joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006770
Capabilities:
List tcp connections and listeners

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
push 0
push 5
push 2
push 1
lea eax, [esp + 0x20]
push eax
push 0
mov dword [esp + 0x28], 0
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov ebp, eax
push 0
push 5
push 2
push 1
lea edx, [esp + 0x20]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
xor ebx, ebx
cmp dword [ebp], ebx
jbe 0x100068be
lea edi, [ebp + 0x18]
cmp dword [edi - 0x14], 5
jne 0x100068b1
mov eax, dword [edi]
push eax
call fcn.100066d0
add esp, 4
lea edx, [esp + 0x14]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x100067f0
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006801
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x10006829
mov al, byte [esp + ecx + 0x14]
cmp al, 0x41
jl 0x10006824
cmp al, 0x5f
jg 0x10006824
add al, 0x20
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, edx
jl 0x10006812
movzx ecx, word [edi - 4]
push ecx
call sub.WS2_32.dll_ntohs
movzx esi, ax
mov ecx, 0x1007bc78
lea eax, [esp + 0x14]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006860
test dl, dl
je 0x1000685c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006860
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006840
xor eax, eax
jmp 0x10006865
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10006871
cmp esi, 0x1964
jmp 0x100068af
mov ecx, 0x1007bc8c
lea eax, [esp + 0x14]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100068a0
test dl, dl
je 0x1000689c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100068a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006880
xor eax, eax
jmp 0x100068a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100068b1
cmp esi, 0x3b63
je 0x100068ce
inc ebx
add edi, 0x18
cmp ebx, dword [ebp]
jb 0x100067d5
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100067b4
push ebp
call dword [sym.imp.MSVCR90.dll_free]
mov ecx, dword [esp + 0x118]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10007180
add esp, 0x108
ret

Function at 0x10006c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x100822c4]
lea eax, [esp]
push eax
push 0x10082260
push 0
push 0
push 0x10009028
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x10082260
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006ca0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10006ccd
mov edx, eax
and edx, 0x80000001
jns 0x10006cc0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x10082260], dl
inc eax
cmp eax, ecx
jl 0x10006cb1
pop ecx
ret
Function at 0x10006cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x100822c4]
lea eax, [esp]
push eax
push 0x10082270
push 0
push 0
push 0x10009040
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x10082270
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006d00
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10006d2d
mov edx, eax
and edx, 0x80000001
jns 0x10006d20
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x10082270], dl
inc eax
cmp eax, ecx
jl 0x10006d11
pop ecx
ret

Function at 0x10006d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x100822c4]
lea eax, [esp]
push eax
push 0x10082280
push 0
push 0
push 0x10009058
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x10082280
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006d60
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10006d8d
mov edx, eax
and edx, 0x80000001
jns 0x10006d80
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x10082280], dl
inc eax
cmp eax, ecx
jl 0x10006d71
pop ecx
ret

Function at 0x10006d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x100822c4]
lea eax, [esp]
push eax
push 0x10082290
push 0
push 0
push 0x10009070
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x10082290
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006dc0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10006ded
mov edx, eax
and edx, 0x80000001
jns 0x10006de0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x10082290], dl
inc eax
cmp eax, ecx
jl 0x10006dd1
pop ecx
ret

Function at 0x10006df0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x10006eb0
push 0
push 0
mov byte [0x10009078], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006e23
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x100016e0
push 0
push 0
call esi
test eax, eax
je 0x10006e3e
push eax
call edi
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x10003760
push 0
push 0
call esi
test eax, eax
je 0x10006e59
push eax
call edi
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x100048a0
push 0
push 0
call esi
test eax, eax
je 0x10006e74
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x10002690
push 0
push 0
call esi
test eax, eax
je 0x10006e8f
push eax
call edi
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x10006900
push 0
push 0
call esi
test eax, eax
je 0x10006eaa
push eax
call edi
pop edi
pop esi
add esp, 0x18
ret

Function at 0x10007180
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000718a
repz ret
jmp fcn.1000753d
Function at 0x10003dd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push 8
mov edi, ecx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10003e15
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10003e0f
push esi
push 8
xor esi, esi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x10003e04
push eax
mov ecx, edi
call sym.FreeImagePlus.dll_public:_int___thiscall_fipWinImage::copyFromHandle_void__
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop edi
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop edi
ret
Function at 0x10003e20
Capabilities:
Capture screenshot
Hide graphical window

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x24], ecx
push eax
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call esi
push 1
mov edi, eax
call esi
mov ecx, dword [esp + 0x30]
cmp ecx, edi
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
cmovg ecx, edi
cmp ebx, eax
mov dword [esp + 0x30], ecx
cmovg ebx, eax
mov dword [esp + 0x34], ebx
test edx, edx
jns 0x10003e8a
mov ebp, edx
neg ebp
xor edx, edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x2c]
test eax, eax
jns 0x10003ea0
mov ebp, eax
neg ebp
xor eax, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x2c], eax
sub ecx, edx
sub ebx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
test ecx, ecx
jle 0x10003fc3
test ebx, ebx
jle 0x10003fc3
push 0
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [esp + 0x40]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push ebp
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowDC]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push dword [esp + 0x1c]
mov ebp, eax
push esi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebx
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
call ebp
push 0xcc0020
push dword [esp + 0x14]
mov esi, eax
push dword [esp + 0x1c]
push edi
push dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
push dword [esp + 0x2c]
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push 5
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0x58]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebx
mov ebx, dword [esp + 0x28]
mov ecx, ebx
call sym.FreeImagePlus.dll_public:_int___thiscall_fipWinImage::copyFromBitmap_struct_HBITMAP____
push esi
push edi
call ebp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebx + 4]
call dword [sym.imp.FreeImage.dll__FreeImage_GetBPP_4]
cmp eax, 0x20
jne 0x10003fb4
mov ecx, ebx
call sym.FreeImagePlus.dll_public:_int___thiscall_fipImage::convertTo24Bits_void_
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret 8
Function at 0x401600
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x437a30]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
push ebp
mov dword [esp + 0x1d], eax
push esi
mov dword [esp + 0x25], eax
push edi
mov dword [esp + 0x2d], eax
push 0x4f3b4
mov edi, ecx
mov dword [esp + 0x35], eax
lea ecx, [esp + 0x1c]
mov word [esp + 0x39], ax
push str.abcxy_xz
push ecx
mov byte [esp + 0x1b], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x43], al
call fcn.004107ad
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, eax
push 0xbb8
push ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x4017a6
mov eax, dword [esp + 0x4c]
push ebx
push eax
lea ecx, [esp + 0x20]
push 0x42b6e8
push ecx
call fcn.004107ad
mov eax, dword [0x438a10]
add esp, 0xc
test eax, eax
jne 0x4016db
mov al, byte [esp + 0x4c]
test al, al
je 0x4016c9
lea edx, [esp + 0x1c]
push edx
push 0x5002
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x4016db
lea eax, [esp + 0x1c]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x4017a5
push 0
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
je 0x401784
mov al, byte [esp + 0x48]
test al, al
je 0x401734
mov cl, byte [edi]
mov al, byte [esp + 0x44]
test al, al
mov byte [edx], cl
mov ecx, 0xa00
je 0x401724
lea esi, [edi + 2]
lea edi, [edx + 2]
rep movsd dword es:[edi], dword [esi]
jmp 0x401774
lea esi, [edi + 0x2802]
lea edi, [edx + 0x2802]
rep movsd dword es:[edi], dword [esi]
jmp 0x401774
mov al, byte [edx]
cmp al, 1
je 0x40173e
cmp al, 2
jne 0x40177d
mov byte [edi], al
mov al, byte [esp + 0x44]
test al, al
mov ecx, 0xa00
je 0x401755
lea ebp, [edx + 2]
add edi, 2
jmp 0x401761
lea ebp, [edx + 0x2802]
add edi, 0x2802
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov edi, ebp
mov ebp, dword [esp + 0x14]
xor eax, eax
mov ecx, 0xa00
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 1
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov al, byte [esp + 0x4c]
test al, al
je 0x401794
mov dword [0x438a10], ebx
jmp 0x4017a5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x438a10], 0
pop ebx
test ebp, ebp
je 0x4017bc
test esi, esi
jne 0x4017b5
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x38]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
call fcn.004105a4
add esp, 0x30
ret
Function at 0x401a30
Capabilities:
Get hostname

Disassembly:
sub esp, 0x1c
mov eax, dword [0x437a30]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x15], eax
push ecx
lea edx, [esp + 0xc]
mov word [esp + 0x1d], ax
push edx
mov byte [esp + 0x10], 0
mov byte [esp + 0x23], al
mov dword [esp + 0xc], 0x14
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ecx, dword [esp + 0x24]
mov esi, eax
lea eax, [esp + 8]
push eax
call fcn.00405840
mov ecx, dword [esp + 0x1c]
xor eax, eax
test esi, esi
setne al
pop esi
call fcn.004105a4
add esp, 0x1c
ret

Function at 0x401aa0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x42a2d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov eax, dword [0x437a30]
lea ecx, [esp]
mov dword [esp + 0x4c], eax
call fcn.00405990
mov eax, dword [esp + 0x60]
test eax, eax
mov dword [esp + 0x58], 0
je 0x401ae3
push eax
lea ecx, [esp + 4]
call fcn.00405840
mov eax, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x6c]
push eax
mov word [esi], 2
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 4]
mov word [esi + 2], ax
call fcn.004055b0
test al, al
je 0x401b13
push 0
call dword [sym.imp.WS2_32.dll_htonl]
jmp 0x401b5b
lea ecx, [esp + 4]
call fcn.004055c0
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x401b5e
lea ecx, [esp + 4]
call fcn.004055c0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x401b54
lea ecx, [esp + 4]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00405580
xor al, al
jmp 0x401b71
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00405580
mov al, 1
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x50]
pop esi
call fcn.004105a4
add esp, 0x5c
ret
Function at 0x403540
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42a39b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x13a8
call fcn.00411290
mov eax, dword [0x437a30]
push esi
push edi
mov dword [esp + 0x13ac], eax
mov dword [esp + 0xc], 0
call fcn.0041e45f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [esp + 0x13c0], 0
call fcn.00401dd0
mov edx, eax
add esp, 4
test edx, edx
je 0x4035f8
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x4e4
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0x1394
stosw word es:[edi], ax
push 0xd
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
jmp 0x4035e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4035e0
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
call fcn.004029d0
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
push esi
call fcn.004023d0
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x13bc], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403632
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x13b4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x13ac]
mov eax, edi
call fcn.004105a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4039b0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42a418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov eax, dword [0x437a30]
push esi
push edi
mov dword [esp + 0x118], eax
mov dword [esp + 0x10], 0
xor eax, eax
mov byte [esp + 0x14], 0
mov ecx, 0x40
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathsiexplore.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x403a50
mov eax, dword [esp + 8]
test eax, eax
je 0x403a4e
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
push esi
push 0x42b89e
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x403a96
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x14]
push ecx
call edi
push str.iexplore.exe
mov esi, eax
call edi
cmp eax, esi
ja 0x403a96
push str.iexplore.exe
call edi
sub esi, eax
lea edx, [esp + esi + 0x14]
push edx
push str.iexplore.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb al, al
inc al
mov byte [esp + 0xf], al
jne 0x403ae5
push 0
push 0x26
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x403acc
call fcn.0041e45f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov esi, dword [esp + 0x12c]
add eax, 0x10
mov dword [esi], eax
mov ecx, esi
call fcn.00402310
jmp 0x403af8
lea edi, [esp + 0x14]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403ad1
mov ecx, 8
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00403860
mov ecx, dword [esp + 0x11c]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
call fcn.004105a4
add esp, 0x120
ret
Function at 0x403d90
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42a48b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8068
call fcn.00411290
mov eax, dword [0x437a30]
push esi
mov dword [esp + 0x8068], eax
lea eax, [esp + 8]
push edi
push eax
call fcn.004039b0
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0x8080], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403df4
lea ecx, [esp + 0xc]
call fcn.00402310
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 0xc]
test eax, eax
jne 0x403e43
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x20], 0x3c
mov eax, dword [edx - 0xc]
test eax, eax
mov dword [esp + 0x30], ecx
je 0x403e26
mov dword [esp + 0x30], edx
mov eax, dword [edx - 0xc]
neg eax
sbb eax, eax
lea edx, [esp + 0x20]
and eax, ecx
push edx
mov dword [esp + 0x38], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x403f27
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x68], al
mov dword [esp + 0x1c], eax
mov ecx, 0x1fff
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
push 0x8000
stosw word es:[edi], ax
push str._nohome
lea ecx, [esp + 0x70]
push ecx
mov dword [esp + 0x2c], 0x44
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [ebp + 8]
push esi
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [esp + 0x88]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403f27
mov ecx, dword [esp + 0x18]
push ecx
push esi
push 1
call fcn.00403910
mov edx, dword [esp + 0x20]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [0x438964], ecx
mov dword [0x438968], edx
jne 0x403f0d
xor eax, eax
jmp 0x403f1b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f12
sub eax, edx
push eax
push esi
mov ecx, 0x43896c
call fcn.004029d0
push 0x403c30
push 0x7d0
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x807c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x8074]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x806c]
call fcn.004105a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4051e0
Capabilities:
Connect to http server
Create http request

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push 0
push 0
lea ecx, [esi + 0xc]
call fcn.004055c0
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 4], eax
je 0x405234
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 3
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 8], eax
jne 0x40523a
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 4], 0
xor al, al
pop esi
ret 0xc
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [esp + 0x18]
push ecx
push 2
push eax
call edi
mov eax, dword [esi + 8]
push 4
lea edx, [esp + 0x18]
push edx
push 5
push eax
call edi
mov edx, dword [esi + 8]
push 4
lea ecx, [esp + 0x18]
push ecx
push 6
push edx
call edi
pop edi
mov al, 1
pop esi
ret 0xc