joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409970
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x42c120
push 1
push 0
push 0x42bf40
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4099a8
xor eax, eax
pop edi
pop esi
add esp, 0x210
ret
lea eax, [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push 0x429c70
push ecx
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
test esi, esi
jl 0x409ae4
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x4099dd
push eax
mov eax, dword [esp + 0xc]
push eax
mov esi, dword [eax]
call dword [esi + 0x50]
jmp 0x4099f3
mov eax, dword [esp + 0x238]
test eax, eax
je 0x4099f5
push eax
mov eax, dword [esp + 0xc]
push eax
mov esi, dword [eax]
call dword [esi + 0x14]
mov esi, eax
test esi, esi
jl 0x409ada
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 8]
push eax
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jl 0x409ada
mov edx, dword [esp + 0x224]
test edx, edx
je 0x409a49
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409a49
mov eax, dword [esp + 8]
push edx
push eax
mov esi, dword [eax]
call dword [esi + 0x2c]
mov esi, eax
test esi, esi
jl 0x409ada
mov edx, dword [esp + 0x228]
test edx, edx
je 0x409a75
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409a75
mov eax, dword [esp + 8]
push edx
push eax
mov esi, dword [eax]
call dword [esi + 0x24]
mov esi, eax
test esi, esi
jl 0x409ada
mov edx, dword [esp + 0x230]
test edx, edx
je 0x409aa9
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409aa9
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 8]
push eax
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
mov esi, eax
test esi, esi
jl 0x409ada
lea eax, [esp + 0x10]
push 0x104
mov ecx, dword [esp + 0x224]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
push 1
mov eax, dword [esp + 0x10]
push ecx
push eax
mov esi, dword [eax]
call dword [esi + 0x18]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, 1
test esi, esi
jge 0x409af9
xor eax, eax
pop edi
pop esi
add esp, 0x210
ret
Function at 0x409b80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
lea eax, [esp]
push ebx
push esi
push edi
push eax
call dword [0x43b8b8]
test eax, eax
jge 0x409b9e
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push eax
push 0x11
push ecx
call dword [0x43b8b4]
test eax, eax
jge 0x409bbd
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push 0x42bfa0
push 0
push ecx
mov eax, dword [edx]
push edx
call dword [eax + 0x14]
test eax, eax
jge 0x409be5
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0xc]
push eax
push str.Dial_Up_Networking
push ecx
call fcn.00409d30
add esp, 0xc
test eax, eax
jne 0x409c09
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push eax
push 0x42bfa0
push 0
push ecx
mov eax, dword [edx]
push edx
call dword [eax + 0x14]
test eax, eax
jge 0x409c31
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
push 0x4302d8
push ecx
call fcn.00409d30
add esp, 0xc
test eax, eax
jne 0x409c55
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [eax]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov cx, word [eax]
mov eax, dword [esp + 0x10]
add edx, ecx
xor ecx, ecx
mov cx, word [eax]
mov eax, dword [0x436a00]
lea esi, [edx + ecx + 2]
mov ebx, dword [eax]
push esi
push eax
call dword [ebx + 0xc]
mov ebx, dword [esp + 0x24]
mov edi, eax
test edi, edi
mov dword [ebx], eax
jne 0x409c97
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
xor edx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov edi, dword [ebx]
mov dx, word [eax]
mov esi, eax
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov dx, word [eax]
mov eax, dword [esp + 0x14]
add edx, dword [ebx]
mov esi, eax
xor ebx, ebx
mov edi, edx
mov bx, word [eax]
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov cx, word [eax]
xor ebx, ebx
add edx, ecx
mov eax, dword [esp + 0x18]
mov bx, word [eax]
mov edi, edx
mov esi, eax
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov cx, word [eax]
mov word [ecx + edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x409e30
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x64
push ebx
push esi
push edi
mov esi, 0xffffffff
mov ebx, dword [esp + 0x78]
push ebp
mov eax, dword [ebx]
test eax, eax
je 0x409e62
cmp eax, 1
je 0x409f0d
cmp eax, 2
je 0x409f72
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
push 0
mov eax, dword [ebx + 4]
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0x40
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
mov ebp, eax
mov eax, dword [0x436a00]
push eax
mov edi, dword [eax]
call dword [edi + 0xc]
mov edi, eax
test edi, edi
je 0x409fc4
push 0
mov eax, dword [ebx + 4]
push 0
push ebp
push edi
push 0xffffffffffffffff
push eax
push 0x40
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, edi
mov edx, dword [esp + 0x80]
mov esi, edx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x409ed3
or cl, cl
je 0x409ecf
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x409ed3
add eax, 2
add esi, 2
or cl, cl
jne 0x409eb3
xor esi, esi
jmp 0x409ed8
sbb esi, esi
sbb esi, 0xffffffff
lea eax, [esp + 0x10]
push edx
push edi
push str.__s____s__n
push eax
call fcn.0040f6c0
lea eax, [esp + 0x20]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov eax, dword [0x436a00]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
mov esi, dword [ebx + 4]
mov ecx, dword [esp + 0x78]
add esi, ecx
mov edx, dword [esp + 0x80]
mov edi, edx
mov al, byte [esi]
cmp al, byte [edi]
jne 0x409f3f
or al, al
je 0x409f3b
mov al, byte [esi + 1]
cmp al, byte [edi + 1]
jne 0x409f3f
add esi, 2
add edi, 2
or al, al
jne 0x409f1f
xor esi, esi
jmp 0x409f44
sbb esi, esi
sbb esi, 0xffffffff
push edx
mov eax, dword [ebx + 4]
add eax, ecx
push eax
push str.__s____s__n
lea eax, [esp + 0x1c]
push eax
call fcn.0040f6c0
lea eax, [esp + 0x20]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
add ebx, 4
mov edx, dword [esp + 0x80]
mov eax, ebx
mov esi, edx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x409fa0
or cl, cl
je 0x409f9c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x409fa0
add eax, 2
add esi, 2
or cl, cl
jne 0x409f80
xor esi, esi
jmp 0x409fa5
sbb esi, esi
sbb esi, 0xffffffff
lea eax, [esp + 0x10]
push edx
push ebx
push str.__s____s__n
push eax
call fcn.0040f6c0
lea eax, [esp + 0x20]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x40a000
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x244
lea eax, [esp + 0x140]
push ebx
push esi
push edi
mov esi, dword [esp + 0x254]
push esi
push str._s.
push eax
call fcn.0040f6c0
add esp, 0xc
test esi, esi
jne 0x40a036
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x244
ret
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov edi, eax
je 0x40a136
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0xc], 0x10
je 0x40a0fa
lea ecx, [esp + 0x38]
mov edx, 0x432618
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40a08e
or al, al
je 0x40a08a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40a08e
add ecx, 2
add edx, 2
or al, al
jne 0x40a06e
xor eax, eax
jmp 0x40a093
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40a0f3
lea ecx, [esp + 0x38]
mov edx, 0x432614
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40a0c0
or al, al
je 0x40a0bc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40a0c0
add ecx, 2
add edx, 2
or al, al
jne 0x40a0a0
xor eax, eax
jmp 0x40a0c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40a0f3
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14c]
push eax
push esi
push str._s_s
push ecx
call fcn.0040f6c0
lea ecx, [esp + 0x15c]
add esp, 0x10
push ecx
call fcn.0040a000
jmp 0x40a122
test byte [esp + 0xc], 0x10
jne 0x40a125
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14c]
push eax
push esi
push str._s_s
push ecx
call fcn.0040f6c0
lea ecx, [esp + 0x15c]
add esp, 0x10
push ecx
call fcn.0040a150
add esp, 4
lea eax, [esp + 0xc]
push eax
push edi
call ebx
cmp eax, 1
je 0x40a05a
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x244
ret

Function at 0x40a150
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x40a16b
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x40a210
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
push edi
push ebp
push eax
push ebx
push esi
call dword [0x43b618]
mov edi, eax
test edi, edi
jne 0x40a28e
mov ebp, dword [0x43b62c]
lea eax, [esp + 0x14]
push 0xff
mov ecx, dword [esp + 0x14]
push eax
push 0
push ecx
call ebp
mov edi, eax
test edi, edi
jne 0x40a26f
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0040a210
mov edi, eax
test edi, edi
je 0x40a241
cmp edi, 0x103
je 0x40a284
cmp edi, 0x3f2
je 0x40a284
cmp edi, 2
jne 0x40a28e
push ebx
push esi
call dword [0x43b60c]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [0x43b624]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret 8
Function at 0x40b210
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1a4
push ebx
push esi
push edi
mov esi, ecx
lea eax, [esp + 0xac]
push ebp
mov dword [esi + 0x60], 0
push 0x435e24
push 0xc
push eax
push 0x430160
push str.POP_DIALUP_CT
push str.WEB_BULLET
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40b25e
lea eax, [esp + 0xb0]
push eax
call fcn.0040f7e0
add esp, 4
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
test eax, eax
jg 0x40b272
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a4
ret
mov ecx, eax
shl ecx, 4
add ecx, eax
shl ecx, 2
push ecx
call fcn.00421690
add esp, 4
mov edi, eax
mov dword [esi + 0x5c], eax
test edi, edi
jne 0x40b29b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a4
ret
mov eax, dword [esi + 0x60]
mov ecx, eax
shl eax, 4
xor ebp, ebp
add eax, ecx
xor ebx, ebx
lea ecx, [eax*4]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
cmp dword [esi + 0x60], ebp
jle 0x40b31c
lea eax, [esp + 0x10]
push ebx
push str.POP_DIALUP_INFO__.3d
push eax
call fcn.0040f6c0
lea edi, [esp + 0x3c]
add esp, 0xc
xor eax, eax
mov ecx, 0x1f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push 0x435e24
stosb byte es:[edi], al
lea eax, [esp + 0x34]
push 0x7f
push eax
push 0x430160
push ecx
push str.WEB_BULLET
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40b316
lea eax, [esp + 0x30]
push ebp
push eax
mov ecx, esi
call fcn.0040b340
test eax, eax
je 0x40b316
inc ebp
inc ebx
cmp dword [esi + 0x60], ebx
jg 0x40b2bc
mov eax, dword [esi + 0x60]
pop ebp
sub eax, ebx
pop edi
pop esi
cmp eax, 1
sbb eax, eax
pop ebx
neg eax
add esp, 0x1a4
ret

