joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406064
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40616e
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4060b7
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.004030f4
jmp 0x406155
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406018
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406038
mov ebx, eax
test esi, esi
je 0x4060df
dec esi
test esi, esi
jl 0x4060df
cmp edi, ebx
jne 0x4060be
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403134
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403380
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
cmp eax, 2
jl 0x406155
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406155
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406155
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406175
lea eax, [ebp - 0x110]
call fcn.00403010
ret

Function at 0x406308
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4063a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406355
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
push esi
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x40638a
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00405eb0
mov eax, dword [ebp - 8]
call fcn.00403340
push eax
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063a7
lea eax, [ebp - 8]
call fcn.00403010
ret
Function at 0x407abc
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x407acb
mov edx, dword [edx + 0x36]
jmp fcn.00403134
mov ecx, dword [edx + 0x18]
jecxz 0x407ac3
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403450
pop edx
mov ecx, dword [ebx]
jecxz 0x407af3
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x407b64
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x407b70
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x407b8c
push eax
je 0x407b8d
call dword [0x41312c]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41312c]
ret
Function at 0x40d274
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe48
cmp dword [0x414560], 0
ja 0x40d2fb
lea eax, [esp + 0x28]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esp
mov edx, 0x28
call fcn.00404c40
mov dword [esp + 4], 0x40d0f8
mov eax, 0x40d304
mov dword [esp + 0x24], eax
mov eax, dword [0x413460]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
push esp
call sub.user32.dll_RegisterClassA
push 0
mov eax, dword [0x413460]
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0
mov eax, dword [esp + 0x4c]
push eax
push 0x80
call sub.user32.dll_CreateWindowExA
mov dword [0x414560], eax
call fcn.00405134
mov dword [0x414564], eax
add esp, 0x1b8
ret

Function at 0x40d510
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40d5b2
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0xc], eax
mov word [esp], 2
push edi
call sub.wsock32.dll_htons
mov word [esp + 2], ax
test esi, esi
jne 0x40d551
xor eax, eax
mov dword [esp + 4], eax
jmp 0x40d562
mov eax, esi
call fcn.00403340
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40d585
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebx + 0xc], eax
jmp 0x40d5b2
call fcn.00405134
mov dword [ebx + 8], eax
push 0x28
push 0x400
mov eax, dword [0x414560]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.wsock32.dll_WSAAsyncSelect
cmp word [ebx + 0x26], 0
je 0x40d5b2
mov edx, ebx
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x100012d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001328
cmp byte [esi + ebx - 1], 0xa
je 0x100012fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x100018d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10007094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10001a90
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x10007094]
movzx eax, al
bt eax, esi
jae 0x10001af0
mov ecx, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10001995
test byte [0x10003030], 8
jne 0x10001a30
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x100019e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001964
cmp esi, 3
jbe 0x100019a0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005130]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001964
mov ecx, dword [0x10007094]
test ecx, ecx
je 0x10001ad0
mov dword [esp], 0x10003040
call dword [0x10007094]
test al, 8
je 0x1000193b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x1000193b
mov ebx, dword [0x10007094]
test ebx, ebx
je 0x10001ab0
mov dword [esp], 0x10003030
call dword [0x10007094]
test al, 8
je 0x10001926
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x1000192e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x100018ed
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x10001a3a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x100019ee
mov eax, 0xffffffff
jmp 0x10001995
Function at 0x10001ca0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100070a0]
test eax, eax
je 0x10001d58
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10001ce0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10001ccc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x10001d8d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100070a0], eax
sub esp, 8
test eax, eax
jne 0x10001cbd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10001cce
Function at 0x10001da0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10001f21
mov eax, dword [esi]
test eax, eax
je 0x10001f10
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], edx
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10001f25
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10001f08
call dword [edx + 0x28]
sub esp, 8
mov dword [esi + 8], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
not eax
shr eax, 0x1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
sub esp, 8
jmp 0x10001ec9
mov edx, esi
mov eax, edi
call dbg.create_registrar
test eax, eax
jne 0x10001e06
xor eax, eax
jmp 0x10001ef8
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10001ef8
Function at 0x4049fe
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x44
mov eax, esp
mov edx, eax
add edx, 0x44
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x404a0f
push str.psapi.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [esp], eax
cmp dword [esp], 0
je 0x404b0f
push str.EnumProcesses
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 4], eax
push str.EnumProcessModules
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 8], eax
push str.GetModuleBaseNameA
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0xc], eax
push str.GetModuleFileNameExA
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x10], eax
push str.EnumDeviceDrivers
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x14], eax
push str.GetDeviceDriverBaseNameA
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x18], eax
push str.GetDeviceDriverFileNameA
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x1c], eax
push str.GetProcessMemoryInfo
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x20], eax
push str.EmptyWorkingSet
push dword [esp + 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4130b4], eax
push 0x1000
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esp + 0x24], eax
push 0x1000
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esp + 0x28], eax
push 0x1000
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esp + 0x2c], eax
push 0x4100d3
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x404b6c
push str.CreateToolhelp32Snapshot
push dword [esp + 0x34]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x34], eax
push str.Thread32First
push dword [esp + 0x34]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x38], eax
push str.Thread32Next
push dword [esp + 0x34]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x3c], eax
push str.OpenThread
push dword [esp + 0x34]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x40], eax
xor eax, eax
add esp, 0x44
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret
Function at 0x405237
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x20
mov eax, esp
mov edx, eax
add edx, 0x20
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x405248
mov edx, dword [esi + 0x18]
lea ecx, [esp]
call fcn.0040a101
push dword [0x410204]
mov eax, dword [0x413058]
call fcn.004141d0
lea ecx, [esp + 8]
pop edx
call fcn.0040a094
push dword [0x410204]
mov eax, dword [0x41305c]
call fcn.004141d0
lea ecx, [esp + 0xc]
pop edx
call fcn.0040a094
mov edx, dword [esp + 4]
xor ecx, ecx
call fcn.0040a178
jne 0x40544b
push dword [esp + 4]
mov edx, dword [0x413134]
pop ecx
call fcn.0040a178
jne 0x405449
push dword [esp + 8]
call fcn.0040c6f0
push dword [esp]
call fcn.0040c6f0
fcompp
fnstsw ax
test ah, 0x41
je 0x40542a
push 0x3e7
call fcn.00404cf3
push dword [0x410204]
mov eax, 0xff
call fcn.00409b8b
lea ecx, [esp + 0x10]
pop edx
call fcn.0040a094
push 0xff
push dword [esp + 0x10]
push str.comspec
call sub.KERNEL32.DLL_GetEnvironmentVariableA
push dword [0x410204]
mov eax, 0xff
call fcn.00409b8b
lea ecx, [esp + 0x14]
pop edx
call fcn.0040a094
push dword [esp + 0x10]
push 0xff
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [0x410204]
push 1
mov eax, dword [esp + 0x18]
call fcn.004099a5
inc dword [0x410204]
mov edx, 0x410010
pop ecx
mov dword [0x410204], ecx
call fcn.0040a178
jne 0x405388
mov edx, dword [esp + 0x10]
push dword [0x410204]
call fcn.0040a140
mov edx, 0x410010
call fcn.0040a140
lea ecx, [esp + 0x14]
pop edx
call fcn.0040a094
push dword [0x410204]
mov eax, 0xff
call fcn.00409b8b
lea ecx, [esp + 0x18]
pop edx
call fcn.0040a094
push 0xff
push dword [esp + 0x18]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push dword [0x410204]
push dword [esp + 0x18]
call fcn.0040c8a0
lea ecx, [esp + 0x1c]
pop edx
call fcn.0040a094
push dword [0x410204]
push 2
push 0x410151
push dword [0x410204]
mov edx, str._c_del__
call fcn.0040a140
mov edx, dword [esp + 0x20]
call fcn.0040a140
mov edx, dword [esp + 0x28]
call fcn.0040a140
mov edx, 0x41015b
call fcn.0040a140
inc dword [0x410204]
push dword [esp + 0x1c]
call fcn.0040c920
pop dword [0x410204]
mov dword [esp + 0x1c], eax
jmp 0x4097af
push dword [0x413134]
mov eax, dword [0x413058]
call fcn.00414200
push dword [esp]
mov eax, dword [0x41305c]
call fcn.00414200
jmp 0x405449
jmp 0x405468
push dword [0x413134]
mov eax, dword [0x413058]
call fcn.00414200
push dword [esp]
mov eax, dword [0x41305c]
call fcn.00414200
xor eax, eax
mov edx, dword [esp + 0xc]
call fcn.0040a160
mov edx, dword [esp + 0x10]
call fcn.0040a160
mov edx, dword [esp + 4]
call fcn.0040a160
mov edx, dword [esp + 8]
call fcn.0040a160
mov edx, dword [esp + 0x18]
call fcn.0040a160
mov edx, dword [esp + 0x14]
call fcn.0040a160
mov edx, dword [esp]
call fcn.0040a160
add esp, 0x20
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 4
Function at 0x405e0c
Capabilities:
Timestomp file

