x68], 0
jne 0x445439
mov dword [ebp - 0x68], esi
mov esi, dword [esi]
xor ebx, ebx
cmp esi, ebx
jne 0x4453ba
jmp 0x445455
cmp dword [ebp - 0x70], 0
jne 0x445439
mov dword [ebp - 0x70], esi
jmp 0x445439
mov dword [ebp - 0x68], esi
cmp dword [ebp - 0x68], ebx
pop edi
pop esi
jne 0x445466
mov eax, dword [ebp - 0x70]
cmp eax, ebx
mov dword [ebp - 0x68], eax
je 0x445480
mov eax, dword [ebp - 0x68]
push dword [eax + 0x190]
add eax, 0x194
push eax
push dword [ebp - 0x7c]
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x18ec]
xor ecx, ebp
pop ebx
call fcn.004568ce
add ebp, 0x18f0
leave
ret 8

Function at 0x445564
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x14]
push ebx
mov dword [edi], vtable.CStatistics.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebp, [edi + 8]
mov esi, ebp
call fcn.00445fa2
mov eax, dword [edi + 4]
test eax, eax
je 0x4455a1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi + 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [edi + 0x2c]
call fcn.0044a8c2
mov eax, dword [edi + 0xa0]
sub eax, 0x10
call fcn.00404929
mov eax, dword [edi + 0x9c]
sub eax, 0x10
call fcn.00404929
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esi, ebp
call fcn.00445fa2
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4455df
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4613d2
call fcn.00456faa
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4833bc]
mov ecx, 0x4833bc
call dword [eax + 0xc]
add eax, 0x10
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x14], esi
call fcn.00405232
push dword [edi + 0x9c]
lea ecx, [ebp - 0x18]
push str.mid_s
call fcn.004069a5
pop ecx
mov dword [ebp - 0x10], esi
pop ecx
lea esi, [edi + 8]
lea ebx, [ebp - 0x18]
call fcn.00445f04
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 4], 0
jne 0x445666
push edi
push 0
push 0x445679
call dword [sym.imp.MSVCR80.dll__beginthread]
add esp, 0xc
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00404929
call fcn.00457082
ret 4

Function at 0x4458ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.guid
push str.SOFTWAREkingsoftKSWSVC
push SysStringLen
mov esi, ecx
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x445962
cmp dword [ebp - 0x7c], 1
jne 0x445962
and word [ebp + 0x18e], ax
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.00405232
jmp 0x445967
call fcn.004051f2
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.004568ce
add ebp, 0x194
leave
ret
Function at 0x445999
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x260
mov eax, 0x46064f
call fcn.00457013
mov esi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x268]
push eax
call fcn.00405099
push 0x46b6d0
lea eax, [ebp - 0x268]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004046e1
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x268]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x26c], eax
je 0x445b1f
lea eax, [ebp - 0x234]
push eax
push str.First_file_name_is__s_n
call dword [sym.imp.MSVCR80.dll_printf]
pop ecx
pop ecx
lea eax, [ebp - 0x234]
push eax
push str.Next_file_name_is__s_n
call dword [sym.imp.MSVCR80.dll_printf]
lea eax, [ebp - 0x234]
push eax
push 0x46b6d8
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 0x10
test eax, eax
je 0x445af8
lea eax, [ebp - 0x234]
push eax
push 0x46b6dc
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x445af8
test byte [ebp - 0x260], 0x10
je 0x445ae8
cmp dword [ebp + 0xc], 0
je 0x445af8
push esi
lea eax, [ebp - 0x264]
push eax
call fcn.00405099
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax - 0xc]
lea ecx, [eax + ecx*2]
cmp eax, ecx
sbb eax, eax
lea edx, [ecx - 2]
and eax, edx
movzx eax, word [eax]
cmp ax, 0x5c
je 0x445aaa
cmp ax, 0x2f
je 0x445aaa
push 0x5c
lea eax, [ebp - 0x264]
call fcn.00405058
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.004046e1
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x264]
call fcn.00445999
add esp, 0xc
add edi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x264]
adc ebx, edx
add eax, 0xfffffff0
call fcn.00404929
jmp 0x445af8
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x244]
add edi, eax
adc ebx, ecx
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445a06
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00404929
mov eax, edi
mov edx, ebx
call fcn.00457096
ret