joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9bd
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], ecx
push esi
push esi
push 0x8003
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.0040fa73
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00401ffc
push dword [edi + 4]
call fcn.004101ec
pop ecx
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.00401ffc
mov edi, dword [edi + 4]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp dword [ebp - 0xc], edi
je 0x40aa2d
lea ecx, [ebp - 0xc]
call fcn.0040b741
mov dword [ebp - 0xc], edi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [ebp + 8]
ja 0x40aa61
lea ecx, [ebp - 0x78]
call fcn.0040fc01
lea ecx, [ebp - 8]
call fcn.0040b757
lea ecx, [ebp - 4]
call fcn.004053b6
lea ecx, [ebp - 0xc]
call fcn.0040b741
jmp 0x40ab1f
push esi
push esi
push esi
push 2
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp dword [ebp - 4], edi
je 0x40aa8a
cmp dword [ebp - 4], esi
je 0x40aa87
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
push esi
push esi
push esi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x40aab6
cmp eax, esi
je 0x40aab0
push eax
call edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push 1
add eax, ecx
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.0040fea9
test al, al
je 0x40aadd
push dword [ebp + 8]
lea ecx, [ebp - 0x78]
push dword [ebp - 8]
call fcn.00410049
test al, al
jne 0x40aae2
lea ecx, [ebp - 0x78]
jmp 0x40aaf5
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x78]
push eax
call fcn.0040ab59
test eax, eax
lea ecx, [ebp - 0x78]
jne 0x40ab26
call fcn.0040fc01
cmp dword [ebp - 8], esi
je 0x40ab07
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x40ab14
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], esi
cmp dword [ebp - 0xc], 0xffffffff
je 0x40ab1f
push dword [ebp - 0xc]
call ebx
mov eax, 0x80090006
jmp 0x40ab52
call fcn.0040fc01
cmp dword [ebp - 8], esi
je 0x40ab38
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x40ab45
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], esi
cmp dword [ebp - 0xc], 0xffffffff
je 0x40ab50
push dword [ebp - 0xc]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40ab59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push str.PUBLICKEY
push 0x74
push dword [0x4155a4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x4155a4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push dword [0x4155a4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0xc]
push 0
push edi
push eax
call fcn.0040fe1a
pop edi
pop esi
test al, al
jne 0x40abaa
xor eax, eax
jmp 0x40abb9
mov ecx, dword [esp + 4]
call fcn.00410017
neg al
sbb eax, eax
neg eax
ret 4

Function at 0x40acd8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x38]
call fcn.00401c1f
mov ebx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov ecx, ebx
call fcn.00404734
add eax, 0x10
mov eax, dword [eax]
cmp eax, esi
je 0x40ad0e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.00401b16
push 0x5c
inc esi
pop edi
mov dword [ebp + 8], edi
push esi
lea eax, [ebp + 8]
push 1
push eax
mov ecx, ebx
call fcn.00404216
cmp dword [0x4123c8], eax
je 0x40ad79
lea esi, [eax + 1]
push 0
push esi
push 0
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x41230c
mov dword [ebp - 8], 0x412314
call fcn.00405298
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x412308
call fcn.00401ffc
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x1c]
call fcn.00401b16
mov dword [ebp + 8], edi
jmp 0x40ad1d
lea ecx, [ebp - 0x38]
call fcn.00401d5d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40af00
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4148c8
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00404b36
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.00401ffc
mov esi, dword [esi + 4]
lea eax, [ebp - 0x178]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x1c]
mov ebx, eax
call fcn.00401b16
cmp ebx, 0xffffffff
je 0x40b008
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x14c]
push 0x4148c4
push eax
call esi
test eax, eax
je 0x40afda
lea eax, [ebp - 0x14c]
push 0x4148c0
push eax
call esi
test eax, eax
je 0x40afda
test byte [ebp - 0x178], 0x10
jne 0x40afda
lea eax, [ebp - 0x14c]
push 0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x41230c
mov dword [ebp - 8], 0x412314
call fcn.0040399e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x412308
push eax
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.0040cc01
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.00401ffc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x38]
call fcn.00401b16
lea ecx, [ebp - 0x1c]
call fcn.00401b16
lea eax, [ebp - 0x178]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x40af4e
mov ecx, edi
call fcn.00401ffc
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b00f
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40b035
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x40b03c
xor eax, eax
jmp 0x40b1b7
push 0x4148d0
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4148c8
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00404b36
mov eax, dword [ebp - 0x50]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40b06d
xor esi, esi
jmp 0x40b099
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00410490
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b12b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test byte [ebp - 0x1bc], 0x10
je 0x40b119
test byte [ebp - 0x1bc], 2
jne 0x40b119
lea eax, [ebp - 0x190]
push 0x4148c4
push eax
call esi
test eax, eax
je 0x40b119
lea eax, [ebp - 0x190]
push 0x4148c0
push eax
call esi
test eax, eax
je 0x40b119
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x190]
push eax
call fcn.0040b1c4
cmp eax, dword [ebp - 4]
jle 0x40b119
mov dword [ebp - 4], eax
lea eax, [ebp - 0x190]
push eax
push 0x4145e0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1bc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b0b4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], ebx
je 0x40b1ac
push ebx
lea ecx, [ebp - 0x28]
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], 0x41230c
mov dword [ebp - 0x14], 0x412314
call fcn.0040399e
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x412308
push eax
lea eax, [ebp - 0x7c]
push dword [ebp + 8]
push eax
call fcn.0040cc01
add esp, 0xc
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040cc01
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.00401b16
lea ecx, [ebp - 0x28]
call fcn.00401b16
lea ecx, [ebp - 0x44]
call fcn.00401ffc
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b1a4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x44]
call fcn.00401b16
lea ecx, [ebp - 0x60]
call fcn.00401b16
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x1c8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40b21b
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push str.ispro7
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov esi, ecx
push eax
call fcn.00404b36
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00404452
push dword [ebp + 8]
mov ecx, esi
call fcn.0040a0d2
test eax, eax
je 0x40b25c
mov esi, 0xffffe88a
jmp 0x40b2f7
lea eax, [ebp - 0x1c]
push eax
call fcn.0040acd8
lea eax, [esi + 0xc4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040cc01
lea eax, [esi + 0xa8]
push eax
lea eax, [ebp - 0x38]
push dword [ebp + 8]
push eax
call fcn.0040cc01
add esp, 0x1c
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a376
test eax, eax
lea ecx, [ebp - 0x38]
je 0x40b2cb
call fcn.00401ffc
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x1c]
call fcn.00401ffc
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, 0xffffe88b
jmp 0x40b2e7
call fcn.00401ffc
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x54]
push eax
call fcn.00401ba8
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.00401b16
lea ecx, [ebp - 0x54]
call fcn.00401b16
lea ecx, [ebp - 0x1c]
call fcn.00401b16
mov eax, esi
pop esi
leave
ret 8
Function at 0x40c128
Capabilities:
Check if file exists
Check os version
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
and byte [ebp - 0x224], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x223]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x120]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x120], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40c260
cmp dword [ebp - 0x110], 2
jne 0x40c260
cmp dword [ebp - 0x11c], 5
jb 0x40c260
cmp dword [ebp + 0xc], 1
jne 0x40c192
push 0x2b
jmp 0x40c199
cmp dword [ebp + 0xc], esi
jne 0x40c1ab
push 0x26
push dword [ebp + 8]
call fcn.0040bd17
mov eax, dword [ebp + 8]
pop ecx
pop ecx
jmp 0x40c365
cmp byte [ebp - 0x224], 0
je 0x40c1f1
lea eax, [ebp - 0x224]
mov edi, 0x412314
push esi
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], 0x41230c
mov dword [ebp - 0x28], edi
call fcn.0040399e
mov esi, 0x412308
push 0x414188
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 4], 1
call fcn.0040481e
jmp 0x40c222
lea eax, [ebp - 0x224]
mov edi, 0x412314
push esi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], 0x41230c
mov dword [ebp - 0xc], edi
call fcn.0040399e
mov esi, 0x412308
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], 0x41230c
mov dword [ecx + 0x14], edi
call fcn.00403a0d
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x40c24e
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x20]
call fcn.00401b16
test byte [ebp - 4], 1
je 0x40c363
lea ecx, [ebp - 0x3c]
jmp 0x40c35e
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.0040c5d9
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00401ffc
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c2b7
lea eax, [ebp - 0x64]
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404280
add eax, 0x10
mov eax, dword [eax]
cmp eax, esi
jne 0x40c29e
xor edi, edi
jmp 0x40c2a7
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
lea ecx, [ebp - 0x64]
call fcn.00401b16
cmp edi, esi
jne 0x40c338
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x40c2f4
dec eax
jne 0x40c338
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0040c128
pop ecx
pop ecx
mov ecx, eax
call fcn.0040c369
push eax
lea ecx, [ebp - 0x20]
call fcn.00401ba8
lea ecx, [ebp - 0x3c]
call fcn.00401b16
push str.Common_Files_
lea ecx, [ebp - 0x20]
call fcn.0040481e
jmp 0x40c338
lea eax, [ebp - 0x8c]
push esi
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00404045
pop ecx
pop ecx
mov ecx, eax
call fcn.00404280
push eax
lea ecx, [ebp - 0x20]
call fcn.00401ba8
lea ecx, [ebp - 0x8c]
call fcn.00401b16
lea ecx, [ebp - 0x58]
call fcn.00401b16
push str.Program_Files_
lea ecx, [ebp - 0x20]
call fcn.0040c4ec
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push eax
mov ecx, edi
mov dword [edi + 0xc], 0x41230c
mov dword [edi + 0x14], 0x412314
call fcn.00403a0d
mov dword [edi], 0x412308
lea ecx, [ebp - 0x20]
call fcn.00401b16
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40c5d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
and byte [ebp - 0x148], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
xor esi, esi
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40c6b2
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x28], 0x104
mov eax, str.CommonFilesDir
je 0x40c634
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x148]
push ecx
push esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x148]
mov ebx, 0x41230c
mov edi, 0x412314
push esi
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.0040399e
mov esi, 0x412308
push 0x414188
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
call fcn.0040481e
lea ecx, [ebp - 0x24]
call fcn.0040c763
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00403a0d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [edi], esi
jmp 0x40c757
cmp byte [ebp - 0x148], 0
mov ebx, 0x41230c
je 0x40c6f9
lea eax, [ebp - 0x148]
mov edi, 0x412314
push esi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], edi
call fcn.0040399e
mov esi, 0x412308
push 0x414188
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 1
call fcn.0040481e
jmp 0x40c726
lea eax, [ebp - 0x148]
mov edi, 0x412314
push esi
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.0040399e
mov esi, 0x412308
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00403a0d
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x40c74e
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x24]
call fcn.00401b16
test byte [ebp - 4], 1
je 0x40c75c
lea ecx, [ebp - 0x44]
call fcn.00401b16
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d4a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], 1
call fcn.0040d645
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40d55d
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40d54f
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x40d513
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x40d53c
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0xc], ebx
jne 0x40d549
cmp byte [ebp - 0x838], bl
je 0x40d54f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ebx
je 0x40d55d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040d155
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x40d582
cmp dword [ebp + 0xc], 4
jne 0x40d5ae
cmp dword [ebp - 0x14], ebx
jne 0x40d5ae
mov ax, word [edi + 0x14]
cmp ax, 3
jne 0x40d59a
mov ecx, edi
call fcn.0040db60
jmp 0x40d5ae
cmp ax, 4
mov ecx, edi
jne 0x40d5a9
call fcn.0040dd41
jmp 0x40d5ae
call fcn.0040e115
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x40db60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.00410490
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40dd2e
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x40dd2e
cmp dword [ebp - 0x14], 1
jne 0x40dd2e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x40dcf1
cmp byte [ebp - 0x148], al
je 0x40dcf1
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x40dce3
lea eax, [ebp - 0x96c]
push 0x414d48
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x4145e4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x414d44
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x40dc47
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.0040d32e
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40dd3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ecb5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x40ed18
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x40ed2a
mov eax, dword [esi + 0xdc]
jmp 0x40ed82
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x40ed80
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x40ed58
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x40ed33
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x40f4ac
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40f516
call esi
cmp eax, 0x3f0
jne 0x40f506
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call esi
cmp eax, 0x78
jne 0x40f512
mov al, 1
jmp 0x40f5db
cmp eax, ebx
je 0x40f58f
lea eax, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40f58f
call esi
cmp eax, 0x7a
jne 0x40f58f
push dword [ebp - 4]
call fcn.0040cdc9
mov esi, eax
pop ecx
lea eax, [ebp - 4]
cmp esi, ebx
push eax
push dword [ebp - 4]
setne byte [ebp - 0x20]
push esi
push 2
push dword [ebp - 8]
call edi
test eax, eax
je 0x40f583
lea eax, [ebp - 0x10]
push eax
mov al, byte [ebp + 8]
neg al
push ebx
push ebx
sbb eax, eax
push ebx
and al, 0xfd
push ebx
push ebx
add eax, 0x223
push ebx
push eax
push 0x20
lea eax, [ebp - 0x18]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40f593
cmp byte [ebp - 0x20], bl
je 0x40f58f
push esi
call fcn.0040cdd4
pop ecx
xor al, al
jmp 0x40f5db
xor edi, edi
cmp dword [esi], ebx
mov byte [ebp + 0xb], bl
jbe 0x40f5c3
lea eax, [esi + 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40f5bf
add dword [ebp - 0xc], 8
inc edi
cmp edi, dword [esi]
jb 0x40f5a2
jmp 0x40f5c3
mov byte [ebp + 0xb], 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [ebp - 0x20], bl
je 0x40f5d8
push esi
call fcn.0040cdd4
pop ecx
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret