joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409daf
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040d650
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x409dcf
push dword [ebp + 0xc]
call fcn.0040544e
pop ecx
jmp 0x409dd1
xor eax, eax
push edi
push 0x4400000
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x409df5
xor eax, eax
jmp 0x409f07
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x2001
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp byte [esi], 0
jne 0x409e71
xor eax, eax
jmp 0x409f05
mov eax, dword [ebp - 8]
test eax, eax
je 0x409e8f
cmp dword [ebp + 0xc], eax
mov byte [ebp + eax - 0x1010], 0
ja 0x409e53
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
add eax, eax
push eax
push esi
push 0
mov dword [ebp - 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x409e1a
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + edi]
push eax
call fcn.0040c670
mov eax, dword [ebp - 8]
sub dword [ebp + 0xc], eax
add esp, 0xc
add edi, eax
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
je 0x409e21
lea eax, [edi + edi + 2]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jne 0x409ead
and dword [ebp - 4], eax
jmp 0x409ef6
and dword [ebp + 0xc], 0
test esi, esi
mov dword [ebp - 4], 1
mov byte [esi + edi], 0
mov ecx, eax
je 0x409eec
test edi, edi
jbe 0x409eec
and word [ecx], 0
test edi, edi
jbe 0x409eec
mov edx, dword [ebp + 0xc]
movzx dx, byte [edx + esi]
mov word [ecx], dx
mov edx, dword [ebp + 0xc]
cmp byte [edx + esi], 0
je 0x409eec
inc dword [ebp + 0xc]
inc ecx
inc ecx
cmp dword [ebp + 0xc], edi
jb 0x409ece
and word [eax + edi*2], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x409f0a
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.0040d650
push ebx
push esi
lea eax, [ebp - 0x210]
push edi
add edx, 0xe
push eax
call fcn.0040550e
lea eax, [ebp - 0x210]
push eax
call fcn.0040544e
xor ebx, ebx
push 0x4244d0
mov word [ebp + eax*2 - 0x212], bx
call fcn.0040544e
add esp, 0xc
mov dword [ebp - 8], eax
call fcn.0040bf8f
cmp dword [ebp - 8], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
jbe 0x409fa4
movsx ax, byte [esi]
sub ax, 2
movzx ecx, ax
mov eax, dword [ebp - 4]
push 3
xor edx, edx
pop edi
div edi
sub edx, ebx
je 0x409f90
dec edx
je 0x409f88
dec edx
jne 0x409f96
add ecx, 0xfffe
jmp 0x409f96
add ecx, 0xfffb
jmp 0x409f96
add ecx, 0xffff
mov byte [esi], cl
inc esi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x409f61
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
lea eax, [ebp - 0x210]
push eax
push dword [0x4114d4]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
jne 0x409fc7
xor eax, eax
jmp 0x40a03c
push ebx
push 0x4400100
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x40f0a0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
cmp esi, ebx
je 0x409fc3
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push dword [ebp - 0xc]
mov edi, eax
call fcn.0040bedf
cmp edi, ebx
pop ecx
je 0x409fc3
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
cmp esi, ebx
je 0x40a03a
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x1210], bl
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x1210]
call fcn.0040bfda
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a041
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x24
push 0x40f700
call fcn.0040d2f8
and dword [ebp - 4], 0
call fcn.0040584a
movzx ecx, cl
inc ecx
cdq
idiv ecx
mov esi, edx
movzx eax, byte [ebp + 8]
add esi, eax
imul esi, esi, 0x3e8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, esi
jae 0x40a0bd
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a09e
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a07d
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a075
or dword [ebp - 4], 0xffffffff
call fcn.0040d333
ret
Function at 0x40a0c7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
push 0x40f6f0
call fcn.0040d2f8
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
cmp edi, ebx
jl 0x40a146
cmp word [ebp - 0x1c], 0xffff
jne 0x40a146
call esi
sub eax, dword [ebp - 0x20]
cmp eax, 0x15f90
ja 0x40a161
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a127
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a108
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov eax, dword [eax + 0x4284d8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x7c]
mov edi, eax
cmp edi, ebx
jl 0x40a161
jmp 0x40a0e9
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x40a167
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0040d333
ret

