joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439be0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c188
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5da2b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x439c31
push ebx
push ebx
push ebx
push 2
call fcn.0043c6f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x439c47
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x439c38
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.004c715d
push ebx
call fcn.004c76cf
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp - 0x14], esi
call fcn.004c715d
add esp, 0x1c
test esi, esi
jne 0x439cab
push esi
push esi
push esi
push 0xd
mov ecx, edi
call fcn.0043c6f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x10], 0x5e90b0
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043cc50
lea eax, [esi + 1]
push eax
call fcn.00437c34
push ebx
push 1
mov ebx, eax
mov dword [ebp + 8], eax
push esi
push ebx
mov byte [eax], 0
call fcn.004c6df3
add esp, 0x14
cmp eax, 1
je 0x439cfb
push 0
push 0
push 0
push 2
mov ecx, edi
call fcn.0043c6f0
xor bl, bl
jmp 0x439d9e
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov esi, ebx
mov byte [ebx + eax], 0
cmp byte [ebx], 0
je 0x439d68
nop dword [eax + eax]
mov al, byte [esi]
cmp al, 0xa
jne 0x439d2a
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0043cb20
inc esi
mov ecx, esi
jmp 0x439d63
cmp al, 0xd
jne 0x439d62
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x439d40
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0043cb20
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
lea ecx, [ebp - 0x10]
call fcn.0043cb20
cmp byte [esi + 1], 0xa
lea ecx, [esi + 1]
jne 0x439d5e
lea ecx, [esi + 2]
mov esi, ecx
jmp 0x439d63
inc esi
cmp byte [esi], 0
jne 0x439d10
sub esi, ecx
je 0x439d76
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0043cb20
push ebx
call fcn.00437c3d
mov eax, dword [ebp - 0x10]
add esp, 4
mov edx, dword [edi]
add eax, 8
mov ecx, edi
push dword [ebp + 0xc]
push 0
push eax
call dword [edx + 8]
cmp byte [edi + 0x2c], 0
je 0x439d9c
xor bl, bl
jmp 0x439d9e
mov bl, 1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x5e90b0
je 0x439db2
push ecx
call fcn.00437c3d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43cd28
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x43cd3c
xor eax, eax
jmp 0x43ce7a
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x43cd65
dec edx
sub edx, 1
jne 0x43cd67
add eax, 2
jmp 0x43cd67
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x43cd7a
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x43ce79
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x43ce10
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x578e10]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x578e10]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x578e10]
mov byte [edi + 2], al
mov al, byte [esi + 0x578e10]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x43cda5
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x43ce13
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x43ce6c
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x43ce28
movzx ecx, byte [eax + 1]
jmp 0x43ce2a
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x578e10]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x578e10]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x43ce61
and ecx, 0xf
mov al, byte [ecx*4 + 0x578e10]
mov byte [edi + 2], al
jmp 0x43ce65
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d0c8
Capabilities:
Check if file exists
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x61c]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.004bf1c0
push ebx
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004bf1c0
push ebx
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.004bf1c0
push ebx
lea eax, [ebp - 0xc34]
push esi
push eax
call fcn.004bf1c0
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004bf1c0
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004bf1c0
add esp, 0x48
lea eax, [ebp - 0x414]
push esi
push 0x2b
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x414]
push str._shiqiang_
push eax
call fcn.004d2a28
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43d181
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x20c]
push str.wnsoft.ini
push eax
call fcn.004d2a28
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0x10
mov ebx, str.Globals
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x571908
push str.OnlyIdentifier1
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
push 0x571908
push str.OnlyIdentifier2
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xa2c]
push eax
push 0x571908
push str.OnlyIdentifier3
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xc34]
push eax
push 0x571908
push str.OnlyIdentifier4
push ebx
call esi
lea eax, [ebp - 0x61c]
push eax
call fcn.004d2a7b
mov esi, eax
lea eax, [ebp - 0x824]
push eax
call fcn.004d2a7b
mov dword [ebp - 0xc38], eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004d2a7b
mov ebx, eax
lea eax, [ebp - 0xc34]
push eax
call fcn.004d2a7b
add esp, 0x10
test esi, esi
je 0x43d2d7
cmp dword [ebp - 0xc38], 0
je 0x43d2d7
test ebx, ebx
je 0x43d2d7
test eax, eax
je 0x43d2d7
lea eax, [ebp - 0x61c]
push eax
push dword [edi]
call fcn.004d2a59
lea eax, [ebp - 0x824]
push eax
mov eax, dword [edi]
add eax, 0x208
push eax
call fcn.004d2a59
lea eax, [ebp - 0xa2c]
push eax
mov eax, dword [edi]
add eax, 0x410
push eax
call fcn.004d2a59
lea eax, [ebp - 0xc34]
push eax
mov eax, dword [edi]
add eax, 0x618
push eax
call fcn.004d2a59
xor eax, eax
add esp, 0x20
inc eax
jmp 0x43d2d9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x43d728
Capabilities:
Get mac address on windows

Disassembly:
push 0x48
mov eax, 0x56c4c6
call fcn.004e718f
mov ebx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x48], 4
call fcn.004d2a7b
push eax
push 0
push ebx
call fcn.004bf1c0
push 0x288
call fcn.004c67d4
mov esi, eax
add esp, 0x14
test esi, esi
je 0x43d71b
lea eax, [ebp - 0x48]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x43d5e7
push esi
call fcn.004c67cf
push dword [ebp - 0x48]
call fcn.004c67d4
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43d71b
lea eax, [ebp - 0x48]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x43d714
and dword [ebp - 0x4c], eax
lea edi, [ebp - 0x2a]
push 6
pop ecx
mov word [ebp - 0x2c], ax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
and dword [ebp - 4], ecx
mov edi, esi
test esi, esi
je 0x43d6e5
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x2c]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.0041ee30
lea eax, [edi + 0x10c]
push eax
call fcn.00568685
push 0x578f04
push eax
call fcn.004c16c0
add esp, 0x2c
test eax, eax
jne 0x43d723
cmp dword [edi + 0x1a0], 0x47
je 0x43d723
and dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp word [ebp - 0x2c], ax
je 0x43d6a8
lea eax, [ebp - 0x2c]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x44]
call fcn.00419cc0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x54]
call fcn.0042b330
push 0
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00430390
mov edi, dword [edi]
test edi, edi
jne 0x43d61d
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
sub eax, ecx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
je 0x43d70c
push 0
lea ecx, [ebp - 0x54]
call fcn.0043e3ab
cmp dword [eax + 0x14], 8
jb 0x43d703
mov eax, dword [eax]
push eax
push ebx
call fcn.004d2a59
pop ecx
pop ecx
lea ecx, [ebp - 0x54]
call fcn.0043e302
push esi
call fcn.004c67cf
pop ecx
call fcn.004e7139
ret 4
lea eax, [ebp - 0x2c]
jmp 0x43d703
push ebp
mov ebp, esp
lea ecx, [ebp + 0xb]
pop ebp
jmp 0x43d582
Function at 0x43d75b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004bf1c0
lea eax, [ebp - 0x20c]
push 0x577c00
push eax
call fcn.004d2a59
add esp, 0x44
lea eax, [ebp - 0x20c]
push 0x57903c
push eax
call fcn.004d2a28
lea eax, [ebp - 0x20c]
push 0x57190c
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0xa34]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d8a4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xa30], 0x104
push eax
push ebx
push ebx
push str.OnlyIdentifier1
push dword [ebp - 0xa34]
call esi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push str.OnlyIdentifier2
push dword [ebp - 0xa34]
call esi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x824]
push eax
push ebx
push ebx
push str.OnlyIdentifier3
push dword [ebp - 0xa34]
call esi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa2c]
push eax
push ebx
push ebx
push str.OnlyIdentifier4
push dword [ebp - 0xa34]
call esi
push dword [ebp - 0xa34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push eax
call fcn.004d2a7b
mov esi, eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004d2a7b
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0x824]
push eax
call fcn.004d2a7b
mov ebx, eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004d2a7b
add esp, 0x10
test esi, esi
je 0x43d954
cmp dword [ebp - 0xa30], 0
je 0x43d954
test ebx, ebx
je 0x43d954
test eax, eax
je 0x43d954
lea eax, [ebp - 0x414]
push eax
push dword [edi]
call fcn.004d2a59
lea eax, [ebp - 0x61c]
push eax
mov eax, dword [edi]
add eax, 0x208
push eax
call fcn.004d2a59
lea eax, [ebp - 0x824]
push eax
mov eax, dword [edi]
add eax, 0x410
push eax
call fcn.004d2a59
lea eax, [ebp - 0xa2c]
push eax
mov eax, dword [edi]
add eax, 0x618
push eax
call fcn.004d2a59
xor eax, eax
add esp, 0x20
inc eax
jmp 0x43d956
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x43d967
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x220]
mov edi, 0x208
push edi
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x578f1c
call fcn.004d2a7b
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004d2a96
push edi
lea eax, [ebp - 0x630]
push ebx
push eax
call fcn.004bf1c0
push edi
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.004bf1c0
add esp, 0x28
mov dword [ebp - 0x634], ebx
mov ecx, 0x104
mov dword [ebp - 0x63c], ebx
lea eax, [ebp - 0x428]
mov dword [ebp - 0x638], ebx
push ecx
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x634]
push eax
push ecx
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43da53
push dword [ebp - 0x634]
push str._08X
push esi
call fcn.0041ee30
add esp, 0xc
jmp 0x43da60
push 0x571908
push esi
call fcn.004d2a59
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x43dc1f
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004bf1c0
add esp, 0x18
lea eax, [ebp - 0x20c]
push ebx
push 0x2b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str._shiqiang_
push eax
call fcn.004d2a28
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
pop ecx
pop ecx
push eax
call esi
test eax, eax
jne 0x43dca2
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x414]
push str.wnsoft.ini
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x43dd37
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x414]
push eax
push dword [edi]
mov ebx, str.Globals
push str.OnlyIdentifier1
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x208
push eax
push str.OnlyIdentifier2
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x410
push eax
push str.OnlyIdentifier3
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x618
push eax
push str.OnlyIdentifier4
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x43dee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov esi, 0xf003f
push eax
push esi
xor edi, edi
mov ebx, ecx
push edi
push 0x57906c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43dfde
push edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push edi
push edi
push edi
push str.ShiQiang
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43dfde
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
lea eax, [eax*2 + 2]
push eax
push dword [ebx]
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.OnlyIdentifier1
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x208
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x208
push eax
push 1
push 0
push str.OnlyIdentifier2
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x410
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x410
push eax
push 1
push 0
push str.OnlyIdentifier3
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x618
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x618
push eax
push 1
push 0
push str.OnlyIdentifier4
push dword [ebp - 4]
call edi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442cd0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x442cbe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
pop esi
test eax, eax
je 0x442cfe
cmp eax, 0xffffffff
je 0x442cfe
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x444144
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x57849c
mov esi, ecx
call ebx
mov dword [esi], eax
test eax, eax
je 0x4441c4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x4441c3
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x444294
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x444361
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x578738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x578738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x578738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x578738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.004d2c70
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x44433d
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.004d2c70
pop ecx
pop ecx
test eax, eax
je 0x44437e
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x4442c7
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.004d2ae0
pop ecx
test eax, eax
je 0x44437e
push ebx
mov ecx, edi
call fcn.00444cc0
mov al, 1
jmp 0x444380
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444c03
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x444c64
mov ecx, esi
call fcn.0044465a
jmp 0x444c79
mov ebx, edi
test edi, edi
jne 0x444c79
mov ecx, esi
call fcn.00444535
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x444c66
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret

Function at 0x44502a
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x448cf0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x448d40
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x448d3a
shr eax, 8
cmp al, 2
jne 0x448d3a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret