joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a5e
Capabilities:
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00408e90
push eax
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00408d10
lea eax, [ebp - 0x20c]
push 0x41b34c
push eax
call fcn.00408d20
add esp, 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x34c]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExA]
mov ebx, eax
test byte [ebp - 0x34c], 0x10
jne 0x401b79
lea eax, [ebp - 0x108]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push 0x41b348
push eax
call fcn.00408d20
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push eax
call fcn.004018d0
add esp, 0x2c
test eax, eax
je 0x401b79
lea eax, [ebp - 0x108]
push eax
call fcn.00402811
pop ecx
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x401b79
push 4
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
lea eax, [ebp - 0x34c]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x401ace
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
leave
ret
Function at 0x401ba5
Capabilities:
Delete file
Enumerate files on windows
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00408e90
push eax
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00408d10
lea eax, [ebp - 0x20c]
push 0x41b354
push eax
call fcn.00408d20
add esp, 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x34c]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExA]
mov ebx, eax
test byte [ebp - 0x34c], 0x10
jne 0x401cc0
lea eax, [ebp - 0x108]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push 0x41b348
push eax
call fcn.00408d20
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push eax
call fcn.00401811
add esp, 0x2c
test eax, eax
je 0x401cc0
lea eax, [ebp - 0x108]
push eax
call fcn.00402811
pop ecx
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x401cc0
push 4
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
lea eax, [ebp - 0x34c]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x401c15
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
leave
ret

Function at 0x401cec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, str.lnkfile
push edi
mov esi, 0x80000000
push esi
xor ebx, ebx
call fcn.00408118
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d31
push str.IsShortCut
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x401d31
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call fcn.004082dc
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x402161
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x318
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x294], eax
mov eax, dword [ebp + 0x2a4]
push ebx
mov ebx, dword [ebp + 0x2a0]
push esi
push edi
mov esi, 0x105
push esi
mov dword [ebp - 0x80], eax
call fcn.00409397
push esi
mov dword [ebp - 0x7c], eax
call fcn.00409397
mov edi, eax
lea eax, [ebp - 0x78]
push eax
call fcn.00408e90
push eax
xor esi, esi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x190]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x190]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x8c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00408e10
push dword [ebp - 0x7c]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Desktop
push esi
push 0x80000001
call fcn.004080c3
add esp, 0x48
push edi
push str.Common_Desktop
push esi
push 0x80000002
call fcn.004080c3
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call fcn.00408d20
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.00408d20
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x8c]
push eax
call fcn.00408d20
lea eax, [ebp + 0x8c]
push str.Internet_Explorer.lnk
push eax
call fcn.00408d20
lea eax, [ebp - 0x78]
push eax
call fcn.00401a5e
lea eax, [ebp - 0x78]
push eax
call fcn.00401ba5
lea eax, [ebp + 0x190]
push eax
call fcn.00401a5e
lea eax, [ebp + 0x190]
push eax
call fcn.00401ba5
add esp, 0x40
push dword [ebp - 0x80]
lea eax, [ebp + 0x8c]
push eax
push ebx
call fcn.00401735
lea eax, [ebp + 0x8c]
push eax
call fcn.004029b2
add esp, 0x10
test edi, edi
je 0x4022ae
push edi
call fcn.00409371
pop ecx
cmp dword [ebp - 0x7c], 0
pop edi
pop esi
pop ebx
je 0x4022c0
push dword [ebp - 0x7c]
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x294]
xor ecx, ebp
call fcn.00408f1b
add ebp, 0x298
leave
ret
Function at 0x4022d5
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1a4]
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x90]
push edi
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x90]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x74]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00408e10
mov ebx, 0x104
push ebx
call fcn.00409397
push eax
push str.Common_Start_Menu
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push 0x80000002
mov dword [ebp - 0x78], eax
call fcn.004080c3
push dword [ebp - 0x78]
lea eax, [ebp + 0x90]
push eax
call fcn.00408d20
lea eax, [ebp + 0x90]
push eax
call fcn.00401a5e
lea eax, [ebp + 0x90]
add esp, 0x40
push eax
call fcn.00401ba5
mov esi, str.Internet_Explorer.lnk
lea eax, [ebp + 0x90]
push esi
push eax
call fcn.00408d20
push dword [ebp - 0x80]
lea eax, [ebp + 0x90]
push eax
push dword [ebp - 0x7c]
call fcn.00401735
push ebx
call fcn.00409397
mov ebx, eax
push ebx
push str.Start_Menu
push edi
push 0x80000001
call fcn.004080c3
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.00408d10
lea eax, [ebp - 0x74]
push eax
call fcn.00401a5e
lea eax, [ebp - 0x74]
push eax
call fcn.00401ba5
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00408d20
add esp, 0x44
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call fcn.00401735
lea eax, [ebp + 0x90]
push eax
call fcn.004029b2
lea eax, [ebp - 0x74]
push eax
call fcn.004029b2
add esp, 0x14
cmp dword [ebp - 0x78], 0
je 0x40241f
push dword [ebp - 0x78]
call fcn.00409371
pop ecx
test ebx, ebx
je 0x40242a
push ebx
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
add ebp, 0x198
leave
ret
Function at 0x402442
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1a4]
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x90]
push edi
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x90]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x74]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00408e10
mov ebx, 0x104
push ebx
call fcn.00409397
push eax
push str.Common_Programs
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push 0x80000002
mov dword [ebp - 0x78], eax
call fcn.004080c3
push dword [ebp - 0x78]
lea eax, [ebp + 0x90]
push eax
call fcn.00408d20
lea eax, [ebp + 0x90]
push eax
call fcn.00401a5e
lea eax, [ebp + 0x90]
add esp, 0x40
push eax
call fcn.00401ba5
mov esi, str.Internet_Explorer.lnk
lea eax, [ebp + 0x90]
push esi
push eax
call fcn.00408d20
push dword [ebp - 0x80]
lea eax, [ebp + 0x90]
push eax
push dword [ebp - 0x7c]
call fcn.00401735
push ebx
call fcn.00409397
mov ebx, eax
push ebx
push str.Programs
push edi
push 0x80000001
call fcn.004080c3
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.00408d10
lea eax, [ebp - 0x74]
push eax
call fcn.00401a5e
lea eax, [ebp - 0x74]
push eax
call fcn.00401ba5
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00408d20
add esp, 0x44
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call fcn.00401735
lea eax, [ebp + 0x90]
push eax
call fcn.004029b2
lea eax, [ebp - 0x74]
push eax
call fcn.004029b2
add esp, 0x14
cmp dword [ebp - 0x78], 0
je 0x40258c
push dword [ebp - 0x78]
call fcn.00409371
pop ecx
test ebx, ebx
je 0x402597
push ebx
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
add ebp, 0x198
leave
ret
Function at 0x4025af
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
mov ebx, dword [ebp + 0x19c]
push esi
push edi
mov edi, dword [ebp + 0x198]
lea eax, [ebp - 0x7c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00408e10
lea eax, [ebp + 0x88]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x88]
push 0
push eax
call fcn.00408e10
push 0x104
call fcn.00409397
push eax
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
mov dword [ebp - 0x80], eax
call fcn.004080c3
push dword [ebp - 0x80]
lea eax, [ebp + 0x88]
push eax
call fcn.00408d20
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
lea eax, [ebp + 0x88]
push esi
push eax
call fcn.00408d20
lea eax, [ebp + 0x88]
add esp, 0x44
push eax
call fcn.00401a5e
lea eax, [ebp + 0x88]
push eax
call fcn.00401ba5
lea eax, [ebp + 0x88]
push str.Internet_Explorer.lnk
push eax
call fcn.00408d20
push ebx
lea eax, [ebp + 0x88]
push eax
push edi
call fcn.00401735
add esp, 0x1c
push 0
push 0x1a
lea eax, [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x7c]
push eax
call fcn.00401a5e
lea eax, [ebp - 0x7c]
push eax
call fcn.00401ba5
lea eax, [ebp - 0x7c]
push 0x41b5f4
push eax
call fcn.00408d20
push ebx
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.00401735
lea eax, [ebp + 0x88]
push eax
call fcn.004029b2
lea eax, [ebp - 0x7c]
push eax
call fcn.004029b2
add esp, 0x2c
cmp dword [ebp - 0x80], 0
pop edi
pop esi
pop ebx
je 0x4026f8
push dword [ebp - 0x80]
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
call fcn.00408f1b
add ebp, 0x190
leave
ret
Function at 0x40270d
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x294]
sub esp, 0x314
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x290], eax
push esi
lea eax, [ebp - 0x7c]
xor esi, esi
push eax
mov dword [ebp - 0x80], esi
call fcn.00408e90
push eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00408e10
lea eax, [ebp + 0x88]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x88]
push esi
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push esi
push eax
call section..text
lea eax, [ebp + 0x18c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x18c]
push esi
push eax
call fcn.00408e10
add esp, 0x38
push esi
push 0x26
lea eax, [ebp + 0x18c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp + 0x18c]
push str.Internet_Exploreriexplore.exe
push eax
call fcn.00408d20
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.00402161
lea eax, [ebp - 0x7c]
push eax
call fcn.00401d78
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.004022d5
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.00402442
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.004025af
add esp, 0x2c
call fcn.00401cec
call fcn.00401d4a
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
pop esi
call fcn.00408f1b
add ebp, 0x294
leave
ret
Function at 0x402fcf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x105
call fcn.00409397
pop ecx
push 0
push 0x1a
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push str.TencentTencentTra
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
push str.veler100TtConf.dat
push eax
call fcn.00408d20
lea eax, [ebp - 0x20c]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x108]
push str.COMMON
push eax
call fcn.00408d20
lea eax, [ebp - 0x108]
add esp, 0x40
push eax
call fcn.00402811
pop ecx
lea eax, [ebp - 0x108]
push eax
push edi
push str.strHomePageUrl
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
call fcn.004029b2
pop ecx
test esi, esi
je 0x4030b9
push esi
call fcn.00409371
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f1b
leave
ret

Function at 0x4030c7
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 0x90]
push 0x105
call fcn.00409397
pop ecx
push 0
push 0x1a
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.360s
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.e360SE.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push edi
push str.HomePage
push str.option
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test esi, esi
je 0x403175
push esi
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f1b
add ebp, 0x88
leave
ret
Function at 0x40318c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 0x90]
push 0x105
call fcn.00409397
pop ecx
push 0
push 0x26
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.36036
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.0se360SE.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push edi
push str.Home
push str.Browser
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test esi, esi
je 0x40323a
push esi
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f1b
add ebp, 0x88
leave
ret

Function at 0x403251
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 0x90]
push 0x105
call fcn.00409397
pop ecx
push 0
push 0x26
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.TheWorld_2
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str..0TheWorld.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push edi
push str.Home
push str.Browser
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test esi, esi
je 0x4032ff
push esi
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f1b
add ebp, 0x88
leave
ret
Function at 0x403316
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 0x90]
push 0x105
call fcn.00409397
pop ecx
push 0
push 0x26
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.TheWo
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.rld_3TheWorld.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push edi
push str.HomePage
push str.option
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test esi, esi
je 0x4033c4
push esi
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f1b
add ebp, 0x88
leave
ret
Function at 0x403762
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
mov esi, dword [ebp + 0x90]
push edi
push 0x105
call fcn.00409397
pop ecx
xor edi, edi
push edi
push 0x1a
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.OperaOperapro
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.fileopera6.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push str.Home_URL
mov edi, str.User_Prefs
push edi
call esi
lea eax, [ebp - 0x80]
push eax
push 0x41b4bc
push str.Startup_Type
push edi
call esi
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test ebx, ebx
je 0x403824
push ebx
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
add ebp, 0x88
leave
ret

Function at 0x40383c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
mov esi, dword [ebp + 0x90]
push edi
push 0x105
call fcn.00409397
pop ecx
xor edi, edi
push edi
push 0x26
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x80]
push eax
call fcn.00408e90
push eax
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00408e10
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.GreenBrowserUs
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push str.erGreenBrowser.ini
push eax
call fcn.00408d20
lea eax, [ebp - 0x80]
push eax
call fcn.00402811
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push str.HomePageUrl
mov edi, str.Settings
push edi
call esi
lea eax, [ebp - 0x80]
push eax
push 0x41b998
push str.StartMode
push edi
call esi
lea eax, [ebp - 0x80]
push eax
call fcn.004029b2
pop ecx
test ebx, ebx
je 0x4038fe
push ebx
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
add ebp, 0x88
leave
ret
Function at 0x403916
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x59c]
sub esp, 0x61c
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x598], eax
push ebx
push esi
mov esi, dword [ebp + 0x5a8]
push edi
mov edi, dword [ebp + 0x5a4]
lea eax, [ebp + 0x390]
push eax
mov dword [ebp - 0x7c], edi
call fcn.00408e90
push eax
xor ebx, ebx
lea eax, [ebp + 0x390]
push ebx
push eax
call fcn.00408e10
lea eax, [ebp + 0x390]
push esi
push eax
call fcn.00408d10
lea eax, [ebp + 0x390]
push 0x41b348
push eax
call fcn.00408d20
push esi
push edi
call fcn.00408118
add esp, 0x28
lea eax, [ebp - 0x78]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403a6e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x400
push edi
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x71], bl
call esi
test eax, eax
jne 0x403a6e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp + 0x494]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x494]
push 0
push eax
call fcn.00408e10
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp + 0x494]
push eax
call fcn.00408d20
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x494]
push eax
call fcn.00408d20
lea eax, [ebp + 0x494]
push eax
push dword [ebp - 0x7c]
call fcn.00408118
add esp, 0x28
lea eax, [ebp + 0x494]
push eax
push dword [ebp - 0x7c]
call ebx
test eax, eax
je 0x403a46
lea eax, [ebp + 0x494]
push eax
push dword [ebp - 0x7c]
call fcn.00403916
pop ecx
pop ecx
lea eax, [ebp + 0x494]
push eax
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x403a4a
mov byte [ebp - 0x71], 1
cmp byte [ebp - 0x71], 0
je 0x403a56
and dword [ebp - 0x80], 0
jmp 0x403a59
inc dword [ebp - 0x80]
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
push dword [ebp - 0x78]
call esi
test eax, eax
je 0x4039c5
cmp dword [ebp - 0x78], 0
pop edi
pop esi
pop ebx
je 0x403a80
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x598]
xor ecx, ebp
call fcn.00408f1b
add ebp, 0x59c
leave
ret