joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010d0
Capabilities:
Parse url

Disassembly:
sub esp, 0x944
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ebx, [ebp + 8]
mov ecx, ebx
call fcn.00401700
test eax, eax
jl 0x401294
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x155]
mov byte [esp + 0x154], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [esp + 0x958]
mov ecx, 0xf
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x58]
lea ecx, [esp + 0x158]
push 0x10000000
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], 0x800
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x401193
mov ecx, ebx
call fcn.00401a80
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x944
ret 0x14
mov al, byte [esp + 0x154]
test al, al
jne 0x4011ae
mov byte [esp + 0x154], 0x2f
mov byte [esp + 0x155], 0
lea eax, [esp + 0x54]
mov ecx, ebx
push eax
call fcn.00401840
mov esi, eax
test esi, esi
jl 0x40128b
mov esi, dword [esp + 0x960]
test esi, esi
jne 0x4011de
mov eax, dword [esp + 0x964]
test eax, eax
jne 0x4011de
xor edi, edi
jmp 0x4011e3
mov edi, 1
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x28]
push 0
push ecx
push edx
mov ecx, ebx
call fcn.004018a0
test eax, eax
jl 0x401281
mov eax, dword [esp + 0x968]
mov ecx, dword [esp + 0x95c]
push 0
push eax
lea edx, [esp + 0x15c]
push ecx
lea eax, [esp + 0x60]
push edx
push eax
mov ecx, ebp
call fcn.004012b0
test eax, eax
jl 0x401281
test edi, edi
je 0x401285
lea ecx, [esp + 0x4c]
push ecx
push 0
mov ecx, ebp
call fcn.004014a0
mov edi, eax
test edi, edi
jl 0x401289
mov edx, dword [esp + 0x964]
mov eax, dword [edx]
cmp edi, eax
jbe 0x40124e
mov edi, eax
test edi, edi
je 0x401274
mov eax, dword [ebp + 4]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00401c40
mov ecx, dword [esp + 0x964]
mov esi, eax
sub esi, edi
neg esi
sbb esi, esi
mov dword [ecx], edi
and esi, eax
jmp 0x40128b
mov ecx, dword [esp + 0x964]
xor esi, esi
mov dword [ecx], edi
jmp 0x40128b
mov esi, eax
jmp 0x40128b
xor esi, esi
jmp 0x40128b
mov esi, edi
mov ecx, ebx
call fcn.00401a80
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x944
ret 0x14

Function at 0x4016c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
neg eax
sbb eax, eax
inc eax
add esp, 0x190
ret

Function at 0x401800
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x401810
mov eax, 0x80004005
ret 4
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
inc eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
ret 4
Function at 0x401840
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
mov edi, ecx
mov al, byte [edi + 0xd]
test al, al
je 0x401855
pop edi
mov eax, 0x80004004
pop esi
ret 4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401895
cmp byte [esi], 0
je 0x401895
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [edi + 8], eax
jne 0x40188e
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x401884
pop edi
mov eax, 0x80004005
pop esi
ret 4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [edi + 8], edx
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 0x80070057
pop esi
ret 4

Function at 0x4018a0
Capabilities:
Check for time delay via gettickcount
Connect socket
Get socket status

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x224
test eax, eax
push ebx
push esi
push edi
mov esi, ecx
je 0x4018c8
cmp byte [eax], 0
je 0x4018c8
push eax
mov ecx, esi
call fcn.00401840
test eax, eax
jne 0x401a6d
cmp dword [esi + 4], 0xffffffff
jne 0x4018dd
mov ecx, esi
call fcn.00401700
test eax, eax
jne 0x401a6d
mov al, byte [esi + 0xd]
test al, al
je 0x4018f5
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov ecx, dword [esp + 0x234]
mov eax, dword [esi + 8]
push ecx
mov dword [esp + 0x20], eax
mov word [esp + 0x1c], 2
call sub.WS2_32.dll_htons
mov word [esp + 0x1a], ax
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 0x10
push edx
push eax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x40194e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x40194e
cmp eax, 0x2734
je 0x40194e
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x224
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
mov al, byte [esi + 0xd]
test al, al
jne 0x401a16
mov edi, dword [esp + 0x238]
mov ebx, 1
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x130]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x134], eax
push edx
push ecx
inc eax
push 0
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc350
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x401a61
test eax, eax
je 0x4019ed
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401a27
mov edx, dword [esi + 4]
lea ecx, [esp + 0x12c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40193d
jmp 0x4019f8
mov al, byte [esi + 0xd]
test al, al
jne 0x4018e4
cmp edi, 0xffffffff
je 0x401a0b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp edi, eax
jle 0x401a50
mov al, byte [esi + 0xd]
test al, al
je 0x40196f
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov al, byte [esi + 0xd]
test al, al
je 0x401a3f
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov byte [esi + 0xc], bl
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x224
ret 0xc
pop edi
pop esi
mov eax, 0x8001011f
pop ebx
add esp, 0x224
ret 0xc
mov al, byte [esi + 0xd]
neg al
sbb eax, eax
add eax, 0x80004005
pop edi
pop esi
pop ebx
add esp, 0x224
ret 0xc
Function at 0x401ae0
Capabilities:
Check for time delay via gettickcount
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x214
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x401c21
mov al, byte [esi + 0xc]
test al, al
je 0x401c21
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
mov al, byte [esi + 0xd]
test al, al
jne 0x401bb7
mov ebp, dword [esp + 0x22c]
mov edi, 1
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x124], eax
push edx
lea ecx, [esp + 0x20]
push 0
inc eax
push ecx
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc350
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x401bff
test eax, eax
je 0x401b99
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401bc8
mov edx, dword [esi + 4]
lea ecx, [esp + 0x11c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401bff
cmp ebp, 0xffffffff
je 0x401bac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp ebp, eax
jle 0x401c10
mov al, byte [esi + 0xd]
test al, al
je 0x401b21
pop edi
pop esi
mov eax, 0x80004004
pop ebp
add esp, 0x214
ret 0xc
mov al, byte [esi + 0xd]
test al, al
je 0x401be0
pop edi
pop esi
mov eax, 0x80004004
pop ebp
add esp, 0x214
ret 0xc
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x224]
mov edx, dword [esi + 4]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jge 0x401c26
pop edi
pop esi
mov eax, 0x80004005
pop ebp
add esp, 0x214
ret 0xc
pop edi
pop esi
mov eax, 0x8001011f
pop ebp
add esp, 0x214
ret 0xc
mov eax, 0x80010006
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x401cb0
Capabilities:
Check for time delay via gettickcount
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x214
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x401df1
mov al, byte [esi + 0xc]
test al, al
je 0x401df1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
mov al, byte [esi + 0xd]
test al, al
jne 0x401d87
mov ebp, dword [esp + 0x22c]
mov edi, 1
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x120]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x124], eax
push edx
push ecx
inc eax
push 0
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc350
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x401dcf
test eax, eax
je 0x401d69
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401d98
mov edx, dword [esi + 4]
lea ecx, [esp + 0x11c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401dcf
cmp ebp, 0xffffffff
je 0x401d7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp ebp, eax
jle 0x401de0
mov al, byte [esi + 0xd]
test al, al
je 0x401cf1
pop edi
pop esi
mov eax, 0x80004004
pop ebp
add esp, 0x214
ret 0xc
mov al, byte [esi + 0xd]
test al, al
je 0x401db0
pop edi
pop esi
mov eax, 0x80004004
pop ebp
add esp, 0x214
ret 0xc
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x224]
mov edx, dword [esi + 4]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_send
test eax, eax
jge 0x401df6
pop edi
pop esi
mov eax, 0x80004005
pop ebp
add esp, 0x214
ret 0xc
pop edi
pop esi
mov eax, 0x8001011f
pop ebp
add esp, 0x214
ret 0xc
mov eax, 0x80010006
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc

Function at 0x4021e0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40222a
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x402222
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x18], ebx
jne 0x402286
cmp esi, 0x7fffffff
ja 0x402286
test esi, esi
mov eax, edi
je 0x402282
mov edx, ebp
sub edx, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x402266
mov byte [eax], cl
inc eax
dec esi
jne 0x402257
jmp 0x40226a
test esi, esi
jne 0x402270
dec eax
mov ebx, 0x8007007a
test ebx, ebx
mov byte [eax], 0
jne 0x402282
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402295
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4022a0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4023a1
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp byte [esp + 0x14], bl
jne 0x402392
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x14]
push eax
call edi
mov ecx, 0x208
sub ecx, eax
cmp ecx, 0x7fffffff
ja 0x402392
xor eax, eax
cmp ecx, ebx
mov esi, ecx
lea edx, [esp + 0x14]
je 0x402392
cmp byte [edx], bl
je 0x40235d
inc edx
dec esi
jne 0x402353
jmp 0x402392
cmp esi, ebx
je 0x402392
lea edx, [esp + 0xc]
test edx, edx
je 0x40236d
mov eax, ecx
sub eax, esi
sub ecx, eax
lea eax, [esp + eax + 0x14]
je 0x402392
mov esi, str.Program_Files
sub esi, eax
mov dl, byte [esi + eax]
cmp dl, bl
je 0x40238b
mov byte [eax], dl
inc eax
dec ecx
jne 0x40237c
jmp 0x40238f
cmp ecx, ebx
jne 0x402390
dec eax
mov byte [eax], bl
lea eax, [esp + 0x14]
push eax
call edi
test eax, eax
je 0x40242e
lea ecx, [esp + 0x14]
push ecx
call edi
mov ecx, 0x208
sub ecx, eax
cmp ecx, 0x7fffffff
ja 0x402402
xor eax, eax
cmp ecx, ebx
mov esi, ecx
lea edx, [esp + 0x14]
je 0x402402
cmp byte [edx], bl
je 0x4023cd
inc edx
dec esi
jne 0x4023c3
jmp 0x402402
cmp esi, ebx
je 0x402402
lea edx, [esp + 0xc]
test edx, edx
je 0x4023dd
mov eax, ecx
sub eax, esi
sub ecx, eax
lea eax, [esp + eax + 0x14]
je 0x402402
mov esi, str.Internet_ExplorerIEXPLORE.EXE
sub esi, eax
mov dl, byte [esi + eax]
cmp dl, bl
je 0x4023fb
mov byte [eax], dl
inc eax
dec ecx
jne 0x4023ec
jmp 0x4023ff
cmp ecx, ebx
jne 0x402400
dec eax
mov byte [eax], bl
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.004021e0
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x210
ret 8
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x210
ret 8
Function at 0x4024b0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061d0
push 0x405440
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
or esi, 0xffffffff
mov dword [ebp - 0x264], esi
mov bl, 1
push 0x4092b8
mov eax, dword [ebp + 8]
push eax
push str._s_s
push 0x104
lea ecx, [ebp - 0x25c]
push ecx
call fcn.00402440
add esp, 0x14
mov byte [ebp - 0x159], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x264], eax
cmp eax, esi
jne 0x40254a
mov dword [ebp - 4], esi
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
mov esi, 0x4092b4
lea eax, [ebp - 0x12c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40257c
test cl, cl
je 0x402578
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40257c
add eax, 2
add esi, 2
test cl, cl
jne 0x402558
xor eax, eax
jmp 0x402581
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402658
mov esi, 0x4092b0
lea eax, [ebp - 0x12c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4025b8
test cl, cl
je 0x4025b4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4025b8
add eax, 2
add esi, 2
test cl, cl
jne 0x402594
xor eax, eax
jmp 0x4025bd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402658
test byte [ebp - 0x158], 0x10
je 0x40260a
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_
push 0x104
lea edx, [ebp - 0x368]
push edx
call fcn.00402440
add esp, 0x14
mov byte [ebp - 0x265], 0
push edi
lea eax, [ebp - 0x368]
push eax
call fcn.004024b0
mov bl, al
jmp 0x402652
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
push 0x104
lea eax, [ebp - 0x46c]
push eax
call fcn.00402440
add esp, 0x14
mov byte [ebp - 0x369], 0
test edi, edi
je 0x40263e
cmp edi, 1
jne 0x402658
lea ecx, [ebp - 0x46c]
push ecx
call fcn.004021d0
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x260], bl
lea edx, [ebp - 0x158]
push edx
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40254d
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
mov dword [ebp - 0x264], esi
test edi, edi
je 0x402693
cmp edi, 2
jne 0x4026bd
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x260], bl
test bl, bl
jne 0x4026bd
push 0
push edi
call fcn.00402700
mov byte [ebp - 0x260], bl
mov dword [ebp - 4], esi
jmp 0x4026e6
xor eax, eax
test bl, bl
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402a00
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esp + 4]
push edi
push eax
lea ecx, [esp + 0x10]
push 0
push ecx
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push closesocket
mov dword [esp + 0x20], 0
call esi
test eax, eax
jne 0x402bb6
mov eax, dword [esp + 8]
cmp eax, 6
jb 0x402bb6
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x10], edi
je 0x402bcb
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push edi
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push closesocket
call esi
test eax, eax
je 0x402a8d
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
add esp, 0x10
ret 8
mov ecx, dword [esp + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x402ab3
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
add esp, 0x10
ret 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov ebx, eax
call ebp
lea esi, [eax + edi + 1]
mov edx, dword [esp + 0x18]
cmp byte [edx], 0
je 0x402b57
mov eax, dword [esp + 0x24]
test eax, eax
je 0x402aec
cmp byte [eax], 0
je 0x402aec
push eax
lea eax, [edi + 4]
push eax
call fcn.00402be0
test eax, eax
jne 0x402b3f
mov cl, byte [esi]
test cl, cl
je 0x402b21
mov eax, dword [esp + 0x28]
test eax, eax
je 0x402b21
cmp byte [eax], 0
je 0x402b21
cmp cl, 0x21
push eax
jne 0x402b14
lea ecx, [esi + 5]
push ecx
call fcn.00402be0
test eax, eax
je 0x402b21
jmp 0x402b3f
lea edx, [esi + 4]
push edx
call fcn.00402be0
test eax, eax
jne 0x402b3f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call ebp
lea ebx, [ebx + eax + 1]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call ebp
lea ebx, [ebx + eax + 1]
push esi
call ebp
lea edi, [eax + esi + 1]
push edi
call ebp
lea esi, [eax + edi + 1]
mov al, byte [edi]
test al, al
jne 0x402ad1
mov esi, dword [esp + 0x1c]
mov byte [ebx], 0
sub ebx, esi
inc ebx
cmp ebx, 6
jae 0x402b7d
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
jmp 0x402b99
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x1c]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret 8
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x402cd0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x29c
push esi
mov esi, dword [esp + 0x2a4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1a1]
mov byte [esp + 0x1a0], 0
mov byte [esp + 0x9c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x9d]
mov dword [esp + 8], 0x94
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0xc]
cmp edx, 0xffffffff
rep stosd dword es:[edi], eax
jne 0x402d46
pop edi
mov eax, 1
pop esi
add esp, 0x29c
ret
test dl, 0x10
je 0x402d56
pop edi
xor eax, eax
pop esi
add esp, 0x29c
ret
push 0x104
lea eax, [esp + 0x1a4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 0x1a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x9c]
lea eax, [esp + 0x1a0]
push edx
push 0
push str.del
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x18], 2
jne 0x402e10
lea edx, [esp + 0x9c]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, eax
test edi, edi
je 0x402def
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x9c]
push 0
push ecx
call fcn.00402700
mov eax, edi
pop edi
pop esi
add esp, 0x29c
ret
lea edx, [esp + 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call fcn.00402700
mov eax, edi
pop edi
pop esi
add esp, 0x29c
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test edi, edi
jne 0x402e24
push eax
push esi
call fcn.00402700
mov eax, edi
pop edi
pop esi
add esp, 0x29c
ret

Function at 0x403df0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
mov dword [esp + 0x10], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
push eax
mov eax, dword [esp + 0x80]
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x403e4d
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret 4

Function at 0x403e70
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x403ea7
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push fcn.00403ec0
push esi
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x403eb1
mov eax, 1
pop esi
ret 8
mov edx, dword [esp + 8]
push edx
call fcn.00403ec0
mov eax, esi
pop esi
ret 8