Function at 0x40ba40
Capabilities:
Print debug messages

Disassembly:
push esi
xor eax, eax
mov dword [ecx], 0x429778
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x50], eax
mov dword [ecx + 0x54], eax
mov esi, ecx
call fcn.00408140
test eax, eax
jne 0x407e5e
push str.Error_initializing_ras_or_rna_dlls____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
ret
mov ecx, 0x436a18
jmp 0x407e00
Function at 0x40bcf0
Capabilities:
Create thread

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0xc]
push eax
lea edi, [esi + 4]
push ecx
mov ecx, edi
call fcn.0040bf40
test eax, eax
jne 0x40bd19
xor eax, eax
pop edi
pop esi
add esp, 8
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0040c360
test eax, eax
jne 0x40bd38
xor eax, eax
pop edi
pop esi
add esp, 8
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0040c3e0
test eax, eax
jne 0x40bd57
xor eax, eax
pop edi
pop esi
add esp, 8
ret 4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0040c060
push esi
push 0
push esi
push 0x40bd90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop edi
pop esi
add esp, 8
ret 4

Function at 0x40bea0
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 0x436a18
jmp fcn.00408140

Function at 0x40c120
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jl 0x40c14c
cmp eax, 9
jae 0x40c14c
mov ecx, dword [eax*4 + 0x433158]
xor eax, eax
cmp dword [ecx], 0x1c
je 0x40c15c
add ecx, 0x10
inc eax
cmp eax, 0x64
jl 0x40c136
mov eax, 0xffffffff
ret 4
push str.mpstate::getLastIndex_failed_due_to_bad_table_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0xffffffff
ret 4

Function at 0x40c610
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x408
push ebx
push esi
push edi
mov ebx, ecx
push ebp
call fcn.00426bf7
mov eax, dword [eax + 0xc]
xor ebp, ebp
mov ecx, dword [ebx]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
push ecx
mov ecx, ebx
call fcn.0040c120
test eax, eax
jl 0x40c6d4
mov eax, dword [ebx + 4]
add eax, ebp
cmp dword [eax + 4], 2
jne 0x40c6b9
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x40c6b9
lea ecx, [esp + 0x18]
push 0x400
push ecx
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jle 0x40c680
inc eax
push eax
call fcn.00421690
add esp, 4
mov ecx, dword [ebx + 4]
mov dword [ecx + ebp + 0xc], eax
jmp 0x40c68b
push str.Error_loading_string_resource_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebx + 4]
mov edx, dword [eax + ebp + 0xc]
test edx, edx
je 0x40c6e4
lea edi, [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebp, 0x10
mov eax, dword [ebx]
push eax
mov ecx, ebx
inc dword [esp + 0x14]
call fcn.0040c120
cmp eax, dword [esp + 0x10]
jge 0x40c640
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x408
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x408
ret
Function at 0x40e010
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
lea ecx, [esp + 8]
push edi
mov dword [esp + 8], 0x104
push eax
push ecx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00409380
add esp, 0x14
test eax, eax
jne 0x40e077
mov edi, str.WebBullet_Free_Trial.lnk
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0xc]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push eax
call fcn.0040a150
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0x104
add esp, 4
push eax
push ecx
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00409380
add esp, 0x14
test eax, eax
jne 0x40e122
mov edi, str.WebBullet
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0xc]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.WebBullet_Free_Trial.lnk
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0xc]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push eax
call fcn.0040a150
add esp, 4
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x40e4f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ebp, ebp
lea eax, [esp + 0x118]
push ebp
push str.URL_SHORTCUT__.2d
push eax
call fcn.0040f6c0
lea edi, [esp + 0x1c]
add esp, 0xc
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push 0x435e24
lea ecx, [esp + 0x11c]
push 0x104
push eax
push 0x430160
push ecx
push str.WEB_BULLET
call ebx
test eax, eax
je 0x40e5a0
lea eax, [esp + 0x10]
push 0x2c
push eax
call fcn.00410300
add esp, 8
test eax, eax
je 0x40e5b2
mov byte [eax], 0
inc eax
lea ecx, [esp + 0x118]
push eax
push esi
inc ebp
push str._s_s.url
push ecx
call fcn.0040f6c0
lea ecx, [esp + 0x20]
lea edx, [esp + 0x128]
add esp, 0x10
push ecx
push edx
call fcn.0040a180
add esp, 8
cmp ebp, 0xa
jl 0x40e509
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret 4
xor eax, eax
jmp 0x40e5a5

Function at 0x4103c0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b3b8
push 0x414f70
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4344f0], eax
xor eax, eax
mov al, byte [0x4344f1]
mov dword [0x4344fc], eax
mov eax, dword [0x4344f0]
shr dword [0x4344f0], 0x10
and eax, 0xff
mov dword [0x4344f8], eax
shl eax, 8
add eax, dword [0x4344fc]
mov dword [0x4344f4], eax
call fcn.00414f50
call fcn.00411f10
test eax, eax
jne 0x410439
push 0x10
call fcn.00410560
add esp, 4
mov dword [ebp - 4], 0
call fcn.00414d70
call fcn.00411180
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x439d38], eax
call fcn.00414bd0
mov dword [0x4344b0], eax
test eax, eax
je 0x41046c
cmp dword [0x439d38], 0
jne 0x410476
push 0xffffffffffffffff
call fcn.00410ce0
add esp, 4
call fcn.00414960
call fcn.00414880
call fcn.00410cb0
mov esi, dword [0x439d38]
mov al, byte [esi]
cmp al, 0x22
je 0x41049d
cmp al, 0x20
jbe 0x4104ca
inc esi
cmp byte [esi], 0x20
ja 0x410495
jmp 0x4104ca
inc esi
cmp byte [esi], 0x22
je 0x4104c9
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4104c4
xor eax, eax
mov al, bl
push eax
call fcn.00414820
add esp, 4
test eax, eax
je 0x4104be
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x4104a6
cmp byte [esi], 0x22
jne 0x4104ca
inc esi
cmp byte [esi], 0
je 0x4104da
cmp byte [esi], 0x20
ja 0x4104da
inc esi
cmp byte [esi], 0
jne 0x4104cf
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4104fe
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00410ce0
jmp 0x41053f
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410d20
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.00410de0
cmp dword [0x43452c], 1
mov esi, dword [esp + 0x10]
jne 0x410d43
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x434528], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x434524], bl
jne 0x410d9d
cmp dword [0x439d30], 0
je 0x410d8b
mov edi, dword [0x439d2c]
sub edi, 4
cmp dword [0x439d30], edi
ja 0x410d8b
mov eax, dword [edi]
test eax, eax
je 0x410d80
call eax
sub edi, 4
cmp dword [0x439d30], edi
jbe 0x410d78
push 0x430140
push 0x430138
call fcn.00410e00
add esp, 8
push 0x430148
push 0x430144
call fcn.00410e00
add esp, 8
test ebx, ebx
je 0x410dbc
call fcn.00410df0
pop edi
pop esi
pop ebx
ret
mov dword [0x43452c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x411f10
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.00412010
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4349a0], eax
cmp eax, 0xffffffff
jne 0x411f2a
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.004154d0
add esp, 8
mov esi, eax
test esi, esi
je 0x411f6c
push esi
mov eax, dword [0x4349a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x411f6c
push esi
call fcn.00411f70
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x411f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4349a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x411ff3
push 0x74
push 1
call fcn.004154d0
add esp, 8
mov edi, eax
test edi, edi
je 0x411fe9
push edi
mov eax, dword [0x4349a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x411fe9
push edi
call fcn.00411f70
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x411ff3
push 0x10
call fcn.00410560
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret