joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404968
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4010
call fcn.00517f10
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x4010]
push 0x4000
push 0
push edi
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x4014]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 1]
xor esi, esi
cmp ecx, 0x3ffe
ja 0x404a20
push edi
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x404a20
lea eax, [ebp - 0x401c]
lea ecx, [ebp - 0x4018]
push eax
push ecx
push 0x6391f0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404a20
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4018]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, 0xffff
mov edi, eax
and edi, edx
shr eax, 0x10
and edx, ecx
shr ecx, 0x10
mov ebx, dword [ebp + 0xc]
push edi
push eax
push edx
push ecx
push str._d._d._d._d
push esi
push ebx
call fcn.00404830
add esp, 0x1c
mov word [ebx + esi*2 - 2], 0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x4010
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404a38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004059dc
push edi
push esi
push 0x770528
call fcn.00404968
add esp, 0xc
test eax, eax
je 0x404a6e
xor ebx, ebx
inc ebx
jmp 0x404a9f
lea eax, [ebp - 0x14]
mov dword [eax], 4
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push 0x639a16
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
test eax, eax
je 0x404a9f
cmp word [esi], 0
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404ea4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x404fa4
mov esi, eax
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404f9d
mov edi, eax
xor eax, eax
lea ebx, [ebp - 0x218]
push 0x208
push eax
push ebx
call fcn.006030b0
add esp, 0xc
push ebx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x70d5fc
push ecx
push eax
push 0x6398ea
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x6396e0]
movups xmmword [esp + 4], xmm0
mov eax, 0x70d5fc
mov dword [esp], eax
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x404f9d
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x228], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
push ecx
push ecx
xor ecx, ecx
lea edx, [ebp - 0x224]
push edx
push ecx
push ebx
push dword [ebp - 0x228]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404fba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x62c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x62c]
mov dword [eax], 0
push eax
call fcn.00405360
add esp, 4
mov dword [0x770508], eax
test eax, eax
je 0x40516a
mov edi, 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.006030b0
add esp, 0xc
lea esi, [ebp - 0x420]
push edi
push ebx
xor edi, edi
push esi
call fcn.006030b0
add esp, 0xc
mov eax, 0x103
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x218]
push ecx
push eax
push 0x6398ea
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, 0x70d810
call fcn.0048b640
mov esi, 0x76ad40
push 0x1048
push edi
push esi
call fcn.006030b0
add esp, 0xc
mov edi, 0x639712
push 0x6398f0
push edi
push 0x823
push esi
call fcn.00405a12
add esp, 0x10
mov esi, 0x76a930
mov ebx, 0x208
push ebx
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
mov eax, 0x103
push eax
push esi
call fcn.00405a6e
add esp, 0x10
mov dword [0x70feb8], 0x2710
lea esi, [ebp - 0x628]
push ebx
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
lea edi, [ebp - 0x638]
push 0x29
push str.___________________________7d9114302a0cb6
push edi
call fcn.0047cba0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x4050e8
mov edi, dword [ebp - 0x638]
push edi
push str.multipart_form_data__boundary_s
mov eax, 0x103
push eax
push esi
call fcn.00404830
add esp, 0x10
cmp byte [ebp - 0x62d], 0
jns 0x405114
push dword [ebp - 0x638]
call fcn.00517bd6
add esp, 4
mov eax, dword [ebp - 0x62c]
mov ecx, dword [0x770508]
mov dword [0x70fc90], ecx
mov dword [0x70fc94], eax
mov edi, 0x70fc98
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
push esi
push 0x639712
push 0x103
push edi
call fcn.00405a6e
add esp, 0x10
mov ecx, 0x70d810
call fcn.0048b370
mov ecx, 0x70d810
push 0xffffffffffffffff
call fcn.0048b7e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x62c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40519c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x830
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x834]
push 0x824
push 0
push ebx
call fcn.006030b0
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x4052a7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push 0x823
push ebx
call fcn.00405305
add esp, 0x18
push ebx
call fcn.0061fdf0
add esp, 4
mov dword [ebp - 0x838], eax
push 0x639805
push esi
call fcn.0061c8f2
add esp, 8
test eax, eax
je 0x4052e7
mov esi, eax
xor edi, edi
push 2
push edi
push eax
call fcn.0061375d
add esp, 0xc
push esi
call fcn.00613a4f
add esp, 4
mov ebx, eax
push edi
push edi
push esi
call fcn.0061375d
add esp, 0xc
mov eax, dword [ebp - 0x838]
lea ecx, [eax + ebx]
add ecx, 2
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x405297
push dword [ebp - 0x838]
lea eax, [ebp - 0x834]
push eax
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x83c], ecx
call fcn.006025b0
add esp, 0xc
add edi, dword [ebp - 0x838]
push esi
push 1
push ebx
push edi
call fcn.0061e677
add esp, 0x10
mov word [ebx + edi], 0xa0d
mov edi, dword [ebp - 0x83c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
push esi
call fcn.0061e030
add esp, 4
jmp 0x4052f0
push esi
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push 0x823
push ebx
call fcn.00405305
add esp, 0x18
push ebx
call fcn.0061fdf0
add esp, 4
mov esi, eax
xor eax, eax
cmp esi, dword [edi]
jae 0x4052e3
push esi
push ebx
push dword [ebp + 8]
call fcn.006025b0
add esp, 0xc
mov eax, esi
mov dword [edi], eax
jmp 0x4052f0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x830
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4059dc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push esi
cmp word [0x770528], 0
jne 0x405a0a
xor eax, eax
mov esi, 0x770528
push eax
push 0x26
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push esi
call fcn.00620710
add esp, 8
mov eax, 0x770528
pop esi
pop ebp
ret
Function at 0x405fa8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x6f4e3c]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea esi, [ebp - 0x18]
mov dword [esi], ecx
mov dword [esi + 4], eax
xor edi, edi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push edi
push esi
push 0x406020
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x405ffe
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebp
ret
Function at 0x407fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x824
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov al, byte [esi + 0xb]
test al, al
mov ecx, dword [esi + 4]
movzx edx, al
mov edi, edx
cmovs edi, ecx
test edi, edi
je 0x4080bb
cmp edi, 0xf
jne 0x408024
mov ecx, esi
push 0xf
push str.repairsedefbrow
push 0xffffffffffffffff
push 0
call fcn.00469a8a
test eax, eax
je 0x408053
mov al, byte [esi + 0xb]
mov ecx, dword [esi + 4]
movzx edx, al
test al, al
cmovs edx, ecx
cmp edx, 0xc
jne 0x4080bb
mov ecx, esi
push 0xc
push str.setsedefbrow
push 0xffffffffffffffff
push 0
call fcn.00469a8a
test eax, eax
jne 0x4080bb
call fcn.00407658
test al, al
je 0x40805c
jmp 0x4080bb
call fcn.00406cae
test al, al
je 0x4080bb
mov esi, dword [ebp + 0xc]
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x408069
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4080bb
lea edi, [ebp - 0x82c]
push 0x820
push 0
push edi
call fcn.006030b0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x408092
mov esi, dword [esi]
push str.__make_default_browser
push esi
push str.__s___s
push 0xffffffffffffffff
push 0x410
push edi
call fcn.00401af6
add esp, 0x18
push 0x7530
push edi
call fcn.00437d75
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x824
pop esi
pop edi
pop ebp
ret
Function at 0x408140
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x61c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00408aa0
mov eax, 0x208
xor esi, esi
lea edi, [ebp - 0x218]
push eax
push esi
push edi
call fcn.006030b0
add esp, 0xc
lea ebx, [ebp - 0x420]
mov eax, 0x208
push eax
push esi
push ebx
call fcn.006030b0
add esp, 0xc
push 0x77093a
push str.__s_____1_
push 0x104
push ebx
call fcn.00404830
add esp, 0x10
push str.IEXPLORE.EXE
push str.SOFTWAREClientsStartMenuInternet
push 0x639278
push 0x103
push edi
call fcn.00404830
add esp, 0x14
push str.LocalizedString
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, str.open
push ebx
push esi
push str.htmlfile_shell
call fcn.00408ad6
push ebx
push esi
push str.InternetShortcut_shell
call fcn.00408ad6
push ebx
push esi
push str.mhtmlfile_shell
call fcn.00408ad6
push ebx
push esi
push str.xhtmlfile_shell
call fcn.00408ad6
call fcn.00488190
cmp eax, 3
jl 0x4082c3
mov esi, 0xfffffff4
mov eax, 0x208
push eax
xor eax, eax
push eax
lea edi, [ebp - 0x628]
push edi
call fcn.006030b0
add esp, 0xc
mov ebx, dword [esi + 0x63a0d8]
push ebx
push str.SoftwareClasses_s_shell
mov eax, 0x104
push eax
push edi
call fcn.00405a6e
add esp, 0x10
push 8
push 0x63a0d8
xor eax, eax
inc eax
push eax
mov eax, 0x6390a0
push eax
push edi
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call eax
mov eax, 0x208
push eax
xor eax, eax
push eax
push edi
call fcn.006030b0
add esp, 0xc
push ebx
push str.SoftwareClasses_s_shellopencommand
mov eax, 0x104
push eax
push edi
call fcn.00405a6e
add esp, 0x10
lea ebx, [ebp - 0x420]
push ebx
call fcn.006208d5
add esp, 4
add eax, eax
push eax
push ebx
xor eax, eax
inc eax
push eax
mov eax, 0x6390a0
push eax
push edi
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esi, 4
jne 0x408217
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x61c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4082d8
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x240
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x238], eax
call fcn.004881b0
mov byte [esp + 7], al
xor esi, esi
lea ebx, [esp + 0x30]
push 0x208
push esi
push ebx
call fcn.006030b0
add esp, 0xc
push esi
push 0x26
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4083fb
push str.internet_exploreriexplore.exe
push ebx
call fcn.00620710
add esp, 8
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
je 0x4083fd
lea edi, [esp + 0x20]
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov dword [edi + 8], ecx
lea esi, [esp + 0x14]
mov ecx, esi
push ebx
call fcn.00401a6c
push edi
push esi
call fcn.0043bfbb
add esp, 8
test al, al
je 0x4083cd
push edi
call fcn.00405ccc
add esp, 4
test eax, eax
je 0x4083cd
mov edi, eax
lea ebx, [esp + 8]
mov ecx, ebx
push str.10.0.0.0
call fcn.00401a6c
push ebx
call fcn.00405ccc
add esp, 4
mov esi, eax
cmp byte [ebx + 0xb], 0
jns 0x4083a7
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
mov ecx, esi
push edi
call fcn.00405c44
mov bh, al
test esi, esi
je 0x4083bd
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
test bh, bh
je 0x408466
cmp byte [esp + 0x1f], 0
jns 0x4083e0
push dword [esp + 0x14]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x2b], 0
mov bl, byte [esp + 7]
jns 0x4083f7
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
xor ecx, ecx
jmp 0x408401
xor ecx, ecx
mov bl, byte [esp + 7]
movzx esi, cl
movzx edi, bl
push esi
xor eax, eax
push eax
push edi
push SysReAllocStringLen
call fcn.00409730
push esi
xor eax, eax
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409730
test bl, bl
je 0x408450
call fcn.004884a0
cmp eax, 5
jl 0x408450
xor edi, edi
inc edi
push esi
push edi
push edi
push SysReAllocStringLen
call fcn.00409730
push esi
push edi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409730
mov ecx, dword [esp + 0x238]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [esp + 0x1f], 0
jns 0x408479
push dword [esp + 0x14]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x2b], 0
mov bl, byte [esp + 7]
jns 0x408490
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
mov cl, 1
jmp 0x408401
Function at 0x408498
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x408653
call fcn.00408aa0
mov eax, 0x208
xor ecx, ecx
lea edi, [ebp - 0x218]
push eax
push ecx
push edi
call fcn.006030b0
add esp, 0xc
mov esi, 0x77093a
push esi
push str.__s_____1_
push 0x104
push edi
call fcn.00404830
add esp, 0x10
push esi
call fcn.006208d5
add esp, 4
add eax, eax
xor edx, edx
inc edx
mov ecx, 0x6390a0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push esi
push edx
push ecx
push 0x63a164
mov eax, SysReAllocStringLen
push eax
call ebx
mov esi, str.open
push edi
push esi
push str.http_shell
call fcn.00408ad6
push edi
push esi
push str.https_shell
call fcn.00408ad6
push edi
push esi
push str.ftp_shell
call fcn.00408ad6
mov eax, 0x208
push eax
xor eax, eax
push eax
push edi
call fcn.006030b0
add esp, 0xc
mov eax, 0x10
mov ecx, str.htmlfile
push eax
push ecx
xor edi, edi
inc edi
push edi
mov eax, 0x6390a0
push eax
push str..htm
mov esi, SysReAllocStringLen
push esi
call ebx
mov eax, 0x10
push eax
mov eax, str.htmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..html
push esi
call ebx
mov eax, 0x10
push eax
mov eax, str.htmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..shtm
push esi
call ebx
mov eax, 0x10
push eax
mov eax, str.htmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..shtml
push esi
call ebx
mov esi, 0x12
mov eax, str.mhtmlfile
push esi
push eax
push edi
mov eax, 0x6390a0
push eax
push str..mht
mov eax, SysReAllocStringLen
push eax
call ebx
push esi
mov eax, str.mhtmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..mhtm
mov eax, SysReAllocStringLen
push eax
call ebx
push esi
mov eax, str.mhtmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..mhtml
mov eax, SysReAllocStringLen
push eax
call ebx
mov eax, str.xhtmlfile
push esi
push eax
push edi
mov eax, 0x6390a0
push eax
push str..xht
mov eax, SysReAllocStringLen
push eax
call ebx
push esi
mov eax, str.xhtmlfile
push eax
push edi
mov eax, 0x6390a0
push eax
push str..xhtml
mov eax, SysReAllocStringLen
push eax
call ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x408aa0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push esi
cmp word [0x77093a], 0
jne 0x408ace
xor eax, eax
mov esi, 0x77093a
push eax
push 0x26
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push esi
call fcn.00620710
add esp, 8
mov eax, 0x77093a
pop esi
pop ebp
ret
Function at 0x408ad6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ecx
mov edi, ecx
call fcn.006208d5
add esp, 4
add eax, eax
xor edx, edx
inc edx
mov ecx, 0x6390a0
mov ebx, SysReAllocStringLen
push eax
push edi
push edx
push ecx
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea edi, [ebp - 0x218]
push esi
push edi
call fcn.006207f6
add esp, 8
push str.opencommand
push edi
call fcn.00620710
add esp, 8
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.006208d5
add esp, 4
add eax, eax
push eax
push ebx
xor esi, esi
inc esi
push esi
mov eax, 0x6390a0
push eax
push edi
mov eax, SysReAllocStringLen
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_scommand
push 0x104
push edi
call fcn.00404830
add esp, 0x14
push ebx
call fcn.006208d5
add esp, 4
add eax, eax
push eax
push ebx
push esi
mov eax, 0x6390a0
push eax
push edi
mov eax, SysReAllocStringLen
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x4096fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
cmp word [0x770b42], 0
jne 0x409728
xor eax, eax
mov esi, 0x770b42
push eax
push 0x25
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LaunchWinApp.exe
push esi
call fcn.00620710
add esp, 8
mov eax, 0x770b42
pop esi
pop ebp
ret
Function at 0x40a70e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x80
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0x10]
mov edx, dword [0x6f4e3c]
xor edx, ebp
mov dword [ebp - 0xc], edx
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
xor edx, edx
test cl, cl
sete dl
lea ecx, [edx + edx*4]
mov word [ebp - 0x20], cx
cmp byte [eax + 0xb], 0
jns 0x40a761
mov eax, dword [eax]
lea ecx, [ebp - 0x60]
mov dword [esp + 0x24], ecx
lea ecx, [ebp - 0x50]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
mov esi, eax
test eax, eax
je 0x40a7d0
mov bl, byte [ebp + 0xc]
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
test bl, bl
je 0x40a7c1
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x80
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40c418
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
mov dword [ebp - 0x14], eax
mov dword [edi], eax
push ecx
push 0x6422d8
push 1
push eax
push 0x6422e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40c47a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
js 0x40c484
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
mov esi, eax
test eax, eax
jns 0x40c494
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
jmp 0x40c48c
mov esi, eax
push eax
push str.CoCreateInstance_failed:_0x_08lx_n
jmp 0x40c48c
mov esi, eax
push eax
push str.get_localPolicy_failed:_0x_08lx_n
call fcn.0040c4c1
add esp, 8
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40c4a1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40c4ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebp
ret