joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181f4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4528a0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x43d50c
call fcn.00422277
mov edi, dword [ebp + 0x41c]
xor eax, eax
mov esi, 0x206
xor ebx, ebx
push esi
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.00420210
xor eax, eax
push esi
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push ebx
push eax
call fcn.00420210
add esp, 0x18
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x208]
push eax
push ebx
push str.dbghelp
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp]
push eax
call fcn.00402abd
push dword [edi]
lea eax, [ebp + 0x208]
push eax
push str.DownloadDatFile.__s_____s
call fcn.00402abd
push dword [ebp + 0x420]
lea eax, [ebp + 0x208]
push eax
push str.http:__sdl.360safe.com_dbghelp_dll.cab
call fcn.0041a10e
add esp, 0x1c
test eax, eax
je 0x4182ea
push str.DownloadDatFile._download_suc
call fcn.00402abd
pop ecx
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x14]
call fcn.00405a89
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 4], ebx
call fcn.004180c3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x10], eax
call fcn.00402a0d
cmp word [ebp + 0x208], bx
je 0x418300
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004201f5
add ebp, 0x414
leave
ret
Function at 0x419976
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
and dword [ebp - 0xc], 0
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 1
call fcn.004197d3
mov eax, dword [eax + 0xa4]
test eax, eax
je 0x4199b2
lea ecx, [ebp - 8]
push ecx
push edi
call eax
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x419af3
mov edi, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [ebp - 0x14]
mov ecx, esi
call fcn.004195fe
test eax, eax
jne 0x419af2
cmp ebx, dword [ebp + 8]
ja 0x419af2
push edi
xor ebx, ebx
lea eax, [ebp - 0x328]
push ebx
push eax
call fcn.00420210
push edi
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.00420210
push edi
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.00420210
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
add esp, 0x24
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 4], eax
call fcn.004197d3
mov eax, dword [eax + 0x98]
cmp eax, ebx
je 0x419a60
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x328]
push ecx
push dword [ebp - 4]
call eax
add esp, 0x14
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x419a92
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
call fcn.004197d3
mov eax, dword [eax + 0xa4]
cmp eax, ebx
je 0x419ae9
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
call eax
pop ecx
pop ecx
jmp 0x419ae9
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x328]
push ecx
inc eax
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x186a0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x419ae9
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
call fcn.004197d3
mov eax, dword [eax + 0xa4]
cmp eax, ebx
je 0x419ae2
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
call eax
pop ecx
pop ecx
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], ebx
jne 0x4199c2
pop ebx
mov ecx, esi
call fcn.004195fe
pop edi
pop esi
test eax, eax
je 0x419b04
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x41a10e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x43d766
call fcn.00422277
and dword [ebp - 0x10], 0
push 0x14
call fcn.00421de0
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
test eax, eax
je 0x41a13c
mov ecx, eax
call fcn.004198ca
mov esi, eax
jmp 0x41a13e
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41a1a9
mov ebx, esi
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
xor edi, edi
inc edi
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
call fcn.004055ff
push dword [ebp + 0xc]
lea ecx, [esi + 0x10]
call fcn.004055ff
push esi
push 0
push 0x4195dd
call fcn.00425cd5
add esp, 0xc
cmp eax, 0xffffffff
je 0x41a19a
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41a192
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
jmp 0x41a19a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [esi + 8], edi
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x41a1a9
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax]
mov eax, dword [ebp - 0x10]
call fcn.0042234f
ret

Function at 0x41a55a
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4528a0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push edi
call fcn.004197d3
mov edi, eax
test edi, edi
je 0x41a617
and dword [ebp - 0x7c], 0
push esi
push 0x208
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00420210
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x78]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x446520
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a5f7
lea eax, [ebp - 0x80]
push eax
call fcn.0041a516
pop ecx
push dword [eax]
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.0040799f
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00402a0d
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.004194b5
pop esi
test eax, eax
je 0x41a614
cmp dword [edi + 0x18], 0
je 0x41a614
mov dword [ebp - 0x7c], 1
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop edi
call fcn.004201f5
add ebp, 0x194
leave
ret
Function at 0x41f1ec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4549cc], 0
push esi
jne 0x41f15f
call fcn.0041f085
test eax, eax
je 0x41f1a2
mov eax, dword [0x4549cc]
cmp eax, 1
jne 0x41f180
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41f1a2
pop esi
ret
push eax
call dword [0x4549d4]
test eax, eax
jne 0x41f1ea
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41f1a6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4549cc]
call dword [0x4549d4]
mov edi, eax
test edi, edi
je 0x41f1cb
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41f1e7
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4549cc]
call dword [0x4549d0]
add edi, 0x10
cmp edi, esi
jb 0x41f1d3
mov eax, edi
pop edi
pop esi
ret
jmp 0x41f14c

Function at 0x4201f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4528a0]
jne 0x4201ff
repz ret
jmp fcn.00428d1d

Function at 0x4362de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042a647
and dword [ebp - 4], 0
cmp dword [0x4557e0], 0
mov ebx, eax
jne 0x43638f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x436440
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x436440
push eax
call fcn.0042a5d5
mov dword [esp], 0x44be88
push edi
mov dword [0x4557e0], eax
call esi
push eax
call fcn.0042a5d5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4557e4], eax
call esi
push eax
call fcn.0042a5d5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4557e8], eax
call esi
push eax
call fcn.0042a5d5
pop ecx
mov dword [0x4557f0], eax
test eax, eax
je 0x43638f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042a5d5
pop ecx
mov dword [0x4557ec], eax
mov eax, dword [0x4557ec]
cmp eax, ebx
je 0x4363e7
cmp dword [0x4557f0], ebx
je 0x4363e7
push eax
call fcn.0042a650
push dword [0x4557f0]
mov esi, eax
call fcn.0042a650
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4363e7
test edi, edi
je 0x4363e7
call esi
test eax, eax
je 0x4363de
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4363de
test byte [ebp - 0xc], 1
jne 0x4363e7
or dword [ebp + 0x10], 0x200000
jmp 0x436420
mov eax, dword [0x4557e4]
cmp eax, ebx
je 0x436420
push eax
call fcn.0042a650
pop ecx
test eax, eax
je 0x436420
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x436420
mov eax, dword [0x4557e8]
cmp eax, ebx
je 0x436420
push eax
call fcn.0042a650
pop ecx
test eax, eax
je 0x436420
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4557e0]
call fcn.0042a650
pop ecx
test eax, eax
je 0x436440
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x436442
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x4010a6
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x4010a6
mov edx, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push edx
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x401097
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.0051eb37
mov esi, eax
add esp, 4
test esi, esi
je 0x401092
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push edi
push esi
call fcn.00522610
add esp, 0xc
cmp dword [ebp - 4], edi
jbe 0x401097
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push esi
push eax
push edi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x401097
push esi
call fcn.0051eadb
mov edx, dword [ebp + 8]
add esp, 4
xor esi, esi
mov dword [edx], edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edi, 0xe
mov edx, dword [ebp + 8]
mov dword [edx], edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x57
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536698
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov edi, esp
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], esp
xor ebx, ebx
xor eax, eax
mov esi, 7
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
push ebx
lea ecx, [ebp + 0x24]
mov word [edi], ax
push ecx
or eax, 0xffffffff
call fcn.00401dd0
sub esp, 0x1c
mov edi, esp
mov dword [ebp - 0x30], esp
mov byte [ebp - 4], 2
push ebx
lea eax, [ebp + 8]
xor edx, edx
push eax
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
or eax, 0xffffffff
mov word [edi], dx
call fcn.00401dd0
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], 1
call fcn.00401960
mov edi, 8
add esp, 0x3c
cmp dword [eax + 0x14], edi
jb 0x4017a9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], edi
jb 0x4017c1
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0051eadb
add esp, 4
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [ebp + 0x1c], edi
jb 0x4017e1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051eadb
add esp, 4
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x18], ebx
mov word [ebp + 8], dx
cmp dword [ebp + 0x38], edi
jb 0x401805
mov eax, dword [ebp + 0x24]
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x401b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534759
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 0x10], ebx
jne 0x401b75
lea ecx, [ebp - 0x2c]
call fcn.0051ebb7
push 0x564318
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], vtable.BadOparationException.0
call fcn.00520fdb
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], vtable.CFileRW.0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x401b95
mov eax, dword [eax]
lea esi, [ebp - 0x2c]
call fcn.004494e0
mov edi, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], ebx
cmp edi, 0xffffffff
je 0x401bcb
push ebx
lea ecx, [ebp - 0x10]
push ecx
push 4
lea edx, [ebp - 0x14]
push edx
push edi
call esi
cmp eax, ebx
jne 0x401bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
jmp 0x401bd2
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x10], ebx
cmp edi, 0xffffffff
je 0x401bf7
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
lea ecx, [ebp + 0xc]
push ecx
push edi
call esi
cmp eax, ebx
jne 0x401bfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
jmp 0x401bfe
mov dword [ebp - 0x28], 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.0051e738
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401500
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x401c5a
test eax, eax
je 0x401c5a
cmp edi, 0xffffffff
je 0x401c51
push 0
lea edx, [ebp - 0x10]
push edx
push eax
push ebx
push edi
call esi
test eax, eax
jne 0x401c61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
jmp 0x401c61
mov dword [ebp - 0x28], 0xc
jmp 0x401c73
mov dword [ebp - 0x28], 0x57
cmp edi, 0xffffffff
je 0x401c73
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x10], esp
push ebx
mov ebx, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [eax + 4], 0
push eax
mov eax, ebx
call fcn.00401400
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.00401200
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 1
test ebx, ebx
je 0x401cdd
lea ecx, [ebx + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x401cdd
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
lea eax, [ebx + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x401cdd
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
cmp edi, 0xffffffff
je 0x401ce9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x2b
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x54ef24
mov byte [ecx], 0
call fcn.00402700
lea ecx, [ebp - 0x20]
call fcn.004025c0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x402e29
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x40], esi
test eax, eax
je 0x402e5d
cmp word [eax], si
je 0x402e5d
push esi
lea ecx, [ebp - 0x40]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x402e5a
mov dword [ebp - 0x40], esi
jmp 0x402e5d
mov esi, dword [ebp - 0x40]
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x44], esi
jb 0x402e72
mov edx, dword [ebp - 0x20]
push edx
call fcn.0051eadb
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
test esi, esi
je 0x402efa
xor ecx, ecx
cmp byte [ebp + 8], al
setne cl
sub esp, 0x1c
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0x48], ecx
mov ecx, esp
push 0x17
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], eax
push str.GoogleAnalyticsAccepted
mov byte [ecx], al
call fcn.00402700
lea ecx, [ebp - 0x3c]
call fcn.004025c0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x402ec8
mov eax, dword [eax]
test eax, eax
je 0x402ede
push 4
lea edx, [ebp - 0x48]
push edx
push 4
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x28], 8
jb 0x402ef0
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x403050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x2b
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x54ef24
mov byte [ecx], 0
call fcn.00402700
lea ecx, [ebp - 0x20]
call fcn.004025c0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x403099
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x40], esi
test eax, eax
je 0x4030cd
cmp word [eax], si
je 0x4030cd
push esi
lea ecx, [ebp - 0x40]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4030ca
mov dword [ebp - 0x40], esi
jmp 0x4030cd
mov esi, dword [ebp - 0x40]
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x44], esi
jb 0x4030e2
mov edx, dword [ebp - 0x20]
push edx
call fcn.0051eadb
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
test esi, esi
je 0x403166
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0x48], 1
push 0xe
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], eax
push 0x54ef50
mov byte [ecx], al
call fcn.00402700
lea ecx, [ebp - 0x3c]
call fcn.004025c0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x403134
mov eax, dword [eax]
test eax, eax
je 0x40314a
push 4
lea ecx, [ebp - 0x48]
push ecx
push 4
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x28], 8
jb 0x40315c
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0051eadb
add esp, 4
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x403180
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x2b
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x54ef24
mov byte [ecx], 0
call fcn.00402700
lea ecx, [ebp - 0x20]
call fcn.004025c0
mov edi, 8
add esp, 0x1c
cmp dword [eax + 0x14], edi
jb 0x4031ce
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x40], esi
test eax, eax
je 0x403202
cmp word [eax], si
je 0x403202
push esi
lea ecx, [ebp - 0x40]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4031ff
mov dword [ebp - 0x40], esi
jmp 0x403202
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0xc], edi
jb 0x403216
mov edx, dword [ebp - 0x20]
push edx
call fcn.0051eadb
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
test esi, esi
je 0x403283
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0xe
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], eax
push 0x54ef50
mov byte [ecx], al
call fcn.00402700
lea ecx, [ebp - 0x3c]
call fcn.004025c0
add esp, 0x1c
cmp dword [eax + 0x14], edi
jb 0x403260
mov eax, dword [eax]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x28], edi
jb 0x403279
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0051eadb
add esp, 4
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x403e40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53658b
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x575494]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push edi
mov eax, dword [0x575494]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
xor ebx, ebx
xor al, al
mov dword [esp + 0x20], edx
mov byte [esp + 0x12], al
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp dword [esi], ebx
je 0x40401d
cmp byte [esi + 4], bl
je 0x404014
cmp ecx, ebx
je 0x40400b
cmp word [ecx], bx
je 0x40400b
cmp edx, ebx
je 0x40400b
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00404330
mov dword [esp + 0x288], ebx
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x403ff5
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov byte [esp + 0x13], bl
cmp eax, 0xffffffff
je 0x403efb
push eax
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi]
cmp dword [eax + 0x10], ebx
je 0x403fdc
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov edi, eax
cmp edi, ebx
je 0x403fdc
mov ecx, dword [esp + 0x14]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [esp + 0x1c], ecx
cmp ecx, 0xffffffff
je 0x403fb9
movzx edx, word [edi + 0x44]
movzx eax, word [edi + 0x46]
add eax, edx
cmp byte [esp + 0x13], 1
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
push edi
mov dword [esp + 0x28], ebx
push ecx
jne 0x403f89
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403fb9
mov ecx, dword [esp + 0x1c]
push ecx
mov byte [esp + 0x16], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.00404440
mov al, byte [esp + 0x12]
jmp 0x404024
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403fb9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push ecx
mov byte [eax], 1
mov byte [esp + 0x16], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.00404440
mov al, byte [esp + 0x12]
jmp 0x404024
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.00404440
mov al, byte [esp + 0x12]
jmp 0x404024
mov eax, esi
call fcn.00404400
lea ecx, [esp + 0x14]
mov dword [esi + 0x10], eax
call fcn.00404440
mov al, byte [esp + 0x12]
jmp 0x404024
lea ecx, [esp + 0x14]
mov dword [esi + 0xc], 0x65b
call fcn.00404440
mov al, byte [esp + 0x12]
jmp 0x404024
mov dword [esi + 0xc], 0x57
jmp 0x404024
mov dword [esi + 0x10], 0x47
jmp 0x404024
mov dword [esi + 0x10], 6
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret