joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ae18
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x414], ecx
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.004014a0
push 0x438
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x20
call fcn.004044f0
push str.._superkiller.ini
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4c50f4
push str.learn_detail
push str.360_link
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x41ae9a
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x20
call fcn.00404380
jmp 0x41aead
push str.http:__baike.360.cn_4005462_20836539.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x20
call fcn.00404380
push 0x418
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00401450
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x64
push 0
push 0x4c5180
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402d00
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10e
push 0
push 0x4c5188
push 1
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402d00
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4c5190
push 2
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402d00
push 0
push 0x20
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402c60
push 0
push 0x435
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b10
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d600
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac330
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x54e144], eax
cmp dword [0x54b1f0], 0
je 0x41d642
mov eax, dword [0x54b1f0]
jmp 0x41d767
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4c63e8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.Newkernel32.dll
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41d6ab
xor eax, eax
jmp 0x41d767
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x21c], eax
push 4
push 0
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x114]
push eax
call dword [0x54b4b8]
cmp dword [ebp - 0x21c], 0
jne 0x41d6f0
xor eax, eax
jmp 0x41d767
push 0x4c6408
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x54e144], eax
cmp dword [0x54e144], 0
jne 0x41d72d
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x54e144], edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x41d767
jmp 0x41d751
mov dword [ebp - 4], 0xffffffff
mov dword [0x54b1f0], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d808
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41d86e
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0xc]
push ecx
push 0x4c6424
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x41dd0f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
jne 0x41dd5b
push 0x24
push 0x4c65e8
push 0x4c65f0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x41dd59
push 5
push 0
push 0
push 0x4c661c
push 0x4c6630
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x41ddda
jmp 0x41ddd8
cmp dword [ebp + 0xc], 1
jne 0x41dd79
push 0
push 0x4c6638
push 0x4c6640
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41ddd8
cmp dword [ebp + 0xc], 2
jne 0x41dd97
push 0
push 0x4c6674
push 0x4c667c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41ddd8
cmp dword [ebp + 0xc], 3
jne 0x41ddd8
push 0x24
push 0x4c66b4
push 0x4c66bc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jne 0x41ddd8
push 5
push 0
push 0
push 0x4c66fc
push 0x4c6710
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x41ddda
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41dde7
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x41ddde
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x41ddde
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
pop ebp
ret

Function at 0x41e8a6
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
call fcn.0041e844
test eax, eax
je 0x41e8bd
jmp 0x41e9b9
cmp dword [ebp + 0x10], 0
jne 0x41e99f
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
push 0x4c6824
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a230
add esp, 0x14
mov dword [ebp - 0x314], 0x104
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4c682c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
test eax, eax
jne 0x41e96a
cmp dword [ebp - 0x314], 0
jbe 0x41e96a
cmp dword [ebp - 0x20c], 1
jne 0x41e96a
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.00402af0
add esp, 8
test eax, eax
jne 0x41e96a
jmp 0x41e9b9
lea ecx, [ebp - 0x104]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x104]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
push 0x4c6860
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
jmp 0x41e9b9
mov ecx, dword [ebp + 8]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
mov esp, ebp
pop ebp
ret
Function at 0x41ee16
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], 1
push 0
push 0x26
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x41ee6b
push str.360safe360safe.exe
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00408000
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41ee6b
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x41eea2
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0041e7d2
add esp, 8
test eax, eax
jne 0x41ee8d
xor eax, eax
jmp 0x41eed5
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41eea2
xor eax, eax
jmp 0x41eed5
call fcn.0041eed9
test eax, eax
jne 0x41eeb2
mov eax, 1
jmp 0x41eed5
call fcn.0041ed0e
test eax, eax
jne 0x41eec2
mov eax, 2
jmp 0x41eed5
call fcn.0041f284
test eax, eax
jne 0x41eed2
mov eax, 3
jmp 0x41eed5
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x41efa1
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x4c6aec
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41eff6
push 9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp + 8], 0
jbe 0x41eff1
push 0x168
mov edx, dword [ebp + 8]
push edx
push 0x52c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41f080
call fcn.0041ef67
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41f049
cmp dword [ebp + 8], 0
jbe 0x41f047
push 0x3e8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push str.Q360SafeMainClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41f047
push 0x168
mov edx, dword [ebp + 8]
push edx
push 0x52c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41f080
mov dword [ebp - 0xc], 0x4c6b14
push 0x30
push 0x4c6b70
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x4c6b78
push 0x4c6b8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x41f084
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x41f0d9
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
jmp 0x41f0db
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41f5c1
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov al, byte [0x54b1fc]
mov byte [ebp - 0x104], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 1
test ecx, ecx
je 0x41f67e
mov dword [ebp - 0x108], 2
mov dword [ebp - 0x10c], 0x104
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x108]
push ecx
push str.DataBasePath
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
test eax, eax
jne 0x41f658
push 0x4c6be8
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
jmp 0x41f67c
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.DriversetcHosts
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x41f6a2
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Hosts
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409100
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41f6e4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x41f6e4
mov dword [ebp - 0x214], 1
jmp 0x41f6ee
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41f936
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov dword [ebp - 0x13c], ecx
cmp dword [ebp + 8], 0
jne 0x41f952
xor eax, eax
jmp 0x41fa96
cmp dword [ebp + 0x14], 0
jne 0x41f98a
mov dword [ebp - 0x114], 0x104
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x41f981
xor eax, eax
jmp 0x41fa96
lea edx, [ebp - 0x10c]
mov dword [ebp + 0x14], edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
jne 0x41fa93
cmp dword [ebp + 0x10], 2
je 0x41f9d7
cmp dword [ebp + 0x10], 1
jne 0x41f9ec
mov ecx, dword [ebp + 0x14]
push ecx
push 3
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x13c]
call fcn.0041f89a
mov dword [ebp - 0x138], 0
push 0x20
push 0
lea eax, [ebp - 0x134]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x134]
push ecx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x41fa7d
push 0
mov edx, dword [ebp - 0x138]
push edx
push 0
push 0
push 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x138], 0
je 0x41fa7d
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x110], 0
je 0x41fa93
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x41fe28
Capabilities:
Download url
Read .ini file
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 4], 0
movsx eax, byte [0x54b200]
test eax, eax
jne 0x41fe99
push 0x104
push 0x54b200
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x54b200
call fcn.0040a210
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41fe7f
push 0x2f
push 0x54b200
call fcn.0040a210
add esp, 8
mov dword [ebp - 8], eax
push str._antifilelib.dat
push 0x104
mov ecx, dword [ebp - 8]
push ecx
call fcn.00409100
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x41fee9
call fcn.0044d820
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41fee9
mov edx, dword [ebp - 0xc]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0x54b304
push 0x4c757c
push 0x4c7580
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0
push 0x54b200
lea ecx, [ebp - 0x110]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov eax, 0x54b200
mov esp, ebp
pop ebp
ret
Function at 0x41ff55
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
call fcn.0044d820
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42004d
mov dword [ebp - 8], 1
mov dword [ebp - 0x110], 0x104
mov eax, dword [ebp - 4]
push eax
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0x4c75b0
push 0x4c75b4
push 0x4c75b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x4c75c4
push 0x4c75d4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x41fff8
push 0x4c75ec
push 0x104
lea edx, [ebp - 0x10c]
push edx
call fcn.00409100
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x214]
push ecx
call fcn.00402af0
add esp, 8
test eax, eax
jle 0x42004d
lea edx, [ebp - 0x214]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0x4c75f0
push 0x4c7600
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x42004f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x420053
Capabilities:
Check if file exists
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac3b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
call fcn.0041fe28
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42029a
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42009b
mov eax, 1
jmp 0x42029c
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042f4f6
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42029a
lea ecx, [ebp - 0x20]
call fcn.0041f720
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x42026d
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
test edx, edx
je 0x42026d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00445154
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
cmp eax, 0x3b
jne 0x42011c
push 0xa
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
mov dword [ebp - 0x1c], eax
jmp 0x4200cd
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
cmp eax, 0x2d
jne 0x42013a
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x228], 0
push 0x104
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042e4bd
add esp, 0xc
test eax, eax
jne 0x42016d
movsx ecx, byte [ebp - 0x228]
test ecx, ecx
je 0x42016d
jmp 0x42026d
push 0xa
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x228]
push eax
push 0x4c7618
push 0x104
lea ecx, [ebp - 0x124]
push ecx
call fcn.0040a230
add esp, 0x10
cmp dword [ebp - 0x22c], 0
je 0x420202
lea edx, [ebp - 0x228]
push edx
call dword [0x54b4b8]
push 0
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x420200
push 0
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x420200
push 0x1f01ff
push 0
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x20]
call fcn.0041fc78
push 1
lea eax, [ebp - 0x228]
push eax
call dword [0x54b4e0]
jmp 0x420268
push 0x80
lea ecx, [ebp - 0x228]
push ecx
call dword [0x54b4e0]
push 0x1f01ff
push 0
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x20]
call fcn.0041fc55
push 0x80
lea eax, [ebp - 0x124]
push eax
call dword [0x54b4e0]
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x80
lea edx, [ebp - 0x228]
push edx
call dword [0x54b4e0]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4200cd
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0042f594
add esp, 4
mov dword [ebp - 0x230], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0041f737
mov eax, dword [ebp - 0x230]
jmp 0x42029c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42062d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
call fcn.0044d820
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x420725
mov dword [ebp - 8], 1
mov dword [ebp - 0x110], 0x104
mov eax, dword [ebp - 4]
push eax
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0x4c773c
push 0x4c7740
push 0x4c7744
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x4c7750
push 0x4c7760
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4206d0
push 0x4c7778
push 0x104
lea edx, [ebp - 0x10c]
push edx
call fcn.00409100
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x214]
push ecx
call fcn.00402af0
add esp, 8
test eax, eax
jle 0x420725
lea edx, [ebp - 0x214]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0x4c777c
push 0x4c778c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x420727
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x42072b
Capabilities:
Download url
Read .ini file
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 4], 0
movsx eax, byte [0x54b308]
test eax, eax
jne 0x42079c
push 0x104
push 0x54b308
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x54b308
call fcn.0040a210
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x420782
push 0x2f
push 0x54b308
call fcn.0040a210
add esp, 8
mov dword [ebp - 8], eax
push str._antihostlib.dat
push 0x104
mov ecx, dword [ebp - 8]
push ecx
call fcn.00409100
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x4207ec
call fcn.0044d820
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4207ec
mov edx, dword [ebp - 0xc]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0x54b40c
push 0x4c77b8
push 0x4c77bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0
push 0x54b308
lea ecx, [ebp - 0x110]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov eax, 0x54b308
mov esp, ebp
pop ebp
ret
Function at 0x420a91
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
cmp dword [0x54b4b0], 0
je 0x420ab3
mov eax, dword [0x54b4b0]
jmp 0x420bd4
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4c7868
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.NewAdvapi32.dll
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x420b1c
xor eax, eax
jmp 0x420bd4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x108], eax
push 4
push 0
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [ebp - 0x104]
push edx
call dword [0x54b4b8]
cmp dword [ebp - 0x108], 0
jne 0x420b5a
xor eax, eax
jmp 0x420bd4
push 0x4c7888
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 0x94], eax
push 0x4c7898
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 0x98], eax
mov edx, dword [ebp - 0x210]
cmp dword [edx + 0x98], 0
je 0x420bb4
mov eax, dword [ebp - 0x210]
cmp dword [eax + 0x94], 0
jne 0x420bc5
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x420bd4
mov dword [0x54b4b0], 1
mov eax, 1
mov esp, ebp
pop ebp
ret