joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fc48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x49fcb3
cmp byte [ebx + 0xd3], 0
jne 0x49fcb3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004071e4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x49fca0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x49fcc0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004070a8
jmp 0x49fcc0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004070a8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a14e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a1556
mov eax, esi
call fcn.00479cf8
test al, al
je 0x4a1556
mov eax, dword [ebx + 0x84]
call fcn.00479978
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a1556
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a154a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00479978
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00470a08
jmp 0x4a1556
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a1320
pop esi
pop ebx
ret

Function at 0x4a24b4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407090
xor eax, eax
push ebp
push 0x4a25ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a25c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004070fc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00412070
mov dl, 1
mov eax, dword [0x443540]
call fcn.00444744
mov dword [ebp - 0x14], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.0044482c
xor eax, eax
push ebp
push 0x4a25b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x4a260c
mov eax, dword [ebp - 0x14]
call fcn.00444974
test al, al
je 0x4a2592
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0044592c
test al, al
je 0x4a2580
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004453a4
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00407768
je 0x4a258e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0044528c
jmp 0x4a258e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0044528c
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x14]
call fcn.004447fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a25b7
mov eax, dword [ebp - 0x14]
call fcn.004055f0
ret
Function at 0x4a2668
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 7], cl
mov byte [ebp - 6], dl
mov byte [ebp - 5], al
lea esi, [ebp - 0x20a]
xor eax, eax
push ebp
push 0x4a27bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a2790
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dl, 1
mov eax, dword [0x4276c4]
call fcn.0043385c
mov dword [ebp - 0xc], eax
mov ebx, 1
lea eax, [ebp - 4]
xor edx, edx
call fcn.004070fc
jmp 0x4a26f4
lea eax, [ebp - 0x210]
movzx edx, word [esi + ebx*2 - 2]
call fcn.00407214
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 4]
call fcn.004074a4
inc ebx
cmp ebx, 0xff
jg 0x4a2704
cmp word [esi + ebx*2 - 2], 0
jne 0x4a26d5
inc ebx
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
call sub.kernel32.dll_GetDriveTypeW
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a2732
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4a2732
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406a50
test eax, eax
je 0x4a273b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4a2771
cmp edi, 5
sete al
and al, byte [ebp - 5]
cmp al, 1
je 0x4a2766
cmp edi, 3
sete al
and al, byte [ebp - 6]
cmp al, 1
je 0x4a2766
cmp edi, 4
sete al
and al, byte [ebp - 7]
cmp al, 1
jne 0x4a2771
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 4]
call fcn.00406a60
call fcn.00407400
test eax, eax
jne 0x4a26c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a279a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a27c2
lea eax, [ebp - 0x210]
call fcn.00407098
lea eax, [ebp - 4]
call fcn.00407098
ret
Function at 0x4a2f9c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4a30d1
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
test ebx, ebx
jle 0x4a30c7
push 0
lea eax, [ebp - 0xc]
push eax
push 0x16
lea eax, [ebp - 0x2a]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, 0x26
call fcn.00404204
mov esi, eax
mov eax, 0x22
call fcn.00404204
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x26
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
mov edx, edi
mov eax, esi
mov ecx, 0x14
call fcn.004043c8
mov eax, dword [esi + 6]
mov dword [edi + 6], eax
mov eax, dword [esi + 0xa]
mov dword [edi + 0xa], eax
mov eax, dword [esi + 0xe]
mov dword [edi + 0xe], eax
mov word [edi + 0x12], 1
mov eax, dword [esi + 0xe]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00404204
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [esi + 0x12]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_BeginUpdateResourceW
mov ebx, eax
test ebx, ebx
jle 0x4a30b1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 1
push 3
push ebx
call sub.kernel32.dll_UpdateResourceW
push 0
push ebx
call sub.kernel32.dll_EndUpdateResourceW
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x14]
call fcn.00404220
mov eax, edi
call fcn.00404220
mov eax, esi
call fcn.00404220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a30db
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a30e8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407090
mov eax, dword [ebp - 8]
call fcn.00407090
mov eax, dword [ebp - 0xc]
call fcn.00407090
xor eax, eax
push ebp
push 0x4a31f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a31ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x44a304]
call fcn.00452a6c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a31bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
mov eax, dword [0x4afc3c]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, eax
mov eax, dword [ebp - 0x10]
call fcn.00452f00
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 8]
call fcn.00407134
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407134
pop edx
call fcn.004a2f9c
mov eax, dword [ebp - 0xc]
call fcn.00411db0
test al, al
je 0x4a31a7
mov eax, dword [ebp - 0xc]
call fcn.00407134
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a31c4
mov eax, dword [ebp - 0x10]
call fcn.004055f0
ret
Function at 0x4a3204
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4a320c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407090
xor eax, eax
push ebp
push 0x4a3433
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
mov eax, dword [ebp - 4]
call fcn.00411db0
test al, al
je 0x4a33ff
mov eax, dword [ebp - 4]
call fcn.004a2ee0
test al, al
jne 0x4a33ff
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00412034
push dword [ebp - 0x18]
push 0x4a3450
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00412070
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407648
mov eax, dword [ebp - 8]
test eax, eax
je 0x4a32b3
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4a32b3
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406a50
mov ebx, eax
test ebx, ebx
je 0x4a32be
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
sub ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004077d0
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov ecx, 0x4a3460
call fcn.00407564
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412070
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00412070
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x4a330c
sub ebx, 4
mov ebx, dword [ebx]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00412034
push dword [ebp - 0x2c]
push 0x4a3450
lea eax, [ebp - 0x30]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 0x14]
call fcn.004077d0
push dword [ebp - 0x30]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407648
mov eax, dword [ebp - 4]
call fcn.00411db0
test al, al
je 0x4a33ff
mov eax, dword [ebp - 8]
call fcn.00411db0
test al, al
jne 0x4a33ff
mov eax, dword [ebp - 0xc]
call fcn.00411db0
test al, al
jne 0x4a33ff
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
xor eax, eax
push ebp
push 0x4a33e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00407134
push eax
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
call sub.kernel32.dll_MoveFileW
mov eax, dword [ebp - 8]
call fcn.004a2aac
lea edx, [ebp - 0x34]
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a0d64
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 4]
call fcn.004a2964
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004a30e8
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a33f3
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a01f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a343a
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004070a0
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.004070a0
ret
Function at 0x4a3658
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x4a37a0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a377b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a0d64
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00412034
push dword [ebp - 8]
push 0x4a37bc
lea edx, [ebp - 0x14]
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a0d64
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00412070
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407648
mov eax, dword [ebp - 4]
call fcn.00411db0
test al, al
je 0x4a3705
push 1
push 0x4a37c0
push 0x4a37c0
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
push 0x4a37c4
mov eax, ebx
call fcn.00479978
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x4a3771
lea edx, [ebp - 0x18]
mov eax, dword [0x4ac14c]
mov eax, dword [eax]
call fcn.004a0d64
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00412034
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a373c
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4a373c
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406a50
test eax, eax
je 0x4a3745
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x4a3771
push 1
push 0x4a37c0
push 0x4a37c0
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
push 0x4a37c4
mov eax, ebx
call fcn.00479978
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3785
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a37a7
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004070a0
ret
Function at 0x407390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427738
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4321c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x40], 0
je 0x4073d0
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x46]
test edx, edx
jne 0x4073dc
mov al, 1
jmp 0x407584
mov dword [ebp - 0x54], 8
call fcn.0040b5c0
movzx eax, ax
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov word [ebp - 0x3c], ax
call fcn.0040b5c0
mov word [ebp - 0x3a], ax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x3a]
push edx
call fcn.0040b5f0
add esp, 8
movzx eax, al
test eax, eax
je 0x407424
xor al, al
jmp 0x407584
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00404df0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004020b0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x40]
call fcn.0040dbf0
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40749f
cmp dword [ebp - 0x38], 1
je 0x4074a6
cmp dword [ebp - 0x38], 3
je 0x407540
jmp 0x407558
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x46], 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
mov edx, dword [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x407509
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
push eax
call fcn.0041181a
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x407509
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x30]
jmp 0x407584
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x46]
test edx, edx
jne 0x40752c
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2e]
jmp 0x407584
cmp dword [ebp - 0x34], 0
jne 0x40753e
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409660
jmp 0x407570
mov byte [ebp - 0x2d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2d]
jmp 0x407584
mov byte [ebp - 0x2f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2f]
jmp 0x407584
jmp 0x407437
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd44
mov esp, ebp
pop ebp
ret
Function at 0x402f10
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x407480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x40aabc
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402fdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x402fd8
mov edx, dword [edi + 0xb8]
push eax
push edx
push str.uid:_s_fe_fec:_d
push 0x40aab0
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, edi
push 0x40aab0
call fcn.00405750
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.004068bc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.004068bc
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov edi, 0x20
jmp 0x402ff1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.004068bc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004068bc
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4033a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4074e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
push 0x40a4bc
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::CString_1
mov eax, 4
mov byte [esp + 0x3c], 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x20], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403449
mov ecx, dword [esi + 0xb8]
push ecx
push str.uid:_s_no_internet_settings_key
push 0x40aab0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, esi
push 0x40aab0
call fcn.00405750
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.EnableAutodial
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403494
push eax
mov eax, dword [esi + 0xb8]
push eax
push str.uid:_s_no_isv:_d
push 0x40aab0
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x40aab0
call fcn.00405750
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4034e9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push str.EnableAutodial
push ecx
call edi
test eax, eax
je 0x4034e9
mov edx, dword [esi + 0xb8]
push eax
push edx
push str.uid:_s_ftc_is:_d
push 0x40aab0
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x40aab0
call fcn.00405750
push 0x40aabc
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x30]
push 1
lea ecx, [esi + 0xbc]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
mov ecx, esi
mov byte [esp + 0x50], 3
call fcn.004035d0
test eax, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 2
setne bl
call fcn.004068bc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40357d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push str.EnableAutodial
push ecx
call edi
test eax, eax
je 0x40357d
mov edx, dword [esi + 0xb8]
push eax
push edx
push str.uid:_s_fl_cls_a_d:_d
push 0x40aab0
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x40aab0
call fcn.00405750
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call fcn.004068bc
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 0
call fcn.004068bc
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004068bc
mov ecx, dword [esp + 0x34]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x403ac0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push pe_nt_image_headers32
push eax
push ecx
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x120]
push pe_nt_image_headers32
push ecx
push 0x40a590
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp]
mov edx, eax
mov ecx, eax
and edx, 0xff
push edx
xor edx, edx
shr ecx, 4
mov dl, ah
and ecx, 0xff
shr eax, 0xc
push ecx
and eax, 0xff
push edx
push eax
mov eax, dword [esp + 0x220]
push str._02.2X___02.2X___02.2X___02.2X_
push eax
call sub.MFC42.DLL_CString::Format
mov al, 1
add esp, 0x224
ret 4
Function at 0x404d20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4077a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x310
push ebx
push esi
mov esi, dword [esp + 0x328]
push edi
mov edi, ecx
push str.default
mov ecx, esi
mov bl, 1
mov dword [esp + 0x18], pe_nt_image_headers32
call fcn.004068c8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
push 0x40a71c
push eax
mov dword [esp + 0x32c], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.HTTP_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404e78
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x11c]
push edx
push eax
push 0
push 0
push 0x40aabc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404e78
lea edx, [esp + 0x11c]
lea ecx, [esp + 0xc]
push edx
call fcn.004068c8
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.004069d0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::MakeLower
push str.iexplore
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Find
test eax, eax
setge bl
test bl, bl
jne 0x404e6d
push str.ybrowser
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Find
test eax, eax
setge bl
test bl, bl
je 0x404e6d
lea esi, [edi + 0x90]
push 0x40a6e8
lea ecx, [esp + 0x1c]
push esi
push ecx
call sub.MFC42.DLL_operator_1
push eax
mov ecx, esi
mov byte [esp + 0x328], 1
call fcn.004069d0
push eax
lea ecx, [edi + 0x84]
call fcn.004069d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x324], 0
call fcn.004068bc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x324], 0xffffffff
call fcn.004068bc
mov ecx, dword [esp + 0x31c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x31c
ret 4