joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e61c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e61d0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4e63d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408d84
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
call fcn.00404e38
mov eax, dword [0x53b31c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e6392
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x53b31c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4e63ec
call fcn.00404b70
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404a8c
mov eax, dword [ebp - 0x1c]
call fcn.004093f8
mov dword [0x53b618], eax
cmp dword [0x53b618], 4
je 0x4e6386
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404acc
mov eax, dword [ebp - 0x10]
mov edx, 0x4e63f8
call fcn.00404978
jne 0x4e629f
mov byte [0x533634], 1
jmp 0x4e62a6
mov byte [0x533634], 0
cmp byte [0x533634], 0
je 0x4e6343
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404614
mov ebx, 1
jmp 0x4e62ef
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
cmp al, 0x61
jb 0x4e62da
mov edx, dword [ebp - 0x18]
cmp al, 0x7a
ja 0x4e62da
inc ebx
jmp 0x4e62ef
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404a8c
jmp 0x4e62fb
mov eax, dword [ebp - 0x18]
call fcn.00404834
cmp ebx, eax
jl 0x4e62c5
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4e640c
call fcn.00404880
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
call fcn.00405ae4
mov ebx, eax
cmp dword [ebp - 0x14], 0
jne 0x4e6343
cmp ebx, 0x3e8
jbe 0x4e6343
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jae 0x4e6343
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp ebx, eax
jbe 0x4e6343
mov byte [ebp - 5], 1
jmp 0x4e6392
cmp byte [0x533634], 0
je 0x4e635f
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00404978
jne 0x4e635f
mov byte [ebp - 5], 1
jmp 0x4e6392
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00404e38
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0040516c
test eax, eax
jle 0x4e6386
mov byte [0x533634], 0
mov byte [ebp - 5], 1
jmp 0x4e6392
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x4e6229
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e63d9
lea eax, [ebp - 0x30]
call fcn.0040457c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x10]
call fcn.0040457c
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4e6940
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4e6a33
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edi, eax
push edi
push 0x4e64c8
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4e6a16
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416da8
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e6a0e
lea eax, [ebp - 4]
call fcn.00404a84
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409d6c
test eax, eax
jne 0x4e6a0e
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416da8
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e69f2
cmp eax, 0xffffffff
je 0x4e6a0e
cmp dword [ebp - 0xc], 0
je 0x4e6a0e
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4e698d
mov eax, edi
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6a3a
lea eax, [ebp - 4]
call fcn.0040457c
ret

Function at 0x4e6a44
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e6a5d
cmp eax, 0xffffffff
je 0x4e6a71
test ebx, ebx
je 0x4e6a71
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4ef744
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov esi, eax
push esi
push 0x4ef72c
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4ef7c4
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00416da8
cmp ebp, eax
je 0x4ef7c0
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00416da8
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4ef7c0
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409d6c
test eax, eax
jne 0x4ef7c0
mov edx, ebx
mov eax, esi
call fcn.00416da8
mov dword [esp + 4], eax
jmp 0x4ef7c4
inc ebx
dec edi
jne 0x4ef77a
mov eax, esi
call fcn.00403770
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ef840
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ef8fb
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x4ef893
lea ecx, [ebp - 0x88]
mov edx, 0x4ef910
mov eax, 0x4ef924
call fcn.0046c2ec
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408d84
cmp dword [ebx], 0
jne 0x4ef8dd
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ef8dd
lea eax, [ebp - 0x83]
call fcn.00409c6c
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x84]
call fcn.004047d8
mov eax, dword [ebp - 0x8c]
mov edx, ebx
call fcn.00408d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef902
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.004045a0
ret

Function at 0x4f0f00
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
push 0
push esi
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4f0f2f
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047e4
jmp 0x4f0f36
mov eax, ebx
call fcn.0040457c
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
mov eax, 0x411284
call fcn.00410db0
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push eax
xor ebx, ebx
push 0x4123d0
push 1
push ebx
push 0x4123c0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x4123e0
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x14]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp eax, ebx
jl 0x40111b
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jne 0x40111b
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, ebx
je 0x40111b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, 0x4150b8
lea eax, [ebp - 0x21c]
push edi
push eax
call esi
cmp dword [ebp + 0x10], 0x17
je 0x4010bc
cmp dword [ebp + 0x10], 2
jne 0x4010d4
lea eax, [ebp - 0x21c]
push 0x41d010
push eax
call esi
lea eax, [ebp - 0x21c]
push edi
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push 0x4150b0
push eax
call fcn.00406275
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
lea edx, [ebp - 0x21c]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jl 0x40111b
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x21c]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x401128
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x401135
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
push ebx
push esi
lea eax, [ebp + 8]
push edi
mov ebx, 0xf003f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
xor edi, edi
push ebx
push edi
push dword [ebp + 8]
push 0x80000002
call esi
test eax, eax
jne 0x4013a0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x64
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.CurrentVersion
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4013a0
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 0x6c]
push edi
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4013a0
lea eax, [ebp + 8]
push eax
push ebx
push edi
push str.Main
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4013a0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x47c]
push eax
push edi
push edi
push str.Install_Directory
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4013a0
lea eax, [ebp - 0x47c]
mov dword [ebp - 4], edi
push eax
call sub.MSVCRT.dll_wcslen
cmp word [ebp + eax*2 - 0x47e], 0x5c
pop ecx
je 0x401277
lea eax, [ebp - 0x47c]
push 0x4150b8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push str.Plugins_
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x274]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x274]
push str.NPIDMan1.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea eax, [ebp - 4]
mov esi, 0x41cd38
push edi
push eax
lea eax, [ebp - 0x274]
push esi
push eax
call fcn.00405ef6
cmp dword [ebp - 4], edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
je 0x40131b
mov eax, dword [0x41cf98]
cmp eax, edi
jne 0x4012df
mov eax, 0x41cf9c
lea ecx, [ebp - 0x274]
push ecx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x884]
push eax
call ebx
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, edi
jne 0x401304
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x884]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x274]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x274]
push str.NPIDMan2.dll
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x274]
push esi
push eax
call fcn.00405ef6
cmp dword [ebp - 4], edi
je 0x4013a0
mov eax, dword [0x41cf98]
cmp eax, edi
jne 0x401367
mov eax, 0x41cf9c
lea ecx, [ebp - 0x274]
push ecx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x884]
push eax
call ebx
mov eax, dword [0x41ce38]
add esp, 0x10
cmp eax, edi
jne 0x40138c
mov eax, 0x41ce3c
push 0x10030
push eax
lea eax, [ebp - 0x884]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013a5
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c4
lea eax, [ebp - 0x24]
push esi
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push 0x41c4f4
push esi
push str.SoftwareDownloadManagerIDMBI
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401589
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401409
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401589
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40142c
cmp dword [ebp - 0x1c], esi
jne 0x401441
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
jmp 0x401589
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp + 8], esi
lea eax, [ebp - 0x22c]
push 0x104
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x40156b
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x22c]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40156b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x208
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push esi
push 0x41571c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401562
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x434]
push 0x415714
push eax
call edi
lea eax, [ebp - 0x434]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
add esp, 0x14
cmp eax, esi
je 0x4014e9
mov word [eax + 2], si
cmp dword [ebp + 0xc], esi
mov eax, str.ProgramPlugins_
jne 0x4014f8
mov eax, str.Plugins_
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x8c4]
push 0x4156e4
push eax
call edi
add esp, 0x10
push 1
pop ebx
lea eax, [ebp - 0x8c4]
push ebx
push eax
lea eax, [ebp - 0x67c]
push str._sNP_IDM_d.dll
push eax
mov dword [ebp - 0x14], esi
call edi
add esp, 0x10
lea eax, [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401549
cmp ebx, 5
jg 0x401562
jmp 0x40155f
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x67c]
push 0x41cd38
push eax
call fcn.00405ef6
inc ebx
jmp 0x401514
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp + 8]
cmp dword [ebp - 0x10], esi
je 0x40144c
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4028de
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4112a8
call fcn.00410db0
sub esp, 0x214
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareDownloadManager
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40291c
or eax, 0xffffffff
jmp 0x40297a
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x208
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push str.TempPath
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40296f
lea eax, [ebp - 0x220]
push str.DwnlData
push eax
lea eax, [ebp - 0x220]
push 0x4160bc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x220]
push eax
call fcn.004109db
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40298f
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get session user name
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7b8
and dword [ebp - 4], 0
push ebx
push esi
mov esi, 0x114
push edi
push esi
lea eax, [ebp - 0x3a8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3a8], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
mov edi, str._s_sDMCache
je 0x402a9a
cmp dword [ebp - 0x398], 2
jne 0x402a9a
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a9a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x294]
push eax
push 0
push 0
push str.AppData
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a87
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
mov dword [ebp - 8], eax
cmp word [ebp + eax*2 - 0x294], 0x5c
mov eax, 0x41c4f4
je 0x402a5d
mov eax, 0x4150b8
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x5b0]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x5b0]
push eax
call ebx
cmp eax, 0xffffffff
je 0x402a87
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x402b6f
lea eax, [ebp - 0x294]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x402b6a
lea eax, [ebp - 0x294]
push eax
call sub.MSVCRT.dll_wcslen
dec eax
pop ecx
mov dword [ebp - 8], eax
cmp word [ebp + eax*2 - 0x294], 0x5c
mov eax, 0x41c4f4
je 0x402ada
mov eax, 0x4150b8
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x5b0]
push edi
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0x398], 2
jne 0x402b5c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x402b24
lea eax, [ebp - 0x8c]
push str.default_user
push eax
call esi
pop ecx
pop ecx
mov eax, dword [ebp - 8]
cmp word [ebp + eax*2 - 0x294], 0x5c
mov eax, 0x41c4f4
je 0x402b3c
mov eax, 0x4150b8
lea ecx, [ebp - 0x8c]
push ecx
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x5b0]
push str._s_sDMCache_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x5b0]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x402b6f
or eax, 0xffffffff
jmp 0x402bb2
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x7b8]
push str._s_settings.bak
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x7b8]
push eax
call ebx
cmp eax, 0xffffffff
je 0x402bb0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x7b8]
push 0x41cd38
push eax
call fcn.00405ef6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039d1
Capabilities:
Check os version

Disassembly:
mov eax, 0x4112c0
call fcn.00410db0
sub esp, 0x320
push ebx
push esi
push edi
lea eax, [ebp - 0x124]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403a74
cmp dword [ebp - 0x114], 2
jne 0x403a74
cmp dword [ebp - 0x120], 6
jb 0x403a1e
push 1
pop esi
cmp dword [ebp + 8], edi
jne 0x403a2c
push edi
push edi
call fcn.0040314e
pop ecx
pop ecx
lea eax, [ebp - 0x32c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403a74
push esi
lea eax, [ebp - 0x32c]
push dword [ebp + 8]
push eax
call fcn.004036a0
add esp, 0xc
cmp eax, edi
je 0x403a74
cmp dword [ebp + 8], edi
je 0x403a69
push edi
push 1
call fcn.0040314e
pop ecx
pop ecx
push 1
pop eax
jmp 0x403a76
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x403ae1
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
xor esi, esi
push eax
mov dword [edi], esi
xor ebx, ebx
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403be1
cmp dword [ebp - 0x10c], 2
jne 0x403be1
cmp dword [ebp - 0x118], 6
jb 0x403b41
push 1
pop ebx
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..IDMWFP
jmp 0x403b52
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x403b6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
mov dword [edi], eax
jmp 0x403be3
call fcn.00403110
neg eax
sbb eax, eax
lea ecx, [ebp + 8]
and eax, 0x100
push ecx
add eax, 0x20019
cmp ebx, esi
push eax
mov dword [edi], esi
push esi
je 0x403b91
push str.SYSTEMCurrentControlSetServicesIDMWFP
jmp 0x403b96
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x403be1
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push str.Start
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403bd8
push 1
pop eax
cmp dword [ebp - 4], eax
je 0x403bd8
cmp dword [ebp - 4], 2
je 0x403bd8
mov dword [edi], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4043c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareDownloadManagerIDMBI
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404510
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.idman
push dword [ebp - 4]
call esi
push str.services
push dword [ebp - 4]
call esi
push str.svchost
push dword [ebp - 4]
call esi
push str.lsass
push dword [ebp - 4]
call esi
push str.wininit
push dword [ebp - 4]
call esi
push str.mnmsrvc
push dword [ebp - 4]
call esi
push str.wermgr
push dword [ebp - 4]
call esi
push str.dexplore
push dword [ebp - 4]
call esi
push str.msfeedssync
push dword [ebp - 4]
call esi
push str.navapw32
push dword [ebp - 4]
call esi
push str.vpc32
push dword [ebp - 4]
call esi
push str.SymProxySvc
push dword [ebp - 4]
call esi
push str.morpheus
push dword [ebp - 4]
call esi
push str.ccApp
push dword [ebp - 4]
call esi
push str.avguard
push dword [ebp - 4]
call esi
push str.avgupd
push dword [ebp - 4]
call esi
push str.ccSvcHst
push dword [ebp - 4]
call esi
push str.update
push dword [ebp - 4]
call esi
push str.zlclient
push dword [ebp - 4]
call esi
push str.pcictlui
push dword [ebp - 4]
call esi
push 0x416a24
push dword [ebp - 4]
call esi
push str.avwebgrd
push dword [ebp - 4]
call esi
push str.AvastSvc
push dword [ebp - 4]
call esi
push str.avgnsx
push dword [ebp - 4]
call esi
push str.ekrn
push dword [ebp - 4]
call esi
push str.AdMunch
push dword [ebp - 4]
call esi
push str.TmProxy
push dword [ebp - 4]
call esi
push str.privoxy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret