joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401810
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48c8ab
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [0x4ada68]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00456da0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call fcn.004032c0
push 1
push 0x498ad0
lea ecx, [esp + 0xc]
mov dword [esp + 0x120], 0
call fcn.00402c80
push 0xa
push str.update.txt
lea ecx, [esp + 0xc]
call fcn.00402c80
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x118], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0044ffb2
add esp, 0x118
ret
Function at 0x402db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402dc9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402e04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402e00
lea ebx, [ebx]
cmp esi, eax
jae 0x402e04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402df0
cmp esi, eax
jb 0x402e0a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x404150
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x404160
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404a50
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x128
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x404aca
xor eax, eax
cmp ecx, ebp
je 0x404ab2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x404ad8
cmp ecx, ebp
je 0x404b6b
push ecx
jmp 0x404b65
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x404b3a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00404a50
mov ebx, eax
cmp ebx, ebp
jne 0x404b88
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x404b00
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x404b4d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.00404c30
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x404b6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044ffb2
add esp, 0x128
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x404b97
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x404b6d
Function at 0x40a2a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x48d950
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4ada68]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0x4b9298
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x10]
call fcn.00444f67
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.0044500e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0044523d
push 0
lea edx, [esp + 0x14]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.setProgressBarPb
call fcn.004032c0
mov edi, 0x4b5f38
call fcn.0041fda0
push 0x4b9298
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x34]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov esi, esp
push eax
call fcn.00405d90
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00407c00
add esp, 4
lea edi, [esp + 0xc]
call fcn.0041c9a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a371
push eax
call fcn.00451f6f
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.00445144
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a3a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret

Function at 0x40aa60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48d7e6
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
mov eax, dword [0x4ada68]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00456da0
add esp, 0xc
lea edi, [esp + 0x10]
call fcn.0041c9a0
lea esi, [esp + 0x14]
mov dword [esp + 0x124], 0
call fcn.0041cb80
push 0x49a25f
lea ecx, [esp + 0x10]
call fcn.004032c0
push 0xc
push str.explorer.exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 1
call fcn.00402c80
push 2
push 0x499f18
lea ecx, [esp + 0x14]
call fcn.00402c80
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ab10
sub eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.00402c80
mov edx, dword [esp + 0xc]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [esp + 0x124], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ab5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ab6e
push eax
call fcn.00451f6f
add esp, 4
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0044ffb2
add esp, 0x11c
ret
Function at 0x40b950
Capabilities:
Terminate process

Disassembly:
push esi
xor esi, esi
cmp dword [ebx + 0x800], esi
jbe 0x40b98a
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
mov eax, dword [ebx + esi*4]
push eax
push 0
push 1
call ebp
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 0x800]
jb 0x40b963
pop edi
pop ebp
xor eax, eax
pop esi
ret

Function at 0x40b990
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48c866
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov eax, dword [0x4ada68]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x21]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
call fcn.00456da0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.004371a8
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40ba16
push 0x80004005
call fcn.00405e20
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x138], ebx
call fcn.004371a8
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40ba47
push 0x80004005
call fcn.00405e20
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0xd
push str.zjrcbank_html
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 1
call fcn.004031b0
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push 0x49a2c0
push eax
call fcn.0040b5c0
mov esi, dword [esp + 0x28]
push esi
call fcn.00420990
add esp, 0x14
cmp eax, 1
je 0x40bab4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40bade
push esi
call fcn.00420990
add esp, 4
cmp eax, 1
jne 0x40bade
push esi
push 0x100
push edi
mov dword [esp + 0x1c], 1
call fcn.00450826
add esp, 0xc
push 0x498ad0
push 0x100
push edi
call fcn.0045088e
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [esp + 0x138], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bb01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bb2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0044ffb2
mov esp, ebp
pop ebp
ret
Function at 0x40c020
Capabilities:
Get hostname

Disassembly:
mov eax, 0x1360
call fcn.00454f40
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x135c], eax
push ebp
mov ebp, dword [esp + 0x1368]
push esi
push edi
push 0x1ff
lea eax, [esp + 0x116d]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0x1174], 0
call fcn.00456da0
push 0x108c
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00456da0
add esp, 0x18
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x10a4]
push eax
mov dword [esp + 0xa0], 0x510
mov dword [esp + 0x14], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x10a4]
push edx
mov esi, eax
lea eax, [esp + 0x1170]
push 0x200
push eax
call fcn.0045003e
add esp, 0x10
test esi, esi
jne 0x40c125
push 0xb4
lea ecx, [esp + 0x10b8]
push esi
push ecx
mov dword [esp + 0xa8], 1
call fcn.00456da0
add esp, 0xc
mov esi, str.IDS_HOST_FAILED
mov ecx, str.CheckRes
call fcn.00421090
lea edx, [esp + 0x10b4]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x40c100
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x10b4]
mov byte [esp + eax + 0xa0], cl
inc eax
test cl, cl
jne 0x40c110
jmp 0x40c16d
lea eax, [esp + 0x1168]
mov dword [esp + 0x9c], 0
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c140
lea edi, [esp + 0xa0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c151
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40c180
lea edx, [esp + 0x14]
push edx
mov eax, edi
call fcn.0041cd20
add esp, 4
test ebp, ebp
je 0x40c19b
lea eax, [esp + 0x1168]
mov edx, ebp
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c191
mov ecx, dword [esp + 0x1368]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0044ffb2
add esp, 0x1360
ret 4
Function at 0x40ced0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b890
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4ada68]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
xor edi, edi
push edi
push eax
push closesocket
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x40cf39
push 0x4a5120
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], eax
call fcn.004570ab
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x40cf70
push 0x4a5120
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], esi
call fcn.004570ab
mov eax, 0x40cf6d
ret
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40cf7e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ffb2
mov esp, ebp
pop ebp
ret 8

Function at 0x40cfa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b870
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4ada68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push closesocket
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x40d010
push 0x4a5120
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
call fcn.004570ab
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push ecx
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x40d04e
push 0x4a5120
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], esi
call fcn.004570ab
mov eax, 0x40d04b
ret
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40d05c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d270
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
push 0x38
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
mov dword [esp + 0x10], 0x3c
call fcn.00456da0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x20], ecx
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40d30a
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d2e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d301
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
add esp, 0x3c
ret 0xc
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push edx
call esi
cmp dword [esp + 0x44], 0x103
jne 0x40d34f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push ecx
call esi
push 0x1f4
call edi
cmp dword [esp + 0x48], 0x103
je 0x40d331
pop edi
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d36f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d38f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
add esp, 0x3c
ret 0xc
Function at 0x40d9e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x48d709
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x1bc], eax
push ebp
push esi
push edi
mov eax, dword [0x4ada68]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1e0]
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1d8], esi
call fcn.004371a8
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x40da48
push 0x80004005
call fcn.00405e20
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x1d8], 1
mov ecx, dword [esp + 0x1e4]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0040bb60
mov byte [esp + 0x1d8], 2
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.004032c0
mov byte [esp + 0x1d8], 3
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 1
jge 0x40daab
lea edx, [esp + 0x1e4]
push edx
lea ecx, [esp + 0x18]
call fcn.00402b40
lea eax, [esp + 0x3c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [esp + 0x14]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x40dadc
push esi
lea ecx, [esp + 0x18]
call fcn.00403100
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
jne 0x40dafb
mov ecx, dword [esp + 0x1e4]
push ecx
push str.Cant_resolve__s_r_n
lea edx, [esp + 0x20]
push edx
jmp 0x40db14
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x49a57c
lea eax, [esp + 0x20]
push eax
call fcn.0040b5c0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edi, dword [esp + 0x18]
add edi, 0xfffffff0
push edi
call fcn.00405d90
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x1dc], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
add esp, 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x1c]
call fcn.0040bcd0
or edx, 0xffffffff
lea ecx, [edi + 0xc]
mov byte [esp + 0x1d8], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db8a
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov dword [esp + 0x1d8], 0xffffffff
mov eax, dword [esp + 0x1e4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dbb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.0044ffb2
add esp, 0x1cc
ret
Function at 0x40e410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1460
call fcn.00454f40
mov eax, dword [0x4ada68]
xor eax, esp
mov dword [esp + 0x145c], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0
mov dword [esp + 0x10], eax
call fcn.00423cb0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 4
push 0
push 0x20
lea ecx, [esp + 0x1160]
push ecx
push 0
call esi
test eax, eax
je 0x40e46f
push 0
lea edx, [esp + 0x115c]
push 0
push edx
call fcn.00423d70
add esp, 0xc
push 1
call fcn.00423cb0
add esp, 4
push 0
push 0x21
lea eax, [esp + 0x1160]
push eax
push 0
call esi
test eax, eax
je 0x40e4a1
push 0
lea ecx, [esp + 0x115c]
push 0
push ecx
call fcn.00423d70
add esp, 0xc
push 0x1ff
lea edx, [esp + 0x1265]
push 0
push edx
mov byte [esp + 0x126c], 0
call fcn.00456da0
add esp, 0xc
push 0xb4
lea eax, [esp + 0x10a4]
push 0
push eax
mov dword [esp + 0xa4], 0
call fcn.00456da0
add esp, 0xc
mov esi, str.IDS_DELETE_TEMP_FILE
mov ecx, str.CheckRes
call fcn.00421090
lea edx, [esp + 0x10a0]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x40e4f8
xor eax, eax
jmp 0x40e510
mov cl, byte [esp + eax + 0x10a0]
mov byte [esp + eax + 0x9c], cl
inc eax
test cl, cl
jne 0x40e510
lea eax, [esp + 0x1260]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e530
lea edi, [esp + 0x9c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40e541
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call fcn.0041cd20
mov ecx, dword [esp + 0x1468]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0044ffb2
mov esp, ebp
pop ebp
ret 4