joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409117
Capabilities:
Write file on windows

Disassembly:
call fcn.00406121
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
push edx
push dword [esp - 0xb0]
call 0x409117
push ebp
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
je 0x40918d
mov ebp, dword [esp + 0x18]
mov eax, dword [edi]
mov esi, ebp
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push ebx
push 0x401cd8
push 0x401a30
push fcn.00403c98
call 0x40914a
test eax, eax
je 0x4102c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x409113
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push 0x405860
push dword [esp - 0x6a]
push 0x4058c0
push dword [esp - 0xc8]
call 0x409183
mov ecx, eax
jl 0x409134
inc edx
lea esp, [esp]
mov edi, edi
mov dword [ecx], 0
lea esp, [esp + 0x14]
pop edx
ret 4
nop
nop
nop
setge al
pop esi
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
push 0x41b036
mov esi, ecx
call fcn.00405433

Function at 0x40914a
Capabilities:
Write file on windows

Disassembly:
call fcn.00406121
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
push edx
push dword [esp - 0xb0]
call 0x409117
push ebp
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
je 0x40918d
mov ebp, dword [esp + 0x18]
mov eax, dword [edi]
mov esi, ebp
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push ebx
push 0x401cd8
push 0x401a30
push fcn.00403c98
call 0x40914a
test eax, eax
je 0x4102c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x409113
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push 0x405860
push dword [esp - 0x6a]
push 0x4058c0
push dword [esp - 0xc8]
call 0x409183
mov ecx, eax
jl 0x409134
inc edx
lea esp, [esp]
mov edi, edi
mov dword [ecx], 0
lea esp, [esp + 0x14]
pop edx
ret 4
nop
nop
nop
setge al
pop esi
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
push 0x41b036
mov esi, ecx
call fcn.00405433

Function at 0x4094c2
Capabilities:
Parse url

Disassembly:
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov eax, dword [esp + 0x4c]
push ebx
push ebp
push eax
lea ecx, [esp + 0x28]

Function at 0x4097a4
Capabilities:
Get file version info
Query or enumerate registry key

Disassembly:
push 1
push eax
mov eax, dword [0x41b1f2]
call fcn.0040b4a2
cmp eax, 0xffffffff
push ecx
push ecx
push 0x4049d0
push ebp
call 0x4097c8
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push 0x405140
push 0x4025f8
push dword [esp - 0xb0]
call 0x4097f7
jl 0x40983f
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp + 0x1b]
call fcn.0040981f
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4097c1
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push dword [eax - 8]
push dword [eax - 4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x4007c8
push 0x3fbbb2
call fcn.004031d1
test eax, eax
push ebx
mov ebx, ecx
Function at 0x4097c8
Capabilities:
Get file version info
Query or enumerate registry key

Disassembly:
push 1
push eax
mov eax, dword [0x41b1f2]
call fcn.0040b4a2
cmp eax, 0xffffffff
push ecx
push ecx
push 0x4049d0
push ebp
call 0x4097c8
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push 0x405140
push 0x4025f8
push dword [esp - 0xb0]
call 0x4097f7
jl 0x40983f
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp + 0x1b]
call fcn.0040981f
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4097c1
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push dword [eax - 8]
push dword [eax - 4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x4007c8
push 0x3fbbb2
call fcn.004031d1
test eax, eax
push ebx
mov ebx, ecx

Function at 0x4097f7
Capabilities:
Get file version info
Query or enumerate registry key

Disassembly:
push 1
push eax
mov eax, dword [0x41b1f2]
call fcn.0040b4a2
cmp eax, 0xffffffff
push ecx
push ecx
push 0x4049d0
push ebp
call 0x4097c8
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push 0x405140
push 0x4025f8
push dword [esp - 0xb0]
call 0x4097f7
jl 0x40983f
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp + 0x1b]
call fcn.0040981f
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4097c1
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push dword [eax - 8]
push dword [eax - 4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x4007c8
push 0x3fbbb2
call fcn.004031d1
test eax, eax
push ebx
mov ebx, ecx

Function at 0x40993b
Capabilities:
Accept command line arguments
Move file

Disassembly:
dec eax
jne 0x4094a3
pop edx
push dword [esp + 4]
push 0xffffffffffffffdf
push esp
push 0x3fef07
call fcn.00402f20
add byte [eax], al
mov eax, 0x41acdc
push esi
cmp eax, 0xffffffff
je 0x40875f
push 2
push 0x13
push 0x400c50
push 0x40a860
call fcn.004031d1
push 0
push edi
inc eax
sub eax, 0xc18b1002
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], 0
shl ecx, 2
add eax, ecx
push 0x40093f
push 0x40020c
push 0x400755
push 0x408cc3
call fcn.00403650
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x4099ab
mov eax, dword [0x41a46d]
pop ebx
sub esp, 8
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push str.ad___Engin
push ecx
add esp, 4
leave
push 0x400e36
push dword [esp + 8]
push dword [esp + 0xc]
push 0x401d9e
call fcn.00402f20
xor eax, eax
mov ecx, dword [esp + 4]
sub eax, ecx
sar eax, 2
add ebx, eax
test ecx, ecx
cmp edx, 0
je 0x40875f
push edx
push ebx
push 0xd
push 0x3fed90
call fcn.0040379d
lea ecx, [esp + 8]
push ecx
push 0x41aceb
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
Function at 0x40a21b
Capabilities:
Create directory

Disassembly:
lea ecx, [esp + 0x10]
push 3
push ecx
mov ecx, dword [esp + 0x10]
call fcn.004077cf
cmp eax, 0xffffffff
jne 0x40a270
push ebx
push esp
push dword [esp - 0x5b]
push dword [esp - 0xdf]
call 0x40a250
lea ecx, [ebp + 8]
mov eax, 0x41a98d
lea ecx, [ebp - 0x2044]
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push 0x401370
push 0x39
call 0x40a28a
push 0x41ad63
push esi
call fcn.0040c1f8
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_Module32Next]
mov edi, eax
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push 0x402bf8
push ecx
push 0x404570
push 0x7e
push dword [esp + 0x30]
call 0x40a2ad
add esi, 4
test eax, eax
lea esp, [esp + 0x18]
pop ebx
ret 4

Function at 0x40a250
Capabilities:
Create directory

Disassembly:
lea ecx, [esp + 0x10]
push 3
push ecx
mov ecx, dword [esp + 0x10]
call fcn.004077cf
cmp eax, 0xffffffff
jne 0x40a270
push ebx
push esp
push dword [esp - 0x5b]
push dword [esp - 0xdf]
call 0x40a250
lea ecx, [ebp + 8]
mov eax, 0x41a98d
lea ecx, [ebp - 0x2044]
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push 0x401370
push 0x39
call 0x40a28a
push 0x41ad63
push esi
call fcn.0040c1f8
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_Module32Next]
mov edi, eax
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push 0x402bf8
push ecx
push 0x404570
push 0x7e
push dword [esp + 0x30]
call 0x40a2ad
add esi, 4
test eax, eax
lea esp, [esp + 0x18]
pop ebx
ret 4

Function at 0x40a39d
Capabilities:
Set file attributes

Disassembly:
je 0x40a35c
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00407fbe
pop edi
leave
push 0x18
push dword [esp + 4]
push edx
push 0x3fced8
call fcn.00402e08
jne 0x40a310
mov eax, 0x41a724
xor eax, eax
mov word [esp + 0x230], bx
add byte [eax], al
mov eax, 0x41aea1
push esi
push 0
mov esi, ecx
call fcn.0040f419
push eax
push 0x403ca8
push 0x405560
call 0x40a360
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test eax, eax
je 0x40a2ff
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0xffffffffffffffd7
push 0x4021f0
push 0x404c50
push 0xffffffffffffffc4
push dword [esp - 0xa4]
call 0x40a39d
push 0x41ab23
push 0x41a141
push esi
call fcn.00408c25
push 0x41abcb
call fcn.00409afb
push ebx
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push ecx
call 0x40a3d0
jne 0x40a3e0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.WS2_32.dll_WSANSPIoctl]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [esp + 0x234]
call fcn.0040e763
lea esp, [esp + 8]
pop eax
ret 8
push ebp
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
mov dword [esp], ebx
push dword [esp + 0xc]
push 0x73
push dword [esp + 0xc]
push 0x3f9efa
call fcn.00402e08
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
push 0
mov esi, ecx
call fcn.004055be
mov dword [esi], 0x100063e0
mov eax, esi
pop esi
mov eax, dword [esi + 0x14]
push 0x41aa57
Function at 0x40a79c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
pop eax
push 0x24
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x3f9ac3
call fcn.0040379d
add byte [eax], al
add byte [eax + 0x1000935c], bh
push esi
push 0
mov esi, ecx
call fcn.00403f7e
mov dword [esi], 0x10009380
mov eax, esi

Function at 0x40a7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
add esp, 0x10
push 0xb7628b02
push edi
push ebx
push 0x67
push ebp
push 0x4088f8
call fcn.004034ec
jmp dword [sym.imp.KERNEL32.dll_SearchPathA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40a823
xor eax, eax
pop esi
mov eax, dword [esp + 0xc]
test eax, eax
push esi
push dword [esp + 0x69]
push 0x4050e8
call 0x40a808
push 0x41a97b
lea edx, [esp + 0x14]
push edx
push 0x41ae2f
push 0x41b049
call fcn.00410dac
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp + 0x5d]
push 0x53
push ebp
push esi
call 0x40a833
cmp ebx, edi
mov esi, ebx
je 0x40a7cb
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add esi, 4
cmp esi, edi
jne 0x40a7cd
push ebx
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push eax
push ebp
push dword [esp - 0x75]
push dword [esp - 0x44]
call 0x40a859
test ebx, ebx
je 0x409568
push ebp
lea esp, [esp + 0x14]
pop esi
ret 8

Function at 0x40a808
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
add esp, 0x10
push 0xb7628b02
push edi
push ebx
push 0x67
push ebp
push 0x4088f8
call fcn.004034ec
jmp dword [sym.imp.KERNEL32.dll_SearchPathA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40a823
xor eax, eax
pop esi
mov eax, dword [esp + 0xc]
test eax, eax
push esi
push dword [esp + 0x69]
push 0x4050e8
call 0x40a808
push 0x41a97b
lea edx, [esp + 0x14]
push edx
push 0x41ae2f
push 0x41b049
call fcn.00410dac
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp + 0x5d]
push 0x53
push ebp
push esi
call 0x40a833
cmp ebx, edi
mov esi, ebx
je 0x40a7cb
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add esi, 4
cmp esi, edi
jne 0x40a7cd
push ebx
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push eax
push ebp
push dword [esp - 0x75]
push dword [esp - 0x44]
call 0x40a859
test ebx, ebx
je 0x409568
push ebp
lea esp, [esp + 0x14]
pop esi
ret 8

Function at 0x40a88c
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push ebx
push dword [esp - 0x89]
call fcn.0040a8b9
mov edx, dword [ecx]
push 0x41a18a
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop edi
pop esi
Function at 0x40a8b9
Capabilities:
Set registry value

Disassembly:
jne 0x408d1c
pop esi
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
pop eax
push 0xffffffffffffff9a
push dword [esp + 8]
push 0x4000cb
push 0x3fde6c
call fcn.004034ec
push 0xffffffffffffffff
push 0x41a48a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
test ebx, ebx
jne 0x408ca0
xor eax, eax
push ebp
mov ebp, dword [ebx + 0x14]
push edi
mov edi, ebp
push esi
mov esi, dword [esp + 0x10]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp - 0x24]
push dword [esp - 0x8e]
push dword [esp - 0x8c]
call 0x40a8f2
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0x41ac33
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0xffffffffffffffaf
push 0xffffffffffffffbc
call 0x40a924
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
mov ebp, dword [esp + 0x5c]
add eax, 0xfffffefa
cmp eax, 0xc
ja 0x408cc0
push ebx
lea esp, [esp + 0xc]
pop ebx
ret 0xc

Function at 0x40a965
Capabilities:
Get file size

Disassembly:
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and ecx, 0xff
push esi
push dword [esp + 4]
push ebp
push 0x4085fa
call fcn.004031d1
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, 0x41a939
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
push esi
push edi
mov dword [esp + 0xc], 0

Function at 0x40acf7
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
test eax, eax
jge 0x40ad1d
xor eax, eax
pop ecx
push esi
push 0xffffffffffffff87
push ecx
call 0x40ad20
mov edx, dword [edi + 0x14]
mov dword [ecx + 0x14], edx
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40acba
mov ecx, dword [edi + 0x18]
mov dword [eax + 0x18], ecx
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push 0x402768
push 0xffffffffffffffb4
push dword [esp - 2]
push dword [esp + 0xd]
call 0x40ad6b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [esp + 0x114]
call fcn.00410c34
add esp, 0x41abce
mov eax, dword [esp + 4]
push 0x41a610
lea ecx, [esp + 8]
push ecx
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0x7e]
push ebp
push eax
push 0x402fd0
call 0x40ad97
mov ebp, eax
je 0x40ada0
dec dword [esi]
jne 0x40ad8e
mov eax, dword [esi + 4]
push esi
call dword [eax + 0x18]
test ebx, ebx
lea esp, [esp + 0x14]
pop esi
ret 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
Function at 0x40ad20
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
test eax, eax
jge 0x40ad1d
xor eax, eax
pop ecx
push esi
push 0xffffffffffffff87
push ecx
call 0x40ad20
mov edx, dword [edi + 0x14]
mov dword [ecx + 0x14], edx
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40acba
mov ecx, dword [edi + 0x18]
mov dword [eax + 0x18], ecx
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push 0x402768
push 0xffffffffffffffb4
push dword [esp - 2]
push dword [esp + 0xd]
call 0x40ad6b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [esp + 0x114]
call fcn.00410c34
add esp, 0x41abce
mov eax, dword [esp + 4]
push 0x41a610
lea ecx, [esp + 8]
push ecx
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0x7e]
push ebp
push eax
push 0x402fd0
call 0x40ad97
mov ebp, eax
je 0x40ada0
dec dword [esi]
jne 0x40ad8e
mov eax, dword [esi + 4]
push esi
call dword [eax + 0x18]
test ebx, ebx
lea esp, [esp + 0x14]
pop esi
ret 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax

Function at 0x40af12
Capabilities:
Get file attributes
Terminate process

Disassembly:
push 0x41a0c5
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
je 0x40af39
add esp, 4
pop esi
push 0x400676
push 0x400477
push esp
push 0x403232
call fcn.00402e08
call dword [ecx + 0x60]
mov eax, dword [esp]
pop ecx
cmp edx, str.OO:CROM_PG_TE
jne 0x40aea3
or ecx, edx
je 0x40aee3
push str.CL_SSMA
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040ae61
mov eax, dword [edi]
push ebp
push ebx
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]

Function at 0x40b7a7
Capabilities:
Copy file

Disassembly:
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push ecx
push 0x1f
push eax
call 0x40b7c7
mov ebx, eax
call edi
test eax, eax
jne 0x40b7f0
mov eax, dword [esp + 0x14]
push eax
call esi
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp + 3]
call 0x40b7e5
pop esi
pop ecx
mov eax, dword [esp + 4]
pop esi
pop ecx
sub esp, 0x10
push esi
push edi
lea esp, [esp + 8]
pop eax
ret 4
push eax
mov eax, dword [0x41a975]
call fcn.0040e54e
cmp eax, 0xffffffff
je 0x40b80b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
Function at 0x40bd48
Capabilities:
Get common file path

Disassembly:
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
push esi
push edi
push edi
push dword [esp - 0x61]
call 0x40bd6d
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], ebx
lea esp, [esp + 8]
mov edi, dword [esp + 8]
push dword [esp - 0x6a]
push dword [esp - 0x4c]
push dword [esp - 0x7d]
push 0x405e08
call 0x40bda4
push 0x41ad1f
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esi]
dec eax
mov dword [esi], eax
jne 0x40bdd2
mov edx, dword [esi + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push edx
call 0x40bdbe
call fcn.0040a2fd
cmp eax, 0xffffffff
jne 0x40be09
xor eax, eax
lea esp, [esp + 8]
pop edi
ret 4
mov dword [esp + 0x24], ebx
call fcn.004094c2
cmp eax, ebx
je 0x40be15
mov dword [esi + 8], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp dword [sym.imp.USER32.dll_SendMessageA]

Function at 0x40bd6d
Capabilities:
Get common file path
Parse url

Disassembly:
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
push esi
push edi
push edi
push dword [esp - 0x61]
call 0x40bd6d
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], ebx
lea esp, [esp + 8]
mov edi, dword [esp + 8]
push dword [esp - 0x6a]
push dword [esp - 0x4c]
push dword [esp - 0x7d]
push 0x405e08
call 0x40bda4
push 0x41ad1f
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esi]
dec eax
mov dword [esi], eax
jne 0x40bdd2
mov edx, dword [esi + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push edx
call 0x40bdbe
call fcn.0040a2fd
cmp eax, 0xffffffff
jne 0x40be09
xor eax, eax
lea esp, [esp + 8]
pop edi
ret 4
mov dword [esp + 0x24], ebx
call fcn.004094c2
cmp eax, ebx
je 0x40be15
mov dword [esi + 8], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp dword [sym.imp.USER32.dll_SendMessageA]

Function at 0x40c08c
Capabilities:
Create new key via cryptacquirecontext
Hide graphical window

Disassembly:
push eax
lea ecx, [esp + 8]
push ecx
push 0x41a8a1
push edx
mov dword [esp + 0x1c], 0
push 4
push 0x4000fb
push 0x18
push esp
push 0x3fdb72
call fcn.00403930
mov eax, 0x41a88d
mov ecx, dword [esp + 8]
Function at 0x40c2ad
Capabilities:
Get thread local storage value

Disassembly:
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40c25d
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40c273
xor eax, eax
pop esi
push ecx
push 0x63
push 0x60
push dword [esp - 0xe0]
call fcn.0040c2ad
ja 0x40c275
lea edi, [ebp + ebp]
push edi
lea ecx, [eax + ebx*2]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
lea ecx, [ebp + ebp]
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push esp
push 0x402d20
push dword [esp + 0xc]
push dword [esp - 0x57]
push 0x401a28
call 0x40c2da
je 0x40c273
cmp eax, 0xbb40e64e
jne 0x40c325
push esi
lea esp, [esp + 0x18]
add dword [esp + 4], ecx
push 0x405e28
push dword [esp - 0x1d]
push fcn.00405ec8
push dword [esp - 0x7d]
call 0x40c30b
push 0x41acc4
push eax
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
lea esp, [esp + 0x14]
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor esi, eax
mov dword [0x41a6fa], esi
jne 0x40c35b
push 0x41b0a6
push ebx
push dword [esp - 0x3b]
push dword [esp - 0x91]
push dword [esp - 0x1c]
push dword [esp - 0xae]
push ecx
call 0x40c389
pop ecx
mov eax, dword fs:[0]
push 0xffffffffffffffff
lea esp, [esp + 0x18]
mov ebx, dword [esp + 8]
push dword [esp - 0x5d]
push esi
push dword [esp - 0xf8]
call 0x40c3a6
sub esp, 0x10
push ebx
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push dword [esp - 0x73]
push 0xffffffffffffffbf
push dword [esp - 0x23]
call 0x40c3d5
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
mov esi, eax
push esi
push 0x41a4f8
lea esp, [esp + 0x10]
pop ebx
ret 4

Function at 0x40c58e
Capabilities:
Move file

Disassembly:
je fcn.0040c603
mov edi, dword [esp + 0x10]
push edi
mov ecx, esi
call dword [sym.imp.USER32.dll_UnregisterClassW]
test eax, eax
je 0x40c581
mov eax, dword [ebx + 8]
xchg dword [esp], ebx
push 0xcfa6bf03
push edi
push 0xffffffffffffffc1
push eax
push esp
push 0x4059e5
call fcn.00402f20
push edi
mov edi, dword [esi + 0x20]
xor ebx, ebx
cmp edi, ebx
je 0x40c622
mov ecx, edi
push 0x41a843
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
call fcn.00405b0c
push dword [esp + 8]
push 0x400554
push 0xfffffffffffffffd
push 0x402dc2
call fcn.00403a9a

Function at 0x40ca6f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push eax
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40cab5
mov eax, dword [ebx + 0x14]
Function at 0x40cb92
Capabilities:
Set socket configuration

Disassembly:
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp + 0x2c]
push dword [esp + 0x72]
push 0x403290
call 0x40cb92
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41ab34
push ecx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea esp, [esp + 0x10]
add dword [esp + 4], edx
push dword [esp - 0x51]
push dword [esp - 0x13]
push 0x401ba0
push dword [esp + 0x11]
push 0xffffffffffffff81
call 0x40cbd1
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0x41a091
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
jne fcn.0040cbf7
lea esp, [esp + 0x18]
pop edx
ret 4