joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cd10
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x4fbe90
push 1
push 0
push 0x4fc000
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40cddc
mov eax, dword [esp]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 8], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40cd69
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
push ecx
call eax
mov ecx, dword [esp + 0x20]
cmp ecx, 0xffffffff
je 0x40cd80
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push esi
push eax
mov eax, dword [edx + 0x44]
call eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x4fbfc0
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x40cdcd
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor esi, esi
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40cde0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 0x800
push ebx
push ebp
mov ebp, dword [esp + 0x80c]
lea edx, [esp + 8]
push edi
mov eax, ebp
sub edx, ebp
jmp 0x40ce00
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40ce00
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ce16
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xa], 0x5c
je 0x40ce47
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40ce34
mov eax, dword [0x4e90cc]
mov dword [edi], eax
push ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40ce6d
push ebp
call fcn.0041b780
add esp, 4
test eax, eax
jne 0x40ce6d
push ebp
call fcn.0041b840
add esp, 4
mov ebx, eax
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40ce74
push esi
push 0
mov ecx, 6
mov esi, str.TMP26391.TMP
rep movsd dword es:[edi], dword [esi]
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x28]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
cmp eax, 0xffffffff
jne 0x40cecb
test ebx, ebx
je 0x40cebf
push ebp
call fcn.0041bd00
add esp, 4
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x800
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x40ceea
push ebp
call fcn.0041bd00
add esp, 4
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x800
ret
Function at 0x40d390
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push eax
push ebp
call fcn.0047befd
add esp, 8
test eax, eax
jne 0x40d3b0
mov eax, 1
pop ebp
pop ecx
ret
push ebx
push esi
xor esi, esi
cmp dword [esp + 0x1c], esi
push edi
jle 0x40d4f7
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d3fb
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x40d3c5
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
xor ebp, ebp
cmp dword [esp + 0x28], ebp
jle 0x40d435
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d444
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, dword [esp + 0x28]
jl 0x40d403
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
je 0x40d4eb
cmp ebp, 0xffffffff
je 0x40d4eb
push ebp
call fcn.0047afeb
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40d4eb
push 0
lea edx, [esp + 0x14]
push edx
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d4ce
cmp dword [esp + 0x10], ebp
jne 0x40d4ce
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d4ce
cmp dword [esp + 0x10], ebp
jne 0x40d4ce
push ebx
call fcn.0047b0b5
add esp, 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
pop ecx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
push ebx
call fcn.0047b0b5
add esp, 4
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret

Function at 0x40d500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d550
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push esi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d550
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x40d570
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e2dd8
push eax
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x10
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 8]
push ecx
xor esi, esi
push esi
push 0xf003f
push esi
push 0x4e88c0
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d614
mov esi, dword [esp + 0x30]
push esi
lea ecx, [esp + 0x10]
call fcn.00418470
mov dword [esp + 0x1c], 0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d5d1
sub eax, edx
mov edx, dword [esp + 0x2c]
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 4]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00417490
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x40d640
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
xor esi, esi
push esi
push 0xf003f
push esi
push 0x4e88c0
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d692
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40d6b0
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 4]
push eax
push 2
xor esi, esi
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d6e7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40d720
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4e1bc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov esi, 1
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push eax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x40d77d
push 0x4e88c0
mov ecx, edi
call fcn.00418470
mov dword [esp + 0x10], esi
jmp 0x40d7fd
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d8be
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebp
push esi
push eax
call ebx
push esi
test eax, eax
jne 0x40d7c4
call fcn.0045d8c9
add esp, 4
push 0x4e88c0
mov ecx, edi
call fcn.00418470
mov dword [esp + 0x10], 1
jmp 0x40d7fd
lea ecx, [esp + 0x18]
call fcn.00418470
mov byte [esp + 0x24], 2
push esi
call fcn.0045d8c9
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004176e0
mov dword [esp + 0x10], 1
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x14]
call fcn.00417490
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x30]
call fcn.00417490
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40dbf0
Capabilities:
Delete file
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e138b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x4818
call fcn.0047af40
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0x4000
lea ecx, [esp + 0x830]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40dd71
mov eax, dword [esp + 0x18]
shr eax, 2
test eax, eax
jbe 0x40dd71
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edi, [esp + 0x828]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
test eax, eax
je 0x40dd63
push eax
push 0
push 0x410
call ebp
mov esi, eax
test esi, esi
je 0x40dd63
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.0047a4b0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40dd5c
mov ecx, dword [esp + 0x14]
push 0x400
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
push 0x4e90b4
lea ecx, [esp + 0x24]
call fcn.00418470
mov dword [esp + 0x4834], 0
mov eax, dword [eax]
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0047befd
add esp, 8
test eax, eax
sete bl
mov dword [esp + 0x4834], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00417490
test bl, bl
je 0x40dd5c
mov ecx, dword [esp + 0x14]
push 0x400
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [edi]
push eax
push 0
push 1
call ebp
test eax, eax
je 0x40dd3a
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40dd63
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x40dd24
jmp 0x40dd63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
sub dword [esp + 0x10], 1
jne 0x40dc59
mov ecx, dword [esp + 0x482c]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40def0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e13e0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [esp + 0x2c], edi
jle 0x40df60
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40df75
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40dfd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, dword [esp + 0x2c]
jl 0x40df22
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
sub esp, 8
mov ecx, esp
mov dword [esp + 0x34], esp
push esi
call fcn.00418470
mov dword [esp + 0x28], 0
lea eax, [esp + 0x18]
or edi, 0xffffffff
push eax
mov dword [esp + 0x2c], edi
call fcn.0041c210
mov dword [esp + 0x2c], 1
mov eax, dword [eax]
push eax
call fcn.0040cde0
add esp, 0x10
mov esi, eax
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x10]
call fcn.00417490
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x40e080
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x4e1501
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.00418470
mov dword [esp + 0x20], 1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x10], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 8]
jge 0x40e0fe
mov edx, dword [esi + eax*4]
push edx
lea ecx, [esp + 0x14]
call fcn.00402d30
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004176e0
jmp 0x40e115
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x28]
push 0x4e88c0
mov ecx, esi
call fcn.00418470
mov dword [esp + 0xc], 1
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40e140
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e2dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ebp
lea eax, [esp + 4]
push eax
push 0x20019
xor ebp, ebp
push ebp
push ecx
push edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e1f8
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push ebp
push edi
push ecx
call ebx
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
push ebp
push ebp
push edi
push eax
call ebx
test eax, eax
jne 0x40e1f5
push esi
lea ecx, [esp + 0x1c]
call fcn.00418470
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x18]
mov edx, esi
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x40e1d0
mov ebp, 1
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00417490
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40e350
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
test esi, esi
je 0x40e408
test edi, edi
je 0x40e408
mov ebx, dword [esp + 0x14]
push ebx
push str.InstallPath
push 0x4e94ac
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040e140
add esp, 0x10
test eax, eax
je 0x40e489
lea eax, [esp + 0xc]
push eax
push str.ForAllUsers
push 0x4e94ac
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d500
add esp, 0x10
test eax, eax
je 0x40e489
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e3c1
sub eax, edx
sar eax, 1
je 0x40e489
cmp dword [esp + 0xc], 0
je 0x40e489
push 0xffffffffffffffff
push 0x4e90cc
push ebx
call fcn.00417180
push ebx
call fcn.0040cde0
add esp, 0x10
test eax, eax
je 0x40e489
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x14]
push ebx
push str.InstallPath
push 0x4e94ac
push closesocket
call fcn.0040e140
add esp, 0x10
test eax, eax
je 0x40e489
lea ecx, [esp + 0xc]
push ecx
push str.ForAllUsers
push 0x4e94ac
push closesocket
call fcn.0040d500
add esp, 0x10
test eax, eax
je 0x40e489
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e450
sub eax, edx
sar eax, 1
je 0x40e489
cmp dword [esp + 0xc], 0
jne 0x40e489
push 0xffffffffffffffff
push 0x4e90cc
push ebx
call fcn.00417180
push ebx
call fcn.0040cde0
add esp, 0x10
test eax, eax
je 0x40e489
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test esi, esi
je 0x40e526
test edi, edi
je 0x40e526
push 1
push 0x26
push ebx
push 0
call ebp
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e4b0
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
je 0x40e4e4
mov edi, ebx
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e4d0
mov edx, dword [0x4e90cc]
mov dword [edi], edx
mov edi, ebx
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e4f0
mov ecx, 7
mov esi, 0x4eaf88
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0041b840
push ebx
call fcn.0040cde0
add esp, 8
test eax, eax
je 0x40e526
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push 1
push 0x1a
push ebx
push 0
call ebp
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e534
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
je 0x40e563
mov edi, ebx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e550
mov eax, dword [0x4e90cc]
mov dword [edi], eax
add ebx, 0xfffffffe
mov edi, ebx
jmp 0x40e570
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e570
pop ebp
mov ecx, 7
mov esi, 0x4eaf88
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x40e880
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e1468
push eax
mov dword fs:[0], esp
sub esp, 0x14
push edi
xor edi, edi
cmp dword [0x530b38], edi
je 0x40e93e
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
lea eax, [esp + 4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x40e932
push esi
mov esi, dword [esp + 8]
push ebx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
push str.EnableLUA
mov ebx, 4
push esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x40e917
cmp dword [esp + 0x14], ebx
je 0x40e950
mov dword [esp + 0x28], 0xffffffff
cmp esi, edi
je 0x40e92e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], edi
xor al, al
jmp 0x40e970
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], edi
xor al, al
pop edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
cmp dword [esp + 0x10], edi
setne bl
mov dword [esp + 0x28], 0xffffffff
cmp esi, edi
je 0x40e96e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], edi
mov al, bl
mov ecx, dword [esp + 0x20]
pop ebx
mov dword [esp + 0x18], edi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x40ebc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e14c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.004173e0
mov ebx, 1
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
mov ecx, ebx
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x40ec1b
push 0x1000
lea ecx, [esp + 0x10]
call fcn.004019a0
mov edx, dword [esp + 0xc]
push ebx
push 0x1a
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40ecd3
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 8
test eax, eax
jl 0x40ecc9
mov ecx, dword [esp + 0xc]
cmp eax, dword [ecx - 8]
jg 0x40ecc9
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov word [edx + eax*2], cx
push 0x4e90cc
lea ecx, [esp + 0x18]
call fcn.00418470
mov byte [esp + 0x2c], 2
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00417fa0
lea ecx, [esp + 0x1c]
call fcn.00417490
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x14]
call fcn.00417490
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [esp + 0x10]
call fcn.00418290
mov edx, dword [esp + 0xc]
push edx
call fcn.0041b840
mov esi, dword [esp + 0x38]
add esp, 4
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004176e0
jmp 0x40ece3
push 0x80070057
call fcn.004010d0
mov esi, dword [esp + 0x34]
push 0x4e88c0
mov ecx, esi
call fcn.00418470
mov dword [esp + 8], ebx
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0xc]
call fcn.00417490
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x40ed10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e1501
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea ecx, [esp + 4]
mov dword [esp], 0
call fcn.004173e0
mov dword [esp + 0x14], 1
mov edx, dword [esp + 4]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x40ed6a
push 0x1000
lea ecx, [esp + 8]
call fcn.004019a0
mov edx, dword [esp + 4]
push esi
push 1
push 0x1a
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40edde
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 8
test eax, eax
jl 0x40edd4
mov ecx, dword [esp + 8]
cmp eax, dword [ecx - 8]
jg 0x40edd4
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 8]
xor ecx, ecx
mov word [edx + eax*2], cx
push str.MraUpdate
lea ecx, [esp + 0xc]
call fcn.00418290
mov eax, dword [esp + 8]
push eax
call fcn.0041b840
mov esi, dword [esp + 0x24]
add esp, 4
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004176e0
jmp 0x40edee
push 0x80070057
call fcn.004010d0
mov esi, dword [esp + 0x20]
push 0x4e88c0
mov ecx, esi
call fcn.00418470
mov dword [esp + 4], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 8]
call fcn.00417490
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret