joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a874
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x47a87c
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47aa2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x390]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x47a976
inc eax
mov dword [ebp - 8], eax
xor esi, esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebx + 0x390]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004047e0
push eax
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, dword [ebx + 0x390]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x47aa40
call fcn.00404b24
inc eax
push eax
lea ecx, [ebp - 0x14]
mov edx, esi
mov eax, dword [ebx + 0x390]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
pop edx
pop ecx
call fcn.00404a40
push 0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004090b8
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004047e8
mov eax, dword [ebp - 0x18]
call fcn.004049e0
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004090b8
push dword [ebp - 0x24]
push 0x47aa4c
push dword [ebp - 4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x20]
call fcn.004049e0
push eax
call sub.kernel32.dll_CopyFileA
inc esi
dec dword [ebp - 8]
jne 0x47a8b0
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.004090b8
lea eax, [ebp - 0x2c]
mov edx, 0x47aa5c
call fcn.004047e8
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x42eea8]
call fcn.0042ef58
mov esi, eax
mov eax, dword [ebx + 0x380]
push eax
mov ecx, 0x47aa74
mov edx, 0x47aa8c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
push 1
mov ecx, 0x47aaa8
mov edx, 0x47aab8
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0040374c
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.004090b8
lea eax, [ebp - 0x34]
mov edx, 0x47aac8
call fcn.004047e8
mov edx, dword [ebp - 0x34]
mov eax, ebx
call fcn.0047a6c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47aa31
lea eax, [ebp - 0x38]
mov edx, 0xc
call fcn.00404544
lea eax, [ebp - 4]
call fcn.00404520
ret
Function at 0x401030
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push ebx
push edi
je 0x4010f7
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4010f7
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4010f7
mov edx, dword [esp + 0xc]
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
push eax
push edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010de
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
push edx
call esi
test eax, eax
jne 0x4010de
mov eax, dword [esp + 0x1c]
cmp eax, 2
je 0x4010ae
cmp eax, 1
jne 0x4010de
cmp dword [esp + 0x14], 0x104
ja 0x4010de
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
push edi
push eax
call esi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x4010e0
xor esi, esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4010ef
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
ret 0x14
pop edi
xor eax, eax
pop ebx
ret 0x14

Function at 0x401100
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push edi
mov dword [esp + 0x14], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
jne 0x40112f
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0xc
ret 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push ebp
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x401153
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x14
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x401168
xor ebp, ebp
jmp 0x4011f0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
xor eax, eax
push 0x4214f0
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], eax
call sub.VERSION.dll_VerQueryValueA
mov ax, word [esp + 0x24]
cmp ax, 0xffff
mov edx, dword [esp + 0x20]
je 0x4011a1
movzx ecx, word [edx + 0xa]
cmp ax, cx
ja 0x4011e4
jb 0x4011ed
mov cx, word [esp + 0x28]
cmp cx, 0xffff
je 0x4011b8
mov ax, word [edx + 8]
cmp cx, ax
ja 0x4011e4
jb 0x4011ed
mov cx, word [esp + 0x2c]
cmp cx, 0xffff
je 0x4011cf
movzx eax, word [edx + 0xe]
cmp cx, ax
ja 0x4011e4
jb 0x4011ed
mov cx, word [esp + 0x30]
cmp cx, 0xffff
je 0x4011f0
mov ax, word [edx + 0xc]
cmp cx, ax
jbe 0x4011eb
mov ebp, 1
jmp 0x4011f0
jae 0x4011f0
or ebp, 0xffffffff
mov eax, dword [esp + 0x18]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0xc
ret 0x14
Function at 0x4012b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
test esi, esi
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 1
stosb byte es:[edi], al
je 0x4012fe
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x4012fe
push esi
call edi
cmp eax, 0x104
jbe 0x401307
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x103
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
test eax, eax
je 0x40132a
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov esi, eax
push esi
call edi
test eax, eax
jne 0x40134a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5c
push esi
call fcn.0040a4c6
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
add esp, 8
test esi, esi
je 0x40139a
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esi], 0
call edi
and ebx, eax
jne 0x401385
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401385
mov ebx, 1
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.0040a4c6
mov esi, eax
add esp, 8
test esi, esi
jne 0x401361
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call edi
and ebx, eax
jne 0x4013bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4013bb
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4014b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4014c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4014dd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4014fe
cmp esi, eax
jae 0x4014d7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014f0
cmp esi, eax
jae 0x4014d7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4018f0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
push edi
mov dword [esp + 0x10], 0x7530
jne 0x4019e0
mov eax, dword [esi + 0x30]
test eax, eax
push 0
je 0x401931
push str._local_
push str.proxy
push 3
jmp 0x401939
mov eax, dword [esi + 0x54]
push 0
push 0
push eax
push str.Mozilla_4.0__compatible__MSIE_5.00__Windows_98__Rising_
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 4], eax
jne 0x40195d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x50], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov byte [esp + 0x20], cl
xor eax, eax
mov dword [esp + 0x1c], ecx
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4019c9
movzx edx, word [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
lea ecx, [esp + 0x28]
push str._s:_d
push ecx
mov dword [esp + 0x24], 3
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 4]
add esp, 0x10
push 0xc
lea eax, [esp + 0x18]
push eax
push 0x26
lea edx, [esp + 0x2c]
push ecx
mov dword [esp + 0x28], edx
call ebx
test eax, eax
je 0x401a94
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 0x14]
push edx
push 2
push eax
call ebx
test eax, eax
je 0x401a94
mov eax, dword [esi + 8]
test eax, eax
jne 0x401aad
mov eax, dword [esi + 0x18]
test eax, eax
push 0
push 0
push 3
jne 0x401a0d
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 4]
xor ecx, ecx
mov cx, word [esi + 0x14]
push 0
push 0
push ecx
push eax
push edx
jmp 0x401a24
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x10]
push eax
xor eax, eax
mov ax, word [esi + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 8], eax
je 0x401a94
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x401a94
mov eax, dword [esi + 8]
push 4
lea edx, [esp + 0x14]
push edx
push 5
push eax
call ebx
test eax, eax
je 0x401a94
mov edx, dword [esi + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 6
push edx
call ebx
test eax, eax
je 0x401a94
mov eax, dword [esi + 0x34]
test eax, eax
je 0x401aad
mov eax, dword [esi + 0x38]
mov ecx, dword [eax - 0xc]
inc ecx
push ecx
push eax
mov eax, dword [esi + 8]
push 0x2b
push eax
call ebx
test eax, eax
je 0x401a94
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax - 0xc]
inc ecx
push ecx
mov ecx, dword [esi + 8]
push eax
push 0x2c
push ecx
call ebx
test eax, eax
jne 0x401aad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [esi + 0x50], eax
call fcn.00401570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404660
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x404870
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x106c
call fcn.0040b0e0
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
je 0x404979
test edi, edi
je 0x404979
lea eax, [esp + 0x1c]
push eax
call fcn.00404660
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404979
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x84]
push edx
push esi
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x404926
jmp 0x4048f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404926
push eax
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00404690
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
push 0x1000
lea eax, [esp + 0x84]
push eax
push esi
call ebx
test eax, eax
jne 0x4048f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00404760
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
xor esi, esi
jmp 0x404950
movzx eax, byte [esp + esi + 0x10]
push eax
push 0x4219b0
push edi
call ebx
add esp, 0xc
inc esi
add edi, 2
cmp esi, 0x10
jb 0x404950
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x106c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x106c
ret

Function at 0x404a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
xor eax, eax
push 0x421a2c
mov byte [esp + 0xc], 0
mov ecx, 0x41
lea edi, [esp + 0xd]
push 0x104
lea esi, [esp + 0x10]
rep stosd dword es:[edi], eax
call fcn.00407c10
add esp, 8
test eax, eax
je 0x404a61
push str.UpdateXMLSSetup.xml
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404a61
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404a70
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x404a9d
xor eax, eax
pop ebx
add esp, 8
ret
push ebp
push esi
push edi
push ebx
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
lea edi, [ebp + 1]
push edi
call fcn.0041602f
mov ecx, edi
mov edx, ecx
mov esi, eax
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add esp, 4
test esi, esi
rep stosb byte es:[edi], al
je 0x404b0f
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404b0f
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
mov edx, dword [esp + 0x20]
push edx
push esi
call fcn.0040a72c
mov ebx, eax
neg ebx
sbb ebx, ebx
push esi
neg ebx
call fcn.00416034
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x404b30
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x630
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor eax, eax
push 0x421a2c
mov byte [esp + 0x224], bl
mov ecx, 0x41
lea edi, [esp + 0x225]
push 0x104
lea esi, [esp + 0x228]
rep stosd dword es:[edi], eax
call fcn.00407c10
add esp, 8
test eax, eax
jne 0x404b7e
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [esp + 0x10], bl
mov ecx, 0x41
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push str._s_smartup.exe
push ecx
call ebp
xor eax, eax
lea edx, [esp + 0x22c]
push edx
mov byte [esp + 0x338], bl
mov ecx, 0x41
lea edi, [esp + 0x339]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push str._sUpdate_smartup.exe
push eax
call ebp
xor eax, eax
mov byte [esp + 0x130], bl
mov ecx, 0x41
lea edi, [esp + 0x131]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x238]
push ecx
lea edx, [esp + 0x134]
push str._sUpdateXMLSRavCopy.xml
push edx
call ebp
xor eax, eax
mov byte [esp + 0x454], bl
mov ecx, 0x41
lea edi, [esp + 0x455]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x454]
lea edx, [esp + 0x34]
call fcn.00404870
xor eax, eax
mov byte [esp + 0x55c], bl
mov ecx, 0x41
lea edi, [esp + 0x55d]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x55c]
lea edx, [esp + 0x34c]
call fcn.00404870
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0x140]
push ecx
call fcn.00404a70
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jne 0x404d44
lea edx, [esp + 0x538]
push edx
lea eax, [esp + 0x11c]
push eax
call fcn.00404a70
add esp, 8
test eax, eax
je 0x404cbf
push 0x80
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x330]
push ecx
jmp 0x404d39
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x11c]
push str._sUpdateXMLSRsSetup.xml
push eax
call ebp
lea ecx, [esp + 0x43c]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.00404a70
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x404d44
lea eax, [esp + 0x538]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.00404a70
add esp, 8
test eax, eax
je 0x404d44
push 0x80
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x330]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
push ebx
mov ebx, eax
xor eax, eax
cmp edx, eax
push edi
je 0x40549f
cmp esi, eax
je 0x40549f
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push 0x42257c
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40548a
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x422570
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405450
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40547f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405464
sub eax, edx
sub ebx, eax
dec ebx
push ebx
push 0x4214f0
push esi
call fcn.0040b11d
add esp, 0xc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405490
sub eax, edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4207fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push 0x34
xor ebx, ebx
push ebx
mov esi, ecx
push 0x86
mov dword [esp + 0x20], esi
call fcn.0041dc80
lea ebp, [esi + 0x88]
mov ecx, ebp
mov dword [esp + 0x12c], ebx
mov dword [esi], 0x4225e8
call fcn.004066b0
lea edi, [esi + 0xa0]
mov ecx, edi
mov byte [esp + 0x12c], 1
call fcn.004176bb
mov dword [edi], vtable.CListCtrl.0
xor eax, eax
mov byte [esp + 0x18], bl
mov ecx, 0x41
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x104
mov byte [esp + 0x134], 2
mov dword [esi + 0x84], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [ebp]
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call dword [edx + 8]
test eax, eax
jne 0x40694b
call dword [esi + 0x98]
mov dword [esi + 0x9c], eax
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 4]
mov eax, esi
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
mov dword [esi + 0x9c], ebx
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4207fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push 0x34
xor ebx, ebx
push ebx
mov esi, ecx
push 0x6b
mov dword [esp + 0x20], esi
call fcn.0041dc80
lea ebp, [esi + 0x88]
mov ecx, ebp
mov dword [esp + 0x12c], ebx
mov dword [esi], 0x4227f8
call fcn.004066b0
lea edi, [esi + 0xa0]
mov ecx, edi
mov byte [esp + 0x12c], 1
call fcn.004176bb
mov dword [edi], vtable.CListCtrl.0
xor eax, eax
mov byte [esp + 0x18], bl
mov ecx, 0x41
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x104
mov byte [esp + 0x134], 2
mov dword [esi + 0x84], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [ebp]
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call dword [edx + 8]
test eax, eax
jne 0x406a68
call dword [esi + 0x98]
mov dword [esi + 0x9c], eax
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 4]
mov eax, esi
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
mov dword [esi + 0x9c], ebx
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4071d0
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42087b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x422b20
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407343
mov byte [esp + 0x18], bl
mov ecx, 0x82
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push 0x422b10
push eax
mov dword [esp + 0x2c], 0x209
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407343
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.00402900
lea ecx, [esp + 0xc]
mov dword [esp + 0x234], ebx
call fcn.00406eb0
push 0x421545
push str.kmon.dll
lea ecx, [esp + 0x14]
call fcn.00406cb0
push 0x421545
push str.ieprot.dll
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00406cb0
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004070b0
mov ecx, eax
call fcn.00402350
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 0xc]
cmp eax, ebx
je 0x40730f
cmp esi, ebx
je 0x4072d1
push str.kmon.dll
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4072eb
cmp edi, ebx
je 0x4072e7
push str.kmon.dll
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4072eb
mov byte [esp + 0x18], bl
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
push 0x422b10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x234], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407343
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret