joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d510
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51eda3
mov eax, dword fs:[0]
push eax
mov eax, 0x2228
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004a8eb0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d580
jmp 0x41d6e6
push 0x2000
push 0
lea edx, [ebp - 0x2218]
push edx
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x2228], 1
mov dword [ebp - 0x2224], 0x1000
lea eax, [ebp - 0x2224]
push eax
lea ecx, [ebp - 0x2218]
push ecx
lea edx, [ebp - 0x2228]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.SOFTWAREQuickSee_file_pe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41d5dc
jmp 0x41d6e6
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0x2220], eax
push str..dll
mov edx, dword [ebp - 0x2220]
push edx
call fcn.004c72b0
add esp, 8
test eax, eax
jne 0x41d629
push 1
lea eax, [ebp - 0x2218]
push eax
push str.Uninst
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041d700
add esp, 0x10
jmp 0x41d6e6
push 0x52ec20
mov edx, dword [ebp - 0x2220]
push edx
call fcn.004c72b0
add esp, 8
test eax, eax
jne 0x41d6e6
lea eax, [ebp - 0x2218]
push eax
lea ecx, [ebp - 0x221c]
call fcn.00405290
mov dword [ebp - 4], 0
push str.__uninstall__productbizhi
lea ecx, [ebp - 0x221c]
push ecx
lea edx, [ebp - 0x2234]
push edx
call fcn.004221b0
add esp, 0xc
mov dword [ebp - 0x222c], eax
mov eax, dword [ebp - 0x222c]
mov dword [ebp - 0x2230], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2230]
push ecx
lea ecx, [ebp - 0x221c]
call fcn.004055e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2234]
call fcn.00405480
push 0xc350
push 1
push 1
lea ecx, [ebp - 0x221c]
call fcn.00405660
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.0041d780
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x221c]
call fcn.00405480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x41d780
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d794
jmp 0x41d7ef
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044ad30
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.call_exe_begin__path__s__cmd__s_
call fcn.0043c160
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0044af30
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
push str.call_exe_return___d___path__s___cmd__s___sync__d_
call fcn.0043c160
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x41d980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x41d98e
jmp 0x41d9e4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d99e
jmp 0x41d9e4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x41d9d4
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 8], esp
push 0
call fcn.00421710
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041d9f0
add esp, 0x30
jmp 0x41d9e4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041dc50
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41dc50
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee19
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x570374]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x41dcb9
mov ecx, dword [ebp - 0x14]
and ecx, 0x10
je 0x41dcb9
mov dword [ebp - 0x10], 1
mov edx, dword [ebp + 8]
push edx
call fcn.00404300
add esp, 4
test eax, eax
je 0x41dcb7
jmp 0x41dd34
jmp 0x41dcda
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41dcda
mov ecx, dword [ebp + 8]
push ecx
push 0x52e808
call fcn.0043c160
add esp, 8
jmp 0x41dd34
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41dd2c
cmp dword [ebp - 0x10], 0
jne 0x41dd14
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41dd14
mov ecx, dword [ebp + 8]
push ecx
push str.DeleteFile:_s_suceesss
call fcn.0043c160
add esp, 8
jmp 0x41dd34
cmp dword [ebp - 0x10], 0
je 0x41dd2c
mov edx, dword [ebp + 8]
push edx
call fcn.00404300
add esp, 4
test eax, eax
je 0x41dd2c
jmp 0x41dd34
xor eax, eax
jne 0x41dc7c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41dd76
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x18]
call fcn.00405290
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004241e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00405480
xor eax, eax
jmp 0x41dd7b
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41dd90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee3f
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 0x104
lea ecx, [ebp - 0x21c]
call fcn.00405310
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x228]
push eax
push 0x52e7d8
push 0x52e7e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x218]
push ecx
call fcn.004c6518
add esp, 4
test eax, eax
jbe 0x41de66
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00405600
lea ecx, [ebp - 0x21c]
call fcn.00410090
lea ecx, [ebp - 0x21c]
call fcn.0040ffd0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405270
mov ecx, dword [ebp - 0x220]
or ecx, 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00405480
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret

Function at 0x41e980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 1
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x214], 0x104
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405290
mov edx, dword [ebp - 0x210]
or edx, 1
mov dword [ebp - 0x210], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret

Function at 0x41ea20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041e980
add esp, 4
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004a8eb0
add esp, 0xc
push str.360safe.exe
lea ecx, [ebp - 0x210]
call fcn.00405660
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x210]
call fcn.00405480
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x41f9e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f0e1
mov eax, dword fs:[0]
push eax
sub esp, 0x544
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x531], 0
mov dword [ebp - 0x550], 0x6c
push 0xd8
push 0
lea eax, [ebp - 0xf0]
push eax
call fcn.004a8eb0
add esp, 0xc
lea ecx, [ebp - 0xf0]
push ecx
push 0x6c
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x6c
jae 0x41fbaa
mov dword [ebp - 0x538], 0
mov edx, dword [ebp - 0x538]
cmp edx, dword [ebp - 0x53c]
jae 0x41fbaa
push 0x410
push 0
lea eax, [ebp - 0x500]
push eax
call fcn.004a8eb0
add esp, 0xc
mov ecx, dword [0x52ee58]
mov dword [ebp - 0x18], ecx
mov dx, word [0x52ee5c]
mov word [ebp - 0x14], dx
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp - 0x538]
mov ax, word [ebp + edx*2 - 0xf0]
mov word [ebp + ecx - 0x18], ax
mov ecx, dword [ebp - 0x538]
add ecx, 4
mov dword [ebp - 0x538], ecx
push 0x207
lea edx, [ebp - 0x500]
push edx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x41fae3
jmp 0x41fa5e
lea ecx, [ebp - 0x500]
push ecx
call fcn.004c6518
add esp, 4
mov dword [ebp - 0x540], eax
mov edx, dword [ebp - 0x540]
push edx
lea eax, [ebp - 0x500]
push eax
mov ecx, dword [ebp + 8]
call fcn.00423cd0
push eax
call fcn.004ca57a
add esp, 0xc
test eax, eax
jne 0x41fba5
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x540]
push ecx
lea edx, [ebp - 0x530]
push edx
mov ecx, dword [ebp + 8]
call fcn.00424510
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x548], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x548]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x518]
push eax
call fcn.0041fcd0
add esp, 0xc
mov dword [ebp - 0x54c], eax
mov ecx, dword [ebp - 0x54c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00421d80
lea ecx, [ebp - 0x518]
call fcn.00421c20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x530]
call fcn.00421c20
mov byte [ebp - 0x531], 1
jmp 0x41fbaa
jmp 0x41fa5e
mov al, byte [ebp - 0x531]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x422cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x422cd9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x422d1c
mov eax, dword [ebp - 8]
jmp 0x422d82
cmp dword [ebp - 0xc], 1
je 0x422d2f
cmp dword [ebp - 0xc], 2
je 0x422d2f
mov eax, 0xd
jmp 0x422d82
cmp dword [ebp + 0xc], 0
je 0x422d76
cmp dword [ebp - 4], 0
je 0x422d65
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x422d5c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x422d63
mov eax, 0xd
jmp 0x422d82
jmp 0x422d76
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x422d99
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x422dce
call fcn.00422570
jmp 0x422de4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x422de2
push 0x26
call fcn.00407190
add esp, 4
jmp 0x422de4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x425c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f7cc
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00405310
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x224]
call fcn.00405290
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x228]
call fcn.00425ab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00405480
lea ecx, [ebp - 0x21c]
call fcn.004067b0
movzx eax, al
test eax, eax
je 0x425ccd
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.004055e0
push 0x52f468
lea ecx, [ebp - 0x21c]
call fcn.0041c760
test eax, eax
jne 0x425d25
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405270
mov eax, dword [ebp - 0x220]
or eax, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00405480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00405480
mov eax, dword [ebp + 8]
jmp 0x425df3
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x22c], 0x104
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0x52f488
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x218]
test edx, edx
je 0x425db4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00405600
lea ecx, [ebp - 0x21c]
call fcn.00410090
lea ecx, [ebp - 0x21c]
call fcn.0040ffd0
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405270
mov edx, dword [ebp - 0x220]
or edx, 1
mov dword [ebp - 0x220], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00405480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00405480
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430030
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.004a8eb0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x430094
cmp dword [ebp - 0x114], 6
jb 0x430094
mov dword [ebp - 0x11c], 1
jmp 0x43009e
mov dword [ebp - 0x11c], 0
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret

Function at 0x430810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0042ef20
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 0xc], 1
jne 0x4309ad
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4309ad
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004313b0
mov ecx, dword [ebp - 4]
call fcn.0042f990
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4308a5
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x4309ad
mov dword [ebp - 0xc], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x4308c5
mov dword [ebp - 0x14], 1
jmp 0x4308cc
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x430905
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
jne 0x430905
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00431060
jmp 0x43092b
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
je 0x43092b
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
jne 0x43092b
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
je 0x430947
mov dword [ebp - 0x18], 1
jmp 0x43094e
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x430987
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
jne 0x430987
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00431060
jmp 0x4309ad
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x4309ad
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
jne 0x4309ad
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x434490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
push 0x52fd0c
push 0
call fcn.00444170
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x4344c3
push 1
push 0
push 0
push str.http:__iquicksee.luxiaoche.com
push 0x52fd6c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x434b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x104
mov dword [ebp - 0x420], 0x530094
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0x5300b8
mov ecx, dword [ebp - 0x420]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x434c8e
mov edx, dword [ebp + 8]
push edx
call fcn.004374a0
mov ecx, eax
call fcn.00424910
call fcn.004374a0
mov ecx, eax
call fcn.00424ea0
push eax
call fcn.00437550
mov ecx, eax
call fcn.00418620
push str.installpkg
call fcn.00437550
mov ecx, eax
call fcn.00418600
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004a8eb0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [0x575cb8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00437550
mov ecx, eax
call fcn.00418640
mov eax, 2
jmp 0x434cc1
cmp dword [0x575d1c], 0
jne 0x434cbc
mov ecx, dword [0x575d1c]
add ecx, 1
mov dword [0x575d1c], ecx
push 1
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [0x575cb8]
push eax
call fcn.00433a30
add esp, 0x10
mov eax, dword [0x56f024]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 4
Function at 0x438620
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.00421910
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00422c30
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x43869f
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.00421d50
mov eax, dword [ebp - 0x220]
jmp 0x438754
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x438723
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00438620
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x438717
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.00421d50
mov eax, dword [ebp - 0x224]
jmp 0x438754
mov dword [ebp - 0x210], 0x100
jmp 0x4386a9
lea ecx, [ebp - 0x21c]
call fcn.00422660
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.00436fa0
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.00421d50
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 4

Function at 0x438830
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x43888f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43885c
mov eax, 1
jmp 0x4388ad
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43888d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x4388ad
jmp 0x4388a8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4388a8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4388ad
mov eax, 1
mov esp, ebp
pop ebp
ret 8