joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4221f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x476624
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], esi
push 1
lea ecx, [esi + 0x68]
mov dword [esp + 0x18], 4
call fcn.00422400
mov eax, dword [esi + 0x5c]
xor ebx, ebx
cmp eax, ebx
je 0x422249
mov cl, byte [eax - 1]
cmp cl, bl
je 0x42223d
cmp cl, 0xff
je 0x42223d
dec cl
mov byte [eax - 1], cl
jmp 0x422249
add eax, 0xfffffffe
push eax
call fcn.004472d3
add esp, 4
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
je 0x422277
mov al, byte [ecx - 1]
cmp al, bl
je 0x42226b
cmp al, 0xff
je 0x42226b
dec al
mov byte [ecx - 1], al
jmp 0x422277
lea eax, [ecx - 2]
push eax
call fcn.004472d3
add esp, 4
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov ecx, dword [esi + 0x3c]
cmp ecx, ebx
je 0x4222a5
mov al, byte [ecx - 1]
cmp al, bl
je 0x422299
cmp al, 0xff
je 0x422299
dec al
mov byte [ecx - 1], al
jmp 0x4222a5
lea eax, [ecx - 2]
push eax
call fcn.004472d3
add esp, 4
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x2c]
cmp ecx, ebx
je 0x4222d3
mov al, byte [ecx - 1]
cmp al, bl
je 0x4222c7
cmp al, 0xff
je 0x4222c7
dec al
mov byte [ecx - 1], al
jmp 0x4222d3
lea eax, [ecx - 2]
push eax
call fcn.004472d3
add esp, 4
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [eax]
lea eax, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00422ab0
mov ecx, dword [esi + 4]
push ecx
call fcn.004472d3
mov edx, dword [esi + 8]
mov dword [esi + 4], ebx
push edx
mov dword [esi + 0x10], ebx
call fcn.004472d3
mov ecx, dword [esp + 0x14]
add esp, 8
mov dword [esi + 8], ebx
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x423730
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x476698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
lea eax, [esp]
mov dword [esp + 0x210], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4237bf
mov ecx, dword [esp + 0x220]
test ecx, ecx
je 0x4237a8
mov al, byte [ecx - 1]
test al, al
je 0x42379c
cmp al, 0xff
je 0x42379c
dec al
mov byte [ecx - 1], al
xor al, al
mov ecx, dword [esp + 0x208]
mov dword fs:[0], ecx
add esp, 0x214
ret
add ecx, 0xfffffffe
push ecx
call fcn.004472d3
add esp, 4
xor al, al
mov ecx, dword [esp + 0x208]
mov dword fs:[0], ecx
add esp, 0x214
ret
push ebx
push ebp
push esi
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.0044b1a8
mov esi, dword [esp + 0x22c]
add esp, 4
mov edi, eax
mov ecx, esi
push 1
push edi
call fcn.00422910
test al, al
je 0x42380f
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
test edi, edi
jbe 0x423803
mov edx, edi
mov bx, word [ecx]
add ecx, 2
mov word [eax], bx
add eax, 2
dec edx
jne 0x4237f4
mov edx, dword [esi + 4]
mov dword [esi + 8], edi
mov word [edx + edi*2], 0
mov edi, dword [0x47ca5c]
mov eax, dword [esp + 0x234]
cmp eax, edi
jae 0x423822
mov edi, eax
mov ebp, dword [esp + 0x230]
test edi, edi
jbe 0x42386f
mov ebx, dword [esi + 8]
push 0
add ebx, edi
mov ecx, esi
push ebx
call fcn.00422910
test al, al
je 0x42386f
test ebp, ebp
mov ecx, 0x47ca58
je 0x42384b
mov ecx, ebp
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
lea eax, [edx + eax*2]
mov dx, word [ecx]
add ecx, 2
mov word [eax], dx
add eax, 2
dec edi
jne 0x423854
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
mov word [eax + ebx*2], 0
test ebp, ebp
je 0x423891
mov al, byte [ebp - 1]
test al, al
je 0x423885
cmp al, 0xff
je 0x423885
dec al
mov byte [ebp - 1], al
jmp 0x423891
add ebp, 0xfffffffe
push ebp
call fcn.004472d3
add esp, 4
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x214
ret
Function at 0x424160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4767ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 3]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov cl, byte [esp + 0xf]
push 0x50
lea esi, [edi + 8]
mov dword [esp + 0x14], edi
mov byte [esi], al
mov byte [esi + 1], cl
mov byte [esi + 0xc], bl
call fcn.0044aeaf
mov dword [eax + 4], ebx
mov byte [eax + 0x48], 1
mov byte [eax + 0x49], bl
mov dword [esi + 8], eax
mov byte [eax + 0x49], 1
mov eax, dword [esi + 8]
add esp, 4
mov ecx, esi
mov dword [eax], ebx
mov edx, dword [esi + 8]
push ebx
mov dword [edx + 8], ebx
mov eax, dword [esi + 8]
push eax
call fcn.00425030
mov dword [esi + 4], eax
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 0x10], ebx
mov cl, byte [esp + 0xf]
mov dword [esp + 0x20], ebx
mov byte [edi + 0x1c], cl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
lea esi, [edi + 0x38]
mov dword [esp + 0x14], esi
mov byte [esp + 0x20], 2
mov dword [esi], ebx
mov byte [esi + 4], 1
call fcn.00422dc0
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [edi + 0x30], ebx
mov dword [edi], 0x47ca60
mov dword [edi + 0x34], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x424460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x47682a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
xor ebx, ebx
add ecx, 0x38
mov dword [esp + 0x94], ebx
mov dword [esp + 8], ecx
mov byte [esp + 0xc], bl
call fcn.00422e50
mov byte [esp + 0xc], 1
mov esi, dword [esp + 0xa4]
mov dword [esp + 0x94], 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4244bd
test al, 0x10
je 0x4244d9
mov al, byte [esp + 0xc]
mov dword [esp + 0x94], 2
cmp al, bl
je 0x42467a
jmp 0x424671
cmp word [esp + 0x9c], 1
jne 0x4245be
lea ecx, [esp + 0x34]
call fcn.00428b10
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x11], eax
push ecx
mov dword [esp + 0x19], eax
push esi
mov dword [esp + 0x21], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x25], eax
mov byte [esp + 0x9c], 3
mov word [esp + 0x29], ax
mov byte [esp + 0x18], bl
mov byte [esp + 0x2b], al
call fcn.00449d30
test eax, eax
je 0x4245a8
lea edx, [esp + 0x10]
push 0x10
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00425600
add esp, 0xc
mov ecx, dword [esp + 0xa0]
mov byte [esp + 0x94], 4
push ecx
lea ecx, [esp + 0x28]
call fcn.00425490
test eax, eax
mov byte [esp + 0x94], 3
push 1
lea ecx, [esp + 0x28]
jne 0x4245a3
call fcn.00422400
lea ecx, [esp + 0x34]
mov byte [esp + 0x94], 1
call fcn.00449160
mov al, byte [esp + 0xc]
mov dword [esp + 0x94], 5
cmp al, bl
je 0x42459c
lea ecx, [esp + 8]
call fcn.00424c10
mov al, 1
jmp 0x42467c
call fcn.00422400
lea ecx, [esp + 0x34]
mov byte [esp + 0x94], 1
call fcn.00449160
jmp 0x42465e
xor edx, edx
lea eax, [esp + 0x10]
mov dword [esp + 0x11], edx
push eax
mov dword [esp + 0x19], edx
push esi
mov dword [esp + 0x21], edx
mov byte [esp + 0x18], bl
mov dword [esp + 0x25], edx
mov word [esp + 0x29], dx
mov byte [esp + 0x2b], dl
call fcn.00425760
lea ecx, [esp + 0x18]
push 0x14
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.00425600
mov esi, dword [esp + 0xb4]
mov byte [esp + 0xa8], 6
push esi
call fcn.0044b1a8
add esp, 0x18
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x30]
push esi
push eax
push ebx
call fcn.00425500
cmp eax, ebx
mov byte [esp + 0x94], 1
push 1
lea ecx, [esp + 0x28]
jne 0x424659
call fcn.00422400
mov al, byte [esp + 0xc]
mov dword [esp + 0x94], 7
cmp al, bl
je 0x424655
mov ecx, dword [esp + 8]
call fcn.00425920
mov al, 1
jmp 0x42467c
call fcn.00422400
mov al, byte [esp + 0xc]
mov dword [esp + 0x94], 8
cmp al, bl
je 0x42467a
mov ecx, dword [esp + 8]
call fcn.00425920
xor al, al
mov ecx, dword [esp + 0x8c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x90
ret 0xc
Function at 0x4291a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x476fb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
xor ebx, ebx
mov byte [esi + 1], cl
mov ecx, esi
mov dword [esp + 0xc], esi
mov byte [esi], al
mov byte [esi + 0xc], bl
call fcn.0042a8b0
mov dl, byte [esp + 0xb]
mov dword [esi + 0x14], 0x14
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 5
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x28], dl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x38]
push ebx
mov byte [esp + 0x1c], 1
mov byte [ecx], al
call fcn.00422400
mov cl, byte [esp + 0xb]
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x48], cl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dl, byte [esp + 0xb]
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x58], dl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x68]
push ebx
mov byte [esp + 0x1c], 4
mov byte [ecx], al
call fcn.00422400
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x429c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429c6a
test al, 0x10
jne 0x429c6a
mov eax, 1
ret
xor eax, eax
ret
Function at 0x42ad80
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x5c
mov esi, ecx
push edi
call fcn.0044b659
add esp, 8
test eax, eax
jne 0x42ad9b
mov eax, edi
jmp 0x42ad9e
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
mov dword [esi], eax
jne 0x42adb4
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
jne 0x42adc1
pop edi
xor al, al
pop esi
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpCreateDownloadObj
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.HttpDeleteDownloadObj
push eax
call edi
mov ecx, dword [esi]
push str.HttpCancel
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.HttpWait
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.HttpGetStateW
push eax
call edi
mov ecx, dword [esi]
push str.HttpGetContentLength
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.HttpGetReceivedLength
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.HttpDownloadExW
push eax
call edi
mov ecx, dword [esi]
push str.HttpGetResumedLength
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.HttpGetCurrentSpeed
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.HttpGetLastError
push eax
call edi
mov ecx, dword [esi]
push str.HttpGetAllPeer
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push str.HttpSetMultiUrls
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
test eax, eax
pop edi
pop esi
setne al
ret 4
Function at 0x42c670
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
push 0x11
push 2
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x42c6ad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_function_failed.errorno:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x20
ret 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 1
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x42c6fa
mov ecx, esi
call fcn.0042c960
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._ioctlsocket_failed.errorno:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x20
ret 4
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 0x10]
push 4
push edx
push 0x20
push 0xffff
push eax
call edi
cmp eax, 0xffffffff
jne 0x42c741
mov ecx, esi
call fcn.0042c960
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.setsockopt_failed.errorno:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x20
ret 4
mov ebp, dword [esp + 0x30]
test bp, bp
je 0x42c7f3
mov edx, dword [esi + 4]
lea ecx, [esp + 0x14]
push 4
push ecx
push 0x1002
mov eax, 0x20000
push 0xffff
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call edi
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push 4
push eax
push 0x1001
push 0xffff
push ecx
call edi
push 0
mov word [esp + 0x20], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, dword [sym.imp.WS2_32.dll_htons]
push ebp
mov dword [esp + 0x24], eax
call edi
mov word [esp + 0x1e], ax
mov eax, dword [esi + 4]
lea edx, [esp + 0x1c]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x42c7e8
mov ecx, esi
call fcn.0042c960
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.bind_failed_errorno:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x20
ret 4
push ebp
call edi
and eax, 0xffff
mov dword [esi + 0xc], eax
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x20
ret 4

Function at 0x42c800
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push str.255.255.255.255
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 4]
push 0x10
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esi + 4]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
pop esi
jne 0x42c86d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.BroadCast_failed_errorno:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
add esp, 0x10
ret 0xc
mov al, 1
add esp, 0x10
ret 0xc
Function at 0x42c880
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x4154
call fcn.0044c0a0
push esi
mov esi, ecx
lea ecx, [esp + 8]
lea edx, [esp + 0x20]
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push edx
push 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x42c94e
push edi
mov ecx, 0x100c
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0x4034
push edx
push eax
mov dword [esp + 0x20], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
pop edi
jne 0x42c927
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov al, 1
pop esi
add esp, 0x4154
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42c944
test eax, eax
jle 0x42c944
mov edx, dword [ecx]
lea esi, [esp + 0x10]
push esi
push eax
lea eax, [esp + 0x12c]
push eax
call dword [edx]
mov al, 1
pop esi
add esp, 0x4154
ret
xor al, al
pop esi
add esp, 0x4154
ret

Function at 0x42c990
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
push 0x10
push eax
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x42c9cd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Send_Error:_d
push 1
call fcn.0042cab0
add esp, 0xc
xor al, al
ret 0xc
mov al, 1
ret 0xc

Function at 0x42c9e0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
mov esi, dword [esp + 0x214]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0044aebd
add esp, 0xc
test esi, esi
je 0x42ca57
cmp word [esi], 0
je 0x42ca57
lea ecx, [esp + 8]
test ecx, ecx
je 0x42ca57
cmp word [esp + 8], 0
je 0x42ca57
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.0044b659
mov esi, eax
lea eax, [esp + 0x10]
push 0x2f
push eax
call fcn.0044b659
add esp, 0x10
test esi, esi
jne 0x42ca62
test eax, eax
jne 0x42ca68
pop edi
xor al, al
pop esi
add esp, 0x208
ret
cmp esi, eax
jbe 0x42ca68
mov eax, esi
lea ecx, [esp + 8]
mov word [eax], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42ca8c
test al, 0x10
jne 0x42ca8c
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov al, 1
pop esi
add esp, 0x208
ret
Function at 0x42e730
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x489d0c]
sub esp, 0x14
push esi
push edi
mov edi, ecx
push eax
xor esi, esi
mov ecx, dword [edi + 0x98]
mov edx, dword [edi + 0x198]
push ecx
push edx
push str.loader_m_IsWaiting:_d_m_BaseParam.LanShare:_d_g_UseP2P:_d
push esi
call fcn.0042cab0
mov eax, dword [edi + 0x98]
add esp, 0x14
cmp eax, esi
je 0x42e87a
cmp dword [0x489d0c], esi
je 0x42e87a
mov ecx, edi
call fcn.0042e700
test al, al
je 0x42e87a
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [esp + 0xc]
push ebp
push eax
push 0xf003f
push esi
push str.SOFTWARELiveUpdate360_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e7ef
mov eax, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
push esi
push str.Intranet
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push 0xf003f
push esi
push str.SOFTWARELiveUpdate360_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x42e83e
mov eax, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push esi
push str.broadcast
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push str.intranet:_d_broadcasted:_d
push 2
call fcn.0042cab0
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, esi
pop ebp
pop ebx
jne 0x42e882
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x42e882
push eax
push esi
push str.Not_use_intranet_down.intranet:_d_broadcasted:_d
push 2
call fcn.0042cab0
add esp, 0x10
pop edi
xor al, al
pop esi
add esp, 0x14
ret
pop edi
mov al, 1
pop esi
add esp, 0x14
ret

Function at 0x431f80
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x48a834]
cmp eax, 0xffffffff
jne 0x431f95
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x48a834], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x431fbe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0044b09d
mov eax, dword [0x48a834]
add esp, 4
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esp + 4]
test eax, eax
jne 0x431fc9
xor al, al
ret
push esi
push eax
call fcn.00431f60
add esp, 4
mov esi, eax
call fcn.0044b0aa
xor edx, edx
div esi
pop esi
test edx, edx
sete al
ret
Function at 0x432d30
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 1
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x24]
push eax
push 0
push esi
push 0x432170
push 0
push 0
mov dword [esi + 0x28], 0
call fcn.0044af3a
add esp, 0x18
mov dword [esi + 0x20], eax
pop esi
ret
Function at 0x43a780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478353
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00447a4d
lea ecx, [esp + 0xc]
mov dword [esi + 0x34], eax
call fcn.004472de
mov edi, dword [0x492f00]
lea ecx, [esp + 8]
call fcn.004472de
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x43a7cc
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 8]
call fcn.0044737a
lea ecx, [esp + 0xc]
call fcn.0044737a
lea eax, [esi + 4]
lea ecx, [esi + 0x14]
lea edx, [esi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
lea eax, [esi + 8]
lea ecx, [esi + 0x24]
lea edx, [esi + 0x28]
xor edi, edi
mov dword [esi], vtable.std::basic_streambuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int__.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov dword [eax], edi
mov eax, dword [esi + 0x20]
push edi
push edi
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
push edi
mov dword [esp + 0x28], edi
mov dword [ecx], edi
mov ecx, esi
call fcn.0043a890
mov cl, byte [esp + 0x24]
xor eax, eax
test cl, 1
mov dword [esi], 0x47cb98
jne 0x43a83a
mov eax, 4
test cl, 2
jne 0x43a841
or al, 2
mov edx, dword [esi + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x20
mov dword [esi + 0x44], eax
mov dword [edx], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov ecx, dword [esi + 0x2c]
mov dword [ecx], edi
mov edx, dword [esi + 0x10]
mov dword [edx], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
mov eax, esi
mov dword [ecx], edi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4