joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401dea
Capabilities:
Delete file
Enumerate files on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
cmp dword [ebp + 8], 0
je 0x401e02
push dword [ebp + 8]
call fcn.004032c5
pop ecx
cmp dword [0x4072e8], 1
push ebx
push esi
push edi
jne 0x401f29
and byte [ebp - 0x348], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x347]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x406794
mov ebx, str._s_s
push 0x408530
lea eax, [ebp - 0x348]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x401f29
lea eax, [ebp - 0x114]
push 0x406790
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401f08
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x114]
push 0x40678c
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x401f08
lea eax, [ebp - 0x114]
push str..exe
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x401f08
lea eax, [ebp - 0x114]
push 0x406780
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401f08
and byte [ebp - 0x244], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x243]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
push 0x408530
lea eax, [ebp - 0x244]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401e6b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
je 0x401f3a
push 0
call dword [sym.imp.MSVCRT.dll_exit]
leave
ret
Function at 0x402caf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push dword [ebp + 8]
stosb byte es:[edi], al
call fcn.00402c69
pop ecx
test eax, eax
pop ecx
je 0x402d3a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp + 8], eax
je 0x402d36
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push ebx
mov ebx, 0x408224
lea eax, [ebp - 0x104]
push ebx
push str._scometcmp.inf
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call esi
push ebx
lea eax, [ebp - 0x104]
push str._scomet.inf
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call esi
pop ebx
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret

Function at 0x402d3d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
push ebx
push esi
push edi
push 0x40
pop edx
xor bl, bl
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40f]
mov byte [ebp - 0x410], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x402e7a
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push str._scometdt_
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x402e7a
lea eax, [ebp - 0x104]
push 0x406794
push eax
mov edi, str._s_s
lea eax, [ebp - 0x30c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402e62
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x410]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x550]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402e28
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x402e7e
xor eax, eax
jmp 0x402e96
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402e9b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push 3
pop esi
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402eec
mov eax, dword [ebp - 0x84]
dec eax
je 0x402eea
dec eax
jne 0x402eec
cmp dword [ebp - 0x90], 4
ja 0x402edd
push 1
pop esi
jmp 0x402eec
cmp dword [ebp - 0x90], 5
jne 0x402eec
push 2
jmp 0x402eda
xor esi, esi
mov eax, esi
pop esi
leave
ret
Function at 0x403128
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
mov esi, str.1678F7E1
lea edi, [ebp - 0x20]
lea eax, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.D14D6793
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor ebx, ebx
push eax
push 9
push ebx
mov edi, 0x80000002
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032b6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40324e
cmp dword [ebp - 8], ebx
jbe 0x40324e
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
mov dword [ebp - 4], ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x42b]
mov byte [ebp - 0x42c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14], 0x400
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40323a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x42c]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x42c]
push eax
call esi
add esp, 0x10
cmp edi, ebx
jne 0x40323a
cmp eax, ebx
jne 0x40323a
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x10], 1
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 0x40
pop ecx
jae 0x40323a
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [edi]
shl eax, 6
add eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
inc dword [edi]
pop ecx
pop ecx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x4031a0
mov edi, 0x80000002
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], ebx
je 0x4032b6
lea eax, [ebp + 8]
mov esi, 0x20006
push eax
push esi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4032a4
cmp eax, 2
jne 0x40328e
lea eax, [ebp + 8]
push eax
push esi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x403299
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x4032b6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4032b6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov ecx, dword [ebp + 0xc]
xor eax, eax
pop edi
pop esi
cmp dword [ecx], ebx
pop ebx
setg al
leave
ret
Function at 0x4033a0
Capabilities:
Delete file

Disassembly:
push esi
push dword [esp + 8]
call fcn.004032c5
pop ecx
mov esi, 0x406e18
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x144
cmp esi, 0x407328
jl 0x4033b0
pop esi
ret

Function at 0x40344d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x17]
mov byte [ebp - 0x18], bl
mov dword [ebp - 8], 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push ebx
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4034ee
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.Build
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4034e5
cmp byte [ebp - 0x18], 0x34
jne 0x4034b1
push 1
pop esi
jmp 0x4034e5
lea eax, [ebp - 0x18]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4034c5
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, 0xc350
pop ecx
jle 0x4034e5
xor ecx, ecx
cmp eax, 0xcea4
setg cl
inc ecx
inc ecx
mov esi, ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034f5
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push edi
push 1
xor ebx, ebx
pop edx
xor eax, eax
push 0x40
lea edi, [ebp - 0x11b]
pop ecx
mov byte [ebp - 0x11c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x21f]
mov byte [ebp - 0x220], bl
mov dword [ebp - 0xc], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x104
push eax
push edx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40357a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403581
xor eax, eax
jmp 0x40363d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x11c]
push str.Comet_
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x11c]
push str.MyCometCursor.exe
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x220]
push 0x103
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x40363a
push esi
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
push esi
push edi
lea eax, [ebp - 0x220]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403632
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x4066b4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403632
mov eax, dword [ebp - 4]
cmp word [eax + 0xc], 0x2a
ja 0x403632
mov dword [ebp - 0xc], ebx
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret
Function at 0x403805
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
je 0x4038b3
cmp edi, 0x20
je 0x4038b3
cmp dword [ebp + 8], 0xffffffff
je 0x4038b6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4038b6
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strlen
mov edi, dword [sym.imp.MSVCRT.dll_rename]
mov byte [ebp + eax - 0x109], 0x5f
lea eax, [ebp - 0x108]
push eax
push esi
call edi
add esp, 0x14
test eax, eax
jne 0x4038b3
lea eax, [ebp - 0x108]
push esi
push eax
call edi
pop ecx
pop ecx
jmp 0x4038b6
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4038be
Capabilities:
Delete registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1214
call fcn.00404150
and byte [ebp - 0xa14], 0
push ebx
push esi
mov ebx, 0x1ff
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x14
mov esi, str.HKLM___SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
pop ecx
lea edi, [ebp - 0x214]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x6b
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20006
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, esi
jle 0x40398d
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
and byte [ebp - 0x1214], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x1213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push esi
push eax
lea eax, [ebp - 0x1214]
push str._r_n_s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1214]
push eax
lea eax, [ebp - 0xa14]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
add esi, 0x40
dec dword [ebp - 8]
jne 0x40393d
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x40000000
push 0x4071e4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4039b1
push str.AddBHOInfSectionA
jmp 0x403a2e
lea eax, [ebp - 0xa14]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
xor ebx, ebx
push 2
push ebx
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xa14]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x403a29
cmp esi, dword [ebp - 0x10]
jne 0x403a29
cmp dword [ebp - 0x14], 0
jne 0x403a24
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x403a1b
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x403a15
and dword [ebp - 0xc], 0
add esi, 0x40
dec edi
jne 0x403a03
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x403a36
push str.AddBHOInfSectionB
call fcn.004033a0
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a3b
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp + 8]
xor ebx, ebx
mov edi, 0x80000002
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push edi
call esi
test eax, eax
je 0x403a97
lea eax, [ebp - 4]
push eax
push 4
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push edi
call esi
push ebx
push dword [ebp + 8]
push ebx
push 2
push ebx
push ebx
push ebx
push str.Comet
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [ebp - 4]
test eax, eax
setne bl
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x403a9e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x403b07
cmp esi, 0xb7
je 0x403b07
cmp esi, 0x4bd
je 0x403b07
cmp esi, 6
je 0x403b07
cmp esi, 2
je 0x403b07
cmp esi, 0x20
je 0x403b07
cmp esi, 5
je 0x403b07
cmp esi, 0x715
je 0x403b07
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403b0c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop esi
leave
ret
mov eax, esi
jmp 0x403b09

Function at 0x403b36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
lea eax, [ebp + 8]
push esi
push eax
xor ebx, ebx
push 9
push ebx
mov dword [ebp - 4], 0x400
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, 0x408c68
jne 0x403bb7
cmp dword [ebp + 0x10], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 8]
push eax
push ebx
je 0x403b80
push dword [ebp + 0x10]
jmp 0x403b83
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x403ba8
lea eax, [ebp - 0x408]
push eax
push 0x406c28
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x403bae
mov byte [0x408c68], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403bbd
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
lea eax, [ebp - 0xc]
push esi
push eax
push 9
push 0
mov esi, 0xff
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c74
push edi
xor edi, edi
lea eax, [ebp - 0x14]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x403c6a
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x614]
push dword [ebp + 0xc]
push str._s_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x614]
push str.Plugins_Directory
push eax
push dword [ebp + 8]
call fcn.00403b36
add esp, 0x1c
test eax, eax
je 0x403c64
cmp byte [eax], 0
je 0x403c64
push eax
call fcn.00403d13
pop ecx
inc edi
cmp edi, 0xc
jb 0x403bf1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret

Function at 0x403c77
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
and byte [ebp - 0x100], 0
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0xff]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.SoftwareNetscapeNetscape_Navigator
lea eax, [ebp - 0x100]
push str._sMain
push eax
call esi
lea eax, [ebp - 0x100]
push str.Install_Directory
push eax
push 0x80000001
call fcn.00403b36
add esp, 0x18
push eax
lea eax, [ebp - 0x300]
push 0x406c28
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
cmp eax, 0xffffffff
pop esi
je 0x403d11
lea eax, [ebp - 0x300]
push str.programplugins
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x300]
push eax
call fcn.00403d13
add esp, 0xc
leave
ret
Function at 0x403d13
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
mov esi, str._np32comet.dll
lea edi, [ebp - 0x10]
and byte [ebp - 0x434], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str._np32cometv.dll
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.cometplug.class
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x433]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x434]
push eax
call sub.MSVCRT.dll_strcpy
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
mov ebx, 0x100
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x434]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x14
lea eax, [ebp - 0x434]
push eax
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x434]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x34]
push ebx
push eax
lea eax, [ebp - 0x434]
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x434]
push eax
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x434]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x434]
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x434]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403df0
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
and byte [ebp - 0x208], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
and byte [ebp - 0x104], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
and byte [ebp - 0x30c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x408530
mov edi, str._s_s
push ebx
lea eax, [ebp - 0x30c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x403ee1
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x208]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push 0x406390
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x44c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403e7e
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret