joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402942
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.004454d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x4029b7
xor eax, eax
jmp 0x402b06
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push 0x3c
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x402af2
mov eax, dword [ebp - 0x14]
push ebx
add eax, 0x18
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x402a35
sub dword [ebp - 8], 0xffffff80
jmp 0x402a4c
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x402a49
add dword [ebp - 8], 0x90
jmp 0x402a4c
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x402af2
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call edi
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x402af2
push ebx
push ebx
add eax, 0xfffffff0
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], ebx
jne 0x402af2
cmp dword [ebp - 0x2c], ebx
jne 0x402af2
cmp dword [ebp - 0x28], ebx
jne 0x402af2
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x402af2
mov edi, dword [ebp + 0xc]
push eax
mov dword [edi], eax
call fcn.0043b2c8
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [edi]
push ebx
push ebx
sub eax, 0x10
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx], ebx
pop esi
setne al
pop edi
pop ebx
leave
ret
Function at 0x403ba1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.00402b0a
pop ecx
pop ecx
mov edi, 0xafbb
push edi
test eax, eax
je 0x403c4a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx - 0xe1c]
mov dword [ebp - 8], eax
call fcn.0043b7d8
pop ecx
push edi
mov ebx, eax
push esi
push ebx
call fcn.004454d0
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebx + 0xafab], eax
mov eax, dword [esi]
mov dword [ebx + 0xafaf], eax
add esp, 0xc
lea eax, [ebx + 0xafb7]
push eax
lea eax, [ebx + 0xafb3]
push eax
call fcn.00402942
mov eax, dword [ebp - 8]
pop ecx
mov edi, ebx
pop ecx
mov ecx, 0x387
rep movsd dword es:[edi], dword [esi]
mov dword [0x46d5b8], ebx
add eax, 8
add ebx, 0xf28
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x403c37
jmp 0x403d70
call fcn.0043b7d8
pop ecx
push edi
mov ebx, eax
push 0x45fdf8
push ebx
call fcn.00442cb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.004454d0
add esp, 0xc
push str.data.cab
mov eax, 0x104
lea edi, [ebp - 0x110]
call fcn.0040e7a4
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403ce6
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [ebx + 0xafaf]
push eax
mov dword [edi], eax
call fcn.0043b2c8
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi]
mov dword [ebx + 0xafab], eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.theme.cab
mov eax, 0x104
lea edi, [ebp - 0x110]
call fcn.0040e7a4
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403d4f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [ebx + 0xafb7]
push eax
mov dword [edi], eax
call fcn.0043b2c8
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi]
mov dword [ebx + 0xafb3], eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46d5b8], ebx
mov eax, 0x45fe00
add ebx, 0xf28
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x403d62
push dword [0x46d5b8]
call fcn.00402f2b
pop ecx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x404c95
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x404e18
cmp dword [ebp + 0x10], ebx
je 0x404e18
cmp esi, ebx
je 0x404cfb
cmp dword [esi + 4], ebx
je 0x404cfb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404c4b
add esp, 0xc
cmp eax, ebx
jne 0x404e1a
add esi, 8
cmp dword [esi + 4], ebx
je 0x404e1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404c4b
add esp, 0xc
jmp 0x404e1a
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.004454d0
add esp, 0xc
push str.theme_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0040e7a4
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404d30
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404d40
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404dd6
push str.data_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0040e7a4
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404d90
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404da0
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404e18
push ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
inc eax
push eax
call fcn.0043b2c8
pop ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
mov byte [eax + ecx], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x404e1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4050cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46d5b8]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp byte [eax + 0xa477], bl
je 0x4051e8
lea ecx, [eax + 0xa478]
cmp ecx, ebx
je 0x4051e8
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4050fe
sub ecx, esi
je 0x4051e7
lea ecx, [eax + 0xad7c]
cmp ecx, ebx
je 0x4051e7
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40511e
sub ecx, esi
je 0x4051e7
add eax, 0xae80
push eax
push SysReAllocString
call fcn.004028cb
pop ecx
pop ecx
test al, al
jne 0x4051e7
mov eax, dword [0x46d5b8]
add eax, 0xae80
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004028cb
pop ecx
pop ecx
test al, al
jne 0x4051e7
call fcn.004051eb
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.004454d0
mov eax, dword [0x46d5b8]
push eax
push fcn.00403f8e
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [eax + 0xac78]
push 0x104
lea eax, [ebp - 0x10c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00404428
add esp, 0x20
cmp esi, ebx
je 0x4051e0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4051c0
sub eax, edx
je 0x4051e0
push 5
push ebx
lea eax, [ebp - 0x10c]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.0043bdb4
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x405414
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call fcn.004454d0
xor eax, eax
push esi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.004454d0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call fcn.0040e1a8
add esp, 0x20
test eax, eax
je 0x4054e2
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x405498
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call esi
xor eax, eax
movzx ecx, word [ebp + eax - 0x208]
mov word [ebp + eax - 0x410], cx
inc eax
inc eax
test cx, cx
jne 0x405481
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea edi, [ebp - 0x208]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4054ad
mov esi, 0x45553c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x208]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], 0
pop edi
je 0x4054e2
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
leave
ret
Function at 0x4066e7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1408
call fcn.0043b7d8
pop ecx
test eax, eax
je 0x40670d
push SysReAllocString
mov ecx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.0040cec7
mov esi, eax
jmp 0x40670f
xor esi, esi
mov ecx, dword [ebp + 8]
add ecx, 0x424
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40671e
sub eax, edi
pop edi
je 0x40673e
push ecx
push esi
call fcn.0040d1e7
lea eax, [esi + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test esi, esi
je 0x40674a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
pop ebp
ret 4

Function at 0x40674f
Capabilities:
Delete registry key

Disassembly:
push ecx
mov ecx, dword [eax + 0x924]
dec ecx
je 0x40677c
dec ecx
jne 0x406781
lea ecx, [eax + 0x208]
push ecx
add eax, 0x30c
call fcn.00401cbb
pop ecx
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop ecx
ret
call fcn.00406783
pop ecx
ret

Function at 0x406783
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [eax + 0x208]
push edi
push ecx
add eax, 0x30c
call fcn.00401cbb
pop ecx
xor edi, edi
push edi
mov esi, eax
push 0x45526c
push esi
call fcn.004026dd
add esp, 0xc
push 1
push 0x455748
push esi
mov dword [ebp - 8], eax
call fcn.004026dd
add esp, 0xc
push edi
push 0x45574c
push esi
mov dword [ebp - 0xc], eax
call fcn.004026dd
add esp, 0xc
push 0x454c5c
push esi
mov dword [ebp - 0x1c], eax
call fcn.00402871
push 0x455750
push esi
mov dword [ebp - 0x18], eax
call fcn.00402871
push edi
mov ebx, 0x455758
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.004026dd
add esp, 0x1c
push 1
mov edi, 0x455764
push edi
push esi
mov dword [ebp - 0x10], eax
call fcn.004026dd
add esp, 0xc
push esi
push SysReAllocString
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0
push dword [ebp - 0x10]
push ebx
push esi
call fcn.00402829
push 1
push dword [ebp - 0x14]
push edi
push esi
call fcn.00402829
mov eax, dword [0x46d5b8]
add esp, 0x20
test dword [eax + 0xa46f], 2
jne 0x406867
push 0
push dword [ebp - 8]
push 0x45526c
push esi
call fcn.00402829
add esp, 0x10
mov eax, dword [0x46d5b8]
test dword [eax + 0xa46f], 1
jne 0x406889
push dword [ebp - 0x18]
push 0x454c5c
push esi
call fcn.004028af
add esp, 0xc
mov eax, dword [0x46d5b8]
test dword [eax + 0xa46f], 4
jne 0x4068c4
cmp dword [ebp - 4], 0
je 0x4068c4
push dword [ebp - 4]
push 0x455750
push esi
call fcn.004028af
add esp, 0xc
push 1
push dword [ebp - 0xc]
push 0x455748
push esi
call fcn.00402829
add esp, 0x10
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4068ec
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4068d0
sub eax, edx
je 0x4068ec
push 0
push edi
push 0x45574c
push esi
call fcn.00402829
add esp, 0x10
push esi
call fcn.0043bdb4
pop ecx
push dword [ebp - 8]
call fcn.0043bdb4
pop ecx
push dword [ebp - 0xc]
call fcn.0043bdb4
pop ecx
push edi
call fcn.0043bdb4
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406a15
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
push edi
push 0x1408
mov esi, eax
call fcn.0043b7d8
pop ecx
test eax, eax
je 0x406a3c
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, str.SoftwareMicrosoftwindowscurrentversionuninstall
call fcn.0040cec7
mov edi, eax
jmp 0x406a3e
xor edi, edi
mov eax, dword [esi + 0x924]
xor ebx, ebx
dec eax
je 0x406a53
dec eax
jne 0x406a6e
mov ebx, str.__Poker_
jmp 0x406a5f
mov ebx, dword [0x46d5b8]
add ebx, 0x8b44
add esi, 0x208
push esi
call fcn.00401c70
mov ebx, eax
pop ecx
push ebx
push edi
call fcn.0040d1e7
lea eax, [edi + 8]
push eax
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push ebx
call fcn.0043bdb4
mov eax, dword [edi]
pop ecx
push 1
mov ecx, edi
call dword [eax]
pop edi
pop esi
pop ebx
ret

Function at 0x406aac
Capabilities:
Create process on windows
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2044
call fcn.0044b550
push ebx
push edi
mov edi, dword [0x46d5b8]
lea eax, [edi + 0x2740]
mov dword [ebp - 4], eax
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406acf
sub eax, edx
je 0x406c42
cmp dword [edi + 0x9056], ebx
je 0x406c42
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x1843]
push ebx
push eax
mov byte [ebp - 0x1844], bl
call fcn.004454d0
push esi
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], bl
call fcn.004454d0
push esi
lea eax, [ebp - 0x1043]
push ebx
push eax
mov byte [ebp - 0x1044], bl
call fcn.004454d0
push esi
lea eax, [ebp - 0x843]
push ebx
push eax
mov byte [ebp - 0x844], bl
call fcn.004454d0
push esi
lea eax, [ebp - 0xc43]
push ebx
push eax
mov byte [ebp - 0xc44], bl
call fcn.004454d0
push esi
lea eax, [ebp - 0x1443]
push ebx
push eax
mov byte [ebp - 0x1444], bl
call fcn.004454d0
lea eax, [ebp - 0x1844]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x844]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1444]
add esp, 0x48
mov dword [ebp - 0x28], eax
lea eax, [esi + 1]
push 0x7ff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2043]
push ebx
push eax
mov dword [ebp - 0x44], 0x3c
mov byte [ebp - 0x2044], bl
call fcn.004454d0
mov ecx, dword [ebp - 4]
push edi
push fcn.00403f8e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x103
lea eax, [ebp - 0x2044]
call fcn.00404428
lea eax, [ebp - 0x2044]
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406c02
lea ecx, [ebp - 0x44]
push ecx
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x2044]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x38], 3
pop esi
je 0x406c2b
cmp dword [ebp - 0x38], 4
jne 0x406c42
push 1
push ebx
push ebx
lea eax, [ebp - 0x2044]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
leave
ret
Function at 0x4074e2
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004454d0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x18]
call fcn.0040e1a8
add esp, 0x14
test eax, eax
je 0x407611
lea eax, [ebp + 0x18]
push eax
push 0x45256c
push 1
push ebx
push 0x45257c
mov dword [ebp + 0x18], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x407614
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x4525bc
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x407606
mov eax, dword [ebp + 0x18]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ebx
jne 0x407589
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x44]
mov esi, eax
cmp esi, ebx
jl 0x4075fd
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], ebx
je 0x4075b1
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call esi
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4075d4
mov eax, dword [ebp - 4]
mov esi, 0x45553c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea edx, [ebp - 0x20c]
push edx
movsw word es:[edi], word [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
pop edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x407614
mov esi, dword [ebp + 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18

Function at 0x407981
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108], bl
call fcn.004454d0
mov eax, dword [ebp + 8]
add eax, 0x9f6
push eax
lea eax, [ebp - 0x108]
push 0x454c64
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x46d5b8]
push dword [eax + 0xe20]
push dword [eax + 0xe1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret 4
Function at 0x407c85
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
xor esi, esi
lea eax, [ebp - 0x40e]
push esi
push eax
call fcn.004454d0
xor eax, eax
push edi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push esi
push eax
call fcn.004454d0
add esp, 0x18
push 0x104
lea eax, [ebp - 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add eax, 0xef2
push str.bresume.exe
push eax
mov dword [ebp + 8], eax
mov ebx, 0x4559c8
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
add esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call esi
push str.dresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call esi
push str.tresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call esi
push str.sresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x208]
sub eax, ecx
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
test dx, dx
jne 0x407d9c
push 0x455a44
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call esi
pop edi
test eax, eax
pop esi
setne al
pop ebx
leave
ret 4

Function at 0x407dda
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.004454d0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push str.bresume.exe
push dword [ebp + 8]
mov ebx, 0x4559c8
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x1c
lea eax, [ebp - 0x208]
push eax
call edi
push str.dresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call edi
push str.tresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call edi
push str.sresume.exe
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call edi
push str.icon.ico
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret