joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40128a
Capabilities:
Terminate process

Disassembly:
jmp 0x40abf5
push 0x14
push 0x4197c0
call fcn.0040118b
push 1
call fcn.0040154b
pop ecx
test al, al
je 0x40ab16
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004015af
mov byte [ebp - 0x24], al
mov eax, dword [0x41b8f8]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40ab16
test eax, eax
jne 0x40aa3a
mov dword [0x41b8f8], ecx
push 0x4119b0
push 0x4115a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40aa1d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40ab06
push 0x41149c
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41b8f8], 2
jmp 0x40aa3f
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004012d5
pop ecx
call fcn.0040107d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40aa70
push esi
call fcn.0040121c
pop ecx
test al, al
je 0x40aa70
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.00401050
mov esi, eax
cmp dword [esi], edi
je 0x40aa8e
push esi
call fcn.0040121c
pop ecx
test al, al
je 0x40aa8e
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00401172
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push esi
push eax
push edi
push 0x400000
call fcn.0040116d
mov esi, eax
call fcn.004015e1
test al, al
je 0x40ab1d
test bl, bl
jne 0x40aabc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004012df
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40ab06
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040134d
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004016f9
jmp 0x40a9b0

Function at 0x4015e1
Capabilities:
Parse pe header

Disassembly:
jmp 0x40bcaa
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40bcea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bcea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bcea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40bcea
cmp dword [ecx + 0x74], 0xe
jbe 0x40bcea
cmp dword [ecx + 0xe8], 0
je 0x40bcea
mov al, 1
ret
xor al, al
ret
Function at 0x40a5f8
Capabilities:
Delete registry key

Disassembly:
push 0x428
mov eax, 0x4adaf7
call fcn.0046c44c
mov edi, ecx
push str.LaunchSafeCleanup...
lea ecx, [ebp - 0x424]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x424]
push ebx
push 2
pop esi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00414d4f
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov dword [edi + 0xfc], ebx
cmp dword [edi + 0xf4], ebx
je 0x40a692
push str._ArmCleanup
lea ecx, [ebp - 0x424]
mov byte [ebp - 0x425], bl
call fcn.00402829
lea edx, [ebp - 0x425]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x424]
call fcn.00438ac3
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
jmp 0x40a74d
call fcn.00452601
push eax
lea ecx, [ebp - 0x424]
call fcn.00402899
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], esi
call fcn.00442bb0
test eax, eax
je 0x40a7f0
mov esi, 0x208
mov dword [ebp - 0x430], ebx
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00484bc0
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00484bc0
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x420]
lea ecx, [ebp - 0x430]
call fcn.00439422
add esp, 0x1c
test eax, eax
je 0x40a7f0
push str._ArmCleanup
lea ecx, [ebp - 0x42c]
call fcn.00402829
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x424]
call fcn.0043919c
pop ecx
mov ecx, dword [ebp - 0x42c]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00402e64
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.00402e64
test esi, esi
jne 0x40a773
mov esi, ebx
jmp 0x40a76b
cmp esi, 0x14
jge 0x40a773
push 0xc8
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0xfc], ebx
je 0x40a75a
cmp dword [edi + 0xfc], ebx
jne 0x40a7b0
push str.launch_cleanup_not_confirmed
lea ecx, [ebp - 0x42c]
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x42c]
mov dword [ebp - 4], 4
pop ecx
call fcn.00414d4f
pop ecx
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x434]
push eax
push 0xf003f
push ebx
push 0x4ce610
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a7fe
push str.Cleanup
push dword [ebp - 0x434]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a7fe
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.0046c3f6
ret
Function at 0x40d87d
Capabilities:
Write file on windows

Disassembly:
push 0x9c
mov eax, 0x4ae14e
call fcn.0046c44c
mov esi, ecx
mov eax, 0xfeff
xor ebx, ebx
mov word [ebp - 0x78], ax
mov eax, vtable.ATL::CAccessToken.0
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push 0x4d2d0c
push eax
call fcn.0040de7e
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call fcn.0040dd97
push ecx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040dd11
lea eax, [ebp - 0x71]
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x8c]
call fcn.0040dcd9
push ebx
cmp byte [ebp - 0x71], bl
je 0x40d963
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], 0xc
push eax
push 1
push str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU_
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x40d9bd
push ebx
push 0x80
push 1
lea eax, [ebp - 0xa8]
push eax
jmp 0x40d96b
push 0x80
push 1
push ebx
push ebx
push 0x40000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d9bd
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d9bd
push ebx
lea eax, [ebp - 0x7c]
mov edi, str._SESSION_
push eax
push edi
call fcn.004882cd
pop ecx
lea eax, [eax*2 + 2]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d9c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x40d9ce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x70]
call fcn.0040df92
mov esi, vtable.ATL::CAccessToken.0
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], esi
call fcn.0040e010
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
call fcn.0040e010
mov eax, ebx
call fcn.0046c3f6
ret

Function at 0x40da05
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push esi
lea esi, [ecx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40da44
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40da44
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40da40
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40da40
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
ret
push 2
pop eax
pop esi
ret
Function at 0x441e9d
Capabilities:
Delete file

Disassembly:
push 0x60
mov eax, 0x4b4b78
call fcn.0046c44c
mov esi, ecx
xor ebx, ebx
push ebx
call fcn.0048af3e
push eax
call fcn.0048aea9
call fcn.0048ae88
push 0xa
mov edx, eax
lea edi, [ebp - 0x38]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0xa
lea eax, [ebp - 0x38]
push eax
push edx
call fcn.0048ba99
push 0x4d1898
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00402459
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402459
push str..txt
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call fcn.00402459
add esp, 0x38
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x6c]
call fcn.00452700
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.004026c3
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
push 0x1021
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x6c]
call fcn.00452c70
test eax, eax
je 0x441f6d
lea ecx, [ebp - 0x6c]
call fcn.004529c0
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x441f70
mov ebx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov dword [ebp - 0x58], vtable.CFileException.0
call fcn.00402e64
lea ecx, [ebp - 0x6c]
call fcn.00452730
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.0046c3f6
ret
Function at 0x44d0d7
Capabilities:
Query environment variable

Disassembly:
push 8
mov eax, 0x4b6b58
call fcn.0046c418
mov ebx, edx
mov edi, ecx
push str.Entered_ExtractPath:
lea ecx, [ebp - 0x10]
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push ecx
push edi
call fcn.00414dc9
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.00424e14
push 0
push str..exe
lea ecx, [ebp - 0x10]
call fcn.0040a9fe
mov esi, eax
cmp esi, 0xffffffff
je 0x44d251
push str.found_EXE_value_in:
lea ecx, [ebp - 0x14]
call fcn.00402829
push ecx
push edi
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00414dc9
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
cmp dword [ebp + 8], 1
jne 0x44d1ce
push 0
push 0x4fe210
lea ecx, [ebp - 0x10]
call fcn.0040a9fe
cmp eax, 0xffffffff
je 0x44d1bb
cmp eax, esi
jge 0x44d1bb
sub esi, eax
mov ecx, edi
add esi, 4
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00415910
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00402e14
jmp 0x44d246
push str.Could_not_extract_app_path_from:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 4
jmp 0x44d23a
cmp dword [ebp + 8], 2
jne 0x44d251
push 0
push 0x4fe25c
lea ecx, [ebp - 0x10]
call fcn.0040a9fe
cmp eax, 0xffffffff
je 0x44d229
cmp eax, esi
jge 0x44d229
sub esi, eax
mov ecx, edi
add esi, 4
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00415910
mov esi, 0x104
mov byte [ebp - 4], 5
push esi
mov ecx, ebx
call fcn.00402bd2
push esi
mov esi, dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.0040ae39
lea ecx, [esi - 0x10]
jmp 0x44d24c
push str.Could_not_extract_app_path_from:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 6
push ecx
push edi
lea edx, [ebp - 0x14]
call fcn.00414dc9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.0046c3e1
ret
Function at 0x44d262
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x4b6ba8
call fcn.0046c418
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push dword [ecx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44d291
xor al, al
jmp 0x44d402
call fcn.00452601
push eax
lea ecx, [ebp - 0x24]
call fcn.00402899
and dword [ebp - 4], 0
call fcn.00452601
push eax
lea ecx, [ebp - 0x14]
call fcn.00402899
xor ebx, ebx
mov esi, 0x400
inc ebx
mov eax, esi
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
cmp edi, 0x32
jge 0x44d3df
push eax
lea ecx, [ebp - 0x14]
call fcn.00402bd2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00402bd2
lea ecx, [ebp - 0x1c]
push ecx
push esi
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44d3df
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.0040ae39
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0040ae39
call fcn.00452601
push eax
lea ecx, [ebp - 0x10]
call fcn.00402899
mov byte [ebp - 4], 2
lea edx, [ebp - 0x10]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0044d0d7
mov eax, dword [ebp - 0x10]
pop ecx
cmp dword [eax - 0xc], 0
je 0x44d351
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d39e
push str.App_for_.pdf_progID_not_found:
lea ecx, [ebp - 0x28]
call fcn.00402829
push ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x28]
call fcn.00414dc9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebp - 4], bl
mov eax, 0x400
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [ebp - 0x1c]
inc edi
jmp 0x44d2c6
push 0x4fe260
lea ecx, [ebp - 0x28]
call fcn.00402829
push ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x28]
call fcn.00414dc9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x44d3ea
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402e64
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402e64
mov al, bl
call fcn.0046c3e1
ret
Function at 0x44d408
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x4b6bfc
call fcn.0046c44c
mov edi, ecx
push str.Entered_EnumKeys:
lea ecx, [ebp - 0x228]
call fcn.00402829
push ecx
xor ebx, ebx
lea edx, [ebp - 0x228]
push edi
mov dword [ebp - 4], ebx
call fcn.00414dc9
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x21c]
push eax
push 8
push ebx
push dword [edi]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44d5b6
mov esi, ebx
cmp esi, 0x32
jae 0x44d5aa
push 0x208
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 0x238], xmm0
call fcn.00484bc0
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44d5aa
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.00402829
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x224]
cmp dword [eax - 0xc], 0
je 0x44d56c
push 0x4d1898
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00402459
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004024b8
add esp, 0x18
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x220]
call fcn.0044d262
mov bl, al
test bl, bl
jne 0x44d57e
lea ecx, [ebp - 0x220]
call fcn.0044d408
mov bl, al
test bl, bl
jne 0x44d57e
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [ebp - 0x224]
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [eax - 0x10]
call fcn.00402e64
inc esi
jmp 0x44d470
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov al, bl
jmp 0x44d5b8
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
call fcn.0046c3f6
ret
Function at 0x44d5be
Capabilities:
Check if file exists
Download url
Get file attributes
Receive data

Disassembly:
push 0x14
mov eax, 0x4b6c78
call fcn.0046c418
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push str.PingPdfExtension:
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.00402829
push 0
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00414d97
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebx], 0
call fcn.00452601
push eax
lea ecx, [ebp - 0x10]
call fcn.00402899
mov byte [ebp - 4], 3
call fcn.00452601
push eax
lea ecx, [ebp - 0x14]
call fcn.00402899
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.00442afb
test eax, eax
jne 0x44d648
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add esi, 0xfffffff0
add ecx, 0xfffffff0
jmp 0x44d761
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004025c6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push edi
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
call fcn.0040abbf
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004024b8
add esp, 0xc
mov byte [ebp - 4], 5
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov esi, dword [ebp - 0x10]
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
push str.ping__URL:
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.00402829
push ecx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x20]
call fcn.00414dc9
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
test ebx, ebx
jne 0x44d6e9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x44d6ec
mov byte [ebx], 1
jmp 0x44d6ec
mov ebx, dword [ebp - 0x18]
cmp byte [ebx], 0
mov ecx, str.Failed
mov eax, str.Success
cmove eax, ecx
lea ecx, [ebp - 0x18]
push eax
call fcn.00402829
push str.ping_result:
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.00402829
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x20]
call fcn.00414dc9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402e64
cmp byte [ebx], 0
je 0x44d750
lea ecx, [ebp - 0x10]
call fcn.00446984
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
add esi, 0xfffffff0
lea ecx, [edi - 0x10]
call fcn.00402e64
mov ecx, esi
call fcn.00402e64
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.0046c3e1
ret
Function at 0x417d52
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x417def
push ebx
push esi
call fcn.00417d1b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004169df
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x417d9c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x417dee
push edi
push eax
call fcn.00410109
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x417dbc
call fcn.004100cf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x417ded
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004169df
add esp, 0x20
test eax, eax
jne 0x417ddb
push edi
call fcn.004100cf
jmp 0x417de3
push ebx
call fcn.004100cf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41d130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d15d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d15d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x10001ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d80
mov ecx, dword [0x1004e240]
call fcn.1001f0d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fed
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x1004d828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1004d82c]
call fcn.10016360
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003272
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x100032b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100032ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003269
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4