joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bdfc
Capabilities:
Get common file path

Disassembly:
push 0x3bc
mov eax, 0x4a30ff
call fcn.00483770
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x30c], ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x218]
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
lea ecx, [ebp - 0x248]
mov dword [esi + 4], eax
call fcn.0042ffa0
mov dword [ebp - 4], ebx
mov eax, 0x4b6e18
push ecx
push ecx
mov esi, esp
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0x248]
lea eax, [ebp - 0x230]
push eax
call fcn.004307e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
push eax
call fcn.004300e0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.004300b0
push str.Defaultcache
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x260]
call fcn.00403ecd
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
push eax
call fcn.00403d46
lea ecx, [ebp - 0x230]
call fcn.0042ffa0
mov byte [ebp - 4], 3
mov dl, 1
mov ecx, eax
call fcn.004325c0
mov bl, al
neg bl
sbb bl, bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x230]
call fcn.004300b0
mov byte [ebp - 4], 0
xor esi, esi
push 0
inc esi
lea ecx, [ebp - 0x260]
push esi
call fcn.0040314a
inc bl
je 0x41bf6d
cmp dword [0x4d8dfc], esi
jg 0x41bf4a
push esi
push 0x4d
push str.fixclear_cache.cc
lea ecx, [ebp - 0x3c8]
call fcn.00437390
mov byte [ebp - 4], 4
mov ebx, esi
lea ecx, [eax + 8]
mov dword [ebp - 0x30c], ebx
mov edx, str.ClearChromeCache_Error
call fcn.00410491
jmp 0x41bf50
mov ebx, dword [ebp - 0x30c]
and dword [ebp - 4], 0
test bl, 1
je 0x41bf6d
and ebx, 0xfffffffe
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 0x30c], ebx
call fcn.004373e0
lea ecx, [ebp - 0x308]
call fcn.0041b9d0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x308]
push eax
push ecx
call fcn.00454d43
pop ecx
mov ecx, eax
call fcn.00454d9a
lea eax, [ebp - 0x2c0]
push eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x230]
call fcn.0041c03c
mov byte [ebp - 4], 6
mov edx, eax
lea ecx, [ebp - 0x260]
mov dword [esp], str.cache
call fcn.00412487
mov byte [ebp - 4], 7
sub esp, 0x14
mov esi, esp
mov dword [ebp - 0x310], esp
push ecx
push ecx
mov ecx, esp
push eax
call fcn.00403d46
mov ecx, esi
call fcn.0042ffa0
mov byte [ebp - 4], 8
mov byte [ebp - 4], 7
call fcn.0041bb1b
add esp, 0x18
mov byte [ebp - 4], 6
xor ebx, ebx
lea ecx, [ebp - 0x260]
push ebx
push 1
call fcn.0040314a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.0040314a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x308]
call fcn.004558b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.004300b0
mov al, 1
call fcn.0048371f
ret
Function at 0x41c1ab
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a3217
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
xor edi, edi
mov ebx, edi
mov dword [esp + 0x18], ebx
cmp dword [0x4d8dfc], 1
jg 0x41c227
push 1
push 0x21
push str.fixclear_cookie.cc
lea ecx, [esp + 0x28]
call fcn.00437390
mov dword [esp + 0x3c0], edi
inc ebx
lea ecx, [eax + 8]
mov dword [esp + 0x18], ebx
mov edx, str.test_n
call fcn.00437a80
or dword [esp + 0x3c0], 0xffffffff
test bl, 1
je 0x41c244
and ebx, 0xfffffffe
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.004373e0
xor eax, eax
push 0x206
mov word [esp + 0x1a8], ax
lea eax, [esp + 0x1aa]
push edi
push eax
call fcn.00482250
add esp, 0xc
lea eax, [esp + 0x1a4]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0xd0]
call fcn.00403059
xor ebx, ebx
inc ebx
mov dword [esp + 0x3c0], ebx
mov esi, str.liebaoUser_Data_
push esi
call fcn.00402919
pop ecx
push eax
push esi
lea ecx, [esp + 0xd4]
call fcn.0040413e
sub esp, 0x18
lea edx, [esp + 0xe4]
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DefaultCookies
call fcn.00403ecd
pop ecx
mov byte [esp + 0x3d8], 2
mov byte [esp + 0x3d8], bl
call fcn.0041c0d0
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DefaultCookies_journal
lea edx, [esp + 0xe8]
call fcn.00403ecd
pop ecx
mov byte [esp + 0x3d8], 3
mov byte [esp + 0x3d8], bl
call fcn.0041c0d0
add esp, 0x18
lea ecx, [esp + 0xfc]
call fcn.0041b9d0
mov byte [esp + 0x3c0], 4
lea eax, [esp + 0xfc]
push eax
push ecx
call fcn.00454d43
pop ecx
mov ecx, eax
call fcn.00454d9a
lea eax, [esp + 0x12c]
push eax
lea edx, [esp + 0xd0]
lea ecx, [esp + 0xe8]
call fcn.0041c03c
mov byte [esp + 0x3c4], 5
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov edx, eax
push str.Cookies
call fcn.00412487
pop ecx
mov byte [esp + 0x3d8], 6
mov byte [esp + 0x3d8], 5
call fcn.0041c0d0
add esp, 0x18
mov byte [esp + 0x3c0], 4
push edi
push ebx
lea ecx, [esp + 0xec]
call fcn.0040314a
lea eax, [esp + 0x12c]
push eax
lea edx, [esp + 0xd0]
lea ecx, [esp + 0xe8]
call fcn.0041c03c
mov byte [esp + 0x3c4], 7
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov edx, eax
push str.Cookies_journal
call fcn.00412487
pop ecx
mov byte [esp + 0x3d8], 8
mov byte [esp + 0x3d8], 7
call fcn.0041c0d0
add esp, 0x18
mov byte [esp + 0x3c0], 4
push edi
push ebx
lea ecx, [esp + 0xec]
call fcn.0040314a
mov byte [esp + 0x3c0], bl
lea ecx, [esp + 0xfc]
call fcn.004558b6
or dword [esp + 0x3c0], 0xffffffff
lea ecx, [esp + 0xcc]
push edi
push ebx
call fcn.0040314a
mov al, bl
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x41cb52
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x794]
mov ebx, ecx
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x41cb8b
xor al, al
jmp 0x41cc03
push 0x7ff
lea eax, [ebp - 0x77]
mov byte [ebp - 0x78], 0
push 0
push eax
call fcn.00482250
add esp, 0xc
cmp esi, 0x800
ja 0x41cb87
lea eax, [ebp - 0x78]
push eax
push esi
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41cb87
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
and dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4b4df8
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41cb87
mov ecx, dword [ebp - 0x7c]
mov ax, word [ecx + 0xa]
mov word [edi], ax
mov ax, word [ecx + 8]
mov word [edi + 2], ax
mov ax, word [ecx + 0xe]
mov word [edi + 4], ax
mov ax, word [ecx + 0xc]
mov word [edi + 6], ax
mov al, 1
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
lea esp, [ebp + 0x78c]
pop ebp
ret 4

Function at 0x41d1d8
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x10]
cmp ecx, 0xffffffff
jne 0x41d204
cmp dword [edx + 0x14], 8
jb 0x41d1ee
mov ecx, dword [edx]
jmp 0x41d1f0
mov ecx, edx
push esi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d1f4
sub ecx, esi
sar ecx, 1
pop esi
add ecx, ecx
cmp dword [edx + 0x14], 8
jb 0x41d20e
mov edx, dword [edx]
push ecx
push edx
push 1
push dword [esp + 0x18]
push dword [esp + 0x18]
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret 0x10
Function at 0x41d861
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a35da
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push str.inetcpl.cpl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
test eax, eax
je 0x41d8b7
push str.ResetIEtoDefaults
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d8b7
push ebx
call eax
xor eax, eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x1c]
push eax
mov ebp, reloc.WS2_32.dll_accept
mov edx, str.Control_PanelAccessibilityHighContrast
push str.Flags
mov ecx, ebp
call fcn.0041e07d
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor edi, edi
pop ecx
inc edi
pop ecx
test al, al
je 0x41d927
mov edx, 0x4b7f54
lea ecx, [esp + 0x1c]
call fcn.0041d4da
test al, al
je 0x41d927
push 6
push 0x4b7f5c
push edi
push str.Flags
push str.Control_PanelAccessibilityHighContrast
push ebp
call esi
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x1c]
push ebx
push edi
call fcn.0040314a
push ecx
push str.SoftwareMicrosoftInternet_ExplorerStyles
push ebp
lea ecx, [esp + 0x28]
call fcn.004314c0
mov dword [esp + 0x40], edi
cmp dword [esp + 0x1c], 0
je 0x41d96d
lea eax, [esp + 0x18]
push eax
push str.Use_My_Stylesheet
lea ecx, [esp + 0x24]
call fcn.00431660
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00431540
push 4
pop edi
test bl, bl
je 0x41d9a2
cmp dword [esp + 0x18], 1
jne 0x41d9a2
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push edi
push eax
push edi
push str.Use_My_Stylesheet
push str.SoftwareMicrosoftInternet_ExplorerStyles
push ebp
call esi
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 1
push ecx
push edi
push str.MSCompatibilityMode
push str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
push ebp
call esi
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047aabf
add esp, 0x30
ret
Function at 0x41df56
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x1c]
push eax
push 2
xor ebx, ebx
mov dword [ebp - 0x18], 8
push ebx
push 0x4b8360
push SysReAllocString
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x474e5089
mov dword [ebp - 8], 0xa1a0a0d
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41dfd9
push 8
push str..png
push 1
push ebx
push str.Extension
push dword [ebp - 0x1c]
call esi
push 0x4c
push str.A3CCEDF7_2DE2_11D0_86F4_00A0C913F750
push 1
push ebx
push str.Image_Filter_CLSID
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
push str.MIMEDatabaseContent_Typeimage_pngBits_
push SysReAllocString
call edi
test eax, eax
jne 0x41e003
push 0x14
lea eax, [ebp - 0x18]
push eax
push 3
push ebx
push 0x4b722c
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
push str.MIMEDatabaseContent_Typeimage_x_png_
push SysReAllocString
call edi
test eax, eax
jne 0x41e042
push 8
push str..png
push 1
push ebx
push str.Extension
push dword [ebp - 0x1c]
call esi
push 0x4c
push str.A3CCEDF7_2DE2_11D0_86F4_00A0C913F750
push 1
push ebx
push str.Image_Filter_CLSID
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
push str.MIMEDatabaseContent_Typeimage_x_pngBits_
push SysReAllocString
call edi
test eax, eax
jne 0x41e06c
push 0x14
lea eax, [ebp - 0x18]
push eax
push 3
push ebx
push 0x4b722c
push dword [ebp - 0x1c]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
mov esp, ebp
pop ebp
ret

Function at 0x41e0c8
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x41e0eb
mov esi, dword [esp + 0x10]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41e0dc
sub esi, edx
sar esi, 1
lea eax, [esi + esi]
push eax
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
push edi
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
ret
Function at 0x41e109
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x244
mov eax, 0x4a36e4
call fcn.00483770
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshtml.dll
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
lea ecx, [ebp - 0x234]
mov dword [esi + 4], eax
call fcn.0042ffa0
xor esi, esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x234]
call fcn.004128db
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.004300b0
push esi
push 0x26
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41e219
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
lea ecx, [ebp - 0x24c]
mov dword [esi + 4], eax
call fcn.0042ffa0
mov dword [ebp - 4], 1
mov eax, str.internet_exploreriexplore.exe
push ecx
push ecx
mov esi, esp
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0x24c]
lea eax, [ebp - 0x234]
push eax
call fcn.004307e0
mov byte [ebp - 4], 2
test edi, edi
jne 0x41e1fb
lea ecx, [ebp - 0x234]
call fcn.004128db
mov edi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.004300b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.004300b0
mov eax, edi
call fcn.0048371f
ret
Function at 0x41e221
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x218]
push esi
push edi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
push str.svcVersion
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41e314
cmp dword [ebp - 0x21c], 1
jne 0x41e314
cmp dword [ebp - 0x218], eax
je 0x41e314
lea eax, [ebp - 0x210]
push eax
call fcn.00402919
lea edi, [ebp - 0x210]
lea esi, [ebp - 0x210]
pop ecx
lea edi, [edi + eax*2]
mov eax, esi
cmp eax, edi
je 0x41e2f6
movzx eax, word [esi]
push eax
call fcn.0047cc44
pop ecx
test eax, eax
je 0x41e2c9
add esi, 2
cmp esi, edi
jne 0x41e2b4
cmp esi, edi
je 0x41e2f6
movzx eax, word [esi]
push 0x2d
pop ecx
cmp ax, cx
jne 0x41e2eb
lea eax, [ebp - 0x214]
mov edx, edi
push eax
lea ecx, [esi + 2]
call fcn.00433790
jmp 0x41e306
push 0x2b
pop ecx
cmp ax, cx
jne 0x41e2f6
add esi, 2
lea eax, [ebp - 0x214]
mov edx, edi
push eax
mov ecx, esi
call fcn.00433800
cmp dword [ebp - 0x214], 0
pop ecx
jne 0x41e3d6
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Version
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41e3d6
cmp dword [ebp - 0x21c], 1
jne 0x41e3d6
cmp dword [ebp - 0x218], eax
je 0x41e3d6
lea eax, [ebp - 0x210]
push eax
call fcn.00402919
lea edi, [ebp - 0x210]
lea esi, [ebp - 0x210]
pop ecx
lea edi, [edi + eax*2]
mov eax, esi
cmp eax, edi
je 0x41e3c5
movzx eax, word [esi]
push eax
call fcn.0047cc44
pop ecx
test eax, eax
je 0x41e398
add esi, 2
cmp esi, edi
jne 0x41e383
cmp esi, edi
je 0x41e3c5
movzx eax, word [esi]
push 0x2d
pop ecx
cmp ax, cx
jne 0x41e3ba
lea eax, [ebp - 0x214]
mov edx, edi
push eax
lea ecx, [esi + 2]
call fcn.00433790
jmp 0x41e3d5
push 0x2b
pop ecx
cmp ax, cx
jne 0x41e3c5
add esi, 2
lea eax, [ebp - 0x214]
mov edx, edi
push eax
mov ecx, esi
call fcn.00433800
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x41e426
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
mov eax, 0x4a3714
call fcn.0048373d
and dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41e4af
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0x18]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41e4a9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov esi, eax
cmovae edx, dword [ebp + 8]
add ecx, ecx
push ecx
push edx
push esi
call fcn.00481c00
mov eax, dword [ebp + 0x18]
add esp, 0xc
xor ecx, ecx
push edi
mov word [esi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x41e4a9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
push 0
push 1
call fcn.0040314a
call fcn.0048370b
ret

Function at 0x41e4c5
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
push esi
push edi
xor esi, esi
lea eax, [esp + 0x10]
push 0x228
push esi
push eax
mov ebp, ecx
mov dword [esp + 0x18], esi
call fcn.00482250
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x41e567
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41e560
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x41e54a
test ecx, ecx
je 0x41e54a
cmp ecx, 4
je 0x41e54a
lea eax, [esp + 0x34]
push ebp
push eax
call fcn.0047b6f6
pop ecx
pop ecx
test eax, eax
je 0x41e55c
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41e528
jmp 0x41e55f
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
test esi, esi
pop edi
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.0047aabf
add esp, 0x230
ret
Function at 0x41fafe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a3b90
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
xor eax, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], ax
xor ebp, ebp
inc ebp
mov dword [esp + 0x4c], ebp
lea eax, [esp + 0x14]
push eax
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41fc30
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebp
push eax
push ebx
lea eax, [esp + 0x20]
mov dword [esp + 0x18], ebx
push eax
push ebx
push str.ProgramPath
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fc18
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
shr eax, 1
add eax, 0x10
push ebx
push eax
call fcn.00421f1a
add dword [esp + 0x10], 2
lea ecx, [esp + 0x10]
cmp dword [esp + 0x38], 8
lea eax, [esp + 0x24]
push ecx
cmovae eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push str.ProgramPath
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fc18
cmp dword [esp + 0x38], 8
lea ecx, [esp + 0x24]
cmovae ecx, dword [esp + 0x24]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41fbfe
sub ecx, edx
sar ecx, 1
push ebx
push ecx
lea ecx, [esp + 0x2c]
call fcn.00421f1a
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.00403d01
jmp 0x41fc3c
push 0x4b5338
mov ecx, esi
call fcn.00403059
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x24]
push ebx
push ebp
call fcn.0040314a
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0047aabf
add esp, 0x40
ret 4
Function at 0x421294
Capabilities:
Create directory
Create thread

Disassembly:
push 0x58
mov eax, 0x4a3fd1
call fcn.00483770
mov eax, dword [0x4d8df4]
lea ecx, [ebp - 0x40]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x64], ebx
push dword [eax]
call fcn.00403034
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x5c]
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], 0x5c
call fcn.0040cbd5
inc eax
lea ecx, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
call fcn.0040c983
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea edx, [ebp - 0x58]
push str.Dumps
lea ecx, [ebp - 0x28]
call fcn.00403ecd
pop ecx
mov byte [ebp - 4], 2
mov esi, 0x4d88f4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00403fed
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28]
push ebx
push eax
call fcn.0040314a
cmp byte [0x4d8d8c], bl
jne 0x42136a
cmp dword [0x4d8908], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4d88f4]
push eax
call fcn.0047d61f
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x42136a
cmp dword [0x4d8908], 8
cmovae esi, dword [0x4d88f4]
push esi
call fcn.0047d2a3
pop ecx
movzx ecx, byte [0x4d8d8c]
test eax, eax
push 1
pop esi
cmove ecx, esi
mov byte [0x4d8d8c], cl
push 0x4b4a8c
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.00403ecd
pop ecx
mov byte [ebp - 4], 3
mov ecx, 0x4d88dc
push eax
call fcn.00403d23
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28]
push ebx
push eax
call fcn.0040314a
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push 0x421c8a
push ebx
push ebx
call fcn.0047d3f2
add esp, 0x18
mov byte [ebp - 4], bl
xor esi, esi
lea ecx, [ebp - 0x58]
push ebx
inc esi
push esi
call fcn.0040314a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push esi
call fcn.0040314a
call fcn.0048371f
ret 0xc
Function at 0x421947
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x4a1713
call fcn.00483770
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push 0x4b4a8c
call fcn.00403ecd
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 1
cmovae eax, dword [ebp - 0x2c]
push esi
push str.__no_sandbox
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push esi
push 1
call fcn.0040314a
call fcn.0048371f
ret 4

Function at 0x4219a0
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x4a1713
call fcn.00483770
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push 0x4b4a8c
call fcn.00403ecd
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 1
cmovae eax, dword [ebp - 0x2c]
push esi
push str.__dflag1
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push esi
push 1
call fcn.0040314a
call fcn.0048371f
ret 4

Function at 0x4219f9
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x4a1713
call fcn.00483770
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push 0x4b4a8c
call fcn.00403ecd
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 1
cmovae eax, dword [ebp - 0x2c]
push esi
push str.__dflag2
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push esi
push 1
call fcn.0040314a
call fcn.0048371f
ret 4