joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b9d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b9fa
xor eax, eax
add esp, 0xc
ret 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x457870
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret 4

Function at 0x40ba40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x828
mov eax, dword [0x46b3ac]
mov dword [esp + 0x824], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x830]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x5c]
mov dword [esp + 0x10], eax
push 0x456ed0
push edx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x1c], eax
call fcn.00431794
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40bacf
mov ecx, dword [esp + 0x824]
call fcn.00431288
add esp, 0x828
ret 4
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x828]
mov eax, 1
pop esi
call fcn.00431288
add esp, 0x828
ret 4

Function at 0x40bb00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x82c
mov eax, dword [0x46b3ac]
mov dword [esp + 0x828], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x834]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x60]
mov dword [esp + 0x10], eax
push 0x456ed0
push edx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x1c], eax
call fcn.00431794
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40bb8f
mov ecx, dword [esp + 0x828]
call fcn.00431288
add esp, 0x82c
ret 4
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x82c]
mov eax, 1
pop esi
call fcn.00431288
add esp, 0x82c
ret 4
Function at 0x40bbe0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.00431b26
mov ebp, eax
lea eax, [ebp + ebp + 2]
push eax
call fcn.0044ac64
mov esi, eax
push edi
push esi
call fcn.004318eb
add esp, 0x10
xor edi, edi
test ebp, ebp
mov byte [esp + 0x10], 1
jl 0x40bc5d
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x40bc3d
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x40bc37
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc57
mov word [esi + edi*2], 0x5c
inc edi
cmp edi, ebp
jle 0x40bc17
pop ebx
push esi
call fcn.0044ac5f
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
mov byte [esp + 0x14], 0
pop ebx
push esi
call fcn.0044ac5f
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4

Function at 0x40bc80
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x46b3ac]
push esi
mov esi, dword [esp + 0x214]
push edi
push esi
mov dword [esp + 0x214], eax
mov edi, ecx
call fcn.00431b26
add esp, 4
test eax, eax
jne 0x40bcc1
pop edi
pop esi
mov ecx, dword [esp + 0x208]
call fcn.00431288
add esp, 0x20c
ret 4
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x14]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
call fcn.004318eb
lea edx, [esp + 0x10]
push esi
push edx
call fcn.004318c1
add esp, 0x10
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40bd13
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.0040ba40
mov ecx, dword [esp + 0x210]
pop edi
mov eax, 1
pop esi
call fcn.00431288
add esp, 0x20c
ret 4

Function at 0x40bd30
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, ecx
call fcn.00431b26
add esp, 4
test eax, eax
jne 0x40bd4a
pop edi
pop esi
ret 4
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40bd6b
push esi
mov ecx, edi
call fcn.0040ba40
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x40be10
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40be65
push 0
push 0x80
push 3
push 0
push 0
push 0x10000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40be5e
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
pop esi
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
pop esi
ret 4
Function at 0x40bf00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00403760
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00403430
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40bf92
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x40d8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x284], 2
jne 0x40d8ee
jmp fcn.0040d5d0
jmp fcn.0040d2f0
Function at 0x40e420
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x70]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esi], method.CDialog.virtual_0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 4]
mov eax, dword [esi + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.00446165
pop esi
pop ecx
ret

Function at 0x40e720
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x46c488]
push esi
mov esi, ecx
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx]
call dword [edx + 0x168]
push 0
mov ecx, esi
call fcn.0044a166
lea eax, [esi + 0x74]
push eax
push 0
push esi
push 0x40e4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
ret

Function at 0x40e8e0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x46c488]
mov ecx, dword [ecx + 0x10]
lea eax, [esp + 8]
push eax
call fcn.004109a0
mov eax, dword [eax]
push str.finish
push eax
call fcn.00431762
mov ebx, eax
mov eax, dword [esp + 0x10]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e92e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x40e96b
mov eax, dword [0x46c488]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx]
call dword [edx + 0x168]
push 0
mov ecx, esi
call fcn.0044a166
lea eax, [esi + 0x74]
push eax
push 0
push esi
push 0x40e4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [0x46c488]
mov ecx, dword [ecx + 0x10]
call fcn.004102f0
pop esi
pop ebx
pop ecx
ret
Function at 0x40fb50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4538be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x46b3ac]
push ebp
mov dword [esp + 0x210], eax
push edi
lea eax, [esp + 0xc]
push eax
push 0x104
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0xc]
push str.Language.xml
push ecx
call fcn.004318c1
lea edx, [esp + 0x14]
push edx
push 0x456ed0
push ebp
call fcn.00431794
push 0x10
call fcn.0044ac34
mov edi, eax
add esp, 0x18
mov dword [esp + 8], edi
test edi, edi
mov dword [esp + 0x220], 0
je 0x40fbfc
push esi
lea esi, [edi + 4]
mov ecx, esi
mov dword [edi], 0x4581c0
call fcn.0040ea40
mov dword [esi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], 0
pop esi
jmp 0x40fbfe
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x220], 0xffffffff
mov dword [ebp + 0x208], edi
call fcn.0040f6b0
mov ecx, dword [esp + 0x218]
neg eax
sbb eax, eax
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x210]
neg eax
pop ebp
call fcn.00431288
add esp, 0x21c
ret

Function at 0x410050
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x4584b0
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x41006a
pop esi
pop ebx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
push str.IsWow64Process
push eax
call edi
mov ecx, dword [esi]
push str.Wow64DisableWow64FsRedirection
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi]
push str.Wow64RevertWow64FsRedirection
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push str.GetSystemWow64DirectoryW
push eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
test eax, eax
mov dword [esi + 4], eax
jne 0x4100c2
pop edi
pop esi
pop ebx
ret
push str.Wow64RevertWow64FsRedirection
push eax
call edi
mov ecx, dword [esi + 4]
push str.Wow64RevertWow64FsRedirection
push ecx
mov dword [esi + 0x20], eax
call edi
pop edi
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
ret
Function at 0x414ac0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [0x46b3ac]
mov dword [esp + 0x414], eax
push esi
push edi
mov esi, ecx
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x210], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x212]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46c488]
stosw word es:[edi], ax
call fcn.0040cac0
mov ecx, eax
call fcn.00403f10
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004318eb
lea ecx, [esp + 0x10]
push str.wnimembUserMB.ini
push ecx
call fcn.004318c1
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
push 0x45700c
push str.UserMbVer
push 0x458e0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 0x84]
test eax, eax
je 0x414b9c
push eax
lea ecx, [esp + 0x214]
push ecx
call fcn.00431762
add esp, 8
test eax, eax
jne 0x414b9c
mov edi, 1
mov dword [esi + 0x78], edi
mov ecx, dword [0x46c488]
call fcn.0040cac0
mov dword [eax + 0x4c4], edi
mov ecx, dword [esp + 0x41c]
call fcn.00431288
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x82c
mov eax, dword [0x46b3ac]
mov dword [esp + 0x828], eax
push ebx
mov ebx, ecx
xor eax, eax
xor edx, edx
push esi
push edi
mov word [esp + 0x10], dx
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x420], dx
mov ecx, 0x81
lea edi, [esp + 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x628], dx
mov ecx, 0x81
lea edi, [esp + 0x62a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x218], dx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46c488]
stosw word es:[edi], ax
call fcn.0040cac0
mov esi, eax
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
mov edi, 1
cmp ecx, edi
jle 0x415214
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00403280
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004318eb
lea eax, [esp + 0x18]
push str.wnimembmb.ini
push eax
call fcn.004318c1
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x104
lea edx, [esp + 0x220]
push edx
push 0x45700c
push str.SysMbVer
push 0x458e0c
call esi
mov eax, dword [ebx + 0x90]
test eax, eax
je 0x415281
push eax
lea eax, [esp + 0x21c]
push eax
call fcn.00431762
add esp, 8
test eax, eax
jne 0x415281
mov dword [ebx + 0x80], edi
lea ecx, [esp + 0x10]
push ecx
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x45700c
push str.NewVer
push str.Globals
call esi
lea eax, [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x630]
push ecx
push 0x45700c
push 0x458e74
push str.Globals
call esi
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x41530e
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
je 0x41530e
push eax
lea edx, [esp + 0x424]
push edx
call fcn.00431762
add esp, 8
test eax, eax
jne 0x41530e
mov eax, dword [ebx + 0x8c]
push eax
lea ecx, [esp + 0x62c]
push ecx
call fcn.00431762
add esp, 8
test eax, eax
jne 0x41530e
mov dword [ebx + 0x7c], edi
mov ecx, dword [esp + 0x834]
call fcn.00431288
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417400
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46b3ac]
push edi
mov dword [esp + 0x214], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41747f
push 0x104
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 8]
push eax
push str._.8X
push ecx
call fcn.00431794
add esp, 0xc
mov ecx, dword [esp + 0x214]
call fcn.00431288
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x417eb0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ecx
push esi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x417f99
lea eax, [esp + 4]
push eax
push 0x4612e8
push 1
push esi
push 0x4612f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x417f93
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x417f05
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x417f18
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x1c]
test cx, cx
je 0x417f2c
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x34]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x417f3f
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x24]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x417f52
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x461338
push eax
call dword [ecx]
test eax, eax
jl 0x417f89
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 1
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ecx
ret 0x1c
Function at 0x417fa0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x46b3ac]
push edi
mov dword [esp + 0x12c], eax
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jne 0x41800d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417fed
cmp eax, 1
jne 0x41800d
cmp byte [esp + 0x122], 1
jne 0x41800d
mov eax, 1
mov ecx, dword [esp + 0x12c]
call fcn.00431288
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
call fcn.00431288
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x418020
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x46b3ac]
mov dword [esp + 0xa38], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov esi, ecx
mov word [esp + 0x838], bx
mov ecx, 0x81
lea edi, [esp + 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x428], bx
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], bx
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], bx
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x18], bx
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1a
lea eax, [esp + 0x840]
push eax
push ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call edi
lea ecx, [esp + 0x838]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004318eb
lea eax, [esp + 0x20]
push eax
call fcn.00431b26
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.00431edb
add esp, 0x14
cmp eax, ebx
je 0x41821f
lea edx, [esp + 0x18]
mov word [eax], bx
push edx
lea eax, [esp + 0x42c]
push eax
call fcn.004318eb
lea ecx, [esp + 0x430]
push str.Local
push ecx
call fcn.004318c1
add esp, 0x10
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418152
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push ecx
call fcn.004318eb
lea edx, [esp + 0x228]
push str.LocalLow
push edx
call fcn.004318c1
add esp, 0x10
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418193
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.004318eb
lea eax, [esp + 0x638]
push str.Roaming
push eax
call fcn.004318c1
add esp, 0x10
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 1
jne 0x4181d5
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ebx
je 0x41821f
cmp dword [esp + 0xc], ebx
je 0x41821f
cmp eax, ebx
je 0x41821f
mov ecx, esi
call fcn.00417fa0
test eax, eax
je 0x41821f
lea edx, [esp + 0x220]
push edx
push esi
call fcn.004318eb
push 0x457080
push esi
call fcn.004318c1
add esp, 0x10
mov ecx, dword [esp + 0xa44]
call fcn.00431288
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x1a
push esi
push ebx
call edi
push 0x457080
push esi
call fcn.004318c1
mov ecx, dword [esp + 0xa4c]
add esp, 8
call fcn.00431288
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418250
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454046
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
mov eax, dword [0x46b3ac]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
mov dword [esp + 0x14], ecx
call fcn.0044ad5c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 0x43c], edi
call fcn.0044ad5c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov word [esp + 0x18], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x20]
push eax
push 0
mov byte [esp + 0x44c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41837a
lea ecx, [esp + 0x18]
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.004318c1
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push 0x457a58
push eax
call fcn.00403920
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41837a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x14]
push str.__sProgram_FilesInternet_Exploreriexplore.exe_
push eax
mov word [esp + 0x232], 0
call fcn.00403920
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push str._HOMEDRIVE__HOMEPATH_
push 0
push 1
push 0x457990
push ebx
push esi
call fcn.00417eb0
add ebx, 0xfffffff0
mov byte [esp + 0x43c], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41839c
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x43c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4183c1
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
mov eax, 1
call fcn.00431288
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4183f0
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41841b
xor eax, eax
pop edi
pop ecx
ret 4
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.00431b26
mov ecx, dword [esp + 0xc]
add esp, 4
shl eax, 1
push eax
push esi
push 1
push 0
push 0x457870
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00418250
pop esi
mov eax, 1
pop edi
pop ecx
ret 4