joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40932f
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call edi
push dword [ebp - 4]
call fcn.004155b9
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4093dc
mov edi, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov eax, dword [esi + 4]
push str.iqiyi
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x40938b
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov eax, dword [esi + 4]
push 0x46644c
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x4093a8
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call edi
push esi
call fcn.004155c4
push dword [ebp - 4]
call fcn.004155b9
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40936e
mov dword [ebp - 0xc], 1
cmp esi, ebx
je 0x4093e7
push esi
call fcn.004155c4
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4093ef
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x4777a8]
xor eax, ebp
mov dword [ebp + 0xdc], eax
mov eax, dword [ebp + 0xe8]
push ebx
push esi
push edi
push 0x40
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.00444c50
xor eax, eax
inc eax
push 0x103
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x27]
push ebx
push eax
call fcn.00444c50
add esp, 0x18
push 0xc
pop ecx
mov esi, str.C:Program_FilesInternet_Exploreriexplore.exe
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x409458
mov eax, dword [ebp - 0x2c]
mov esi, 0x464eb0
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40946c
lea edi, [ebp - 0x28]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x409479
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp + 0xdc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004410db
add ebp, 0xe0
leave
ret 4
Function at 0x40d243
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x24
mov eax, 0x45adf4
call fcn.00445165
mov esi, ecx
and dword [0x48011c], 0
xor ebx, ebx
inc ebx
cmp dword [esi + 0x14c], ebx
jne 0x40d289
push str.sogou.com
push dword [ebp + 0x18]
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x40d289
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x18]
mov dword [eax], ebx
call fcn.004032a6
pop ecx
jmp 0x40d3ac
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 0x18]
call fcn.0040230f
and dword [ebp - 4], 0
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.00413941
or dword [ebp - 4], 0xffffffff
call fcn.0040d023
test eax, eax
jne 0x40d2bf
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov dword [0x48011c], ebx
push 0xb
push str.about:blank
push dword [ebp + 0x18]
call fcn.00442e51
add esp, 0xc
test eax, eax
je 0x40d3ac
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push 0x8065
push dword [0x47f8a4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
test esi, esi
je 0x40d3ac
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x10], eax
call edi
jmp 0x40d3c5
push ebx
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40d345
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x2c], 0x12
jne 0x40d3bf
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x40d3ac
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
cmp ebx, edi
je 0x40d3b4
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x40d3b4
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d3b4
lea eax, [ebp + 0x18]
push eax
push edi
push 0x8068
push dword [esi + 0xc]
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], edi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x40d3a0
lea eax, [ebp + 0x14]
push eax
push 0x463ce8
push dword [ebp + 0x18]
call dword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x40d3bc
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
call fcn.0044523d
ret 0x14
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
inc ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1770
jb 0x40d30c
jmp 0x40d3ac
Function at 0x40de5d
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 4
mov eax, 0x45ad9e
call fcn.00445165
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0040230f
and dword [ebp - 4], 0
push 0x23
lea ecx, [ebp + 8]
call fcn.00406144
test eax, eax
jle 0x40deaf
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.00401dff
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00401f24
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023bd
push 0x104
mov esi, 0x4804a8
push esi
push 0x4803a0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x22
push esi
mov edi, esi
call fcn.00441d60
pop ecx
pop ecx
cmp eax, esi
jne 0x40dedd
lea edi, [eax + 1]
push 0x22
push edi
jmp 0x40dee0
push 0x20
push esi
call fcn.00441d60
pop ecx
pop ecx
test eax, eax
je 0x40deee
mov byte [eax], 0
push 5
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.00401dff
