joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502730
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x5615c8
push ecx
call fcn.004f87e0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.005018d0
test eax, eax
jne 0x502760
mov eax, esi
jmp fcn.00501d60
ret
Function at 0x502b70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x5925f0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3d0]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x502bff
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.004cfe50
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x502c3a
push str.Received_too_short_packet
push ebx
call fcn.004f8870
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca9d7
add esp, 0x88
ret
mov eax, edi
call fcn.00501a50
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x502c53
jmp dword [eax*4 + 0x502d40]
cmp edx, 4
jle case.0x502c53.4
mov eax, edi
call fcn.00501a60
movzx ecx, word [esi + 0x40]
add ecx, 1
cmp cx, ax
jne case.0x502c53.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.004f8b50
mov edi, eax
add esp, 0x10
test edi, edi
je 0x502ca8
mov ecx, 5
mov eax, esi
call fcn.00502af0
mov eax, edi
jmp 0x502c21
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.0050f740
jmp 0x502d14
mov eax, edi
call fcn.00501a60
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x5615c8
push ebx
mov dword [esi + 8], edx
call fcn.004f87e0
jmp 0x502d14
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.00501b00
add esp, 0xc
test eax, eax
je case.0x502c53.4
jmp 0x502c21
push str.Internal_error:_Unexpected_packet
push 0x55fe2c
push ebx
call fcn.004f8870
add esp, 0xc
push ebp
call fcn.0050f800
add esp, 4
test eax, eax
je 0x502c1f
mov ecx, 5
mov eax, esi
call fcn.00502af0
mov eax, 0x2a
jmp 0x502c21

Function at 0x504ab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x504af4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004f8870
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.005049a0
add esp, 4
pop esi
pop ecx
ret
Function at 0x506140
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x5925f0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.004f8cb0
add esp, 0xc
test eax, eax
jl 0x5061a9
mov ecx, 0x3e8
cmp eax, ecx
jge 0x506180
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.0050e1c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x506244
test eax, eax
jne 0x5061ce
push 1
push eax
push edi
call fcn.004f8cb0
add esp, 0xc
test eax, eax
jge 0x506175
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.004f8870
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ca9d7
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5061fe
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.004f94c0
add esp, 8
cmp ebp, 0xffffffff
jne 0x506214
push str.Error_accept__ing_server_connect
jmp 0x506249
push str.Connection_accepted_from_server_n
push edi
call fcn.004f87e0
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.00511d80
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ca9d7
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.004f8870
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.004ca9d7
add esp, 0x18
ret
Function at 0x50e1c0
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x50e204
cmp ebp, ebx
jne 0x50e204
mov eax, dword [esp + 0x334]
push eax
call fcn.0050e190
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x50e21f
mov esi, edi
call fcn.004fd5c0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x50e253
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x50e29a
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x50e282
cmp dword [esp + eax*4 + 0x24], ebp
je 0x50e282
add eax, 1
cmp eax, ecx
jb 0x50e275
cmp eax, ecx
jne 0x50e294
cmp ecx, 0x40
jae 0x50e294
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x50e29a
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, ecx
lea ecx, [ecx]
xor eax, eax
cmp edi, eax
jle 0x50e2e1
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x50e2eb
jne 0x50e2eb
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x50e355
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x50e31e
cmp eax, 0x2714
jne 0x50e359
test edi, edi
jle 0x50e2b0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004fd5c0
push edx
push eax
call fcn.004fd5f0
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x50e2b0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x50e367
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x50e376
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x50e3ad
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50e39b
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50e3ad
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x50e3e0
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50e3ce
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50e3e0
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x50ff30
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x50ff3f
jmp dword [ecx*4 + 0x50ff94]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x510120
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5925f0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004e32b6
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x510185
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x510185
lea edx, [esp]
push edx
call dword [0x593ca4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ca9d7
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004ca9d7
add esp, 0x108
ret
jmp 0x510120

Function at 0x5101a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5925f0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004e32b6
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x510185
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x510185
lea edx, [esp]
push edx
call dword [0x593ca4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ca9d7
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004ca9d7
add esp, 0x108
ret
jmp 0x510120

Function at 0x512c10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x5158a9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0051583e
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004caa30
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x5158f8
cmp dword [ebp - 0x1c], 5
jb 0x515910
jmp 0x51590c
cmp dword [ebp - 0x10], 1
jne 0x515910
cmp dword [ebp - 0x1c], 4
ja 0x51590c
jne 0x515910
cmp dword [ebp - 0x18], 0
jbe 0x515910
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x566ba4
call fcn.0051572f
test eax, eax
jge 0x515931
mov byte [0x5999c0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ca9d7
add ebp, 0x78
leave
ret
Function at 0x402840
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, dword [esp + 0x11c]
test esi, esi
je 0x402941
mov ebx, dword [esp + 0x120]
test ebx, ebx
jle 0x402941
push ebp
push str.Shell32.dll
xor ebp, ebp
call fcn.00402950
add esp, 4
cmp eax, 0x50000
jb 0x4028a2
push ebx
push esi
push 0x26
call fcn.00404690
add esp, 0xc
test eax, eax
je 0x402935
mov ebp, 1
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402935
mov ecx, ebx
push edi
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x10]
and ecx, 3
mov dword [esp + 0x14], ebx
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
push 0
push str.ProgramFilesDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x40292a
mov eax, dword [esp + 0x14]
mov ebp, 1
cmp eax, 2
jne 0x40292a
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40292a
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x110
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x402c30
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x8060
call fcn.0042d040
push ebx
mov ebx, dword [esp + 0x8068]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 0xc], edi
je 0x402dcd
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x7fff
jge 0x402dcd
push ebx
call fcn.004029d0
mov esi, eax
add esp, 4
cmp esi, edi
jbe 0x402db9
mov dword [esp + 0x14], edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0x20], eax
lea ebp, [esi + 1]
mov dword [esp + 0x24], eax
push ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x44
call fcn.0043c46a
mov edi, eax
add esp, 4
test edi, edi
je 0x402cc2
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, ebx
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x8078]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x402cde
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402d05
push ebp
call fcn.0043c46a
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x402d09
push edi
push ebp
call esi
push 0x5c
push ebp
call fcn.0042cfca
add esp, 8
test eax, eax
je 0x402d09
mov byte [eax], 0
jmp 0x402d09
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x70]
push 0x4521e0
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x70]
push edi
push edx
call esi
lea eax, [esp + 0x70]
push 0x4521e0
push eax
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x70]
push ecx
push edx
call esi
test ebx, ebx
je 0x402d4a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402d4c
mov ebx, ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push ebx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402d8e
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x402d92
mov esi, dword [esp + 0x10]
test ebp, ebp
je 0x402d9f
push ebp
call fcn.0043c493
add esp, 4
test edi, edi
pop ebp
je 0x402dad
push edi
call fcn.0043c493
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x8060
ret
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x8060
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x8060
ret
Function at 0x404470
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
mov eax, dword [0x453250]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp ebx, esi
je 0x404658
cmp dword [ebp + 0xc], esi
je 0x404658
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x124]
lea edx, [ebp - 0x124]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x32c]
mov dword [ebp + 8], esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x32c]
push eax
push ecx
lea eax, [ebp + 8]
push edx
push eax
push ebx
call fcn.0042d1fb
add esp, 0x14
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0043c05f
lea edx, [ebp - 0x124]
lea ecx, [ebp - 0x14]
push edx
call fcn.0043c2b2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], esi
jle 0x40454b
push eax
call fcn.004032b0
add esp, 4
test eax, eax
je 0x404658
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00411330
add esp, 8
test eax, eax
je 0x404658
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x18]
mov dword [ebp + 0xc], esi
push ecx
push 0x44b348
push 1
push esi
push 0x44b358
mov byte [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x404604
mov eax, dword [ebp - 0x18]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
push edx
push 0x44b368
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, esi
jl 0x4045f8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0042d040
mov dword [ebp - 0x10], esp
mov eax, esp
push esi
push ebx
push eax
call fcn.0043c427
mov ecx, dword [ebp - 0x20]
push 1
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x18]
test eax, eax
jl 0x4045e6
mov dword [ebp + 0xc], 1
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x20], 0
xor esi, esi
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0043bf22
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0043bf22
mov eax, dword [ebp + 0xc]
jmp 0x404675
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0043bf22
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0043bf22
xor eax, eax
lea esp, [ebp - 0x338]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404690
Capabilities:
Get common file path
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x118
push ebp
push esi
mov esi, dword [esp + 0x128]
test esi, esi
je 0x404809
mov ebp, dword [esp + 0x12c]
test ebp, ebp
jle 0x404809
push ebx
lea eax, [esp + 0x10]
push edi
push eax
xor ebx, ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x404729
mov edx, dword [esp + 0x12c]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x404717
mov ecx, ebp
mov edi, esi
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x404708
mov ebx, 1
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
jne 0x4047fc
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esp + 0x12c], 0x19
jne 0x404758
lea edx, [esp + 0x24]
push str.Common_Desktop
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4047fc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4047fc
mov ecx, ebp
mov edi, esi
mov edx, ecx
mov dword [esp + 0x1c], ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x24]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4047f1
mov eax, dword [esp + 0x20]
mov ebx, 1
cmp eax, 2
jne 0x4047f1
lea ecx, [esp + 0x24]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4047f1
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x118
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x118
ret

Function at 0x404a40
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x456abc]
test eax, eax
je 0x404a7c
mov eax, dword [eax]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x404a7c
mov ecx, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push 0x200
push 0x456840
push 0x456af4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x404a7c
mov eax, 0x456840
ret
xor eax, eax
ret
Function at 0x404b90
Capabilities:
Identify system language via api

Disassembly:
push 0xffffffffffffffff
push 0x444ab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x453250]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], ebx
push 0x3ea
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0043c49e
mov ecx, dword [0x456abc]
cmp ecx, ebx
je 0x404be8
mov eax, dword [0x456ac0]
push eax
call fcn.0043c00f
mov eax, dword [esi + 0xe8]
lea ebp, [esi + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x404c50
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00404a40
add esp, 8
cmp eax, ebx
je 0x404c50
mov ecx, dword [esp + 0x28]
push eax
call fcn.0043c05f
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], bl
call fcn.0043bf22
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0043bf22
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, ebp
call fcn.0043bead
push 0x9c9
lea ecx, [esp + 0x10]
mov dword [esi + 0xc0], ebx
call fcn.0043c49e
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push edx
push eax
call fcn.00404a80
add esp, 8
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
je 0x404c91
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x404c97
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, eax
and eax, 0xffff
lea ecx, [esp + 0x10]
push eax
push str._04x
push ecx
and edi, 0x3ff
call fcn.0043aebf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00404a40
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x404d2a
mov ecx, edi
lea edx, [esp + 0x10]
and ecx, 0xffff
push ecx
push str._04x
push edx
call fcn.0043aebf
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.00404a40
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x404d2a
cmp di, bx
je 0x404d26
push ebx
lea edx, [esp + 0x14]
push str._04x
push edx
call fcn.0043aebf
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.00404a40
add esp, 0x14
mov esi, eax
cmp esi, ebx
je 0x404d36
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0043c00f
mov ecx, dword [esp + 0x2c]
push esi
call fcn.0043c05f
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0043bf22
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.0043bf22
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4