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x20]
pop dword [0x410204]
mov esi, esp
sub esp, 0x3c
mov eax, esp
mov edx, eax
add edx, 0x3c
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x405e27
mov edx, dword [esi + 0x18]
lea ecx, [esp]
call fcn.0040a101
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 4]
call fcn.0040a101
lea eax, [esp + 8]
lea eax, [esp + 0x10]
lea eax, [esp + 0x18]
lea eax, [esp + 0x20]
push dword [esp]
push 0
call fcn.0040ee4a
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x3c]
call sub.KERNEL32.DLL_GetFileTime
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x40]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0x34]
call sub.KERNEL32.DLL_CloseHandle
push 0
call fcn.0040ecb9
mov edx, dword [esp + 0x38]
push dword [0x410204]
call fcn.0040a140
pop eax
jmp 0x405ef4
mov edx, dword [esp]
call fcn.0040a160
mov edx, dword [esp + 4]
call fcn.0040a160
mov edx, dword [esp + 0x38]
call fcn.0040a160
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 8

Function at 0x405f1e
Capabilities:
Set registry value

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
mov esi, esp
sub esp, 0x1c
mov eax, esp
mov edx, eax
add edx, 0x1c
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x405f2f
mov eax, dword [esi + 0x18]
mov dword [esp], eax
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 4]
call fcn.0040a101
mov edx, dword [esi + 0x20]
lea ecx, [esp + 8]
call fcn.0040a101
mov edx, dword [esi + 0x24]
lea ecx, [esp + 0xc]
call fcn.0040a101
mov dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x14]
push eax
push dword [esp + 8]
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
cmp ebx, 0
jne 0x405fcc
mov eax, dword [esp + 0xc]
call fcn.00409937
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push eax
push 1
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
cmp ebx, 0
jne 0x405fc3
mov dword [esp + 0x10], 1
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x405fd4
mov edx, dword [esp + 8]
call fcn.0040a160
mov edx, dword [esp + 4]
call fcn.0040a160
mov edx, dword [esp + 0xc]
call fcn.0040a160
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 0x10
Function at 0x40a340
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x20]
pop dword [0x410204]
mov esi, esp
sub esp, 0x24
mov eax, esp
mov edx, eax
add edx, 0x24
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40a35b
mov edx, dword [esi + 0x18]
lea ecx, [esp]
call fcn.0040a101
mov eax, dword [esi + 0x1c]
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov dword [esp + 6], 0x80000000
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
mov dword [esp + 0x12], 0
push dword [0x410204]
mov eax, 0x800
call fcn.00409b8b
lea ecx, [esp + 0x1a]
pop edx
call fcn.0040a094
mov edx, 0x410210
lea ecx, [esp + 0x1a]
call fcn.0040a0e0
push 0
push 0
push 0
movsx eax, byte [esp + 0x10]
push eax
push str.Opera_6.01
call sub.WININET.dll_InternetOpenA
mov dword [esp + 0xa], eax
push 0
push dword [esp + 0xa]
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x1e]
call sub.WININET.dll_InternetOpenUrlA
mov dword [esp + 0xe], eax
mov eax, 1
call fcn.004141c0
lea eax, [esp + 0x12]
push eax
mov eax, dword [esp + 0x1a]
call fcn.00409937
push eax
mov eax, dword [esp + 0x1e]
push eax
push dword [esp + 0x1a]
call sub.WININET.dll_InternetReadFile
mov ebx, dword [esp + 0x12]
cmp ebx, 0
jne 0x40a445
mov byte [esp + 5], 0
jmp 0x40a472
mov edx, dword [esp + 0x1a]
push dword [0x410204]
call fcn.0040a140
push dword [0x410204]
push dword [esp + 0x1a]
mov eax, dword [esp + 0x22]
call fcn.004098fa
pop eax
lea ecx, [esp + 0x1e]
pop edx
call fcn.0040a094
mov ebx, dword [esp + 0x1e]
add ebx, dword [esp + 0x12]
mov dword [esp + 0x1e], ebx
movsx ebx, byte [esp + 5]
cmp ebx, 0
jne 0x40a40e
push dword [esp + 0xe]
call sub.WININET.dll_InternetCloseHandle
push dword [esp + 0xa]
call sub.WININET.dll_InternetCloseHandle
mov edx, dword [esp + 0x1a]
push dword [0x410204]
call fcn.0040a140
pop eax
jmp 0x40a4b4
mov edx, dword [esp + 0x16]
call fcn.0040a160
mov edx, dword [esp + 0x1a]
call fcn.0040a160
mov edx, dword [esp]
call fcn.0040a160
add esp, 0x24
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret 8

Function at 0x40a4e0
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
push ebp
push esi
push edi
push dword [esp + 0x18]
pop dword [0x410204]
mov esi, esp
sub esp, 4
mov eax, esp
mov edx, eax
add edx, 4
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40a4fb
push dword [0x410204]
mov eax, 0x1f4
call fcn.00409b8b
lea ecx, [esp + 4]
pop edx
call fcn.0040a094
mov eax, dword [esp]
push eax
push 0x226
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov edx, dword [esp]
push dword [0x410204]
call fcn.0040a140
pop eax
jmp 0x40a549
mov edx, dword [esp]
call fcn.0040a160
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
pop ebx
ret