joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x21c], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.0041b1d0
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.004046c1
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4048cd
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp - 0x214]
neg esi
sbb esi, esi
and esi, 3
inc esi
push esi
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4048af
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4048cd
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x4048cd
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
xor eax, eax
inc eax
mov word [esi + 8], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00416782
leave
ret 0xc

Function at 0x4048de
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x21c], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.0041b1d0
add esp, 0xc
push 1
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.004046c1
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4049bf
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp - 0x214]
neg esi
sbb esi, esi
and esi, 3
inc esi
push esi
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4049a1
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4049bf
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x4049bf
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
xor eax, eax
inc eax
mov word [esi + 8], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00416782
leave
ret 0xc
Function at 0x4049d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x4284c0
call fcn.0042437a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov edi, edx
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x21c], esi
call fcn.0041b1d0
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.004046c1
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404b36
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push esi
push 0x42e92c
push edi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x220], esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 0x21c]
call edi
test eax, eax
je 0x404a96
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404b36
add dword [ebp - 0x220], 0xa
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416f61
push dword [ebp - 0x220]
mov ebx, eax
push esi
push ebx
call fcn.0041b1d0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x228]
push eax
push esi
push dword [ebp - 0x224]
push dword [ebp - 0x21c]
call edi
cmp eax, esi
jne 0x404a85
mov edi, dword [ebp - 0x22c]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
pop eax
mov word [edi], ax
cmp ebx, esi
jne 0x404b40
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], esi
lea esi, [ebp - 0x224]
call fcn.00402a14
push dword [ebp - 0x21c]
mov dword [edi + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x224]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
call fcn.004243fd
ret 4
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x224], eax
cmp eax, esi
jne 0x404b09
push 0x8007000e
call fcn.004011b7
int3
Function at 0x404b5c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x4284c0
call fcn.0042437a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov edi, edx
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x21c], esi
call fcn.0041b1d0
add esp, 0xc
push 1
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.004046c1
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404cc3
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push esi
push 0x42e92c
push edi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x220], esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 0x21c]
call edi
test eax, eax
je 0x404c23
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404cc3
add dword [ebp - 0x220], 0xa
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416f61
push dword [ebp - 0x220]
mov ebx, eax
push esi
push ebx
call fcn.0041b1d0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x228]
push eax
push esi
push dword [ebp - 0x224]
push dword [ebp - 0x21c]
call edi
cmp eax, esi
jne 0x404c12
mov edi, dword [ebp - 0x22c]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
pop eax
mov word [edi], ax
cmp ebx, esi
jne 0x404ccd
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], esi
lea esi, [ebp - 0x224]
call fcn.00402a14
push dword [ebp - 0x21c]
mov dword [edi + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x224]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
call fcn.004243fd
ret 4
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x224], eax
cmp eax, esi
jne 0x404c96
push 0x8007000e
call fcn.004011b7
int3
Function at 0x4052b8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x4053d7
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4053d7
xor eax, eax
cmp dword [ebp - 0x88], 2
push ebx
sete al
push esi
xor esi, esi
inc esi
push edi
mov edi, dword [ebp - 0x94]
test eax, eax
je 0x405328
cmp edi, 5
jne 0x405328
cmp dword [ebp - 0x90], esi
jne 0x405328
mov ebx, esi
jmp 0x40532a
xor ebx, ebx
xor edx, edx
push 6
pop ecx
cmp eax, edx
je 0x40534d
cmp edi, ecx
jne 0x405341
cmp dword [ebp - 0x90], edx
jne 0x40534d
mov edx, esi
xor eax, eax
xor esi, esi
cmp edi, ecx
jb 0x40535d
push 7
jmp 0x4053a1
cmp edi, ecx
jne 0x405341
cmp dword [ebp - 0x90], esi
jne 0x405341
mov eax, esi
jmp 0x405343
test eax, eax
je 0x405365
mov esi, ecx
jmp 0x4053be
test edx, edx
je 0x40536d
push 5
jmp 0x4053a1
test ebx, ebx
je 0x4053be
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Service_Pack_1
lea eax, [ebp - 0x84]
push eax
call esi
test eax, eax
jne 0x40538d
push 2
jmp 0x4053a1
push str.Service_Pack_2
lea eax, [ebp - 0x84]
push eax
call esi
test eax, eax
jne 0x4053a4
push 3
pop esi
jmp 0x4053be
push str.Service_Pack_3
lea eax, [ebp - 0x84]
push eax
call esi
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffffd
add esi, 4
mov edi, dword [ebp - 0x9c]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x16
pop eax
mov dword [edi + 8], esi
mov word [edi], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00416782
leave
ret 4

Function at 0x40541c
Capabilities:
Query environment variable

Disassembly:
push 0x210
mov eax, 0x428404
call fcn.0042437a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0041b1d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
pop eax
mov word [edi], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x40548e
push 0x8007000e
call fcn.004011b7
and dword [ebp - 4], 0
lea esi, [ebp - 0x21c]
call fcn.00402a14
mov dword [edi + 8], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
call fcn.004243fd
ret
Function at 0x4054b8
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, ecx
test edi, edi
je 0x4055a2
push esi
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0041b1d0
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0041b1d0
push ebx
push 0x42eab0
lea eax, [ebp - 0x20c]
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
movzx eax, word [ebx]
add esp, 0x28
pop esi
cmp eax, 0x5c
je 0x405533
cmp eax, 0x2f
jne 0x405576
push 0x104
lea eax, [ebp - 0x414]
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x405576
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
push edi
inc bl
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [edi], ax
movzx eax, bl
mov word [edi + 8], ax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00416782
leave
ret

Function at 0x4055af
Capabilities:
Encode data using xor

Disassembly:
push 8
mov eax, 0x428bb2
call fcn.0042437a
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x4056aa
cmp dword [ebp + 8], ebx
je 0x4055f5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x4055f5
lea edi, [eax + eax]
mov eax, edi
call fcn.00421730
mov esi, esp
push 3
push edi
push dword [ebp + 8]
call fcn.00401184
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
push eax
call fcn.00402a86
mov dword [ebp - 0x14], eax
add eax, 0x14
push eax
call fcn.00416f61
push dword [ebp - 0x14]
mov edi, eax
push 0
push edi
call fcn.0041b1d0
add esp, 0x14
push ebx
call esi
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x405637
cmp eax, ecx
jle 0x405637
xor byte [ecx + ebx], 0x50
inc ecx
cmp ecx, eax
jl 0x40562e
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
mov eax, edi
call fcn.00402aec
mov esi, dword [ebp + 0x10]
lea ebx, [eax - 1]
mov eax, dword [ebp - 0x14]
add esp, 0xc
neg ebx
push esi
sbb bl, bl
mov byte [edi + eax], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
inc bl
sete al
dec eax
and eax, 0xfffffffd
add eax, 0xb
mov word [esi], ax
xor eax, eax
mov word [esi + 8], ax
test bl, bl
je 0x40569f
push edi
lea esi, [ebp - 0x14]
call fcn.00402a2c
and dword [ebp - 4], 0
call fcn.00402a14
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x4056aa
push edi
call fcn.00416897
pop ecx
xor eax, eax
lea esp, [ebp - 0x24]
call fcn.004243fd
ret 0xc
Function at 0x405718
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 1
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setge bl
test esi, esi
je 0x405750
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
movzx eax, bl
mov word [esi + 8], ax
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x405757
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
test esi, esi
je 0x405813
and dword [ebp - 0x234], 0
push ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4057a9
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [esi], ax
xor eax, eax
mov word [esi + 8], ax
jmp 0x405812
push edi
lea eax, [ebp - 0x230]
push eax
mov edi, 0x22c
push ebx
mov dword [ebp - 0x230], edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4057f0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x405823
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x230], edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4057c5
mov edi, dword [ebp - 0x234]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x16
pop eax
mov dword [esi + 8], edi
mov word [esi], ax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00416782
leave
ret 4
mov edi, dword [ebp - 0x228]
jmp 0x4057fa

Function at 0x40582b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne byte [ebp + 0xb]
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], 0x103
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x103
jne 0x40587e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 8]
jne 0x405856
pop edi
test ebx, ebx
je 0x405898
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [ebx], ax
movzx eax, byte [ebp + 0xb]
mov word [ebx + 8], ax
xor eax, eax
leave
ret 4

Function at 0x40589e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
mov eax, 0xc80000
je 0x4058b1
mov eax, 0xca0000
push eax
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push 0xfffffffffffffff6
push dword [esi]
call dword [sym.imp.USER32.dll_SetClassLongA]
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x4058f0
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0xb
pop eax
mov word [edi], ax
xor eax, eax
mov word [edi + 8], ax
xor eax, eax
pop ebp
ret 4
Function at 0x4058f6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0xef330]
push dword [ebp + 8]
shl eax, 0xc
lea eax, [eax + esi + 0x8b19c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ecx, dword [esi + 0xef330]
xor eax, eax
push eax
push eax
shl ecx, 0xc
lea ecx, [ecx + esi + 0x8b19c]
push ecx
push 0x40594e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0xef330]
mov dword [esi + ecx*4 + 0xef1a0], eax
inc dword [esi + 0xef330]
xor eax, eax
pop ebp
ret 4

Function at 0x405dad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [esi + 0xef334], edi
je 0x405dd0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x16
pop eax
mov word [ebx], ax
mov dword [ebx + 8], edi
jmp 0x405ea3
mov eax, dword [esi + 0x8b198]
push dword [ebp + 0xc]
imul eax, eax, 0x1624
mov dword [eax + esi + 0xb88], edi
mov eax, dword [esi + 0x8b198]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
imul eax, eax, 0x1624
lea eax, [eax + esi + 0x1b8c]
push eax
call edi
mov eax, dword [esi + 0x8b198]
push dword [ebp + 8]
imul eax, eax, 0x1624
lea eax, [eax + esi + 0xb8c]
push eax
call edi
mov eax, dword [esi + 0x8b198]
push dword [ebp + 0x10]
imul eax, eax, 0x1624
lea eax, [eax + esi + 0x1d98]
push eax
call edi
mov eax, dword [esi + 0x8b198]
push dword [ebp + 0x14]
imul eax, eax, 0x1624
lea eax, [eax + esi + 0x1fa0]
push eax
call edi
mov eax, dword [esi + 0x8b198]
mov ecx, dword [esi]
imul eax, eax, 0x1624
mov dword [eax + esi + 0x1d94], ecx
mov ecx, dword [esi + 0x8b198]
imul ecx, ecx, 0x1624
xor eax, eax
push eax
push eax
lea ecx, [ecx + esi + 0xb88]
push ecx
push 0x4059d8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x16
pop eax
mov word [ebx], ax
mov eax, dword [esi + 0x8b198]
mov dword [ebx + 8], eax
inc dword [esi + 0x8b198]
xor eax, eax
pop edi
pop ebp
ret 0x10
Function at 0x405ebe
Capabilities:
Create http request

Disassembly:
push 0x21c
mov eax, 0x4283d1
call fcn.0042437a
mov ebx, edx
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x21c], ebx
cmp ebx, esi
je 0x406047
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
push esi
push esi
push esi
push esi
push edi
push eax
mov dword [ebp - 0x224], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
cmp edi, esi
jne 0x405f15
push dword [ebp - 0x224]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x406047
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.0041b1d0
add esp, 0xc
push esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x2f
push edi
mov dword [ebp - 0x228], 0x208
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x220], eax
call edi
push dword [ebp - 0x224]
call edi
push esi
push esi
push dword [ebp - 0x220]
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x218]
push eax
call edi
xor ecx, ecx
test eax, eax
setg cl
and dword [ebp - 0x220], ecx
je 0x405fe2
mov ebx, str.filename_
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push ebx
mov dword [ebp - 0x224], eax
call edi
mov ecx, dword [ebp - 0x224]
lea ebx, [ecx + eax*2]
cmp ebx, esi
jne 0x405fca
mov dword [ebp - 0x220], esi
jmp 0x405fdc
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov ebx, dword [ebp - 0x21c]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
cmp dword [ebp - 0x220], esi
je 0x40603b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x406012
push 0x8007000e
call fcn.004011b7
mov dword [ebp - 4], esi
push 8
pop eax
lea esi, [ebp - 0x21c]
mov word [ebx], ax
call fcn.00402a14
mov dword [ebx + 8], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x406047
push 0xb
pop eax
mov word [ebx], ax
xor eax, eax
mov word [ebx + 8], ax
xor eax, eax
call fcn.004243fd
ret
Function at 0x406075
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x437084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x94
push edi
xor ebx, ebx
lea eax, [ebp - 0x98]
push ebx
push eax
call fcn.0041b1d0
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40617a
cmp dword [ebp + 8], 0x64
jl 0x406129
cmp dword [ebp - 0x94], 6
ja 0x4060d7
jne 0x4060f8
cmp dword [ebp - 0x90], 1
jb 0x4060f8
mov eax, dword [esi + 0xef33c]
mov ecx, dword [eax]
push ebx
push dword [esi]
push eax
call dword [ecx + 0x28]
mov eax, dword [esi + 0xef33c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0xef33c], ebx
mov eax, dword [esi]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xac], 0x14
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0x9c], ebx
call dword [sym.imp.USER32.dll_FlashWindowEx]
jmp 0x40617a
cmp dword [ebp - 0x94], 6
ja 0x40613d
jne 0x40617a
cmp dword [ebp - 0x90], 1
jb 0x40617a
lea edi, [esi + 0xef33c]
cmp dword [edi], ebx
jne 0x40615b
push edi
push 0x42a5c0
push 0x17
push ebx
push 0x42a5e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [edi]
mov ecx, dword [eax]
push 2
push dword [esi]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp + 8]
mov edi, dword [edi]
mov ecx, dword [edi]
push ebx
push 0x64
cdq
push edx
push eax
push dword [esi]
push edi
call dword [ecx + 0x24]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00416782
leave
ret 4
Function at 0x4062c2
Capabilities:
Get common file path

Disassembly:
push 0x430
mov eax, 0x428b82
call fcn.0042437a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0041b1d0
add esp, 0xc
lea edi, [ebp - 0x42c]
call fcn.004066cd
lea ecx, [ebp - 0x428]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
push str.S_1_5_32_544
push dword [ebp - 0x428]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x40635b
push eax
push 0x10
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x424]
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4063c7
push 0x42e8b0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
jmp 0x4063c7
xor eax, eax
push esi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.0041b1d0
push dword [ebp - 0x428]
lea eax, [ebp - 0x420]
push str.HKU_sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x43c]
push eax
mov edx, str.Desktop
lea ecx, [ebp - 0x420]
call fcn.004049d0
push dword [ebp - 0x434]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x218]
push eax
call esi
push 0x42e8b0
lea eax, [ebp - 0x218]
push eax
call esi
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
pop eax
mov word [ebx], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x424], eax
test eax, eax
jne 0x4063f5
push 0x8007000e
call fcn.004011b7
and dword [ebp - 4], 0
lea esi, [ebp - 0x424]
call fcn.00402a14
mov dword [ebx + 8], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x424]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
call fcn.004243fd
ret 4