joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ade3f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ade77
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004abec9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004abea1
jmp 0x4ade83
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4af531
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4af573
call fcn.004b4feb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4af573
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4af56a
xor eax, eax
jmp 0x4af57b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004af581
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b551b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b5549
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b5567
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b5481
jmp 0x4b5567
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b5567
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b5481
test edi, edi
mov eax, edi
jne 0x4b5551
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4db12b
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx - 0x38], dl
popal
sub eax, 0x23a50f83
mov esi, 0x6a155667
dec edi
popaw
sub dl, dl
invalid
Function at 0xa4bf120
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0xa4bf2ed
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
or ebp, 0xffffffff
jmp 0xa4bf14a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa4bf151
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa4bf140
mov eax, 1
add ebx, ebx
jne 0xa4bf163
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa4bf158
jne 0xa4bf174
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa4bf158
xor ecx, ecx
sub eax, 3
jb 0xa4bf188
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa4bf1fa
mov ebp, eax
add ebx, ebx
jne 0xa4bf193
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xa4bf1a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xa4bf1c4
inc ecx
add ebx, ebx
jne 0xa4bf1b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa4bf1a5
jne 0xa4bf1c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa4bf1a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa4bf1e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa4bf1d5
jmp 0xa4bf146
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa4bf1e4
add edi, ecx
jmp 0xa4bf146
pop esi
mov edi, esi
mov ecx, 0x24b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa4bf202
cmp byte [edi], 1
jne 0xa4bf202
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa4bf207
lea edi, [esi + 0x3b000]
mov eax, dword [edi]
or eax, eax
je 0xa4bf27f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x49454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x49580]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa4bf234
mov ecx, edi
jns 0xa4bf263
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x49584]
or eax, eax
je 0xa4bf279
mov dword [ebx], eax
add ebx, 4
jmp 0xa4bf251
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa4bf2b0
cmp al, 0xef
ja 0xa4bf2a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa4bf285
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa4bf292
mov ebp, dword [esi + 0x49588]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa4bf2e4
sub esp, 0xffffff80
jmp 0xa48bbf9
Function at 0x416f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x416f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416f38
mov eax, 1
add ebx, ebx
jne 0x416f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416f50
jne 0x416f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f50
xor ecx, ecx
sub eax, 3
jb 0x416f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x416ff2
mov ebp, eax
add ebx, ebx
jne 0x416f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416fbc
inc ecx
add ebx, ebx
jne 0x416fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416f9d
jne 0x416fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416fcd
jmp 0x416f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416fdc
add edi, ecx
jmp 0x416f3e
pop esi
mov edi, esi
mov ecx, 0x712
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x416ffa
cmp byte [edi], 0xa
jne 0x416ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x416fff
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41706e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41702c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1707c]
or eax, eax
je 0x417068
mov dword [ebx], eax
add ebx, 4
jmp 0x417049
call dword [esi + 0x17080]
popal
jmp 0x407cd2

Function at 0x5533700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0553378f
jae 0x553370e
xor ecx, ecx
call fcn.0553378f
jae 0x553373d
xor eax, eax
call fcn.0553378f
jae 0x553374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0553378f
adc al, al
jae 0x553372f
jne 0x5533779
stosb byte es:[edi], al
jmp 0x5533711
call fcn.0553379b
sub ecx, ebx
jne 0x5533756
call fcn.05533799
jmp 0x5533775
lodsb al, byte [esi]
shr eax, 1
je 0x5533783
adc ecx, ecx
jmp 0x5533772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.05533799
cmp eax, 0x7d00
jae 0x5533772
cmp ah, 5
jae 0x5533773
cmp eax, 0x7f
ja 0x5533774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5533711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401189
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011b0
cmp esi, eax
jb 0x4011ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x406170
Capabilities:
Get common file path

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4061ad
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push esi
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x4099f0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x454ca8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46fb88]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041b558
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x409a31
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x1b44]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
add esi, 0x1b44
push eax
mov dword [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x409a6f
mov eax, dword [esi]
push 0
push eax
call ebp
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x18]
push str._sDownLoad
push edx
call fcn.00401ab0
mov edi, dword [esp + 0x20]
add esp, 0xc
push edi
call ebx
test eax, eax
jne 0x409af8
push eax
push edi
call ebp
test eax, eax
jne 0x409af8
push 0x10
push 0x45a620
mov ecx, esi
call fcn.00401590
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x18]
push str._sDownLoad
push edx
call fcn.00401ab0
mov esi, dword [esp + 0x20]
add esp, 0xc
push esi
call ebx
test eax, eax
jne 0x409af3
push eax
push esi
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x409ad8
call fcn.00401340
jmp 0x409b1c
call fcn.00401340
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
lea eax, [esi - 0x10]
jmp 0x409afb
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40a390
Capabilities:
Create process on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1b68], 0
mov dword [edi + 0x1ad0], 1
mov dword [edi + 0x1c10], 0
jle 0x40a3de
lea esi, [edi + 0x1b5c]
lea ebx, [ebx]
mov ecx, esi
call fcn.00406eb0
test eax, eax
je 0x40a3d5
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
cmp dword [edi + 0x1b68], 0
jg 0x40a3c0
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, 0x470f78
lea ebx, [edi + 0x1894]
nop
cmp dword [ebx], 0
je 0x40a43e
mov eax, dword [esi - 4]
test eax, eax
je 0x40a418
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00401710
mov ecx, edi
call fcn.0040a270
inc dword [edi + 0x1c10]
cmp dword [ebx], 0
je 0x40a43e
mov eax, dword [esi]
test eax, eax
je 0x40a43e
push eax
call fcn.0040f480
mov ecx, dword [esi]
add esp, 4
push 2
push 0
push 0
push ecx
push str.open
push 0
call ebp
add esi, 0x14
add ebx, 4
cmp esi, 0x470ff0
jl 0x40a3f0
cmp dword [edi + 0x1c10], 0
jne 0x40a463
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp 0x409170
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40a530
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x453c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x46fb88]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46fb88]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x154]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x14], esi
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp + 0x18b0], eax
call fcn.0041b558
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x40a59f
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push esi
push 2
mov dword [esp + 0x154], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a5f5
push 0x458f28
mov ecx, ebx
call fcn.00401710
lea eax, [edi - 0x10]
mov dword [esp + 0x14c], esi
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a67b
mov ecx, dword [eax]
push eax
jmp 0x40a674
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40a63f
lea esp, [esp]
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0x18b0]
je 0x40a62d
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40a610
jmp 0x40a63f
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x18]
call fcn.004016d0
mov edi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi - 0x10]
push esi
call fcn.00401410
add eax, 0x10
mov dword [ebx], eax
add esp, 4
mov dword [esp + 0x14c], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40a67b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0043b6e4
add esp, 0x13c
ret 4
Function at 0x40ce00
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x454008
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46fb88]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x44]
add edx, ecx
push edi
mov byte [esp + 0x18], al
mov dword [esp + 0x20], edx
call fcn.0041acde
mov ebx, eax
mov eax, dword [esp + 0x44]
push edi
push eax
push ebx
call fcn.0043bd70
lea ebp, [esi + 0x358]
add esp, 0x10
mov ecx, ebp
call fcn.00405f80
mov ecx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [eax + 8], ebx
lea ecx, [esi + 0x378]
mov dword [eax + 0xc], edi
call fcn.0040c720
call fcn.0041b558
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40ceb2
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x44]
push edi
push ebx
push ecx
lea edx, [esi + 0x118]
push edx
lea eax, [esp + 0x48]
push str._s_Inx:_d_Offset:_d_Len:_d_r_n
push eax
mov dword [esp + 0x44], 0
call fcn.00401ab0
mov edi, dword [esp + 0x50]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
mov ecx, dword [esi + 0x350]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cf30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x40d2e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x454090
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46fb88]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041b558
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d323
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], 0
call fcn.0041b558
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d355
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.0040cf50
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
call ebx
test eax, eax
je 0x40d38d
push edi
call fcn.00424650
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x40d3b8
push edi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0040cf80
mov ebp, dword [esp + 0x18]
push ebp
call ebx
test eax, eax
je 0x40d3b2
push ebp
call fcn.00424650
inc edi
cmp edi, dword [esi + 0x10]
jl 0x40d394
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d3dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d401
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40e730
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x40e020
push 0
push 0
mov dword [esi + 0x254], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x258], eax
mov eax, 1
pop esi
ret

Function at 0x40f250
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f2b7
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40f293
cmp eax, 2
jne 0x40f2a6
mov eax, dword [esp + 0x14]
test esi, esi
je 0x40f2b3
test eax, eax
je 0x40f2b0
cmp byte [eax + esi - 1], 0
je 0x40f2b3
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x40f480
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x2011f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push closesocket
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f4eb
push edi
mov edi, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40f4d4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
push str.Start_Page
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40f4ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x40f4e5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop edi
pop ecx
ret
xor eax, eax
pop ecx
ret
test edi, edi
je 0x40f4fa
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop edi
pop ecx
ret
Function at 0x410540
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [0x46fb88]
xor eax, esp
mov dword [esp + 0xc0], eax
push edi
mov edi, dword [esp + 0xcc]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov dword [esp + 0x30], 0x9c
call fcn.00401590
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4106bd
mov eax, dword [esp + 0x2c]
sub eax, 4
je 0x410726
mov ecx, 1
sub eax, ecx
je 0x410659
sub eax, ecx
jne 0x4106bd
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x41060e
sub eax, ecx
jne 0x4106bd
cmp byte [esp + 0xc2], cl
mov ecx, edi
jne 0x4105ee
push str.Microsoft_Windows_7
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push str.Microsoft_Windows_Server_2008_R2
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
cmp byte [esp + 0xc2], cl
mov ecx, edi
jne 0x410639
push str.Microsoft_Windows_Vista
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push str.Microsoft_Windows_Server_2008
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x410704
sub eax, ecx
je 0x4106e2
sub eax, ecx
jne 0x4106bd
cmp byte [esp + 0xc2], cl
jne 0x4106a1
cmp word [esp + 4], 9
jne 0x4106a1
push str.Microsoft_Windows_XP_Professional_x64_Edition
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x4106d3
push str.Microsoft_Windows_Server_2003
mov ecx, edi
call fcn.004016d0
pop esi
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push 0x59
call esi
test eax, eax
je 0x4106bc
push str.Microsoft_Windows_Server_2003_R2
jmp 0x4106b5
push str.Microsoft_Windows_XP
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push str.Microsoft_Windows_2000
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41077c
cmp eax, 0xa
je 0x41075a
cmp eax, 0x5a
jne 0x4106bd
push str.Microsoft_Windows_Me
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
push str.Microsoft_Windows_98
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x4107a7
push str.Microsoft_Windows_NT_4.0
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret
cmp eax, 1
jne 0x4106bd
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.004016d0
mov ecx, dword [esp + 0xc4]
pop edi
xor ecx, esp
call fcn.0043b6e4
add esp, 0xc4
ret