joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a98c
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
and byte [ebp - 0x188], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x187]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4c]
push eax
call fcn.004047b1
mov ebx, 0x412314
mov edi, 0x41231c
push 0
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], edi
call fcn.00403a9e
mov esi, 0x412310
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x20], esi
call fcn.00401b39
lea ecx, [ebp - 0x20]
call fcn.00402077
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], 0x104
call fcn.00402077
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], eax
call fcn.00402077
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x68]
push eax
call fcn.004047b1
mov ecx, eax
mov dword [ebp - 4], ecx
call fcn.00402077
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x84]
push eax
call fcn.00404887
mov ecx, eax
mov dword [ebp + 0xc], ecx
call fcn.00402077
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00404887
mov ecx, eax
mov dword [ebp + 0xc], ecx
call fcn.00402077
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x188]
push ecx
mov eax, dword [eax + 4]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push dword [ebp - 4]
push dword [ebp - 0x24]
push eax
push 0
call sub.VERSION.dll_VerInstallFileA
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0xc], eax
call fcn.00401b39
lea ecx, [ebp - 0x84]
call fcn.00401b39
lea ecx, [ebp - 0x68]
call fcn.00401b39
mov eax, dword [ebp + 0xc]
test al, 1
je 0x40ab10
lea eax, [ebp - 0x188]
push 0
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], edi
call fcn.00403a2f
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00404ce8
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.00402077
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x68]
call fcn.00401b39
lea ecx, [ebp - 0x4c]
call fcn.00401b39
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40ab58
test al, 4
jne 0x40ab58
test al, 0x80
mov esi, eax
jne 0x40ab23
test ah, 4
je 0x40ab26
push 0x20
pop esi
test ah, 2
je 0x40ab2e
push 5
pop esi
test ah, 1
je 0x40ab36
push 0x70
pop esi
lea ecx, [ebp - 0x20]
call fcn.00402077
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x20]
call fcn.00401b39
mov eax, 0xfffff830
sub eax, esi
jmp 0x40ab75
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402077
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x20]
call fcn.00401b39
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40ab7c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 0x10c], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
and byte [ebx], 0
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00402077
push dword [esi + 4]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 8], eax
jne 0x40abda
mov al, 1
jmp 0x40ac50
push eax
lea ecx, [ebp + 0x10]
call fcn.0040a977
push dword [ebp + 0x10]
lea eax, [ebp - 0x10c]
push dword [ebp + 8]
push dword [ebp - 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ac00
mov bl, 1
jmp 0x40ac46
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x41467c
push dword [ebp + 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40abfc
mov edx, dword [ebp - 4]
xor ecx, ecx
xor esi, esi
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
or ecx, edx
mov edx, dword [ebp + 0xc]
or eax, esi
cmp ecx, dword [edx]
jne 0x40ac39
cmp eax, dword [edx + 4]
jne 0x40ac3c
mov byte [ebx], 1
cmp eax, dword [edx + 4]
ja 0x40ac44
jb 0x40abfc
cmp ecx, dword [edx]
jb 0x40abfc
xor bl, bl
lea ecx, [ebp + 0x10]
call fcn.0040ac57
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40ac60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], ecx
push esi
push esi
push 0x8003
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.0040fc87
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00402077
push dword [edi + 4]
call fcn.0041069d
pop ecx
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.00402077
mov edi, dword [edi + 4]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp dword [ebp - 0xc], edi
je 0x40acd0
lea ecx, [ebp - 0xc]
call fcn.0040ba4a
mov dword [ebp - 0xc], edi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [ebp + 8]
ja 0x40ad04
lea ecx, [ebp - 0x78]
call fcn.0040fe1d
lea ecx, [ebp - 8]
call fcn.0040ba60
lea ecx, [ebp - 4]
call fcn.00405685
lea ecx, [ebp - 0xc]
call fcn.0040ba4a
jmp 0x40adc2
push esi
push esi
push esi
push 2
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp dword [ebp - 4], edi
je 0x40ad2d
cmp dword [ebp - 4], esi
je 0x40ad2a
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
push esi
push esi
push esi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x40ad59
cmp eax, esi
je 0x40ad53
push eax
call edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push 1
add eax, ecx
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.004100e6
test al, al
je 0x40ad80
push dword [ebp + 8]
lea ecx, [ebp - 0x78]
push dword [ebp - 8]
call fcn.00410286
test al, al
jne 0x40ad85
lea ecx, [ebp - 0x78]
jmp 0x40ad98
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x78]
push eax
call fcn.0040adfc
test eax, eax
lea ecx, [ebp - 0x78]
jne 0x40adc9
call fcn.0040fe1d
cmp dword [ebp - 8], esi
je 0x40adaa
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x40adb7
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], esi
cmp dword [ebp - 0xc], 0xffffffff
je 0x40adc2
push dword [ebp - 0xc]
call ebx
mov eax, 0x80090006
jmp 0x40adf5
call fcn.0040fe1d
cmp dword [ebp - 8], esi
je 0x40addb
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x40ade8
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], esi
cmp dword [ebp - 0xc], 0xffffffff
je 0x40adf3
push dword [ebp - 0xc]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40adfc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push str.PUBLICKEY
push 0x74
push dword [0x415614]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x415614]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push dword [0x415614]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0xc]
push 0
push edi
push eax
call fcn.00410057
pop edi
pop esi
test al, al
jne 0x40ae4d
xor eax, eax
jmp 0x40ae5c
mov ecx, dword [esp + 4]
call fcn.00410254
neg al
sbb eax, eax
neg eax
ret 4

Function at 0x40af7b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x38]
call fcn.00401c42
mov ebx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov ecx, ebx
call fcn.004048ca
add eax, 0x10
mov eax, dword [eax]
cmp eax, esi
je 0x40afb1
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.00401b39
push 0x5c
inc esi
pop edi
mov dword [ebp + 8], edi
push esi
lea eax, [ebp + 8]
push 1
push eax
mov ecx, ebx
call fcn.004043ac
cmp dword [0x4123d0], eax
je 0x40b01c
lea esi, [eax + 1]
push 0
push esi
push 0
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x412314
mov dword [ebp - 8], 0x41231c
call fcn.004055bf
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x412310
call fcn.00402077
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x1c]
call fcn.00401b39
mov dword [ebp + 8], edi
jmp 0x40afc0
lea ecx, [ebp - 0x38]
call fcn.00401d80
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b230
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40b256
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x40b25d
xor eax, eax
jmp 0x40b3d8
push 0x41494c
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x41418c
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00404e5d
mov eax, dword [ebp - 0x50]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40b28e
xor esi, esi
jmp 0x40b2ba
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00410c80
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b34c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test byte [ebp - 0x1bc], 0x10
je 0x40b33a
test byte [ebp - 0x1bc], 2
jne 0x40b33a
lea eax, [ebp - 0x190]
push 0x414188
push eax
call esi
test eax, eax
je 0x40b33a
lea eax, [ebp - 0x190]
push 0x414184
push eax
call esi
test eax, eax
je 0x40b33a
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x190]
push eax
call fcn.0040b3e5
cmp eax, dword [ebp - 4]
jle 0x40b33a
mov dword [ebp - 4], eax
lea eax, [ebp - 0x190]
push eax
push 0x41469c
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1bc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b2d5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], ebx
je 0x40b3cd
push ebx
lea ecx, [ebp - 0x28]
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], 0x412314
mov dword [ebp - 0x14], 0x41231c
call fcn.00403a2f
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x412310
push eax
lea eax, [ebp - 0x7c]
push dword [ebp + 8]
push eax
call fcn.00404ce8
add esp, 0xc
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00404ce8
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.00401b39
lea ecx, [ebp - 0x28]
call fcn.00401b39
lea ecx, [ebp - 0x44]
call fcn.00402077
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b3c5
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x44]
call fcn.00401b39
lea ecx, [ebp - 0x60]
call fcn.00401b39
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x1c8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40b43c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push str.ispro7
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov esi, ecx
push eax
call fcn.00404e5d
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push eax
call fcn.004045e8
push dword [ebp + 8]
mov ecx, esi
call fcn.0040a6cc
test eax, eax
je 0x40b47d
mov esi, 0xffffe88a
jmp 0x40b518
lea eax, [ebp - 0x1c]
push eax
call fcn.0040af7b
lea eax, [esi + 0xc4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00404ce8
lea eax, [esi + 0xa8]
push eax
lea eax, [ebp - 0x38]
push dword [ebp + 8]
push eax
call fcn.00404ce8
add esp, 0x1c
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a98c
test eax, eax
lea ecx, [ebp - 0x38]
je 0x40b4ec
call fcn.00402077
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x1c]
call fcn.00402077
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, 0xffffe88b
jmp 0x40b508
call fcn.00402077
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x54]
push eax
call fcn.00401bcb
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.00401b39
lea ecx, [ebp - 0x54]
call fcn.00401b39
lea ecx, [ebp - 0x1c]
call fcn.00401b39
mov eax, esi
pop esi
leave
ret 8
Function at 0x40c431
Capabilities:
Check if file exists
Check os version
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
and byte [ebp - 0x224], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x223]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x120]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x120], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40c569
cmp dword [ebp - 0x110], 2
jne 0x40c569
cmp dword [ebp - 0x11c], 5
jb 0x40c569
cmp dword [ebp + 0xc], 1
jne 0x40c49b
push 0x2b
jmp 0x40c4a2
cmp dword [ebp + 0xc], esi
jne 0x40c4b4
push 0x26
push dword [ebp + 8]
call fcn.0040c020
mov eax, dword [ebp + 8]
pop ecx
pop ecx
jmp 0x40c66e
cmp byte [ebp - 0x224], 0
je 0x40c4fa
lea eax, [ebp - 0x224]
mov edi, 0x41231c
push esi
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], 0x412314
mov dword [ebp - 0x28], edi
call fcn.00403a2f
mov esi, 0x412310
push 0x4141a4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 4], 1
call fcn.004049b4
jmp 0x40c52b
lea eax, [ebp - 0x224]
mov edi, 0x41231c
push esi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], 0x412314
mov dword [ebp - 0xc], edi
call fcn.00403a2f
mov esi, 0x412310
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], 0x412314
mov dword [ecx + 0x14], edi
call fcn.00403a9e
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x40c557
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x20]
call fcn.00401b39
test byte [ebp - 4], 1
je 0x40c66c
lea ecx, [ebp - 0x3c]
jmp 0x40c667
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.0040c88d
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00402077
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c5c0
lea eax, [ebp - 0x64]
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404416
add eax, 0x10
mov eax, dword [eax]
cmp eax, esi
jne 0x40c5a7
xor edi, edi
jmp 0x40c5b0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
lea ecx, [ebp - 0x64]
call fcn.00401b39
cmp edi, esi
jne 0x40c641
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x40c5fd
dec eax
jne 0x40c641
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0040c431
pop ecx
pop ecx
mov ecx, eax
call fcn.0040c672
push eax
lea ecx, [ebp - 0x20]
call fcn.00401bcb
lea ecx, [ebp - 0x3c]
call fcn.00401b39
push str.Common_Files_
lea ecx, [ebp - 0x20]
call fcn.004049b4
jmp 0x40c641
lea eax, [ebp - 0x8c]
push esi
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004041db
pop ecx
pop ecx
mov ecx, eax
call fcn.00404416
push eax
lea ecx, [ebp - 0x20]
call fcn.00401bcb
lea ecx, [ebp - 0x8c]
call fcn.00401b39
lea ecx, [ebp - 0x58]
call fcn.00401b39
push str.Program_Files_
lea ecx, [ebp - 0x20]
call fcn.0040c7f5
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push eax
mov ecx, edi
mov dword [edi + 0xc], 0x412314
mov dword [edi + 0x14], 0x41231c
call fcn.00403a9e
mov dword [edi], 0x412310
lea ecx, [ebp - 0x20]
call fcn.00401b39
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40c88d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
and byte [ebp - 0x148], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
xor esi, esi
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40c966
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x28], 0x104
mov eax, str.CommonFilesDir
je 0x40c8e8
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x148]
push ecx
push esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x148]
mov ebx, 0x412314
mov edi, 0x41231c
push esi
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00403a2f
mov esi, 0x412310
push 0x4141a4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
call fcn.004049b4
lea ecx, [ebp - 0x24]
call fcn.0040ca17
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00403a9e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [edi], esi
jmp 0x40ca0b
cmp byte [ebp - 0x148], 0
mov ebx, 0x412314
je 0x40c9ad
lea eax, [ebp - 0x148]
mov edi, 0x41231c
push esi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], edi
call fcn.00403a2f
mov esi, 0x412310
push 0x4141a4
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 1
call fcn.004049b4
jmp 0x40c9da
lea eax, [ebp - 0x148]
mov edi, 0x41231c
push esi
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00403a2f
mov esi, 0x412310
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00403a9e
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x40ca02
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x24]
call fcn.00401b39
test byte [ebp - 4], 1
je 0x40ca10
lea ecx, [ebp - 0x44]
call fcn.00401b39
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d66a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], 1
call fcn.0040d806
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40d71e
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40d710
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x40d6d4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x40d6fd
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0xc], ebx
jne 0x40d70a
cmp byte [ebp - 0x838], bl
je 0x40d710
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ebx
je 0x40d71e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040d316
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x40d743
cmp dword [ebp + 0xc], 4
jne 0x40d76f
cmp dword [ebp - 0x14], ebx
jne 0x40d76f
mov ax, word [edi + 0x14]
cmp ax, 3
jne 0x40d75b
mov ecx, edi
call fcn.0040dd21
jmp 0x40d76f
cmp ax, 4
mov ecx, edi
jne 0x40d76a
call fcn.0040df02
jmp 0x40d76f
call fcn.0040e2d6
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x40dd21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.00410c80
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40deef
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x40deef
cmp dword [ebp - 0x14], 1
jne 0x40deef
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x40deb2
cmp byte [ebp - 0x148], al
je 0x40deb2
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x40dea4
lea eax, [ebp - 0x96c]
push 0x414dbc
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x4146a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x414600
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x40de08
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.0040d4ef
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40defd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ee76
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x40eed9
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x40eeeb
mov eax, dword [esi + 0xdc]
jmp 0x40ef43
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x40ef41
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x40ef19
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x40eef4
pop ebp
pop ebx
pop edi
pop esi
ret