joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a10a
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x9c
mov eax, 0x1008d3ca
call fcn.1005ede7
mov ebx, ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
push 0xfde9
push dword [ebp + 8]
xor edi, edi
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xa8], eax
call fcn.10055359
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10050126
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 3
cmp dword [ebp - 0xa8], eax
je 0x1005a17e
push dword [ebp - 0xa8]
call fcn.100683e8
pop ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 1
push edi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1005a205
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
add eax, dword [ebx + 0x1c]
push eax
mov dword [ecx], eax
call fcn.1005e7f1
mov ecx, dword [ebp - 0x20]
mov dword [esi], eax
push dword [ecx]
push edi
push eax
call fcn.100616d0
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [esi]
call fcn.1005ddb9
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebx + 0x1c]
mov ecx, dword [eax - 0xc]
add esi, dword [edx]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push esi
call fcn.1005ddb9
add esp, 0x30
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
push esi
push edi
push 1
push edi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1005a20d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10056e89
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10056e89
mov eax, edi
call fcn.1005ed91
ret 0xc
Function at 0x1005b0a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc8
mov eax, 0x1008d510
call fcn.1005ede7
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc8], eax
xor eax, eax
mov dword [ebp - 0xc0], 0x3967694f
push eax
push eax
sub esp, 0xc
mov dword [ebp - 0xbc], 0x5867514e
mov ecx, esp
mov dword [ebp - 0xb8], 0x62384744
mov dword [ebp - 0xb4], 0x7649514f
mov dword [ebp - 0xb0], 0x6c774841
mov dword [ebp - 0xac], 0x6d6b6a43
mov dword [ebp - 0xa8], 0x6a465341
mov dword [ebp - 0xa4], 0x6b775143
mov dword [ebp - 0xa0], 0x58417941
mov dword [ebp - 0x9c], 0x396b6742
mov dword [ebp - 0x98], 0x6459425a
mov dword [ebp - 0x94], 0x32495845
mov dword [ebp - 0x90], 0x46386848
mov dword [ebp - 0x8c], 0x4441574f
mov dword [ebp - 0x88], 0x4c4d794f
mov dword [ebp - 0x84], 0x6f38794e
mov dword [ebp - 0x80], 0x6e567849
mov dword [ebp - 0x7c], 0x6f4d6748
mov dword [ebp - 0x78], 0x72426862
mov dword [ebp - 0x74], 0x69384150
mov dword [ebp - 0x70], 0x66735150
mov dword [ebp - 0x6c], 0x6f6b6a4b
mov dword [ebp - 0x68], 0x314d7848
mov dword [ebp - 0x64], 0x2b497747
mov dword [ebp - 0x60], 0x4b6f484e
mov dword [ebp - 0x5c], 0x6273444c
mov dword [ebp - 0x58], 0x514d6942
mov dword [ebp - 0x54], 0x4b6f524e
mov dword [ebp - 0x50], 0x51387747
mov dword [ebp - 0x4c], 0x5451774d
mov dword [ebp - 0x48], 0x3749784d
mov dword [ebp - 0x44], 0x4c516945
mov dword [ebp - 0x40], 0x706b784c
mov dword [ebp - 0x3c], 0x73777842
mov dword [ebp - 0x38], 0x564d6a43
mov dword [ebp - 0x34], 0x4945774c
mov dword [ebp - 0x30], 0x626f5145
mov dword [ebp - 0x2c], 0x2f457945
mov dword [ebp - 0x28], 0x4d456748
mov dword [ebp - 0x24], 0x414d534c
mov dword [ebp - 0x20], 0x7a424141
mov byte [ebp - 0xc4], al
push dword [ebp - 0xc4]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.1004f7d5
lea eax, [ebp - 0xd4]
push eax
call fcn.10052b8c
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1005c5f3
push eax
lea ecx, [ebp + 0x14]
call fcn.10052ec8
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
setne bl
call fcn.1005c473
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 4]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1005c5aa
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
test bl, bl
push 0x18
pop esi
push 0
pop edx
push ecx
mov ecx, dword [ebp - 0xc8]
cmovne edx, esi
push eax
add ecx, edx
push ecx
call fcn.10063370
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.1005c3f0
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.10056e89
mov al, 1
call fcn.1005ed91
ret
Function at 0x1005dfd7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1012572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.1005df9a
push esi
call fcn.1005e2ff
mov esi, eax
push edi
mov dword [ebp - 0x14], esi
call fcn.1005e2ff
push 0x58
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.100616d0
lea eax, [ebp - 0x7c]
push eax
push 5
push esi
call fcn.1005de84
mov edi, eax
add esp, 0x20
cmp edi, 5
jb 0x1005e175
push edi
push esi
call fcn.1005e3e3
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push esi
call fcn.1005e56f
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x1005e170
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push edi
push esi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1005e155
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1005e138
xor edx, edx
lea ecx, [ebx + 0x2c]
test edi, edi
je 0x1005e0be
sub esi, ecx
mov al, byte [esi + ecx]
mov byte [ecx], al
mov byte [ebx + edx + 0x4c], al
inc edx
inc ecx
cmp edx, edi
jb 0x1005e0a9
mov esi, dword [ebp - 0x14]
lea ecx, [ebx + 0x2c]
lea eax, [edi + esi]
push eax
lea eax, [ecx + edi]
push eax
call fcn.1005df51
mov edx, dword [ebp - 0x18]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1005e104
lea esi, [ebx + 0xc]
push esi
call fcn.1005df51
pop ecx
pop ecx
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.1005df51
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0x2c]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x1005e164
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x1005e170
push 1
push ebx
call fcn.1005e676
pop ecx
pop ecx
xor ebx, ebx
call fcn.1005e281
push 0x10127990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.1005e6b3
mov esp, ebp
pop ebp
ret
Function at 0x1005e198
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1012572c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xc], ebx
xor edi, edi
call fcn.1005df9a
xor esi, esi
mov eax, dword [esi*4 + 0x101279a8]
test eax, eax
je 0x1005e1d0
add eax, 0x2c
cmp eax, dword [ebx]
je 0x1005e275
inc esi
cmp esi, 0x40
jb 0x1005e1ba
xor esi, esi
test esi, esi
je 0x1005e257
push dword [esi + 4]
push dword [esi]
call fcn.1005e3e3
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 8], edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1005e252
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x1005e21f
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x1005e212
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [esi]
inc edi
push 0
push esi
mov dword [ecx], eax
call fcn.1005e676
pop ecx
pop ecx
call fcn.1005e281
push 0x10127990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e6b3
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x101279a8]
jmp 0x1005e1d8

Function at 0x1005e281
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10127ab0], esi
jbe 0x1005e2d3
mov eax, dword [0x10127aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10127aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10127ab0]
jb 0x1005e2ae
push dword [0x10127aac]
call fcn.100683e8
and dword [0x10127aac], 0
and dword [0x10127ab0], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005e337
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1012572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1005e3d1
test esi, esi
je 0x1005e3d1
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1005e3c8
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x1005e3b4
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x1005e3d1
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x1005e3d1
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1005e3c8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1005e382
jmp 0x1005e3d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e6b3
mov esp, ebp
pop ebp
ret

Function at 0x1005e56f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1012572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
cmp dword [0x10127aa8], 0x40
jae 0x1005e665
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
mov edx, 0xfff80000
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x1005e663
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005e63e
cmp dword [ebp - 0x10], 0x10000
jne 0x1005e632
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x1005e635
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x1005e635
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1005e642
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1005e5e7
test ebx, ebx
je 0x1005e663
xor eax, eax
cmp dword [eax*4 + 0x101279a8], 0
je 0x1005e656
inc eax
cmp eax, 0x40
jb 0x1005e644
jmp 0x1005e663
inc dword [0x10127aa8]
mov dword [eax*4 + 0x101279a8], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1005e6b3
mov esp, ebp
pop ebp
ret

Function at 0x1006b7d9
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006b6de
Function at 0x10076325
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1001b180
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
loope 0x100088ad
test byte [esi - 0x68], bh
test eax, 0xcaf49684
stosd dword es:[edi], eax
xchg esi, eax
or al, 0x65
mov dl, byte [esi - 0x7e6b969c]
dec edx
cdq
dec ebp
ror ch, cl
invalid
fld qword [eax]
or eax, 0xca346be
mov ebx, 0xf15f830f
loope 0x1000885a
invalid
pop ebx
jae 0x1001b1b2
adc al, 0xc1
or eax, 0x1b661e64
and dword [ecx], 0x71
clc
xor al, 0x7d
pop edx
mov ebx, cs
cld
dec edx
test eax, 0xeed4a0e4
mov cl, 0xa0
loopne 0x1001b18a
xchg edx, eax
lodsd eax, dword [esi]
out 0x88, eax
out 0x79, al
mov al, byte [0xf28c7a22]
and ah, ch
cmp dword ss:[ecx - 0x7e67e1eb], edi
ret
add ebx, 0xffffff77
jmp 0x1001b1e5
cmp dword [ebx], 0
stc
jmp 0x1001b215
je 0x1001b407
jmp 0x1001b23f
mov ecx, ebx
jb 0x1001b271
insd dword es:[edi], dx
sal ah, 0xfc
push eax
setae byte [edx]
jle 0x1001b25b
cmp dl, byte [ebp - 0xe938872]
out 0x6d, al
salc
push cs
mov edi, 0x201aad8e
sbb ah, byte [eax]
sbb byte [ebp - 0x11], al
or eax, 0xfc95e050
and eax, 0x108808c4
nop
cmp ebp, dword [ecx + 0x3e]
iretd
add ebx, 4
jmp 0x1001b297
mov edx, dword [ebx]
jmp 0x1001b2b5
add edx, ebx
stc
jb 0x1001b2d6
mov dl, 0x8a
fcomp dword [esi - 0x53]
mov edi, dword [edi]
sub eax, 0x6c57ed70
dec eax
jmp 0x22c471d9
mov eax, dword [ebx + 4]
jmp 0x1001b2fc
sub dword [edx], 0x9684660c
jmp 0x1001b32c
add edx, 4
jmp 0x1001b34b
sub eax, 1
jmp 0x1001b37c
invalid
leave
neg esp
dec ebx
pop ecx
adc dword [edx + 0x23], esi
dec eax
pop ds
test dh, 0xa
adc ebp, dword [eax + 0x4d5aec4b]
xor byte [ebx], al
add al, 0xc7
lahf
bound esp, qword [edi + ecx]
test dword [edi - 1], edx
invalid
jne 0x1001b2d9
jmp 0x1001b396
add ebx, 8
jmp 0x1001b3c1
jle 0x1001b353
rcl byte [esi], 0x12
pop ss
dec edx
pop esi
invalid
sub dword [ecx], 1
stc
jb 0x1001b3d8
loop 0x1001b362
stosb byte es:[edi], al
inc edi
mov dl, 0x99
wait
jecxz 0x1001b3a5
xchg ebx, eax
retf 0x543c
jne 0x1001b274
clc
jae 0x1001b402
into
invalid
call int.1001b45b
jmp 0x1001b425
popal
clc
jmp 0x1001b456
jmp 0x100088b5
Function at 0x402a98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x405014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b30
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b10
xor eax, eax
push ebp
push 0x402b09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x405014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x405014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403220
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x403281
cmp word [0x406208], 0xd7b2
jne 0x403249
cmp dword [0x406210], 0
jbe 0x403249
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40505c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4032a8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405020], 0
jne 0x40329d
push 0
push 0x405054
push 0x40505c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403e74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403eda
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004034f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040298c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403ec4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ee1
lea eax, [ebp - 0x10]
call fcn.004033a4
ret
Function at 0x402b20
Capabilities:
Create thread
Delete file
Get common file path
Read .ini file

Disassembly:
sub esp, 0x8a8
mov eax, dword [0x491830]
xor eax, esp
mov dword [esp + 0x8a4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x8b4]
push esi
push edi
call fcn.00402d20
call fcn.00402de0
call fcn.00402f10
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2b2]
push ecx
mov word [esp + 0x2b4], ax
call fcn.00451520
add esp, 0xc
mov ebx, str.Logo.swf
lea edi, [esp + 0x2a8]
call fcn.0040f1f0
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xaa]
push ecx
mov word [esp + 0xac], ax
call fcn.00451520
add esp, 0xc
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x6a]
push eax
mov word [esp + 0x6c], dx
call fcn.00451520
add esp, 0xc
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x2a]
push edx
mov word [esp + 0x2c], cx
call fcn.00451520
add esp, 0xc
push str.UnInst
lea eax, [esp + 0x64]
push 0x20
push eax
call fcn.0044e64f
add esp, 0xc
lea ecx, [esp + 0xa0]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x478a24
lea edx, [esp + 0xa4]
push 0x104
push edx
call fcn.0044e6be
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
push 0x20
lea ecx, [esp + 0x28]
push ecx
push 0x478bfc
lea edx, [esp + 0x70]
push edx
push str.Zt58501
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x20]
push eax
call fcn.0044ee47
mov esi, eax
add esp, 4
inc esi
push esi
push 0x478c00
lea ecx, [esp + 0x28]
push 0x20
push ecx
call fcn.0044e767
add esp, 0x10
lea edx, [esp + 0xa0]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x68]
push ecx
push str.Zt58501
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push str.http:__client.5054399.com_uninstall.htm_tagzt58501ver3.0.0.1
push str._scount_u
lea edx, [esp + 0x4bc]
push 0x200
push edx
call fcn.0044e767
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0x403d10
push 0
lea eax, [esp + 0x4c4]
push 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 0xf28]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0xf28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
xor eax, eax
mov ecx, 0x4786c4
mov ebx, str._OGY
call fcn.004045d0
mov ecx, dword [esp + 0x8b8]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e3af
add esp, 0x8a8
ret 4
Function at 0x402d20
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x28c
mov eax, dword [0x491830]
xor eax, esp
mov dword [esp + 0x288], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x8a]
push ecx
mov word [esp + 0x8c], ax
call fcn.00451520
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.00451520
add esp, 0x18
push 0x104
lea ecx, [esp + 0x84]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x80]
push 0x5c
push edx
call fcn.0044e73b
add eax, 2
push eax
lea eax, [esp + 0xc]
push 0x40
push eax
call fcn.0044e64f
add esp, 0x14
push str.Software4399GameLoginZt58501
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [esp + 0x288]
xor ecx, esp
xor eax, eax
call fcn.0044e3af
add esp, 0x28c
ret

Function at 0x402de0
Capabilities:
Delete directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46bc15
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x491830]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x491830]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov dword [esp + 0x220], 0
cmp eax, 0x4787a4
je 0x402e3e
mov esi, 0x4787a4
call fcn.00410710
xor ecx, ecx
cmp ecx, 0x4786c4
je 0x402e57
mov esi, 0x4786c4
call fcn.00410710
call fcn.004109e0
xor edx, edx
cmp edx, 0x4787d8
je 0x402e6b
mov esi, 0x4787d8
call fcn.004109e0
xor eax, eax
cmp eax, 0x4786c4
je 0x402e7e
mov ecx, 0x4786c4
call fcn.004107c0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.00451520
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x478cd8
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0044e6be
lea edx, [esp + 0x18]
add esp, 0xc
push edx
call fcn.0040f2a0
add esp, 4
test eax, eax
jne 0x402ede
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044e3af
add esp, 0x21c
ret