joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db40
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x40dbe6
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x40dbb9
cmp word [ecx + 0xa], 4
jne 0x40dbb9
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40dbb9
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.0040dad0
test eax, eax
mov dword [esi], eax
je 0x40dbda
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x40db90
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.0044f1f0
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x40dbf6.11001
jmp dword [eax*4 + 0x40dc1c]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x40e3b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x503a24]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x40de80
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x40e170
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.0040de30
jne 0x40e502
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40e4f8
xor eax, eax
nop
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x40e410
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e426
mov edx, dword [str.ws2_32]
mov eax, dword [0x47ce98]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40e46d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x40e4bf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x40e470
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e485
mov edx, dword [str.wship6]
mov eax, dword [0x47ce90]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x40e4f4
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x40e4bf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40e4f4
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x40e4b6
inc edi
cmp edi, 3
jl 0x40e4c1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x49f4f4], eax
mov dword [0x49f4fc], ecx
mov dword [fcn.0040de30], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x503a24], 1
movzx eax, word [esp + 0x230]
mov eax, dword [eax*8 + 0x49f4f4]
add esp, 0x22c
ret 4
Function at 0x40e5c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x11], eax
push 0xa
lea edx, [esp + 0x14]
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov eax, dword [esp + 0x38]
xor ecx, ecx
push edx
mov dword [esp + 0x21], ecx
push eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x29], cl
call fcn.0045bec5
mov edx, dword [esp + 0x48]
push 0xa
lea ecx, [esp + 0x28]
push ecx
push edx
call fcn.0045bec5
mov ecx, dword [esp + 0x48]
push 0x11
push 2
push 2
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.0040e520
push 0x11
push 2
push 2
lea edx, [esp + 0x50]
mov ebx, eax
mov eax, dword [esp + 0x70]
push edx
push eax
call fcn.0040e520
mov ebp, dword [esp + 0x84]
add esp, 0x40
push ebp
push 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40e677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HeapAlloc_failed:__d_n
push 0x4a8380
call fcn.0044dcce
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x40]
push ebp
push ecx
push ebp
push esi
call fcn.0040d900
push ebp
push esi
push edi
lea edx, [esp + 0x3c]
push ebx
push edx
call fcn.0040d940
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x18]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
add esp, 0x24
push eax
mov eax, dword [esp + 0x30]
push ecx
push 0
push edx
push esi
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x40e6c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.sendto___failed:__d_n
jmp 0x40e6cd
push eax
push str.sent__d_bytes_n
call fcn.0044ee3f
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret
Function at 0x40ea20
Capabilities:
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x600
push esi
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x7f
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ea60
mov ecx, dword [0x47a868]
mov dx, word [0x47a86c]
mov dword [edi], ecx
mov eax, 0x4acdd0
mov word [edi + 4], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea82
lea edi, [esp + 8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40ea90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 8]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20c]
push str.scbInit_load_path_is__s
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x214]
push edx
call fcn.00402a90
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [esp + 8]
push eax
call esi
test eax, eax
mov dword [0x503a2c], eax
jne 0x40eb1d
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00410b40
test eax, eax
jne 0x40eb02
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 8]
push edx
call esi
test eax, eax
mov dword [0x503a2c], eax
jne 0x40eb1d
mov eax, 0xfffffffe
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x840
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x200
lea eax, [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40f7e3
mov byte [esp + 0x448], al
mov ecx, 0xff
lea edi, [esp + 0x449]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x44c]
push str.SSLTray:_GetSystemDirectoryA_failed_with_error__d.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x454]
push edx
call fcn.00402a90
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x248]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f7f0
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40f800
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f820
mov ax, word [0x47a898]
mov word [edi], ax
mov eax, 0x4d3f6c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f838
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40f846
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x48]
push 0x47a858
push ecx
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x40f8a5
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
mov eax, dword [0x4ac768]
add esp, 0x14
cmp edi, eax
jne 0x40f8a5
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f8c0
mov edx, dword [str._SSL_bin_]
mov eax, dword [0x47d3b0]
mov cx, word [0x47d3b4]
mov dword [edi], edx
mov dword [edi + 4], eax
mov eax, 0x4d3f6c
mov word [edi + 8], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f8f0
lea edi, [esp + 8]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40f900
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 8]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00402a90
mov eax, dword [0x4ac768]
push eax
mov eax, dword [0x49f060]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x14]
push edx
push eax
push 0x4d3ed0
push ecx
call fcn.004064e0
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f950
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f990
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
lea eax, [esp + 0x248]
mov byte [edi + 4], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f9b2
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40f9c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f9e0
mov eax, dword [str.Help.pdf]
mov ecx, dword [0x47d404]
mov dx, word [0x47d408]
mov dword [edi], eax
lea eax, [esp + 0x48]
mov dword [edi + 4], ecx
push 0x47a858
push eax
mov word [edi + 8], dx
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x40fa45
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
add esp, 0x14
test edi, edi
jle 0x40fa45
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fa60
mov ecx, dword [str._SSL_bin_help.pdf]
mov edx, dword [0x47d3f0]
mov eax, dword [0x47d3f4]
mov dword [edi], ecx
mov ecx, dword [0x47d3f8]
mov dword [edi + 4], edx
mov dx, word [0x47d3fc]
mov dword [edi + 8], eax
push 0
mov dword [edi + 0xc], ecx
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
mov word [edi + 0x10], dx
mov edx, dword [0x49f060]
push edx
push 0x4d3ed0
push eax
call fcn.004064e0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fac0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fb00
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
mov byte [edi + 4], dl
xor eax, eax
jmp 0x40fb20
mov cl, byte [esp + eax + 0x248]
mov byte [esp + eax + 0x48], cl
inc eax
test cl, cl
jne 0x40fb20
lea edi, [esp + 0x48]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fb35
mov eax, dword [str._sso.html]
mov ecx, dword [0x47d42c]
mov dx, word [0x47d430]
mov dword [edi], eax
lea eax, [esp + 0x48]
mov dword [edi + 4], ecx
push 0x47a858
push eax
mov word [edi + 8], dx
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x40fb9a
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
add esp, 0x14
test edi, edi
jle 0x40fb9a
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fbb4
mov ecx, dword [str._SSL_bin_sso.html]
mov edx, dword [0x47d418]
mov eax, dword [0x47d41c]
mov dword [edi], ecx
mov ecx, dword [0x47d420]
mov dword [edi + 4], edx
mov dx, word [0x47d424]
mov dword [edi + 8], eax
push 0
mov dword [edi + 0xc], ecx
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
mov word [edi + 0x10], dx
mov edx, dword [0x49f060]
push edx
push 0x4d3ed0
push eax
call fcn.004064e0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fc20
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fc60
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
mov byte [edi + 4], dl
xor eax, eax
jmp 0x40fc80
mov cl, byte [esp + eax + 0x248]
mov byte [esp + eax + 0x48], cl
inc eax
test cl, cl
jne 0x40fc80
lea edi, [esp + 0x48]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fc95
mov eax, dword [str.Diagnosis.exe]
mov ecx, dword [0x47d450]
mov edx, dword [0x47d454]
mov dword [edi], eax
mov ax, word [0x47d458]
mov dword [edi + 4], ecx
mov cl, byte [0x47d45a]
mov dword [edi + 8], edx
lea edx, [esp + 0x48]
mov word [edi + 0xc], ax
push 0x47a858
push edx
mov byte [edi + 0xe], cl
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x40fd0b
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
add esp, 0x14
test edi, edi
jle 0x40fd0b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fd25
mov edx, dword [0x49f060]
mov ecx, 5
mov esi, str._SSL_bin_Diagnosis.exe
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
movsw word es:[edi], word [esi]
push 0x4d3ed0
push eax
movsb byte es:[edi], byte [esi]
call fcn.004064e0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fd70
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fdb0
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
lea eax, [esp + 0x248]
mov byte [edi + 4], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fdd2
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fde0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fe00
mov ax, word [0x47a898]
mov word [edi], ax
mov eax, 0x4ac548
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fe18
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fe26
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x48]
push 0x47a858
push ecx
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x40fe85
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
mov eax, dword [0x4ac540]
add esp, 0x14
cmp edi, eax
jne 0x40fe85
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fea0
mov edx, dword [str._SSL_bin_]
mov eax, dword [0x47d3b0]
mov cx, word [0x47d3b4]
mov dword [edi], edx
mov dword [edi + 4], eax
mov eax, 0x4ac548
mov word [edi + 8], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fed0
lea edi, [esp + 8]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fee0
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [0x4ac540]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
mov edx, dword [0x49f060]
and ecx, 3
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x4d3ed0
push eax
call fcn.004064e0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ff30
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
xor eax, eax
mov byte [esp + 0x48], 0
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ff70
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
mov byte [edi + 4], dl
xor eax, eax
jmp 0x40ff90
mov cl, byte [esp + eax + 0x248]
mov byte [esp + eax + 0x48], cl
inc eax
test cl, cl
jne 0x40ff90
lea edi, [esp + 0x48]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ffa5
mov eax, dword [0x47d474]
mov ecx, dword [0x47d478]
mov edx, dword [0x47d47c]
mov dword [edi], eax
mov ax, word [0x47d480]
mov dword [edi + 4], ecx
mov cl, byte [0x47d482]
mov dword [edi + 8], edx
lea edx, [esp + 0x48]
mov word [edi + 0xc], ax
push 0x47a858
push edx
mov byte [edi + 0xe], cl
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x41001b
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
add esp, 0x14
test edi, edi
jle 0x41001b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410035
mov edx, dword [0x49f060]
mov ecx, 5
mov esi, str._SSL_bin_AutoLogin.exe
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
movsw word es:[edi], word [esi]
push 0x4d3ed0
push eax
movsb byte es:[edi], byte [esi]
call fcn.004064e0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410080
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
push esi
push edi
push 0
push 0x26
lea eax, [esp + 0x250]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x248]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4100b0
mov ecx, dword [str.SAG]
mov dl, byte [0x47d410]
mov dword [edi], ecx
mov byte [edi + 4], dl
mov byte [esp + 0x48], al
xor eax, eax
mov ecx, 0x7f
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x248]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4100e6
lea edi, [esp + 0x48]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4100f4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410111
mov eax, dword [0x47d4dc]
mov ecx, dword [0x47d4e0]
mov edx, dword [0x47d4e4]
mov dword [edi], eax
mov al, byte [0x47d4e8]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov byte [edi + 0xc], al
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0xf
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x49f518]
lea edi, [esp + 8]
dec edi
cmp eax, 5
jne 0x410198
mov eax, dword [0x509824]
test eax, eax
jne 0x410180
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410167
mov ecx, 7
mov esi, str._SSL_bin_vista_32_XEngine.sys
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4101d3
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410180
mov ecx, 7
mov esi, str._SSL_bin_vista_64_XEngine.sys
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4101d3
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410198
mov ecx, dword [str._SSL_bin_XEngine.sys]
mov edx, dword [0x47d488]
mov eax, dword [0x47d48c]
mov dword [edi], ecx
mov ecx, dword [0x47d490]
mov dword [edi + 4], edx
mov edx, dword [0x47d494]
mov dword [edi + 8], eax
mov al, byte [0x47d498]
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], edx
mov byte [edi + 0x14], al
mov ecx, dword [0x4ac7a0]
push ecx
mov ecx, dword [0x49f060]
lea edx, [esp + 0x4c]
push edx
mov edx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
push 0x4d3ed0
push edx
call fcn.004064e0
add esp, 0x18
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffd
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret