joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1512c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], edi
cmp eax, edi
je 0x151c3
cmp dword [ecx + 8], 4
jb 0x151c3
lea ecx, [ebp + 8]
push ecx
push dword [eax]
call fcn.00013ec0
test eax, eax
jl 0x151c3
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x151c3
cmp dword [ebx + 4], edi
je 0x151ba
movzx eax, word [ebx]
test ax, ax
je 0x151ba
movzx edi, ax
inc edi
inc edi
cmp edi, dword [ebp + 0xc]
jbe 0x151ac
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000017
mov dword [esi + 0x18], eax
mov ebx, eax
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
push ebx
mov eax, edi
shr eax, 1
push eax
push dword [ebp - 4]
call fcn.0001400e
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov dword [esi + 0x18], ebx
jmp 0x15196
Function at 0x156c0
Capabilities:
Register network filter via wfp api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x1a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp + 0x10]
push 0x3c
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x5c]
push 0
push eax
mov dword [ebp - 0x100], esi
call sub.ntoskrnl.exe_memset
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xf8]
mov eax, 0x1850a
mov dword [ebp - 0x48], eax
mov ebx, 0x184d8
mov dword [ebp - 0x4c], ebx
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
push dword [0x1a9a0]
mov dword [ebp - 0x44], esi
call sub.fwpkclnt.sys_FwpmCalloutAdd0
cmp eax, esi
jl 0x157ee
push 0x98
lea eax, [ebp - 0xf4]
push esi
push eax
call sub.ntoskrnl.exe_memset
mov esi, dword [ebp - 0xf8]
lea edi, [ebp - 0xcc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x9c], 0x5003
lea edi, [ebp - 0x98]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xfc]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xa0], eax
lea edi, [ebp - 0xbc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov esi, 0x195ac
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push ebx
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0xf4]
xor edx, edx
push eax
push dword [0x1a9a0]
inc edx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
mov byte [ebp - 8], 6
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00017e51
leave
ret 0xc
Function at 0x15804
Capabilities:
Register network filter via wfp api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x1a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x10]
push 0x3c
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x40]
push 0
push eax
mov dword [ebp - 0xe4], esi
call sub.ntoskrnl.exe_memset
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xdc]
mov eax, 0x18566
mov dword [ebp - 0x2c], eax
mov ebx, 0x18548
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x40]
push eax
push dword [0x1a9a0]
mov dword [ebp - 0x28], esi
call sub.fwpkclnt.sys_FwpmCalloutAdd0
cmp eax, esi
jl 0x15902
push 0x98
lea eax, [ebp - 0xd8]
push esi
push eax
call sub.ntoskrnl.exe_memset
mov esi, dword [ebp - 0xdc]
lea edi, [ebp - 0xb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xe4]
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x80], 0x5003
lea edi, [ebp - 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xe0]
xor eax, eax
mov dword [ebp - 0x84], eax
lea edi, [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
push eax
movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0xd8]
push eax
push dword [0x1a9a0]
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00017e51
leave
ret 0xc
Function at 0x15918
Capabilities:
Register network filter via wfp api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x1a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp + 0x10]
push 0x3c
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x5c]
push 0
push eax
mov dword [ebp - 0x100], esi
call sub.ntoskrnl.exe_memset
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xf8]
mov eax, 0x1850a
mov dword [ebp - 0x48], eax
mov ebx, 0x184d8
mov dword [ebp - 0x4c], ebx
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x5c]
push eax
push dword [0x1a9a0]
mov dword [ebp - 0x44], esi
call sub.fwpkclnt.sys_FwpmCalloutAdd0
cmp eax, esi
jl 0x15a46
push 0x98
lea eax, [ebp - 0xf4]
push esi
push eax
call sub.ntoskrnl.exe_memset
mov esi, dword [ebp - 0xf8]
lea edi, [ebp - 0xcc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x9c], 0x5003
lea edi, [ebp - 0x98]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xfc]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xa0], eax
lea edi, [ebp - 0xbc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov esi, 0x195ac
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push ebx
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0xf4]
xor edx, edx
push eax
push dword [0x1a9a0]
inc edx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
mov byte [ebp - 8], 0x11
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00017e51
leave
ret 0xc
Function at 0x4017c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404004]
jne 0x4017ce
repz ret
jmp fcn.00401b99

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x405f90
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552fc6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x405fcc
xor eax, eax
jmp 0x406035
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00513d10
add esp, 0xc
call fcn.00406940
test al, al
lea eax, [ebp - 0x218]
je 0x406051
push str.Bin360AppCore.exe
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x21c]
call fcn.00407cd0
push edi
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push str.360DesktopMainProg
lea ecx, [ebp - 0x21c]
call fcn.004094b0
lea ecx, [ebp - 0x21c]
mov ebx, eax
call fcn.00408990
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
push str.Bin360Desktop.exe
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406033
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x406174
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
test edi, edi
je 0x4060c6
push edi
push eax
lea eax, [ebp - 0x21c]
push 0x563ae4
push eax
call fcn.00406440
add esp, 0x10
jmp 0x4060db
push eax
lea eax, [ebp - 0x21c]
push 0x563af4
push eax
call fcn.00406440
add esp, 0xc
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 4], 1
mov edi, dword [esi - 0xc]
jle 0x4060fc
push edi
lea ecx, [ebp - 0x21c]
call fcn.004063c0
mov esi, dword [ebp - 0x21c]
lea eax, [edi + edi]
push eax
push esi
push 1
push 0
push str.360Desktop
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esi - 8]
mov ebx, eax
push esi
call fcn.00517503
add esp, 8
test eax, eax
js 0x40616a
cmp eax, dword [esi - 8]
jg 0x40616a
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x406033
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x406033
push 0x80070057
call fcn.00406210
push 0x80004005
call fcn.00406210
int3
Function at 0x4062d0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552ff8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5ad6f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40630d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call fcn.00406610
add esp, 8
test eax, eax
jne 0x40633a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
call fcn.00406940
test al, al
je 0x40637b
lea ecx, [ebp + 8]
call fcn.00407cd0
push 1
push str.360DesktopMainProg
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00409e10
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00408990
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4063aa
push str.360Desktop
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406e99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406e99
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406e8a
cmp esi, edx
jae 0x406e99
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x406e78
cmp esi, edx
jae 0x406e99
cmp word [esi], 0
je 0x406e99
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40e080
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1062c
call fcn.004d68c0
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x414]
xor esi, esi
push eax
push 0x5ad004
call dword [sym.imp.ole32.dll_StringFromGUID2]
cmp dword [0x5ad018], esi
je 0x40e152
push ebx
push 0x5639e4
mov dword [ebp - 0x10628], esi
xor ebx, ebx
mov dword [ebp - 0x1062c], esi
mov dword [ebp - 0x10624], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40e14b
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e11b
lea ecx, [ebp - 0x10624]
push ecx
lea ecx, [ebp - 0x1062c]
push ecx
lea ecx, [ebp - 0x10628]
push ecx
call eax
movzx eax, word [ebp - 0x10624]
lea ebx, [esi + 1]
mov dword [ebp - 0x10624], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x40e14b
mov eax, dword [ebp - 0x10628]
cmp eax, 6
jne 0x40e13c
cmp dword [ebp - 0x1062c], 4
je 0x40e141
jmp 0x40e14b
cmp eax, 0xa
jb 0x40e14b
mov dword [0x5b3d24], 1
mov dword [0x5ad018], esi
pop ebx
cmp dword [0x5b3d24], esi
je 0x40e166
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov eax, str.SOFTWAREClassesCLSID_sInprocServer32
jmp 0x40e170
mov edi, SysReAllocString
mov eax, str.CLSID_sInprocServer32
lea ecx, [ebp - 0x414]
push ecx
push eax
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.0040eeb0
add esp, 0x10
call fcn.0040e2b0
movzx eax, al
lea ecx, [ebp - 0x1062c]
neg eax
mov dword [ebp - 0x1062c], esi
push ecx
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x620]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e29a
mov edi, dword [ebp - 0x1062c]
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00513d10
add esp, 0xc
mov dword [ebp - 0x10628], 0x208
lea eax, [ebp - 0x10628]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x10624]
push eax
push 0
push 0x5645e0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e28f
mov eax, dword [ebp - 0x10624]
cmp eax, 1
je 0x40e224
cmp eax, 2
jne 0x40e28f
mov eax, dword [ebp - 0x10628]
test eax, eax
je 0x40e240
test al, 1
jne 0x40e28f
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], si
je 0x40e249
jmp 0x40e28f
xor eax, eax
mov word [ebp - 0x20c], ax
push 0xfffe
lea eax, [ebp - 0x10620]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x10620]
push 0x7ffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x10620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
cmovne esi, ecx
test edi, edi
je 0x40e29a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004d684f
mov esp, ebp
pop ebp
ret
Function at 0x40e3b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5539cb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.Utils
push eax
call esi
call fcn.0040e2b0
test al, al
mov edx, str.HaloBand.dll
mov ecx, str.HaloBand_x64.dll
lea eax, [ebp - 0x218]
cmove ecx, edx
push ecx
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e580
mov eax, dword [0x5b3adc]
test al, 1
jne 0x40e499
or eax, 1
mov dword [0x5b3adc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x561c40
mov dword [0x5b3ad0], 0x5639b4
mov dword [0x5b3ad4], eax
mov byte [0x5b3ad8], 0
call fcn.004d683a
mov eax, dword [0x5b3adc]
add esp, 4
test al, 2
jne 0x40e4f5
or eax, 2
mov dword [0x5b3ae0], 0x5639cc
mov dword [0x5b3adc], eax
xor eax, eax
push 0x561c70
mov dword [0x5b3ae4], 0x5b3ad0
mov dword [0x5b3af4], 2
mov dword [0x5b3aec], 0
mov dword [0x5b3af0], 0
mov dword [0x5b3af8], eax
mov dword [0x5b3ae8], 0x5b3ae0
call fcn.004d683a
add esp, 4
mov eax, dword [0x5b3ae0]
mov ecx, 0x5b3ae0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x218]
push eax
mov ecx, str._u__s___s_
mov dword [ebp - 4], 0
mov eax, 0x563ae4
cmove eax, ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00406440
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0x1388
push 1
push 0
push esi
push str.regsvr32.exe
push 0
call fcn.00443e70
add esp, 0x30
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e57b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret 4
Function at 0x410610
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553d69
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], esi
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x41077d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x410787
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
jne 0x4106eb
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x564f60
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.00406ce0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.HaloDesktopData
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410742
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x564f60
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
call fcn.00406ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406210
push 0x80004005
call fcn.00406210
int3

Function at 0x4107a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553da8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], esi
xorps xmm0, xmm0
push dword [ecx]
movups xmmword [ebp - 0x30], xmm0
push 0xf
push eax
push 0x56504c
push str.ActiveCreatShortcut
push str.Default
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x410850
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x41082c
movzx eax, ax
push eax
call fcn.004069f0
jmp 0x410832
push eax
call fcn.00406ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00406210
int3