joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e79
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x45378c]
cmp eax, 0xffffffff
jne 0x409ff7
push 0x110
lea eax, [ebp - 0x114]
mov dword [0x45378c], 0xfffffc18
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x409ff2
cmp dword [ebp - 0x108], 2
jne 0x409ff2
cmp dword [ebp - 0x114], 5
jne 0x409f74
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x409f03
inc eax
jmp 0x409fd5
cmp eax, 1
jne 0x409f66
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_1
call fcn.00422646
add esp, 0xc
test eax, eax
jne 0x409f26
push 3
jmp 0x409f71
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.00422646
add esp, 0xc
test eax, eax
jne 0x409f44
push 4
jmp 0x409f71
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_3
call fcn.00422646
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x409fd5
cmp eax, 2
jne 0x409ff2
push 6
pop eax
jmp 0x409fd5
cmp dword [ebp - 0x114], 6
jne 0x409fdc
cmp dword [ebp - 0x110], 0
jne 0x409fc6
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_1
call fcn.00422646
add esp, 0xc
test eax, eax
jne 0x409fa4
push 8
jmp 0x409f71
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.00422646
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
jmp 0x409fd5
xor eax, eax
cmp dword [ebp - 0x110], 1
setne al
add eax, 0xa
mov dword [0x45378c], eax
jmp 0x409ff7
cmp dword [ebp - 0x114], 6
mov ecx, 0x3e8
mov eax, dword [0x45378c]
cmova eax, ecx
jmp 0x409fd5
mov eax, dword [0x45378c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x40a384
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0x38
mov eax, 0x43c8bb
call fcn.00423c42
mov esi, ecx
cmp byte [esi + 0xec], 0
jne 0x40a4b4
call fcn.00402aa9
lea ecx, [ebp - 0x28]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
call fcn.00404164
push eax
mov ecx, esi
call fcn.00405041
xor edi, edi
lea ecx, [ebp - 0x28]
xor ebx, ebx
push edi
inc ebx
push ebx
call fcn.00402015
push edi
push 0x444bb4
lea ecx, [esi + 0x18]
call fcn.00402059
lea ecx, [ebp - 0x28]
call fcn.0040420d
push eax
lea ecx, [esi + 0x98]
call fcn.00405041
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402015
lea ecx, [ebp - 0x28]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x50], edi
call fcn.00402632
lea ecx, [esi + 0x80]
mov dword [ebp - 4], edi
push ecx
mov ecx, eax
call fcn.0040a1bf
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00403735
call fcn.0040279d
mov word [esi + 0x7c], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
lea ecx, [ebp - 0x40]
mov dword [esi + 0x78], eax
call fcn.004027ec
lea ecx, [esi + 0x60]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.0040a1bf
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00403735
push edi
push edi
push edi
push edi
push str.QQ_Data_Report
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0xf0], eax
test eax, eax
je 0x40a4b4
push 4
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0x12c
push ecx
push 2
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push edi
push 3
push edi
push edi
push 0x50
push str.qbwup.imtt.qq.com
push dword [esi + 0xf0]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0xf4], eax
test eax, eax
je 0x40a4b4
mov byte [esi + 0xec], bl
call fcn.00423bf1
ret 4
Function at 0x40d6a1
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
push esi
push edi
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov eax, edi
shr eax, 4
xor eax, esi
mov dword [ebp - 8], 8
and eax, 0xf0f0f0f
xor esi, eax
shl eax, 4
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, esi
and eax, 0xffff
xor esi, eax
shl eax, 0x10
xor edi, eax
mov eax, esi
shr eax, 2
xor eax, edi
and eax, 0x33333333
xor edi, eax
shl eax, 2
xor esi, eax
mov ebx, esi
shr ebx, 8
xor ebx, edi
and ebx, 0xff00ff
xor edi, ebx
shl ebx, 8
xor ebx, esi
rol ebx, 1
mov eax, ebx
xor eax, edi
and eax, 0xaaaaaaaa
xor ebx, eax
xor eax, edi
rol eax, 1
mov edi, eax
mov eax, dword [ebp - 4]
mov edx, ebx
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x445a20]
or esi, dword [eax*4 + 0x445820]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x445620]
or esi, dword [edx*4 + 0x445420]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
xor edx, ebx
mov ecx, edx
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x445920]
or ecx, dword [eax*4 + 0x445720]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x445520]
or ecx, dword [edx*4 + 0x445320]
mov eax, dword [ebp - 4]
or ecx, esi
xor edi, ecx
mov edx, edi
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x445a20]
or esi, dword [eax*4 + 0x445820]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x445620]
mov eax, dword [ebp - 4]
or esi, dword [edx*4 + 0x445420]
mov edx, dword [eax]
add eax, 4
xor edx, edi
mov dword [ebp - 4], eax
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x445920]
or ecx, dword [eax*4 + 0x445720]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x445520]
or ecx, dword [edx*4 + 0x445320]
or ecx, esi
xor ebx, ecx
dec dword [ebp - 8]
jne 0x40d71e
ror ebx, 1
mov edx, ebx
mov esi, dword [ebp - 0x10]
xor edx, edi
and edx, 0xaaaaaaaa
xor ebx, edx
xor edx, edi
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, ebx
and eax, 0xff00ff
xor ebx, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, ebx
and eax, 0x33333333
xor ebx, eax
shl eax, 2
xor edx, eax
mov eax, ebx
shr eax, 0x10
xor eax, edx
and eax, 0xffff
xor edx, eax
shl eax, 0x10
xor ebx, eax
mov ecx, ebx
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
shl eax, 4
xor eax, ebx
xor ecx, edx
pop edi
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d9ac
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xf8], eax
xor esi, esi
movzx edx, byte [esi + str.80_]
mov eax, edx
sar edx, 3
and eax, 7
movzx ecx, word [eax*2 + 0x445c00]
movsx eax, byte [edx + edi]
test eax, ecx
setne al
mov byte [ebp + esi - 0x74], al
inc esi
cmp esi, 0x38
jl 0x40d9cf
xor esi, esi
movzx ebx, byte [esi + 0x445b50]
lea edi, [esi + esi]
and dword [ebp + edi*4 - 0xf0], 0
mov ecx, ebx
and dword [ebp + edi*4 - 0xf4], 0
xor edx, edx
cmp ecx, 0x1c
jge 0x40da24
mov al, byte [ebp + ecx - 0x74]
jmp 0x40da2b
mov al, byte [ebp + ecx - 0x90]
mov byte [ebp + edx - 0x3c], al
inc edx
inc ecx
cmp edx, 0x1c
jl 0x40da19
push 0x1c
pop edx
lea ecx, [ebx + 0x1c]
cmp ecx, 0x38
jge 0x40da47
mov al, byte [ebp + ecx - 0x74]
jmp 0x40da4e
mov al, byte [ebp + ecx - 0x90]
mov byte [ebp + edx - 0x3c], al
inc edx
inc ecx
cmp edx, 0x38
jl 0x40da3c
xor ecx, ecx
movzx eax, byte [ecx + 0x445b20]
cmp byte [ebp + eax - 0x3c], 0
je 0x40da77
mov eax, dword [ecx*4 + 0x445ba0]
or dword [ebp + edi*4 - 0xf4], eax
movzx eax, byte [ecx + 0x445b38]
cmp byte [ebp + eax - 0x3c], 0
je 0x40da93
mov eax, dword [ecx*4 + 0x445ba0]
or dword [ebp + edi*4 - 0xf0], eax
inc ecx
cmp ecx, 0x18
jl 0x40da5b
inc esi
cmp esi, 0x10
jl 0x40d9fb
mov edx, dword [ebp - 0xf8]
lea ecx, [ebp - 0xf4]
call fcn.0040d8b5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret

Function at 0x40ddbf
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x44ef60
call fcn.00426f90
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x40de26
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x40de26
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x40de26
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x40de26
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x40de2f
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.00426fd5
ret
Function at 0x40deab
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x4551c0]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x4551c8]
test edx, edx
jne 0x40def9
test eax, eax
je 0x40df0c
mov edx, eax
mov dword [0x4551c0], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x40df0c
cmp ecx, ebx
jb 0x40df0c
cmp ecx, edi
jbe 0x40dfe4
mov edx, eax
test eax, eax
jmp 0x40df2e
test edx, edx
je 0x40df29
mov eax, dword [edx + 8]
test eax, eax
je 0x40df29
cmp eax, ebx
jb 0x40df29
cmp eax, edi
jbe 0x40dfe4
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x4551c0], edx
jne 0x40df12
movzx eax, si
sub esi, eax
mov ecx, esi
cmp esi, ebx
jbe 0x40e088
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e088
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x40df7f
cmp dword [ebp - 0x30], eax
jae 0x40df91
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x40df45
jmp 0x40e088
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4551c0], edx
test edx, edx
je 0x40e088
mov eax, dword [0x4551c8]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x4551c8], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec esi
jne 0x40dfd6
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x40e08c
cmp esi, edi
ja 0x40e08c
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.0041e3e0
add esp, 0xc
mov eax, esi
jmp 0x40e08e
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e08c
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x40e080
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x40e083
movzx edx, si
test edx, edx
je 0x40e061
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4551c0], edx
test edx, edx
jne 0x40dfb2
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x40e011
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e15b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4551cc], 0
je 0x40e16f
mov eax, 0x10dd
jmp 0x40e1d2
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4551cc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40e190
mov eax, 0x10dd
jmp 0x40e1d1
mov dword [0x4551d4], esi
mov dword [0x4551c4], esi
mov dword [0x4551bc], esi
mov dword [0x4551d0], esi
mov dword [0x4551b8], esi
mov esi, dword [0x4551c8]
jmp 0x40e1cb
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x40e1b6
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e1d6
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4551cc], eax
je 0x40e1f2
mov eax, 0x10dd
jmp 0x40e27a
push ebx
push esi
push edi
mov edi, dword [0x4551c4]
xor ebx, ebx
test edi, edi
je 0x40e23c
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x40e22d
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x40e22d
call fcn.0040e095
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.0041e2e4
mov edi, esi
pop ecx
test esi, esi
jne 0x40e201
mov dword [0x4551c4], ebx
call fcn.0040de80
mov edi, dword [0x4551bc]
test edi, edi
je 0x40e269
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.0041e2e4
mov edi, esi
pop ecx
test esi, esi
jne 0x40e251
pop edi
pop esi
mov dword [0x4551bc], ebx
xor eax, eax
mov dword [0x4551cc], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ec77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push str.kdump
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40eca1
xor eax, eax
inc eax
jmp 0x40ee37
push ebx
push esi
push edi
push 0x53
pop eax
push 0x4f
mov word [ebp - 0x3c], ax
pop eax
push 0x46
mov word [ebp - 0x3a], ax
pop eax
push 0x54
mov word [ebp - 0x38], ax
pop eax
push 0x57
mov word [ebp - 0x36], ax
pop eax
push 0x41
mov word [ebp - 0x34], ax
pop eax
push 0x52
mov word [ebp - 0x32], ax
pop eax
push 0x45
mov word [ebp - 0x30], ax
pop eax
push 0x5c
pop esi
push 0x6b
mov word [ebp - 0x2e], ax
pop eax
push 0x69
pop ebx
push 0x6e
pop edx
push 0x67
mov word [ebp - 0x2a], ax
pop eax
push 0x73
pop edi
push 0x6f
mov word [ebp - 0x24], ax
pop eax
push 0x66
mov word [ebp - 0x20], ax
pop eax
push 0x74
pop ecx
push 0x61
mov word [ebp - 0x1e], ax
pop eax
push 0x76
mov word [ebp - 0x18], ax
pop eax
push 0x72
mov word [ebp - 0x10], ax
pop eax
push 0x75
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 0x22], di
mov word [ebp - 8], di
xor edi, edi
mov word [ebp - 6], ax
lea eax, [ebp - 0x3c]
push 0x20019
mov word [ebp - 0x2c], si
mov word [ebp - 0x28], bx
mov word [ebp - 0x26], dx
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], si
mov word [ebp - 0x16], dx
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], bx
mov word [ebp - 0xe], bx
mov dword [ebp - 0x464], edi
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x45c], edi
push eax
push 0x80000002
lea ecx, [ebp - 0x464]
call fcn.004040e7
test eax, eax
jne 0x40ed8e
xor esi, esi
inc esi
jmp 0x40ee27
lea eax, [ebp - 0x450]
mov dword [ebp - 0x450], edi
push eax
xor ebx, ebx
mov esi, edi
inc ebx
push ebx
push edi
push str.SOFTWAREkingsoftAntivirusKFlag
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee27
push 0x40c
lea eax, [ebp - 0x448]
mov dword [ebp - 0x454], ebx
push edi
push eax
mov dword [ebp - 0x458], 0x104
mov dword [ebp - 0x44c], edi
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x454]
push eax
push edi
push str.KPacketName
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ee15
cmp dword [ebp - 0x44c], esi
cmovne esi, ebx
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x450], edi
lea ecx, [ebp - 0x464]
call fcn.00404145
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x40f024
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x43cb6f
call fcn.00423c0f
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.0040eedd
call fcn.0041602d
test eax, eax
je 0x40f04a
or dword [0x4551f4], 2
mov ecx, esi
call fcn.0040f61d
test eax, eax
je 0x40f05c
or dword [0x4551f4], 1
call fcn.0040ec77
test eax, eax
je 0x40f06c
or dword [0x4551f4], 4
mov ecx, esi
call fcn.0040f450
test eax, eax
je 0x40f1e5
test byte [0x4551f4], 2
je 0x40f08b
mov ecx, str.Udte_Call
jmp 0x40f09e
mov ecx, str.Real
call fcn.00415349
test eax, eax
jne 0x40f0a7
mov ecx, str.Udte
call fcn.0041539a
test eax, eax
je 0x40f0ac
call fcn.0041d809
xor edi, edi
push edi
push 0x2710
push 1
push edi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x20], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov edx, str.SpesmarlIlnclzs
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x10]
call fcn.0041733f
push 0x20019
lea ecx, [ebp - 0x1c]
push dword [eax]
push 0x80000001
call fcn.004040e7
mov ecx, dword [ebp - 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0040153a
inc bl
je 0x40f12c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push str.DelayMinutes
lea ecx, [ebp - 0x1c]
call fcn.00403fda
lea ecx, [ebp - 0x1c]
call fcn.00404145
mov eax, dword [ebp - 0x10]
cmp eax, 3
jbe 0x40f12c
imul eax, eax, 0x3c
mov dword [esi + 0x1c], eax
mov ecx, 0x80054cf
call fcn.004153f6
mov eax, dword [0x4551f4]
test al, 1
je 0x40f14e
mov ecx, 0x80054d0
call fcn.004153f6
mov eax, dword [0x4551f4]
test al, 2
je 0x40f161
mov ecx, 0x80054d1
call fcn.004153f6
mov eax, dword [0x4551f4]
and eax, 4
mov dword [0x4551e0], eax
je 0x40f175
mov ecx, 0x80054d6
call fcn.004153f6
push 0x4551b0
push edi
push edi
push 0x402f8d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4551b4], eax
call fcn.0041036d
sub esp, 0xc
xor ecx, ecx
mov edx, 0x206d
inc ecx
call fcn.004135a9
add esp, 0xc
mov esi, str.QQCallVersionReport_
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
jne 0x40f1da
mov eax, 0x444dfc
mov edx, 0xb0c
push eax
push eax
push eax
push edi
push edi
push 0x206c
call fcn.00403041
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea ecx, [ebp - 0x1c]
call fcn.00404145
xor eax, eax
inc eax
call fcn.00423bdd
ret
Function at 0x40f387
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45528c]
push ebx
xor ebx, ebx
inc ebx
mov dword [0x455294], ebx
push esi
mov esi, ecx
test eax, eax
je 0x40f3a8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi]
test ecx, ecx
je 0x40f3c6
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x455290]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x40f40a
cmp dword [0x455288], 0
jbe 0x40f40a
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x455290]
test ecx, ecx
je 0x40f40a
test eax, eax
je 0x40f403
push 1
push ecx
call ebx
mov ecx, dword [0x455290]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x455288], eax
mov dword [0x455290], eax
cmp dword [esi + 0x2c], eax
je 0x40f448
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x40f43b
push 0
push dword [esi + 0x2c]
call ebx
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x2c], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f6cf
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43cc8a
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.00432510
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x1024], edi
call fcn.004014a4
push eax
mov ecx, ebx
call fcn.004012ba
mov dword [ebp - 4], edi
inc edi
mov dword [ebp - 0x1024], edi
call fcn.004014a4
push eax
lea ecx, [ebp - 0x1020]
call fcn.004012ba
mov dword [ebp - 4], edi
call fcn.004014a4
push eax
lea ecx, [ebp - 0x101c]
call fcn.004012ba
push 0x444e50
lea edx, [esi + 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1018]
call fcn.00410cc6
pop ecx
push eax
lea ecx, [ebp - 0x1020]
mov byte [ebp - 4], 3
call fcn.004109f9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1018]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov edx, dword [0x4552c8]
lea ecx, [ebp - 0x1018]
call fcn.0041d295
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1020]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004111af
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1018]
lea ecx, [ecx - 0x10]
call fcn.0040153a
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push eax
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0x1000
push 0
push eax
call fcn.0041e3e0
mov edi, dword [ebp - 0x1020]
lea eax, [ebp - 0x1014]
add esp, 0xc
push edi
push 0x800
push eax
push 0x444dfc
push str.Item1
push 0x44afcc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1014]
push eax
call fcn.0041e3c2
pop ecx
cmp eax, 0x1b
jbe 0x40f8a0
lea eax, [ebp - 0xfde]
push eax
lea ecx, [ebp - 0x101c]
call fcn.00410a47
mov esi, dword [ebp - 0x101c]
mov edx, esi
push ecx
lea ecx, [ebp - 0x1018]
call fcn.0041d121
pop ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.004109f9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1018]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x40f8a6
push ebx
call fcn.0040f647
cmp dword [ebx], 0
je 0x40f897
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40f8a6
mov ecx, ebx
call fcn.00410d2b
jmp 0x40f8a6
mov esi, dword [ebp - 0x101c]
lea ecx, [esi - 0x10]
call fcn.0040153a
lea ecx, [edi - 0x10]
call fcn.0040153a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret 4
Function at 0x40fb9f
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x43cd15
call fcn.00423c0f
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
call fcn.004014a4
push eax
lea ecx, [ebp - 0x10]
call fcn.004012ba
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov edx, dword [0x4552ac]
call fcn.0041d295
push 0x20019
lea ecx, [ebp - 0x28]
push dword [eax]
push 0x80000002
call fcn.004040e7
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
lea ecx, [ecx - 0x10]
call fcn.0040153a
test bl, bl
je 0x40fc17
mov edi, dword [ebp - 0x10]
lea ecx, [edi - 0x10]
call fcn.004110bc
lea ecx, [edi - 0x10]
jmp 0x40fca2
mov edx, dword [0x4552b0]
lea ecx, [ebp - 0x18]
mov ebx, 0x200
mov dword [ebp - 0x14], ebx
call fcn.0041d295
mov edi, eax
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040a05d
push ebx
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0040a095
lea eax, [ebp - 0x14]
push eax
push esi
push dword [edi]
lea ecx, [ebp - 0x28]
call fcn.00404011
test eax, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
setne bl
add ecx, 0xfffffff0
call fcn.0040153a
push ecx
lea ecx, [ebp - 0x10]
call fcn.00410d60
test bl, bl
jne 0x40fc04
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x40fc96
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40fc96
lea ecx, [ebp - 0x10]
call fcn.00410d2b
mov esi, dword [ebp - 0x10]
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.004110bc
mov ecx, edi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
call fcn.0040153a
lea ecx, [ebp - 0x28]
call fcn.00404145
mov eax, esi
call fcn.00423bdd
ret 4