push str.file:
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00401f83
mov ebx, eax
neg ebx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.004023bd
test bl, bl
je 0x40df68
push 8
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.0040e71e
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00401f24
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023bd
lea eax, [ebp + 8]
push eax
call fcn.0040e527
lea eax, [ebp + 8]
push eax
call fcn.0040e592
jmp 0x40dff1
push edi
call fcn.00443771
mov dword [esp], str.WORD.EXE
push edi
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x40dff1
push str.DREAMWEAVER.EXE
push edi
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x40dff1
push str.FRONTPAGE
push edi
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x40dff1
and dword [ebp - 0x10], eax
mov esi, dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoA]
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40dff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40dff1
push dword [ebp - 0x10]
call fcn.004155b9
pop ecx
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x40dfea
push dword [ebx + 8]
lea ecx, [ebp + 8]
call fcn.004022e0
push ebx
call fcn.004155c4
pop ecx
lea eax, [ebp + 8]
push eax
mov esi, 0x467304
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00403dca
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.00401f24
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023bd
push esi
lea ecx, [ebp + 8]
call fcn.00403ea1
push 5
push 0
push dword [ebp + 8]
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004023bd
call fcn.0044523d
ret 4
Function at 0x40e054
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x45b0d0
call fcn.00445165
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push str.SoftwareMicrosoftInternet_ExplorerDefault_HTML_Editor_shelleditcommand
mov edi, 0x104
push SysReAllocString
mov dword [ebp - 0x14], edi
call esi
test eax, eax
je 0x40e096
lea eax, [ebp - 0x10]
push eax
push str.InternetShortcut_shelleditcommand
push SysReAllocString
call esi
test eax, eax
jne 0x40e0e4
lea eax, [ebp - 0x14]
push eax
push 0x4803a0
xor esi, esi
push esi
push esi
push 0x464857
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], esi
jbe 0x40e0e4
push dword [ebp + 8]
lea edi, [ebp + 8]
call fcn.00413941
mov dword [ebp - 4], esi
push dword [eax]
call fcn.0040de5d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004023bd
jmp 0x40e0ec
push dword [ebp + 8]
call fcn.0040dddf
call fcn.0044523d
ret 4

Function at 0x40e333
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4777a8]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x8d]
push ebx
push eax
mov byte [ebp + 0x8c], bl
call fcn.00444c50
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.00444c50
lea eax, [ebp - 0x78]
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e38b
sub eax, esi
jne 0x40e3ba
push 0x104
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.00441750
pop ecx
pop ecx
cmp eax, ebx
je 0x40e3ba
mov byte [eax + 1], bl
lea eax, [ebp + 0x8c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e3c3
sub eax, edx
jne 0x40e3f9
mov cl, byte [ebp + eax - 0x78]
mov byte [ebp + eax + 0x8c], cl
inc eax
cmp cl, bl
jne 0x40e3ce
push edi
lea edi, [ebp + 0x8c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e3e6
mov esi, str.config.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
lea eax, [ebp + 0x8c]
push eax
push ebx
push str.SYSIE
push 0x46486c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x80]
mov dword [ecx + 0x14c], eax
mov ecx, dword [ebp + 0x190]
pop esi
xor ecx, ebp
pop ebx
call fcn.004410db
add ebp, 0x194
leave
ret 4
Function at 0x40e9b6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x4777a8]
xor eax, esp
mov dword [esp + 0x14c], eax
push esi
push edi
mov eax, dword [0x4777a8]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x20], esi
call fcn.0041e760
push eax
lea ecx, [esp + 0x18]
call fcn.0040237a
push ebx
lea eax, [esp + 0x18]
push 0x464670
push eax
mov dword [esp + 0x174], esi
call fcn.0040257d
add esp, 0xc
mov edi, 0x464857
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.0040230f
push edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], 1
call fcn.0040230f
mov byte [esp + 0x168], 2
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.004414d7
pop ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.0041e760
push eax
lea ecx, [esp + 0x20]
call fcn.0040237a
lea eax, [esp + 0x24]
push eax
lea esi, [esp + 0x10]
mov byte [esp + 0x16c], 3
call fcn.0040fffa
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x16c], 4
call fcn.00401f24
mov byte [esp + 0x168], 3
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004023bd
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x18]
call fcn.00431107
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x40eb82
push 0x464ea8
push ebx
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x40eb82
lea eax, [esp + 0x2c]
push eax
lea esi, [esp + 0x10]
call fcn.0040fffa
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], 5
call fcn.00401f24
mov byte [esp + 0x168], 3
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004023bd
lea eax, [esp + 0x34]
push eax
lea esi, [esp + 0x10]
call fcn.0040fffa
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], 6
call fcn.00401f24
mov byte [esp + 0x168], 3
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004023bd
push edi
lea ecx, [esp + 0x14]
call fcn.00401f83
test eax, eax
jne 0x40eb82
push edi
lea ecx, [esp + 0x1c]
call fcn.00401f83
test eax, eax
jne 0x40eb82
mov dword [esp + 0x20], 1
lea ecx, [edi - 0x10]
call fcn.004023bd
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004023bd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004023bd
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004023bd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.004410db
mov esp, ebp
pop ebp
ret
Function at 0x41092c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4777a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x412]
push 0
push eax
mov edi, ecx
call fcn.00444c50
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00444c50
mov ax, word [ebx]
mov word [ebp - 0x414], ax
mov ax, word [ebx + 2]
add esp, 0x18
mov word [ebp - 0x412], ax
test edi, edi
je 0x4109f4
push 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4109f4
lea eax, [ebp - 0x20c]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4109b3
lea eax, [ebx + 4]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4109c6
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4109d4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
inc eax
jmp 0x4109f6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004410db
leave
ret
Function at 0x410ac9
Capabilities:
Enumerate process modules
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x2b0]
sub esp, 0x330
mov eax, dword [0x4777a8]
xor eax, ebp
mov dword [ebp + 0x2ac], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp + 0x1a9]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x1a8], bl
call fcn.00444c50
add esp, 0xc
cmp esi, ebx
jne 0x410b0e
xor eax, eax
jmp 0x410b11
mov eax, dword [esi + 0x20]
push ebx
push 0x26
lea ecx, [ebp + 0x1a8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x220
mov edi, eax
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call fcn.00444c50
add esp, 0xc
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x410c47
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], 0x224
call sub.KERNEL32.dll_Module32First
jmp 0x410c36
lea eax, [ebp + 0xa4]
push str.shock
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x410c2a
lea eax, [ebp + 0xa4]
push 0x464ea8
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x410c2a
lea edi, [ebp + 0xa4]
call fcn.0041025f
test eax, eax
je 0x410c2a
mov eax, edi
push str.urlnav
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x410c2a
mov eax, edi
push str.cpush
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x410c2a
mov eax, edi
push str.wssecure
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x410c2a
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x410c01
xor eax, eax
jmp 0x410c1b
lea eax, [edi + edi]
call fcn.004457c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa4]
push ecx
push eax
call fcn.0040e96b
cmp dword [0x47f570], ebx
je 0x410c2a
mov ecx, eax
call fcn.00410a04
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x410b6b
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2ac]
xor ecx, ebp
call fcn.004410db
add ebp, 0x2b0
leave
ret
Function at 0x411b4a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45a423
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4777a8]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
or dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00431deb
xor ebx, ebx
mov dword [esp + 0x70], ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebx
cmp eax, ebx
jbe 0x411c7d
push 0x30
pop edi
push edi
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00444c50
mov eax, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push 1
push dword [esp + 0x18]
mov dword [esp + 0x40], edi
push eax
mov dword [esp + 0x48], 0x31
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
test dword [esp + 0x3c], 0x100
je 0x411c5c
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x411c5c
cmp dword [eax + 4], 0x505a0a0
jne 0x411c5c
add eax, 0x10
push eax
lea ecx, [esp + 0x18]
call fcn.0040208f
push ebx
push 0x26
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.0041182d
cmp eax, ebx
jl 0x411c4a
inc eax
push eax
lea ecx, [esp + 0x18]
call fcn.0040e787
movsx eax, al
push eax
call fcn.0044496c
push dword [ebp + 8]
mov ebx, eax
call fcn.0044496c
pop ecx
pop ecx
cmp eax, ebx
jne 0x411c4a
push dword [esp + 0x10]
lea ecx, [esp + 0x24]
push dword [esp + 0x2c]
call fcn.0043e274
xor ebx, ebx
mov byte [esp + 0x70], bl
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004023bd
test byte [esp + 0x40], 0x80
je 0x411c6b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x1c]
jb 0x411ba8
mov esi, dword [esp + 0x28]
cmp esi, ebx
jne 0x411caa
xor esi, esi
or dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00431e02
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 1
jne 0x411cbe
mov eax, dword [esp + 0x24]
movzx esi, word [eax]
or esi, 0x20000
jmp 0x411c87
mov edx, dword [esp + 0x24]
xor ecx, ecx
xor eax, eax
cmp esi, ebx
jbe 0x411ce0
cmp eax, ebx
jl 0x411cf6
cmp eax, esi
jge 0x411cf6
mov edi, dword [edx + eax*4]
cmp edi, dword [esp + 0x18]
ja 0x411cf2
inc eax
cmp eax, esi
jb 0x411cca
cmp ecx, esi
jge 0x411cf6
lea eax, [edx + ecx*4]
movzx esi, word [eax]
or esi, 0x30000
jmp 0x411c87
mov ecx, eax
jmp 0x411ce0
call fcn.0041e6d5
int3
Function at 0x411ea3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 8]
lea eax, [ebx + 0x28]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x411fbb
push edi
lea edi, [esi + 1]
push edi
call fcn.004155b9
push edi
push 0
push eax
mov dword [ebx], eax
call fcn.00444c50
add esp, 0x10
push dword [ebx]
lea eax, [ebx + 0x28]
push esi
push dword [ebp - 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x411fb8
mov eax, dword [ebx]
and dword [ebp - 4], 0
test eax, eax
je 0x411fb8
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x465758
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x411fb8
mov esi, dword [ebp - 4]
push 0xd
pop ecx
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov word [ebx + 0xa], ax
mov eax, dword [ebp - 0x34]
shr ecx, 0x10
mov esi, dword [ebp + 8]
mov word [ebx + 8], cx
mov ecx, eax
mov word [ebx + 0xe], ax
mov eax, dword [ebp - 0x30]
shr ecx, 0x10
mov word [ebx + 0xc], cx
mov ecx, eax
mov word [ebx + 0x12], ax
mov eax, dword [ebp - 0x2c]
shr ecx, 0x10
mov word [ebx + 0x16], ax
mov word [ebx + 0x10], cx
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x18]
shr ecx, 0x10
mov word [ebx + 0x14], cx
mov dword [ebx + 0x24], eax
lea edi, [ebx + 0x230]
mov ebx, str.CompanyName
call fcn.00412078
lea edi, [esi + 0x640]
mov ebx, 0x467e8c
call fcn.00412078
lea edi, [esi + 0x438]
mov ebx, 0x467e9c
call fcn.00412078
xor eax, eax
inc eax
jmp 0x411fba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412134
Capabilities:
Enumerate process modules
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x4777a8]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
call esi
mov edi, 0x220
jmp 0x412248
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], 0x224
call sub.KERNEL32.dll_Module32First
jmp 0x412205
lea eax, [esp + 0x138]
push str.shock
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x4121f7
lea eax, [esp + 0x138]
push 0x464ea8
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x4121f7
lea ebx, [esp + 0x138]
call fcn.0040e9b6
test eax, eax
je 0x4121f7
mov eax, ebx
push str.urlnav
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x4121f7
mov eax, ebx
push str.cpush
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x4121f7
mov eax, ebx
push str.wssecure
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x41220f
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x41217e
jmp 0x41222a
push str.C:Program_Files1234df.dll
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0x14], 1
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
jne 0x41227c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
mov ebx, eax
xor eax, eax
push edi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call fcn.00444c50
add esp, 0xc
push ebx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x412163
xor eax, eax
jmp 0x41227f
xor eax, eax
inc eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004410db
mov esp, ebp
pop ebp
ret

Function at 0x412560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
mov edi, str.SOFTWARE123
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4125a7
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4125d4
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push str.HomePage
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x4125d4
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret