joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b98a
xor eax, eax
add esp, 0xc
ret 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x457868
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret 4

Function at 0x40b9d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x828
mov eax, dword [0x46b3ac]
mov dword [esp + 0x824], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x830]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x5c]
mov dword [esp + 0x10], eax
push 0x456ed0
push edx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x1c], eax
call fcn.00431524
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40ba5f
mov ecx, dword [esp + 0x824]
call fcn.00431018
add esp, 0x828
ret 4
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x828]
mov eax, 1
pop esi
call fcn.00431018
add esp, 0x828
ret 4

Function at 0x40ba90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x82c
mov eax, dword [0x46b3ac]
mov dword [esp + 0x828], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x834]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x60]
mov dword [esp + 0x10], eax
push 0x456ed0
push edx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x1c], eax
call fcn.00431524
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40bb1f
mov ecx, dword [esp + 0x828]
call fcn.00431018
add esp, 0x82c
ret 4
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x82c]
mov eax, 1
pop esi
call fcn.00431018
add esp, 0x82c
ret 4
Function at 0x40bb70
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.004318b6
mov ebp, eax
lea eax, [ebp + ebp + 2]
push eax
call fcn.0044a9f4
mov esi, eax
push edi
push esi
call fcn.0043167b
add esp, 0x10
xor edi, edi
test ebp, ebp
mov byte [esp + 0x10], 1
jl 0x40bbed
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x40bbcd
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x40bbc7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bbe7
mov word [esi + edi*2], 0x5c
inc edi
cmp edi, ebp
jle 0x40bba7
pop ebx
push esi
call fcn.0044a9ef
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
mov byte [esp + 0x14], 0
pop ebx
push esi
call fcn.0044a9ef
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4

Function at 0x40bc10
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x46b3ac]
push esi
mov esi, dword [esp + 0x214]
push edi
push esi
mov dword [esp + 0x214], eax
mov edi, ecx
call fcn.004318b6
add esp, 4
test eax, eax
jne 0x40bc51
pop edi
pop esi
mov ecx, dword [esp + 0x208]
call fcn.00431018
add esp, 0x20c
ret 4
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x14]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
call fcn.0043167b
lea edx, [esp + 0x10]
push esi
push edx
call fcn.00431651
add esp, 0x10
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40bca3
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.0040b9d0
mov ecx, dword [esp + 0x210]
pop edi
mov eax, 1
pop esi
call fcn.00431018
add esp, 0x20c
ret 4

Function at 0x40bcc0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, ecx
call fcn.004318b6
add esp, 4
test eax, eax
jne 0x40bcda
pop edi
pop esi
ret 4
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40bcfb
push esi
mov ecx, edi
call fcn.0040b9d0
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x40bda0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bdf5
push 0
push 0x80
push 3
push 0
push 0
push 0x10000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40bdee
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bde8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
pop esi
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
pop esi
ret 4
Function at 0x40be90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004037c0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00403490
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40bf22
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x40d870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x284], 2
jne 0x40d87e
jmp fcn.0040d560
jmp fcn.0040d280
Function at 0x40e3b0
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x70]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esi], method.CDialog.virtual_0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 4]
mov eax, dword [esi + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.00445ef5
pop esi
pop ecx
ret

Function at 0x40e680
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x46c488]
push esi
mov esi, ecx
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx]
call dword [edx + 0x168]
push 0
mov ecx, esi
call fcn.00449ef6
lea eax, [esi + 0x74]
push eax
push 0
push esi
push 0x40e440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
ret

Function at 0x40e840
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x46c488]
mov ecx, dword [ecx + 0x10]
lea eax, [esp + 8]
push eax
call fcn.00410700
mov eax, dword [eax]
push str.finish
push eax
call fcn.004314f2
mov ebx, eax
mov eax, dword [esp + 0x10]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e88e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x40e8cb
mov eax, dword [0x46c488]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx]
call dword [edx + 0x168]
push 0
mov ecx, esi
call fcn.00449ef6
lea eax, [esi + 0x74]
push eax
push 0
push esi
push 0x40e440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [0x46c488]
mov ecx, dword [ecx + 0x10]
call fcn.00410010
pop esi
pop ebx
pop ecx
ret
Function at 0x40f8a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45364e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x46b3ac]
push ebp
mov dword [esp + 0x210], eax
push edi
lea eax, [esp + 0xc]
push eax
push 0x104
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0xc]
push str.Language.xml
push ecx
call fcn.00431651
lea edx, [esp + 0x14]
push edx
push 0x456ed0
push ebp
call fcn.00431524
push 0x10
call fcn.0044a9c4
mov edi, eax
add esp, 0x18
mov dword [esp + 8], edi
test edi, edi
mov dword [esp + 0x220], 0
je 0x40f94c
push esi
lea esi, [edi + 4]
mov ecx, esi
mov dword [edi], 0x4581b8
call fcn.0041d340
mov dword [esi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], 0
pop esi
jmp 0x40f94e
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x220], 0xffffffff
mov dword [ebp + 0x208], edi
call fcn.0040f400
mov ecx, dword [esp + 0x218]
neg eax
sbb eax, eax
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x210]
neg eax
pop ebp
call fcn.00431018
add esp, 0x21c
ret

Function at 0x40fd70
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x4584a8
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x40fd8a
pop esi
pop ebx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
push str.IsWow64Process
push eax
call edi
mov ecx, dword [esi]
push str.Wow64DisableWow64FsRedirection
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi]
push str.Wow64RevertWow64FsRedirection
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push str.GetSystemWow64DirectoryW
push eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
test eax, eax
mov dword [esi + 4], eax
jne 0x40fde2
pop edi
pop esi
pop ebx
ret
push str.Wow64RevertWow64FsRedirection
push eax
call edi
mov ecx, dword [esi + 4]
push str.Wow64RevertWow64FsRedirection
push ecx
mov dword [esi + 0x20], eax
call edi
pop edi
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4148a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [0x46b3ac]
mov dword [esp + 0x414], eax
push esi
push edi
mov esi, ecx
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x210], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x212]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46c488]
stosw word es:[edi], ax
call fcn.0040ca50
mov ecx, eax
call fcn.00403f70
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0043167b
lea ecx, [esp + 0x10]
push str.wnimembUserMB.ini
push ecx
call fcn.00431651
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
push 0x45700c
push str.UserMbVer
push 0x458e04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 0x84]
test eax, eax
je 0x41497c
push eax
lea ecx, [esp + 0x214]
push ecx
call fcn.004314f2
add esp, 8
test eax, eax
jne 0x41497c
mov edi, 1
mov dword [esi + 0x78], edi
mov ecx, dword [0x46c488]
call fcn.0040ca50
mov dword [eax + 0x4c4], edi
mov ecx, dword [esp + 0x41c]
call fcn.00431018
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414f40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x82c
mov eax, dword [0x46b3ac]
mov dword [esp + 0x828], eax
push ebx
mov ebx, ecx
xor eax, eax
xor edx, edx
push esi
push edi
mov word [esp + 0x10], dx
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x420], dx
mov ecx, 0x81
lea edi, [esp + 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x628], dx
mov ecx, 0x81
lea edi, [esp + 0x62a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x218], dx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46c488]
stosw word es:[edi], ax
call fcn.0040ca50
mov esi, eax
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
mov edi, 1
cmp ecx, edi
jle 0x414ff4
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032e0
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0043167b
lea eax, [esp + 0x18]
push str.wnimembmb.ini
push eax
call fcn.00431651
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x104
lea edx, [esp + 0x220]
push edx
push 0x45700c
push str.SysMbVer
push 0x458e04
call esi
mov eax, dword [ebx + 0x90]
test eax, eax
je 0x415061
push eax
lea eax, [esp + 0x21c]
push eax
call fcn.004314f2
add esp, 8
test eax, eax
jne 0x415061
mov dword [ebx + 0x80], edi
lea ecx, [esp + 0x10]
push ecx
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x45700c
push str.NewVer
push str.Globals
call esi
lea eax, [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x630]
push ecx
push 0x45700c
push 0x458e6c
push str.Globals
call esi
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x4150ee
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
je 0x4150ee
push eax
lea edx, [esp + 0x424]
push edx
call fcn.004314f2
add esp, 8
test eax, eax
jne 0x4150ee
mov eax, dword [ebx + 0x8c]
push eax
lea ecx, [esp + 0x62c]
push ecx
call fcn.004314f2
add esp, 8
test eax, eax
jne 0x4150ee
mov dword [ebx + 0x7c], edi
mov ecx, dword [esp + 0x834]
call fcn.00431018
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4171f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46b3ac]
push edi
mov dword [esp + 0x214], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41726f
push 0x104
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 8]
push eax
push str._.8X
push ecx
call fcn.00431524
add esp, 0xc
mov ecx, dword [esp + 0x214]
call fcn.00431018
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x417ca0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ecx
push esi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x417d89
lea eax, [esp + 4]
push eax
push 0x460f28
push 1
push esi
push 0x460f38
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x417d83
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x417cf5
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x417d08
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x1c]
test cx, cx
je 0x417d1c
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x34]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x417d2f
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x24]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x417d42
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x460f78
push eax
call dword [ecx]
test eax, eax
jl 0x417d79
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 1
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ecx
ret 0x1c
Function at 0x417d90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x46b3ac]
push edi
mov dword [esp + 0x12c], eax
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jne 0x417dfd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417ddd
cmp eax, 1
jne 0x417dfd
cmp byte [esp + 0x122], 1
jne 0x417dfd
mov eax, 1
mov ecx, dword [esp + 0x12c]
call fcn.00431018
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
call fcn.00431018
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417e10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x46b3ac]
mov dword [esp + 0xa38], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov esi, ecx
mov word [esp + 0x838], bx
mov ecx, 0x81
lea edi, [esp + 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x428], bx
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], bx
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], bx
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x18], bx
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1a
lea eax, [esp + 0x840]
push eax
push ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call edi
lea ecx, [esp + 0x838]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0043167b
lea eax, [esp + 0x20]
push eax
call fcn.004318b6
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.00431c6b
add esp, 0x14
cmp eax, ebx
je 0x41800f
lea edx, [esp + 0x18]
mov word [eax], bx
push edx
lea eax, [esp + 0x42c]
push eax
call fcn.0043167b
lea ecx, [esp + 0x430]
push str.Local
push ecx
call fcn.00431651
add esp, 0x10
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417f42
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push ecx
call fcn.0043167b
lea edx, [esp + 0x228]
push str.LocalLow
push edx
call fcn.00431651
add esp, 0x10
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417f83
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.0043167b
lea eax, [esp + 0x638]
push str.Roaming
push eax
call fcn.00431651
add esp, 0x10
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 1
jne 0x417fc5
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ebx
je 0x41800f
cmp dword [esp + 0xc], ebx
je 0x41800f
cmp eax, ebx
je 0x41800f
mov ecx, esi
call fcn.00417d90
test eax, eax
je 0x41800f
lea edx, [esp + 0x220]
push edx
push esi
call fcn.0043167b
push 0x457080
push esi
call fcn.00431651
add esp, 0x10
mov ecx, dword [esp + 0xa44]
call fcn.00431018
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x1a
push esi
push ebx
call edi
push 0x457080
push esi
call fcn.00431651
mov ecx, dword [esp + 0xa4c]
add esp, 8
call fcn.00431018
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418040
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x453dd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
mov eax, dword [0x46b3ac]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
mov dword [esp + 0x14], ecx
call fcn.0044aaec
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 0x43c], edi
call fcn.0044aaec
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov word [esp + 0x18], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x20]
push eax
push 0
mov byte [esp + 0x44c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41816a
lea ecx, [esp + 0x18]
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.00431651
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push 0x457a50
push eax
call fcn.00403980
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41816a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x14]
push str.__sProgram_FilesInternet_Exploreriexplore.exe_
push eax
mov word [esp + 0x232], 0
call fcn.00403980
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push str._HOMEDRIVE__HOMEPATH_
push 0
push 1
push 0x457988
push ebx
push esi
call fcn.00417ca0
add ebx, 0xfffffff0
mov byte [esp + 0x43c], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41818c
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x43c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4181b1
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
mov eax, 1
call fcn.00431018
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4181e0
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41820b
xor eax, eax
pop edi
pop ecx
ret 4
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.004318b6
mov ecx, dword [esp + 0xc]
add esp, 4
shl eax, 1
push eax
push esi
push 1
push 0
push 0x457868
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00418040
pop esi
mov eax, 1
pop edi
pop ecx
ret 4