joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a710
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x418b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 4]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
mov dword [esp + 0x18], 0
call fcn.00416726
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 8], eax
je 0x40a78d
lea eax, [esi + 0x410]
lea ecx, [esi + 0xc]
push eax
lea edx, [esi + 0x40c]
mov dword [eax], 0x400
mov eax, dword [edi]
push ecx
mov ecx, dword [esi]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40a7b0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x40a7f3
lea edx, [esi + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x40c]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 8], 0
pop edi
lea ecx, [esi + 4]
call sub.MFC42.DLL_CString::CString
pop esi
ret

Function at 0x40a850
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x40a893
lea edx, [esi + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x40c]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 8], 0
pop edi
pop esi
ret
Function at 0x40a8a0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x418b6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x518
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x52c]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x524], 0
call fcn.00416726
lea ecx, [esp]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 8], eax
je 0x40a936
lea edx, [esp + 0x410]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x410]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x428], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
or ecx, 0xffffffff
push esi
mov esi, dword [esp + 0x53c]
test eax, eax
push edi
mov dword [esp + 0x530], ecx
je 0x40a975
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [esp + 0x14]
dec ecx
push ecx
mov ecx, dword [esp + 0x420]
push esi
push ecx
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call ebx
mov ecx, dword [esp + 0x538]
push 1
lea edx, [esp + 0x428]
push ecx
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40a9d6
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x420]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov dword [esp + 0x18], 0
lea edx, [esp + 0x424]
push esi
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 8
neg esi
sbb esi, esi
inc esi
test eax, eax
je 0x40aa30
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x420]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x528]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x524
ret
Function at 0x40eca0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40f900
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [0x4247a4]
sub esp, 8
test eax, eax
jne 0x40f93c
call fcn.0040fd20
push 0x41c960
push 0x422f24
call fcn.0040fc90
push 0x41c9a0
push 0x423fa4
call fcn.0040fc90
add esp, 0x10
mov dword [0x4247a4], 1
mov eax, dword [esp + 0xc]
push esi
push edi
push eax
call fcn.0040fa10
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push 0x422f24
push edi
call fcn.0040fae0
mov edx, dword [esp + 0x18]
push edx
call fcn.0040fdf0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
push eax
call fcn.0040fdf0
mov ecx, dword [esp + 0x34]
add esp, 0x18
test ecx, ecx
mov dword [esp + 0xc], eax
je 0x40f9ab
xor esi, esi
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0040fb60
add esp, 8
inc esi
cmp esi, 0x10
jl 0x40f985
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
jmp 0x40f9cd
mov ecx, dword [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov esi, 0xf
lea eax, [esp + 8]
push eax
push esi
call fcn.0040fb60
add esp, 8
dec esi
jns 0x40f9bc
mov ecx, dword [esp + 8]
push ecx
call fcn.0040fdf0
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
push edx
call fcn.0040fdf0
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 0x14]
push 0x423fa4
push eax
call fcn.0040fae0
add esp, 0x14
pop edi
pop esi
add esp, 8
ret

Function at 0x40fa10
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x70
mov edx, dword [esp + 0x74]
mov ecx, 0x20
xor eax, eax
push ebx
push esi
push edi
mov edi, 0x423724
rep stosd dword es:[edi], eax
xor ecx, ecx
movsx eax, byte [ecx + str.91__]
dec eax
mov esi, eax
and esi, 7
sar eax, 3
mov bl, byte [esi*4 + 0x41cc78]
mov al, byte [eax + edx]
test al, bl
setne al
mov byte [esp + ecx + 0xc], al
inc ecx
cmp ecx, 0x38
jl 0x40fa2a
xor edi, edi
movsx ecx, byte [edi + 0x41ca18]
xor eax, eax
xor edx, edx
cmp eax, 0x1c
setge dl
dec edx
mov esi, ecx
and edx, 0xffffffe4
add edx, 0x38
cmp ecx, edx
jl 0x40fa76
lea esi, [ecx - 0x1c]
mov dl, byte [esp + esi + 0xc]
mov byte [esp + eax + 0x44], dl
inc eax
inc ecx
cmp eax, 0x38
jl 0x40fa5e
