joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c71e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4c71eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4c72ee
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x51a3d4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x51a3d4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x51a3d4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x51a3d4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x51a3d4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x51a3d4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x51a3d4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x51a3d4]
xor eax, edx
inc ecx
dec edi
jne 0x4c7206
pop edi
test esi, esi
je 0x4c7310
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x51a3d4]
xor eax, edx
inc ecx
dec esi
jne 0x4c72f2
pop esi
pop ebx
not eax
ret
Function at 0x4cab40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x53ba74]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4cab53
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4cab94
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x53bb1c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4cabc6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4cabca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4cabbb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4cabe8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4cabec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4cabdd
xor ecx, ecx
mov eax, 0x53ba84
xor ebx, ebx
mov bl, byte [ecx + 0x53bb2c]
cmp byte [esp + ebx + 0x14], 0
je 0x4cac17
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x53bb44]
cmp byte [esp + ebx + 0x14], 0
je 0x4cac2e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4cabfe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4cab87
lea edx, [esp + 0x84]
push edx
call fcn.004cac70
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4cf980
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x58db38]
xor edx, edx
cmp eax, edx
jne 0x4cf9a6
xor eax, eax
mov byte [eax + 0x58da38], al
inc eax
cmp eax, 0x100
jl 0x4cf98e
mov dword [0x58db38], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x58da38
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4cfa37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4cfa0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4cf9d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4cfab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4cfb03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4cfaea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d6490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5061ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004d6db0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x51b70c
call fcn.004f57e0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4d6523
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004f57e0
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4d651c
push 0
mov ecx, eax
call fcn.004cd5c0
mov dword [esi + 0xc], eax
jmp 0x4d6525
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4d6525
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5abc80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5abd8c
test eax, eax
je 0x5abd8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x5c6ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x5abd73
lea edi, [eax + 4]
jmp 0x5abcd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x5abcec
mov dword [ebp - 4], 2
jmp 0x5abd0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x5abd03
mov dword [ebp - 4], 1
jmp 0x5abd0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x5abd83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x5abd46
mov byte [ecx], 0x3d
jmp 0x5abd52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x5abd5d
mov byte [ecx], 0x3d
jmp 0x5abd63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x5abcd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102f560
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1037f7c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102f5a5
cmp dword [ebp - 0x108], 2
jne 0x102f5a5
cmp dword [ebp - 0x114], 5
jb 0x102f5a5
xor eax, eax
inc eax
jmp 0x102f5a7
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.010248c0
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401030
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x410
lea eax, [ebp - 0x416]
push 0
push eax
mov word [ebp - 0x418], 0
call fcn.00408110
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x418]
push ecx
push section..data
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x401095
mov eax, 0xcb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4010c2
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jb 0x4010c2
lea edx, [ebp - 0x418]
push edx
push ecx
push esi
call fcn.0040808c
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x6f
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x410
lea eax, [ebp - 0x416]
push 0
push eax
mov word [ebp - 0x418], 0
call fcn.00408110
lea ecx, [ebp - 0x418]
push 0x208
push ecx
call fcn.00401030
add esp, 0x14
test eax, eax
jne 0x401146
push esi
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x4012d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x410
lea eax, [ebp - 0x422]
push 0
push eax
mov word [ebp - 0x424], 0
call fcn.00408110
push 0x419898
push 0x10000
call fcn.00408313
mov esi, eax
xor eax, eax
add esp, 0x14
cmp esi, eax
mov dword [ebp - 0x43c], esi
je 0x40135a
lea ecx, [esi + 0x10000]
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], esi
jmp 0x401374
xor esi, esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
lea edx, [ebp - 0x424]
push 0x208
push edx
mov dword [ebp - 4], eax
call fcn.00401030
add esp, 8
test eax, eax
mov dword [ebp - 0x428], eax
je 0x4013a6
push esi
call fcn.00408318
mov eax, dword [ebp - 0x428]
jmp 0x401528
push 0
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x43c]
push edx
mov ecx, edi
call fcn.00401dc0
mov ebx, dword [ebp - 0x438]
mov esi, dword [ebp - 0x430]
sub esi, ebx
test ebx, ebx
je 0x401517
test esi, esi
je 0x401517
lea eax, [esi + 1]
push eax
call fcn.00408c39
mov edi, eax
add esp, 4
test edi, edi
jne 0x401417
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00408318
lea eax, [edi + 0xe]
jmp 0x401528
push esi
push ebx
push edi
call fcn.00408430
add esp, 0xc
xor eax, eax
test esi, esi
mov byte [esi + edi], 0
jbe 0x40143b
lea esp, [esp]
xor byte [eax + edi], 0x2b
add eax, 1
cmp eax, esi
jb 0x401430
push esi
push ebx
push 0
call fcn.00407e50
add esp, 0xc
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x424]
push edx
mov dword [ebp - 0x440], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x428], eax
je 0x4014f9
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 4
lea edx, [ebp - 0x440]
push edx
push eax
mov dword [ebp - 0x42c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x4014d4
cmp dword [ebp - 0x42c], 4
jne 0x4014d4
mov ecx, dword [ebp - 0x428]
push 0
lea eax, [ebp - 0x42c]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x4014d4
cmp dword [ebp - 0x42c], esi
jne 0x4014d4
xor esi, esi
jmp 0x4014d9
mov esi, 0x570
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4014fe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4014fe
mov esi, 2
push edi
call fcn.00408b5c
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00408318
add esp, 8
mov eax, esi
jmp 0x40152b
mov edx, dword [ebp - 0x43c]
push edx
call fcn.00408318
mov eax, 0x65b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x1f2
push eax
mov word [ebp - 0x1fe], ax
mov word [ebp - 0x1fc], ax
mov word [ebp - 0x1fa], ax
lea eax, [ebp - 0x1f8]
push eax
mov word [ebp - 0x210], 0x44
mov word [ebp - 0x20e], 0x52
mov word [ebp - 0x20c], 0x4c
mov word [ebp - 0x20a], 0x4f
mov word [ebp - 0x208], 0x47
mov word [ebp - 0x206], 0x2e
mov word [ebp - 0x204], 0x64
mov word [ebp - 0x202], 0x61
mov word [ebp - 0x200], 0x74
call fcn.00408110
lea ecx, [ebp - 0x210]
push esi
push ecx
call fcn.004012d0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x401a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x1f2
push eax
mov word [ebp - 0x1fe], ax
mov word [ebp - 0x1fc], ax
mov word [ebp - 0x1fa], ax
lea eax, [ebp - 0x1f8]
push eax
mov word [ebp - 0x210], 0x44
mov word [ebp - 0x20e], 0x52
mov word [ebp - 0x20c], 0x4c
mov word [ebp - 0x20a], 0x4f
mov word [ebp - 0x208], 0x47
mov word [ebp - 0x206], 0x2e
mov word [ebp - 0x204], 0x64
mov word [ebp - 0x202], 0x61
mov word [ebp - 0x200], 0x74
call fcn.00408110
lea ecx, [ebp - 0x210]
push esi
push ecx
call fcn.00401600
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret

Function at 0x4028f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x410
lea eax, [ebp - 0x416]
push 0
push eax
mov word [ebp - 0x418], 0
call fcn.00408110
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x418]
push ecx
push str._ALLUSERSPROFILE_TXQMPC
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x402955
mov eax, 0xcb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x402982
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jb 0x402982
lea edx, [ebp - 0x418]
push edx
push ecx
push esi
call fcn.0040808c
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x6f
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x402ca0
Capabilities:
Find taskbar
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x210], di
call fcn.00408110
add esp, 0xc
cmp dword [ebp + 8], edi
jne 0x402cec
mov dword [ebp + 8], 1
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 0x214], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Wtsapi32.dll
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x220], esi
je 0x402d42
call fcn.00402750
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x21c], eax
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x402d50
mov esi, dword [ebp - 0x21c]
cmp esi, edi
je 0x402d77
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x402d77
lea ecx, [ebp - 0x214]
push ecx
push eax
call esi
test eax, eax
jne 0x402df8
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x402ddd
lea edx, [ebp - 0x218]
push edx
push eax
mov dword [ebp - 0x218], 0xffffffff
call ebx
mov eax, dword [ebp - 0x218]
push eax
push edi
push 0x80000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x402ddd
lea ecx, [ebp - 0x214]
push ecx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x402ddd
cmp dword [ebp - 0x214], 0
jne 0x402df8
xor edi, edi
cmp dword [ebp + 8], edi
je 0x402df8
sub dword [ebp + 8], 1
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402d50
mov eax, dword [ebp - 0x220]
test eax, eax
pop edi
pop esi
pop ebx
je 0x402e0c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x403510
Capabilities:
Check os version
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
ja 0x40352f
cmp ah, 2
jb 0x40353f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
push esi
push edi
xor esi, esi
push esi
mov eax, 0x53
mov word [ebp - 0x58], ax
mov word [ebp - 0x26], ax
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x5c]
push eax
push esi
push 0xf003f
push 1
mov ecx, 0x5c
mov edx, 0x6e
push esi
mov word [ebp - 0x42], dx
mov word [ebp - 0x3c], dx
mov word [ebp - 0x48], cx
mov word [ebp - 0x38], cx
mov edx, 0x51
mov word [ebp - 0x28], cx
push esi
lea ecx, [ebp - 0x58]
mov edi, 0x65
mov word [ebp - 0x36], dx
mov word [ebp - 0x34], dx
mov edx, 0x43
push ecx
push 0x80000002
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x56], 0x6f
mov word [ebp - 0x54], 0x66
mov word [ebp - 0x52], 0x74
mov word [ebp - 0x50], 0x57
mov word [ebp - 0x4e], 0x61
mov word [ebp - 0x4c], 0x72
mov word [ebp - 0x4a], di
mov word [ebp - 0x46], 0x54
mov word [ebp - 0x44], di
mov word [ebp - 0x40], 0x63
mov word [ebp - 0x3e], di
mov word [ebp - 0x3a], 0x74
mov word [ebp - 0x32], 0x50
mov word [ebp - 0x30], dx
mov word [ebp - 0x2e], 0x4d
mov word [ebp - 0x2c], 0x67
mov word [ebp - 0x2a], 0x72
mov word [ebp - 0x24], 0x56
mov word [ebp - 0x22], dx
mov word [ebp - 0x1c], si
mov word [ebp - 0x1a], si
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403634
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x5c]
push 4
lea edx, [ebp + 8]
push edx
mov eax, 0x73
push 4
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
mov word [ebp - 0x10], ax
push esi
lea eax, [ebp - 0x18]
push eax
push ecx
mov word [ebp - 0x14], 0x72
mov word [ebp - 0x12], di
mov word [ebp - 0xe], 0x75
mov word [ebp - 0xc], 0x6c
mov word [ebp - 0xa], 0x74
mov word [ebp - 8], si
mov word [ebp - 6], si
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x5c]
cmp eax, esi
je 0x40368e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x4036a0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [edi], 0
jne 0x4036cc
mov dword [edi], 1
pop edi
lea eax, [esi + 0x57]
pop esi
mov esp, ebp
pop ebp
ret
cmp word [esi], 0
jne 0x4036e3
mov dword [edi], 2
pop edi
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40370c
mov dword [edi], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x10000
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x403727
mov dword [edi], 4
jmp 0x403738
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x403741
mov dword [edi], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x40374e
push esi
call edi
push ebx
call edi
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4039f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0x400
lea ecx, [ebp - 0x406]
push 0
push ecx
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x40c], 0
mov word [ebp - 0x408], 0
call fcn.00408110
add esp, 0xc
lea edx, [ebp - 0x40c]
push edx
push 0x20019
push 0
push str.SoftWareTencentQQPCMgr
push 0x80000002
mov dword [ebp - 0x410], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b45
mov edx, dword [ebp - 0x40c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x408]
push ecx
push 0
push 0
push str.InstallDir
push edx
call ebx
test eax, eax
jne 0x403abe
lea eax, [ebp - 0x408]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403aa0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, esi
call fcn.00406ab0
push 0x201
lea ecx, [ebp - 0x408]
push 0
push ecx
call fcn.00408110
mov ecx, dword [ebp - 0x40c]
add esp, 0xc
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push str.Version
push ecx
call ebx
test eax, eax
pop ebx
jne 0x403b24
lea eax, [ebp - 0x408]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403b02
mov ecx, dword [ebp - 0x414]
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x408]
push edx
call fcn.00406ab0
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004080f8
mov esp, ebp
pop ebp
ret