Function at 0x40a26c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x411054], 0
push ebx
push esi
push edi
mov ebx, eax
jne 0x40a28c
call fcn.0040a1cb
test eax, eax
mov dword [ebp - 8], eax
jne 0x40a29e
mov esi, ebx
call fcn.0040a16d
test eax, eax
mov dword [ebp - 8], eax
je 0x40a353
push str.eventConn
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
mov edx, dword [ecx]
sub esp, 0x10
mov edi, esp
mov word [ebp - 0x18], 3
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x94]
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40a33a
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x40a2fe
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x10
push dword [0x415268]
mov eax, 0x1388
push dword [0x4201b0]
push eax
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov ebx, dword [ebx]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0xf0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b3f6
Capabilities:
Copy file
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x180c
call fcn.0040d650
push ebx
push esi
push edi
call fcn.00407f83
mov esi, str.CNwuedcoweu
push esi
xor ebx, ebx
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
je 0x40b465
push 0x400
lea eax, [esp + 0x1c]
push eax
push ebx
mov byte [0x4244ad], 1
call edi
push 0x419d78
lea eax, [esp + 0x1c]
call fcn.00405490
test eax, eax
pop ecx
je 0x40b465
push 4
push ebx
push 3
call fcn.0040a89c
add esp, 0xc
call fcn.0040b383
call fcn.0040ac11
test eax, eax
je 0x40b481
cmp byte [0x4244ad], bl
jne 0x40b460
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
jmp 0x40b460
call fcn.0040ac79
test eax, eax
je 0x40b4eb
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push ebx
push 9
call fcn.0040a89c
add esp, 0xc
push 0x400
lea eax, [esp + 0x101c]
push eax
push ebx
call edi
lea eax, [esp + 0x18]
push eax
call fcn.0040acd6
test eax, eax
pop ecx
je 0x40b4eb
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b4eb
lea eax, [esp + 0x18]
push eax
call fcn.00407927
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x4244ad], bl
je 0x40b508
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040a89c
add esp, 0xc
jmp 0x40b4e4
lea eax, [esp + 0x818]
push eax
call fcn.0040787e
test eax, eax
pop ecx
je 0x40b460
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov esi, eax
lea eax, [esp + 0x818]
push eax
call fcn.00407927
test eax, eax
pop ecx
je 0x40b5a3
push 1
lea eax, [esp + 0x81c]
push eax
push 0x41a648
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004069fa
add esp, 0x14
test eax, eax
je 0x40b593
or dword [esp + 0x14], 0xffffffff
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0xdc3cba00
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b4e4
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
jmp 0x40b4fe
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
call fcn.0040a89c
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ce06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40ce10
repz ret
jmp fcn.0040d0ab
Function at 0x40108d
Capabilities:
Read .ini file

Disassembly:
add ecx, 0x108
push ecx
push 0x400
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x10

Function at 0x4010f4
Capabilities:
Read .ini file

Disassembly:
add ecx, 0x108
push ecx
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
xor eax, eax
ret 0x10
Function at 0x4031b4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov dword [0x40f554], eax
lea eax, [ebp - 0x104]
push str.SetupHelper:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, 0x40f558
push 0x103
push esi
call fcn.004061d9
pop ecx
test eax, eax
pop ecx
jne 0x403210
push 0x40f550
push esi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp + 0x10]
mov esi, 0x40f65c
push esi
call sub.MSVCRT.dll_strcpy
push esi
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 0xc
xor ebx, ebx
mov dword [ebp + 0x10], ebx
mov edi, 0x40e130
push dword [edi]
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x40324f
add edi, 8
inc ebx
cmp edi, str._import_verycd_data
jl 0x403232
jmp 0x403259
call dword [ebx*8 + 0x40e134]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4045fa
Capabilities:
Check os version
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x94
lea eax, [ebp - 0x94]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 0xc], 0
push dword [ebp + 8]
je 0x404641
call fcn.00406167
pop ecx
jmp 0x404647
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404660
cmp dword [ebp - 0x90], 5
jb 0x404660
push 4
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
leave
ret
Function at 0x4049ec
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
push edi
je 0x404b04
cmp dword [ebp + 0xc], esi
je 0x404b04
push ebx
call sub.MSVCRT.dll_strlen
cmp eax, 0x104
pop ecx
jae 0x404b04
mov edi, 0x94
lea eax, [ebp - 0xd4]
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd4], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xd0], 5
jb 0x404b04
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 4
push 1
mov dword [ebp - 0xc], esi
pop edi
mov dword [ebp - 8], esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
jne 0x404b04
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithNameA]
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclA]
test eax, eax
jne 0x404afb
mov eax, dword [ebp + 8]
push 3
or eax, dword [ebp + 0x10]
push edi
push eax
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push dword [ebp - 4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x404afb
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
cmp edi, esi
sete al
jmp 0x404b06
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40613a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40614c
xor eax, eax
ret
and eax, 0x10
cmp al, 0x10
jne 0x40615d
xor eax, eax
cmp dword [esp + 8], eax
setne al
ret
xor eax, eax
cmp dword [esp + 8], eax
sete al
ret

Function at 0x406167
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push dword [ebp + 8]
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strlen
xor ecx, ecx
add esp, 0xc
mov byte [ebp + eax - 0x123], cl
lea eax, [ebp - 0x124]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x10], 0x414
mov dword [ebp - 0xe], ecx
mov dword [ebp - 0xa], ecx
mov dword [ebp - 6], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x4061d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
leave
ret
push 1
pop eax
leave
ret
Function at 0x406257
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
xor ebx, ebx
push eax
push 0xf003f
push ebx
push str.SOFTWARESandai_Technologies_Inc.ThunderOem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406285
xor eax, eax
jmp 0x4062e7
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 0xc]
push esi
push eax
push ebx
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4062db
push eax
push esi
call fcn.0040613a
pop ecx
test eax, eax
pop ecx
je 0x4062db
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
cmp eax, esi
jbe 0x4062d4
cmp byte [eax], 0x5c
je 0x4062d4
dec eax
jmp 0x4062c8
and byte [eax + 1], 0
push 1
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x4062ea
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 8]
pop ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4063f7
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x40d0a0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4063f7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
dec edx
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
je 0x4063e0
dec edx
je 0x4063c5
dec edx
je 0x4063a6
dec edx
je 0x406383
push 0x40ec78
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x406404
movzx edx, cx
shr ecx, 0x10
push edx
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push str._d._d._d._d
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x406406
shr ecx, 0x10
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push str._d._d._d
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x406406
movzx ecx, cx
shr eax, 0x10
push ecx
push eax
push str._d._d
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x406406
shr eax, 0x10
push eax
push 0x40e02c
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x406406
push 0x40ec78
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push edi
call fcn.0040a0e1
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x406976
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406a18
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
cmp eax, 1
pop ecx
jb 0x406a18
push ebx
push edi
push esi
lea eax, [ebp - 0x104]
push 0x17
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s.lnk
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call ebx
push 0
lea eax, [ebp - 0x104]
push 2
push eax
push 0
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s.lnk
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call ebx
push 1
pop eax
pop edi
pop ebx
jmp 0x406a1a
xor eax, eax
pop esi
leave
ret

Function at 0x406a1d
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406abe
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
cmp eax, 1
pop ecx
jb 0x406abe
push ebx
push edi
push esi
lea eax, [ebp - 0x104]
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s.lnk
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call ebx
xor eax, eax
lea ecx, [ebp - 0x104]
push eax
push eax
push ecx
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s.lnk
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call ebx
push 1
pop eax
pop edi
pop ebx
jmp 0x406ac0
xor eax, eax
pop esi
leave
ret
Function at 0x406b42
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 4]
push edi
mov dword [ebp - 4], ebx
push eax
je 0x406b63
push str.SoftwareThunder_NetworkThunderOem
jmp 0x406b68
push str.SoftwareSandai_Technologies_Inc.ThunderOem
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
cmp eax, ebx
jne 0x406c17
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov ebx, str.ThunderOemArray
mov dword [ebp - 8], 0x103
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406be9
cmp dword [ebp - 8], eax
jbe 0x406be9
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.00406ac3
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
inc eax
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp dword [ebp + 0x10], 0
je 0x406c2c
cmp dword [ebp + 8], 0
lea eax, [ebp - 4]
push eax
je 0x406c0b
push str.SoftwareThunder_NetworkThunderOem
jmp 0x406c10
push str.SoftwareSandai_Technologies_Inc.ThunderOem
push edi
call esi
test eax, eax
je 0x406c1b
xor eax, eax
jmp 0x406c2f
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40737a
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.http_shellopencommand
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40746c
push 0x40
lea edi, [ebp - 0x10b]
pop ecx
mov byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x40f550
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x40746c
cmp byte [ebp - 0x10c], 0x22
lea edi, [ebp - 0x10c]
jne 0x407407
lea edi, [ebp - 0x10b]
push 0x40ef4c
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
jne 0x407422
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
sub eax, edi
mov esi, eax
lea eax, [ebp - 0x210]
push esi
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x210]
mov edi, str.open
mov byte [ebp + esi - 0x210], bl
push 1
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push dword [ebp + 8]
push eax
push edi
push ebx
call esi
cmp eax, 0x20
jg 0x40747f
push 1
push ebx
push ebx
push dword [ebp + 8]
push edi
push ebx
call esi
jmp 0x40747f
push 1
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
leave
ret