joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461661
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4b9504
call fcn.0049dfc4
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
call fcn.004603d7
test al, al
je 0x461771
cmp word [esi + 0x30], 8
jne 0x461771
xor ebx, ebx
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], vtable._zstring_class_ztraits_0__.0
lea edi, [esi + 0x1c]
mov dword [ebp - 4], ebx
mov ecx, edi
mov dword [ebp - 0x14], 0x104
call fcn.00402f35
mov edi, dword [edi + 4]
lea eax, [ebp - 0x28]
push 0x104
push eax
lea ecx, [ebp - 0x38]
call fcn.0041120a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00411336
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
lea ecx, [ebp - 0x28]
sete byte [ebp - 0xd]
mov byte [ebp - 4], bl
call fcn.00401d79
cmp byte [ebp - 0xd], bl
pop edi
je 0x461765
push dword [esi + 0x38]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], vtable._zstring_class_ztraits_0__.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004011f6
lea ecx, [ebp - 0x2c]
call fcn.004011f6
cmp dword [ebp - 0x1c], ebx
mov esi, dword [esi + 0x40]
jne 0x461729
xor eax, eax
jmp 0x461732
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push esi
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
call fcn.00401db4
cmp eax, dword [0x4be690]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
setne byte [ebp - 0xd]
call fcn.004012b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004012b4
mov al, byte [ebp - 0xd]
jmp 0x461773
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004012b4
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x463e50
Capabilities:
Create thread

Disassembly:
mov eax, 0x4b9b3c
call fcn.0049dfc4
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x4f41f3], bl
push esi
mov esi, ecx
je 0x463e6f
push 7
jmp 0x463ec7
cmp byte [0x4f41f0], bl
jne 0x463e7b
xor eax, eax
jmp 0x463ee5
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x24]
mov byte [0x4f41f3], 1
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp + 8], bl
je 0x463eca
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x464875
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 6
pop eax
jmp 0x463ee5
mov ecx, esi
call fcn.00464275
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov byte [0x4f41f3], bl
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x463ef5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4b9b50
call fcn.0049dfc4
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x4f41f4], bl
push esi
mov esi, ecx
jne 0x463fa4
mov byte [0x4f41f0], 1
mov byte [0x4f41f4], 1
mov dword [ebp - 0x10], ebx
push 0xf003f
push str.SOFTWAREInstallShieldUpdate_Service
push SysReAllocStringLen
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00403674
test eax, eax
jne 0x463f85
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xa
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.AllowSelfUpdate
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x463f85
lea eax, [ebp - 0x24]
push 0x4ebd34
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x463f85
mov byte [0x4f41f0], bl
mov ecx, esi
call fcn.00463fb2
test eax, eax
jne 0x463f96
mov byte [0x4f41f0], bl
cmp dword [ebp - 0x10], ebx
je 0x463fa4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x463fb2
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x4b9b6c
call fcn.0049dfc4
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00428a44
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
pop ecx
pop ecx
push dword [eax + 0xc]
call esi
mov edi, vtable._zstring_class_ztraits_0__.0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004036b2
push str.temp
call esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], edi
push eax
mov byte [ebp - 4], 2
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00401b2b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004012b4
lea ecx, [ebp - 0x20]
call fcn.00402f35
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x464066
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004012b4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp - 0x20]
call fcn.00402f35
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004012b4
push 1
pop eax
jmp 0x464057
Function at 0x4659d6
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4b9ebc
call fcn.0049dfc4
push ecx
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov ecx, esi
call fcn.00402f35
mov esi, dword [esi + 4]
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, edi
je 0x465a2b
cmp eax, 0xffffffff
mov ebx, eax
jne 0x465a2b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x465a72
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 8]
push edi
push eax
push dword [ebp + 0xc]
call esi
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0xc]
call esi
mov esi, dword [ebp + 8]
sub esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
cmp ebx, edi
je 0x465a70
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x465a83
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x4b9ed8
call fcn.0049dfc4
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push edi
push esi
lea ecx, [ebp - 0x20]
call fcn.0040235c
xor ebx, ebx
push str..tmp
mov dword [ebp - 4], ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], vtable._zstring_class_ztraits_0__.0
push eax
mov byte [ebp - 4], 1
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00401b2b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.004012b4
lea ecx, [ebp - 0x20]
call fcn.00402f35
mov edi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00402f35
mov eax, dword [esi + 4]
push 0x4e8c2c
push edi
push eax
call fcn.00477690
cmp eax, ebx
jge 0x465b0d
mov ebx, eax
jmp 0x465b55
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push 0x4e8c28
push eax
call fcn.004659d6
cmp eax, ebx
jl 0x465b09
mov ecx, esi
call fcn.00402f35
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00402f35
mov esi, dword [esi + 4]
lea ecx, [ebp - 0x20]
call fcn.00402f35
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x465b55
or ebx, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004012b4
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x465b74
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x4b9ef4
call fcn.0049dfc4
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040235c
xor ebx, ebx
push str..tmp
mov dword [ebp - 4], ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], vtable._zstring_class_ztraits_0__.0
push eax
mov byte [ebp - 4], 1
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.00401b2b
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.004012b4
mov ecx, esi
call fcn.00402f35
mov eax, dword [esi + 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x465c6d
push 2
push ebx
push 0xfffffffffffffffd
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.00402f35
mov edi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00402f35
mov eax, dword [esi + 4]
push 0x4e8c2c
push edi
push eax
call fcn.00477a50
cmp eax, ebx
jge 0x465c3d
mov ebx, eax
jmp 0x465c70
mov ecx, esi
call fcn.00402f35
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00402f35
mov esi, dword [esi + 4]
lea ecx, [ebp - 0x1c]
call fcn.00402f35
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x465c70
or ebx, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004012b4
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x467b12
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp + 0xc]
push eax
push 0x20000013
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
call fcn.0047549c
add esp, 0x14
test eax, eax
je 0x467b4c
mov eax, dword [ebp + 0xc]
cmp eax, 0xc8
jb 0x467b50
cmp eax, 0x12c
jae 0x467b50
xor eax, eax
jmp 0x467b67
push esi
mov esi, eax
add eax, 0xd3c0
or eax, 0x80040000
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
leave
ret 8

Function at 0x4699fc
Capabilities:
Hide graphical window

Disassembly:
cmp byte [ecx + 0xc8], 0
jne 0x469a10
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x46b7b7
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4ba8c4
call fcn.0049dfc4
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xb0], bl
jne 0x46b8de
mov dword [ebp - 0x10], ebx
push 0x20019
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00403674
test eax, eax
jne 0x46b8c9
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x200
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x4e57c0
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x24]
push eax
call fcn.00411399
push ebx
lea eax, [ebp - 0x14]
push 1
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0x2e
call fcn.00401db4
push eax
lea eax, [ebp - 0x38]
push ebx
push eax
lea ecx, [ebp - 0x24]
call fcn.00402476
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00410f26
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004012b4
lea ecx, [ebp - 0x24]
call fcn.00402f35
push 0xa
push dword [ebp - 0x20]
call fcn.004113c0
pop ecx
cmp eax, 5
pop ecx
jge 0x46b8be
push ebx
push str.Update_Service
push str.FLEXnet_Connect_requires_Internet_Explorer_5.0_or_later.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004012b4
cmp dword [ebp - 0x10], ebx
je 0x46b8ba
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x46b8e0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004012b4
cmp dword [ebp - 0x10], ebx
mov byte [esi + 0xb0], 1
je 0x46b8de
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x472b22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x472b45
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x472b48
xor eax, eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret

Function at 0x472b50
Capabilities:
Check os version
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jae 0x472bcb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
jne 0x472b8c
push 0x4e63ac
jmp 0x472bb6
cmp ax, 0x404
jne 0x472b99
push 0x4e63a4
jmp 0x472bb6
and eax, 0xff
cmp ax, 0x11
jne 0x472bab
push str.MS_UI_Gothic
jmp 0x472bb6
cmp ax, 0x12
jne 0x472bcb
push 0x4e638c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
mov word [eax], 9
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x47574c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 8], 1
call fcn.0047589b
push 3
xor ebx, ebx
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], ecx
jne 0x47577a
mov dword [ebp - 8], ecx
jmp 0x475810
cmp eax, ebx
je 0x475810
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x475802
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x4757c6
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x4757ef
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0x10], ebx
jne 0x4757fc
cmp byte [ebp - 0x838], bl
je 0x475802
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
je 0x475810
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0047532f
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x475835
cmp dword [ebp + 0xc], 4
jne 0x47584f
cmp dword [ebp - 0x14], ebx
jne 0x47584f
cmp word [edi + 0x14], 3
mov ecx, edi
jne 0x47584a
call fcn.00475a2c
jmp 0x47584f
call fcn.00475c6c
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x47589b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4bb91c
call fcn.0049dfc4
sub esp, 0x360
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x268]
mov edi, SysReAllocStringLen
push eax
push str..htm
mov ebx, ecx
push edi
mov dword [ebp - 0x14], 0x104
call esi
test eax, eax
jne 0x4759a8
lea eax, [ebp - 0x268]
push str._shellopencommand
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x268]
push eax
push edi
call esi
test eax, eax
jne 0x4759a8
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
lea eax, [ebp - 0x164]
push str.netscape.exe
push eax
call fcn.004a0150
xor esi, esi
pop ecx
cmp eax, esi
pop ecx
je 0x4759aa
lea ecx, [ebp - 0x164]
sub eax, ecx
add eax, 0xd
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x60]
call fcn.0041e40c
lea eax, [ebp - 0x36c]
lea ecx, [ebp - 0x60]
push eax
mov dword [ebp - 4], esi
call fcn.0047721b
mov eax, dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
mov ecx, eax
mov word [ebx + 0x16], ax
shr ecx, 0x10
mov word [ebx + 0x14], cx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], vtable.is::version_info.0
call fcn.0041e474
xor eax, eax
jmp 0x475a1d
xor esi, esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x475a0c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x104
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push esi
push 0x4e57c0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x475a0c
movsx ax, byte [ebp - 0x268]
sub eax, 0x30
cmp dword [ebp - 0x10], esi
mov word [ebx + 0x14], ax
je 0x475a08
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
jmp 0x475a1c
cmp dword [ebp - 0x10], esi
je 0x475a1a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x475a2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4bb930
call fcn.0049dfc4
mov eax, 0x1190
call fcn.0049dff0
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], esi
and byte [ebp - 0x978], 0
mov edx, 0x208
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x977]
and byte [ebp - 0x119c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x119b]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x475c04
lea eax, [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 0x10]
mov dword [ebp - 0x54], str.http
mov dword [ebp - 0x50], str.HTTP_Proxy
mov dword [ebp - 0x4c], str.HTTP_ProxyPort
mov dword [ebp - 0x48], str.https
mov dword [ebp - 0x44], str.HTTPS_Proxy
mov dword [ebp - 0x40], str.HTTPS_ProxyPort
mov dword [ebp - 0x3c], str.ftp
mov dword [ebp - 0x38], str.FTP_Proxy
mov dword [ebp - 0x34], str.FTP_ProxyPort
mov dword [ebp - 0x14], 4
call ebx
test eax, eax
jne 0x475c04
cmp dword [ebp - 0x20], 1
jne 0x475c04
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x54]
mov dword [ebp - 0x18], 3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x100
push eax
lea eax, [ebp - 0x154]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x475bc7
cmp byte [ebp - 0x154], al
je 0x475bc7
push dword [edi]
lea eax, [ebp - 0x978]
push eax
call esi
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x978]
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x475bb9
lea eax, [ebp - 0x978]
push 0x4ea238
push eax
call esi
push dword [ebp - 0x24]
lea eax, [ebp - 0x978]
push 0x4e66f4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x978]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x978]
push 0x4e93c0
push eax
call esi
add edi, 0xc
dec dword [ebp - 0x18]
jne 0x475b1d
lea eax, [ebp - 0x978]
push 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x119c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
push 0x26
mov dword [ebp - 0x30], 3
push dword [eax + 4]
call fcn.00475531
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x475c12
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47675b
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [esi + 0x28], eax
mov dword [edi], eax
jbe 0x476858
cmp dword [esi + 0x64], 0x2710
jbe 0x476794
cmp dword [esi + 0x5c], 0
je 0x476794
mov ecx, esi
call fcn.00476865
lea ebx, [eax + eax*4]
jmp 0x476799
mov ebx, 0x1f4
test ebx, ebx
jne 0x4767a0
push 1
pop ebx
cmp byte [esi + 0x98], 0
je 0x4767b5
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x4767c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi]
sub ecx, eax
cmp ecx, ebx
jb 0x4767de
mov ecx, ebx
lea edx, [ebp + 0x10]
push edx
push ecx
mov ecx, dword [ebp + 8]
add eax, ecx
push eax
push dword [esi + 4]
call fcn.00475468
add esp, 0x10
test eax, eax
jne 0x476806
mov eax, dword [esi]
push dword [esi + 0x78]
mov ecx, esi
call dword [eax + 8]
test al, al
je 0x476861
cmp byte [esi + 0x98], 0
je 0x47681b
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x476828
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x476858
push dword [ebp - 4]
add dword [edi], eax
add dword [esi + 0x54], eax
add dword [esi + 0x5c], eax
push dword [ebp - 8]
add dword [esi + 0x68], eax
mov ecx, esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00476667
mov eax, dword [ebp + 0xc]
cmp dword [edi], eax
jb 0x476779
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc
xor al, al
jmp 0x47685a

Function at 0x476865
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x74]
cmp eax, 0x7530
jbe 0x47689d
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], ecx
mov ecx, dword [esi + 0x6c]
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x6c], eax
call edi
mov dword [esi + 0x74], eax
mov edi, dword [esi + 0x64]
test edi, edi
jne 0x4768a9
mov eax, dword [esi + 0x5c]
jmp 0x4768f2
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x4768f0
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0x5c]
cmp ebx, eax
jbe 0x4768ce
shr ebx, 1
shr edi, 1
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], edi
mov eax, dword [esi + 0x5c]
mov edi, dword [esi + 0x64]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x4768b2
pop ebp
pop ebx
pop edi
pop esi
ret