joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d74a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100d74a0
push 0xffffffffffffffff
push 0x100edc98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001850]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100025d0]
cmp eax, 0xffffffff
jne 0x100d74d9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100d74e6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100d754d
jmp 0x100d751c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100d758a
test edi, edi
jne 0x100d7590
push 0x100d70a0
push 0x100f04dc
call fcn.100d6d40
mov eax, dword [0x100025d0]
add esp, 8
cmp eax, 0xffffffff
je 0x100d754d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100d7576
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d7576
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100d75c8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100d75b9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100d7590
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100d7510
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100d7627
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100d760c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100d7627
jmp 0x100d7600
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100d7600
jmp 0x100d7627
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100d7625
cmp esi, dword [eax + 8]
jne 0x100d7625
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100d7615
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100d763b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100d763b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100d70d0
cmp esi, ebx
jne 0x100d75e0
mov ebp, dword [esp + 0x14]
jmp 0x100d7510
Function at 0x4013d6
Capabilities:
Terminate process

Disassembly:
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401397
jmp 0x40139e
call 0x4645825
add bl, byte [eax - 0x3d]
push eax
mov ax, 0x5eb
xor eax, eax
je 0x4013a8
add dword [esp + 4], 2
pop eax
ret
jmp 0x4013af
call 0x2444970b
add eax, ebx
push eax
mov ax, 0x5eb
xor eax, eax
je 0x4013b8
pop eax
add dword [esp], 3
ret
jmp 0x4013bf
call 0x2444971b
add al, 0xc3
push eax
mov ax, 0x5eb
xor eax, eax
je 0x4013c8
pop eax
add dword [esp], 4
ret
jmp 0x4013cf
call 0x4645856
add eax, 0xd3bc358
cmp ecx, dword [0x40e004]
jne 0x4013e0
add dword [esp + 4], 5
pop eax
ret
repz ret

Function at 0x4038e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40390e
call fcn.004019fb
mov dword [eax], esi
call fcn.004019e8
push 0x16
pop esi
mov dword [eax], esi
call fcn.00402415
mov eax, esi
jmp 0x403963
test dword [ebp + 0xc], 0xfffffff9
jne 0x4038f4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40393b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401a0e
pop ecx
call fcn.004019e8
mov eax, dword [eax]
jmp 0x403963
test al, 0x10
jne 0x403961
test al, 1
je 0x403961
test byte [ebp + 0xc], 2
je 0x403961
call fcn.004019fb
mov dword [eax], 5
call fcn.004019e8
mov dword [eax], 0xd
jmp 0x403932
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40501b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043ab
and dword [ebp - 0x14], 0
cmp dword [0x40fb18], 0
mov dword [ebp - 0x18], eax
jne 0x4050ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405176
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405176
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40fb18], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40fb1c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40fb20], eax
call edi
push eax
call esi
mov dword [0x40fb28], eax
test eax, eax
je 0x4050ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40fb24], eax
mov eax, dword [0x40fb24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405127
cmp dword [0x40fb28], ecx
je 0x405127
push eax
call esi
push dword [0x40fb28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405127
test ebx, ebx
je 0x405127
call edi
test eax, eax
je 0x40511e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40511e
test byte [ebp - 8], 1
jne 0x405127
or dword [ebp + 0x10], 0x200000
jmp 0x40515a
mov eax, dword [0x40fb1c]
cmp eax, dword [ebp - 0x18]
je 0x40515a
push eax
call esi
test eax, eax
je 0x40515a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40515a
mov eax, dword [0x40fb20]
cmp eax, dword [ebp - 0x18]
je 0x40515a
push eax
call esi
test eax, eax
je 0x40515a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40fb18]
call esi
test eax, eax
je 0x405176
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405178
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004013d6
leave
ret
Function at 0x401000
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x40
push 0x40
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0xf0000000
push 1
push 0
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40108a
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40108a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
test eax, eax
jne 0x401091
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push esi
push 2
push eax
mov dword [ebp - 0xc], 0x40
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
neg eax
sbb eax, eax
and eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401870
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x800
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018db
mov ecx, dword [ebp - 8]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edx, [ebp - 8]
push edx
mov esi, eax
mov eax, dword [ebp - 4]
push esi
push 0
push 0
push str.Local_AppData
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4018d1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402a27
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x402a31
repz ret
jmp fcn.00402bd6

Function at 0x404acb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a27
and dword [ebp - 0x14], 0
cmp dword [0x40b744], 0
mov dword [ebp - 0x18], eax
jne 0x404b7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404c26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404c26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b744], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b748], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b74c], eax
call edi
push eax
call esi
mov dword [0x40b754], eax
test eax, eax
je 0x404b7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b750], eax
mov eax, dword [0x40b750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404bd7
cmp dword [0x40b754], ecx
je 0x404bd7
push eax
call esi
push dword [0x40b754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404bd7
test ebx, ebx
je 0x404bd7
call edi
test eax, eax
je 0x404bce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404bce
test byte [ebp - 8], 1
jne 0x404bd7
or dword [ebp + 0x10], 0x200000
jmp 0x404c0a
mov eax, dword [0x40b748]
cmp eax, dword [ebp - 0x18]
je 0x404c0a
push eax
call esi
test eax, eax
je 0x404c0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404c0a
mov eax, dword [0x40b74c]
cmp eax, dword [ebp - 0x18]
je 0x404c0a
push eax
call esi
test eax, eax
je 0x404c0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b744]
call esi
test eax, eax
je 0x404c26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404c28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402a27
leave
ret
Function at 0x401838
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x4018ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4095c4
call sub.KERNEL32.DLL_GetVersionExA
cmp byte [0x409045], 0
je 0x401866
push 0x4095c4
call sub.KERNEL32.DLL_VirtualQuery
mov eax, 0x4095e4
call fcn.004011fc
mov eax, 0x4095f4
call fcn.004011fc
mov eax, 0x409620
call fcn.004011fc
push 0xff8
push 0
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40961c], eax
cmp dword [0x40961c], 0
je 0x4018cd
mov eax, 3
mov edx, dword [0x40961c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x4018a3
mov eax, 0x409604
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x409610], eax
mov byte [0x4095bc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4018f5
cmp byte [0x409045], 0
je 0x4018ed
push 0x4095c4
call sub.KERNEL32.DLL_WinExec
ret

Function at 0x4018fc
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4095bc], 0
je 0x4019d9
xor edx, edx
push ebp
push 0x4019d2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x409045], 0
je 0x40192e
push 0x4095c4
call sub.KERNEL32.DLL_VirtualQuery
mov byte [0x4095bc], 0
mov eax, dword [0x40961c]
push eax
call sub.KERNEL32.DLL_GetStdHandle
xor eax, eax
mov dword [0x40961c], eax
mov ebx, dword [0x4095e4]
jmp 0x401961
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
mov ebx, dword [ebx]
cmp ebx, 0x4095e4
jne 0x40194f
mov eax, 0x4095e4
call fcn.004011fc
mov eax, 0x4095f4
call fcn.004011fc
mov eax, 0x409620
call fcn.004011fc
mov eax, dword [0x4095dc]
test eax, eax
je 0x4019a7
mov edx, dword [eax]
mov dword [0x4095dc], edx
push eax
call sub.KERNEL32.DLL_GetStdHandle
mov eax, dword [0x4095dc]
test eax, eax
jne 0x401990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4019d9
cmp byte [0x409045], 0
je 0x4019c7
push 0x4095c4
call sub.KERNEL32.DLL_WinExec
push 0x4095c4
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret
Function at 0x401f24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4095bc], 0
jne 0x401f41
call fcn.00401838
test al, al
je 0x401f49
cmp ebx, 0x7ffffff8
jle 0x401f53
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4020a7
xor ecx, ecx
push ebp
push 0x4020a0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x409045], 0
je 0x401f74
push 0x4095c4
call sub.KERNEL32.DLL_VirtualQuery
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f84
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402023
mov eax, ebx
test eax, eax
jns 0x401f99
add eax, 3
sar eax, 2
mov edx, dword [0x40961c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402023
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401fd4
mov eax, ebx
test eax, eax
jns 0x401fc3
add eax, 3
sar eax, 2
mov ecx, dword [0x40961c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401ffa
mov ecx, ebx
test ecx, ecx
jns 0x401fdd
add ecx, 3
sar ecx, 2
mov edi, dword [0x40961c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4095ac]
sub ebx, 4
add dword [0x4095b0], ebx
call fcn.00403100
jmp 0x4020a7
cmp ebx, dword [0x409614]
jg 0x402075
sub dword [0x409614], ebx
cmp dword [0x409614], 0xc
jge 0x402047
add ebx, dword [0x409614]
xor eax, eax
mov dword [0x409614], eax
mov eax, dword [0x409618]
add dword [0x409618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4095ac]
sub ebx, 4
add dword [0x4095b0], ebx
call fcn.00403100
jmp 0x4020a7
mov eax, ebx
call fcn.00401e30
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4020a7
cmp byte [0x409045], 0
je 0x40209f
push 0x4095c4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4020b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4095c0], eax
cmp byte [0x4095bc], 0
jne 0x4020ec
call fcn.00401838
test al, al
jne 0x4020ec
mov dword [0x4095c0], 8
mov dword [ebp - 4], 8
jmp 0x40224d
xor ecx, ecx
push ebp
push 0x402246
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x409045], 0
je 0x40210d
push 0x4095c4
call sub.KERNEL32.DLL_VirtualQuery
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402128
mov dword [0x4095c0], 9
jmp 0x40221d
dec dword [0x4095ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4095b0], eax
test bl, 1
je 0x402188
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402158
test edx, 0x80000003
je 0x402167
mov dword [0x4095c0], 0xa
jmp 0x40221d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40217f
mov dword [0x4095c0], 0xa
jmp 0x40221d
add ebx, edx
mov esi, eax
call fcn.004019dc
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x409618]
jne 0x4021c8
sub dword [0x409618], ebx
add dword [0x409614], ebx
cmp dword [0x409614], 0x3c00
jle 0x4021b9
call fcn.00401ccc
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403100
jmp 0x40224d
mov edx, dword [eax]
test dl, 2
je 0x4021eb
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4021e6
mov dword [0x4095c0], 0xb
jmp 0x40221d
or dword [eax], 1
jmp 0x402214
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021fe
cmp dword [eax], 0
je 0x4021fe
cmp dword [eax + 8], 0xc
jge 0x40220a
mov dword [0x4095c0], 0xb
jmp 0x40221d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019dc
mov edx, ebx
mov eax, esi
call fcn.00401c44
mov eax, dword [0x4095c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40224d
cmp byte [0x409045], 0
je 0x402245
push 0x4095c4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403c50
Capabilities:
Get disk size
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x403de4
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
test esi, esi
je 0x403cb8
push 0x403df4
push esi
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x403cb8
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x403cb8
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCPInfo
jmp 0x403dda
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x403cf8
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x403dda
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00403c3c
mov esi, eax
cmp byte [esi], 0
je 0x403dda
lea eax, [esi + 1]
call fcn.00403c3c
mov esi, eax
cmp byte [esi], 0
je 0x403dda
jmp 0x403cfe
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetCPInfo
jmp 0x403dbd
lea eax, [esi + 1]
call fcn.00403c3c
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x403dda
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_GetCPInfo
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_VirtualFree
mov esi, eax
cmp esi, 0xffffffff
je 0x403dda
push esi
call sub.KERNEL32.DLL_VirtualAlloc
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x403dda
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_GetCPInfo
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x403d1c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCPInfo
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e08
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_DeleteCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404038
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403e8b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404038
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403e8b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404054
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f14
xor eax, eax
push ebp
push 0x403f0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403c50
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403ef2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404074
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403ef2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f14
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetCPInfo
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_EnumCalendarInfoA
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40402e
cmp byte [ebp - 0xd], 0
jne 0x403f5b
cmp byte [ebp - 0x12], 0
je 0x40402e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403f74
dec ebx
cmp byte [ebx], 0x2e
je 0x403f83
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403f73
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40402e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403fc0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
test esi, esi
jne 0x40402e
cmp byte [ebp - 0xd], 0
je 0x40402e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
test esi, esi
jne 0x40402e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e40
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x407de8
call fcn.00404424
xor eax, eax
push ebp
push 0x407f36
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, dword [0x408298]
call fcn.004037d0
mov eax, dword [ebp - 0x14]
call fcn.004053c0
mov edi, eax
inc ebx
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004052d4
mov edx, dword [ebp - 0x18]
mov eax, 0x4097a4
call fcn.00403648
lea eax, [ebp - 0x1c]
mov edx, dword [0x408294]
call fcn.004037d0
push dword [ebp - 0x1c]
push dword [0x4097a4]
push 0x407f50
mov eax, 0x4097a8
mov edx, 3
call fcn.004038b4
push 0x407f60
push dword [0x4097a4]
push 0x407f50
mov eax, 0x4097ac
mov edx, 3
call fcn.004038b4
push 0
push 0
mov eax, dword [0x4097ac]
call fcn.00403940
mov esi, eax
push esi
mov eax, dword [0x4097a8]
call fcn.00403940
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
push 5
push esi
call fcn.00404540
cmp edi, ebx
jge 0x407e86
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f3d
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403618
ret