xor ecx, ecx
movsx eax, byte [ecx + 0x41ca28]
mov dl, byte [esp + eax + 0x43]
test dl, dl
je 0x40fac5
mov eax, 0x2aaaaaab
mov ebx, 6
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
lea esi, [edx + edi*8 + 0x423724]
cdq
idiv ebx
mov al, byte [esi]
mov edx, dword [edx*4 + 0x41cc78]
sar edx, 2
or al, dl
mov byte [esi], al
inc ecx
cmp ecx, 0x30
jl 0x40fa87
inc edi
cmp edi, 0x10
jl 0x40fa55
pop edi
pop esi
pop ebx
add esp, 0x70
ret
Function at 0x40fd20
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x28
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x41cc58]
dec edx
cmp edx, ecx
je 0x40fd3b
inc eax
cmp eax, 0x20
jl 0x40fd27
jmp 0x40fd3f
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x20
jl 0x40fd25
push ebx
lea eax, [esp + 0xc]
push ebp
push esi
mov dword [esp + 0x10], eax
push edi
mov dword [esp + 0x10], 0
mov eax, 0x4237a4
xor esi, esi
mov ebx, eax
mov eax, esi
mov ecx, esi
sar eax, 1
and ecx, 1
and eax, 0xf
shl ecx, 4
mov edx, esi
or eax, ecx
mov ecx, dword [esp + 0x10]
and edx, 0x20
or eax, edx
xor edi, edi
xor edx, edx
movsx ebp, byte [ecx + eax + 0x41ca58]
mov eax, 8
mov ecx, edx
sar eax, cl
test ebp, eax
je 0x40fdae
mov ecx, dword [esp + 0x14]
mov al, byte [ecx + edx]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edi, eax
inc edx
cmp edx, 4
jl 0x40fd8a
mov dword [ebx], edi
inc esi
add ebx, 4
cmp esi, 0x40
jl 0x40fd62
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esi, 0x40
add edx, 4
cmp ebx, 0x423fa4
mov dword [esp + 0x10], esi
mov eax, ebx
mov dword [esp + 0x14], edx
jl 0x40fd5e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x410a60
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4193b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0xc]
cmp esi, edi
mov dword [esp + 0x18], esi
je 0x410a95
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], edi
call fcn.004106f0
test eax, eax
jle 0x410b34
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], edi
mov esi, dword [esp + 0x3c]
mov ecx, ebx
push esi
call fcn.00410720
test al, al
je 0x410ac8
cmp esi, edi
jne 0x410b15
mov esi, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
add esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x410b15
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esi], ebx
call fcn.00416726
mov eax, dword [esp + 0x34]
push 0
push 4
push 0
push 0
push esi
push 0x410ba0
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_AfxBeginThread
mov edi, eax
test edi, edi
jne 0x410b5f
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc edi
add edx, 0x24
mov ecx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
call fcn.004106f0
cmp edi, eax
jl 0x410ab4
mov esi, dword [esp + 0x18]
test esi, esi
mov dword [esp + 0x24], 0xffffffff
je 0x410b47
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
mov ecx, dword [edi + 0x2c]
push 0
mov dword [esi + 0x18], ecx
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
test ecx, ecx
je 0x410b92
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [esp + 0x14]
jmp 0x410b4a
Function at 0x410d00
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4193f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 0xc]
xor esi, esi
cmp edi, esi
mov dword [esp + 0x14], edi
je 0x410d34
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [esp + 0x10], esi
call fcn.004106f0
test eax, eax
jle 0x410dbc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], esi
mov esi, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
add esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x410d9c
mov ecx, dword [esi + 0x1c]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x18]
xor edi, edi
test eax, eax
je 0x410d98
inc edi
cmp edi, 0xa
jg 0x410d98
push 0x64
call ebp
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x410d87
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc esi
add edx, 0x24
mov ecx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
call fcn.004106f0
cmp esi, eax
jl 0x410d4e
pop ebp
test edi, edi
mov dword [esp + 0x20], 0xffffffff
je 0x410dcf
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4127a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4194f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CClientDC::CClientDC
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 4]
mov ecx, esi
push eax
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0x16
push ecx
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowPos
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00416e76
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x414090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x419830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 6]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_AfxParseURL
test eax, eax
jne 0x41411c
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], al
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, ecx
mov dword [esi + 0x1c], edx
je 0x414135
lea eax, [esp + 0xc]
push eax
call fcn.00416708
mov ecx, dword [esp + 8]
mov eax, dword [esi + 0x14]
push edi
lea edi, [esi + 0x14]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x414161
mov dx, word [esi + 0x18]
cmp dx, word [esp + 0xa]
jne 0x414161
mov eax, dword [esi + 8]
test eax, eax
jne 0x41417d
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.00416708
mov cx, word [esp + 0xa]
mov word [esi + 0x18], cx
mov ecx, esi
call fcn.00413e50
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x4143c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4198c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 1
call fcn.004166fc
mov edi, dword [esp + 0x3c]
xor esi, esi
mov byte [esp + 0x30], 2
mov ebp, dword [edi + 8]
test ebp, ebp
jle 0x414472
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0x18]
push 0
mov eax, dword [eax + esi*4]
push ecx
push 0x422b20
push eax
call fcn.004148e0
mov eax, dword [esp + 0x30]
add esp, 0x14
test eax, eax
jle 0x41446d
mov ecx, dword [esp + 0x18]
push 0x422b1c
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x41446d
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
je 0x41445f
push 0x422b18
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::operator
inc esi
cmp esi, ebp
jl 0x41440f
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00416714
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4147e0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x41995f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push 0x422d8c
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_1
mov ebp, dword [esp + 0x2c]
push 0
push ebp
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4148a1
push edi
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x414897
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x42274c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x414897
mov eax, dword [esp + 0x14]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
lea ecx, [esp + 0x1c]
push str._d._d._d._d
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x18
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
mov esi, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00416714
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x414b80
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x414bd2
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
pop edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x414bf0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x408
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x414c18
xor eax, eax
add esp, 0x408
ret
mov eax, dword [esp + 0x40c]
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414c4e
xor eax, eax
add esp, 0x408
ret
push ebx
push esi
mov esi, dword [esp + 0x418]
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x414c93
test cl, cl
je 0x414c7f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x414c93
add eax, 2
add esi, 2
test cl, cl
jne 0x414c5b
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop esi
mov eax, ecx
pop ebx
add esp, 0x408
ret
sbb eax, eax
pop esi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop ebx
add esp, 0x408
ret

Function at 0x414d30
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [esp + 0x18], ebx
call edi
mov ecx, dword [esp + 0xc]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
push ebx
call edi
mov edi, eax
cmp edi, ebx
je 0x414dd7
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x414d85
test dword [esi + 0xc], 0x100000
jne 0x414d9d
mov eax, dword [esi + 4]
push eax
jmp 0x414d97
cmp ebp, 1
jne 0x414d9d
test dword [esi + 0xc], 0x100000
je 0x414d9d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push 0
push edi
call ebx
push esi
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x14]
push eax
call sub.MFC42.DLL_operatornew
add esp, 8
lea ecx, [esp + 0x10]
mov esi, eax
push ecx
push esi
push edi
call ebx
test eax, eax
jne 0x414d72
mov ebx, 1
pop ebp
test esi, esi
je 0x414de4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x414df0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 1
call fcn.00414d30
add esp, 4
lea eax, [esp]
push 0
push 0x21
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x104
ret

Function at 0x414e20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 0
call fcn.00414d30
add esp, 4
lea eax, [esp]
push 0
push 0x20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x104
ret