joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4696e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47af8f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49d7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
call fcn.00405650
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4a2614]
push eax
push str.QiyiShellParser::ExecInstall________________________________Used_Time:__d_MiliSeconds
lea eax, [ebp - 0x14]
push eax
call fcn.00401850
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00402cf0
mov dword [ebp - 0x28], eax
mov ecx, 0x4a23d8
call fcn.0046e810
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
push ecx
push 0x468fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x68
call fcn.00406b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a2618], eax
mov eax, dword [0x4a2618]
push eax
push str.QiyiShellParser::ExecInstallOK________________________________Start_Tick:__d
lea ecx, [ebp - 0x14]
push ecx
call fcn.00401850
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00402cf0
mov dword [ebp - 0x2c], eax
mov ecx, 0x4a23d8
call fcn.0046e810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4697f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47afb2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x49d7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x18
push ecx
push 0x468fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x68
call fcn.00406b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a2614], eax
lea ecx, [ebp - 0x14]
call fcn.00405650
mov dword [ebp - 4], 0
mov eax, dword [0x4a2614]
push eax
push str.QiyiShellParser::ExecInstall________________________________Start_Tick:__d
lea ecx, [ebp - 0x14]
push ecx
call fcn.00401850
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00402cf0
mov dword [ebp - 0x24], eax
mov ecx, 0x4a23d8
call fcn.0046e810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4698c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push str.QiyiShellParser::ExecUnInstallInit_______________________________
call fcn.00402e90
mov dword [ebp - 0x14], eax
mov ecx, 0x4a23d8
call fcn.0046e810
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
push ecx
push 0x468fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00406b00
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x469930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push 0x488d70
call fcn.00402e90
mov dword [ebp - 0x14], eax
mov ecx, 0x4a23d8
call fcn.0046e810
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
push ecx
push 0x468fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00406b00
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x46dd80
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x270
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x264], 0xffffffff
je 0x46dde2
mov ecx, dword [ebp - 0x1c]
add ecx, 0x260
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x260]
mov edx, dword [eax + 0x48]
call edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x260
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x260]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10c
call fcn.004055f0
jmp 0x46de04
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00406d80
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10c
call fcn.00402350
push eax
lea ecx, [ebp - 8]
call fcn.00405620
movzx ecx, al
test ecx, ecx
je 0x46de55
push 0x3e8
lea ecx, [ebp - 8]
call fcn.00406d60
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x46de53
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00406d60
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x46ddf6
mov ecx, dword [ebp - 0x1c]
call fcn.0046dc40
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
call fcn.0042714d
mov esp, ebp
pop ebp
ret
Function at 0x46de80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
call fcn.00406100
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x46deb4
xor eax, eax
jmp 0x46df5a
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46dee0
xor eax, eax
jmp 0x46df5a
mov ecx, dword [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043c6f0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov edx, dword [ebp - 0x18]
push edx
call fcn.00404cc0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46df60
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479afe
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49d7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x46e0bb
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_Explorer_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46e0b9
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x1c]
call fcn.00405650
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
push edx
push 0x400
lea ecx, [ebp - 0x1c]
call fcn.00401230
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402e60
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x2e
lea ecx, [ebp - 0x1c]
call fcn.00405360
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404350
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00401fb0
movzx ecx, al
test ecx, ecx
jne 0x46e09e
push 0x48aa6c
lea ecx, [ebp - 0x20]
call fcn.004050a0
lea ecx, [ebp - 0x20]
call fcn.00401560
push eax
call fcn.0043c323
add esp, 4
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x10]
push edx
push 0xf003f
push 0
push 0x48aa98
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46e09e
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push 0x48aa74
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00405670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00405670
jmp 0x46e0f3
lea eax, [ebp - 0x28]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46e0f3
push str.QiyiFragment.exe
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x46e110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0043ed00
mov eax, dword [0x49d7a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x101c], ecx
mov word [ebp - 0x1010], 0
push 0xffe
push 0
lea eax, [ebp - 0x100e]
push eax
call fcn.0043be70
add esp, 0xc
push 0x48a924
mov ecx, dword [ebp - 0x101c]
add ecx, 0xa8
push ecx
lea edx, [ebp - 0x1018]
push edx
call fcn.00401e30
add esp, 0xc
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call fcn.00401560
push eax
push 0x800
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebp - 0x1018]
call fcn.00405670
mov dword [ebp - 0x1014], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
lea edx, [ebp + ecx*2 - 0x1010]
push edx
call fcn.0043beea
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x46e1ee
mov eax, dword [ebp - 0x1014]
add eax, 1
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
jmp 0x46e1b4
mov eax, dword [ebp - 0x1014]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043bd9a
mov esp, ebp
pop ebp
ret
Function at 0x46e210
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b24
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x49d7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x24c]
call fcn.00405650
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.0043be70
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x46e32d
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x46e32d
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x250]
jne 0x46e309
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x258], ecx
jmp 0x46e320
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46e2ed
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], 0
jbe 0x46e3ae
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x46e3ae
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x46e3ae
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x258]
jne 0x46e38a
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.00403280
jmp 0x46e3a1
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46e368
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402cf0
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00405670
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bd9a
mov esp, ebp
pop ebp
ret 4
Function at 0x46e630
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b97
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x49d7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x30]
call fcn.00405580
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x46e6c2
cmp dword [ebp - 0x3c], 0x6f
je 0x46e6c2
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401fd0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402010
mov eax, dword [ebp + 8]
jmp 0x46e7f7
mov eax, dword [ebp - 0x38]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46e703
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401fd0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402010
mov eax, dword [ebp + 8]
jmp 0x46e7f7
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x46e74a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401fd0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402010
mov eax, dword [ebp + 8]
jmp 0x46e7f7
lea ecx, [ebp - 0x34]
call fcn.00405650
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_02X_02X_02X_02X_02X
lea edx, [ebp - 0x34]
push edx
call fcn.00405be0
add esp, 0x20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x34]
call fcn.00405690
push eax
lea ecx, [ebp - 0x30]
call fcn.004055b0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401fd0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00405670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402010
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bd9a
mov esp, ebp
pop ebp
ret
Function at 0x46e810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479bcc
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x49d7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x270
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x46e927
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x14]
call fcn.00405650
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
push str._r_n_d__02d__02d__02d:_02d:_02d._03d_:__s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00401850
add esp, 0x28
lea ecx, [ebp - 0x14]
call fcn.00401560
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x264], 0xffffffff
je 0x46e8f5
lea ecx, [ebp - 0x14]
call fcn.00402c60
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00401560
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x260
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x260]
mov eax, dword [edx + 0x38]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00405670
jmp 0x46e910
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x270
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x473f30
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x49d7a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 8], 0
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.0043be70
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x474050
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x474050
lea edx, [ebp - 4]
push edx
push 0x10008
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x47404e
cmp dword [ebp - 0x21c], 0
jne 0x474044
mov dword [ebp - 0x220], 0x104
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x103
jne 0x47401a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x21c], eax
jmp 0x474044
cmp dword [ebp - 0x21c], 0
jne 0x47403f
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.00473f30
mov dword [ebp - 0x21c], eax
jmp 0x473fb7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47405a
mov dword [ebp - 0x21c], 0x3f2
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043bd9a
mov esp, ebp
pop ebp
ret 8
Function at 0x20c4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x20c41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x20c407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20c406a
add dl, dl
jne 0x20c4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20c40dc
xor eax, eax
add dl, dl
jne 0x20c4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20c417d
add dl, dl
jne 0x20c40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20c40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20c40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20c40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x20c40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x20c4075
mov eax, 1
add dl, dl
jne 0x20c40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20c40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20c40e1
sub eax, ebx
mov ebx, 1
jne 0x20c4128
mov ecx, 1
add dl, dl
jne 0x20c410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20c4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20c4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20c4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x20c413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20c414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20c4136
cmp eax, 0x7d00
jae 0x20c416d
cmp eax, 0x500
jb 0x20c4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20c4075
cmp eax, 0x7f
ja 0x20c4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20c4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x20c419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x20c4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407a9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407aab
pop dword [ebp - 8]
mov eax, 0x407aab
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x883bfd68
sub dword [ebp - 0x18], 0x39e9b81d
mov dword [ebp - 0x14], 0x751d9439
add dword [ebp - 0x14], 0xbd15b80c
mov dword [ebp - 0x10], 0xe4a8b29a
sub dword [ebp - 0x10], 0x985c6e6c
mov dword [ebp - 0xc], 0xecba0da5
add dword [ebp - 0xc], 0x1345f25b
lea eax, [ebp - 0x18]
push eax
mov eax, 0xd993a3fd
add eax, 0x26acfc0f
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x2db74d49
add dword [ebp - 0x18], 0x46bb1c0d
mov dword [ebp - 0x14], 0x4b27701c
sub dword [ebp - 0x14], 0x9bb0ea7
mov dword [ebp - 0x10], 0x7fd679e0
sub dword [ebp - 0x10], 0x1c670d74
mov dword [ebp - 0xc], 0x7ae7a11a
add dword [ebp - 0xc], 0x85185ee6
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x41c105e
sub eax, 0x3db704a
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb6f
push 0
call eax
mov ecx, 0x4a66d19c
sub ecx, 0x4a667e11
mov esi, eax
mov edx, 0x43be00
add edx, dword [ebp - 8]
mov edi, 0x7e61905e
add edi, 0x4e817d94
mov dword [ebp - 4], 0x568fe8e9
mov ebx, dword [edx]
add dword [ebp - 4], 0x2a348d6b
sub ebx, edi
xor dword [ebp - 4], esi
mov dword [esi], ebx
add dword [ebp - 4], edi
add esi, 0x6a5e9669
sub esi, 0x6a5e9665
add edx, 0x1550bcf6
add edx, 0xeaaf430e
loop 0x407bc2
add eax, 0x5374dbc5
sub eax, 0x53739ac6
mov ebx, eax
add eax, 0x2b0a901b
add eax, 0xd4f56fea
mov ecx, 0x6562b1d4
sub ecx, 0x6522b1d4
add ecx, dword [ebp - 8]
call ebx
leave
ret