joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ed00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x674], 0
lea eax, [esi + 0x2bc]
push eax
jne 0x41ed34
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esi + 4]
push 0
push ecx
mov byte [esi + 0x674], 1
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
push 1
mov dword [eax], 0x3b8
mov dword [esi + 0x2c8], 0x10
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x41ed90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0041b3c0
mov esi, eax
call fcn.0041b540
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.004643f7
push 0x4987c0
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0046445a
push esi
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0046445a
push 0x40
lea eax, [ebp - 0x854]
push 0
push eax
call fcn.00462010
add esp, 0x30
xor eax, eax
lea edx, [ebp - 0x814]
push edx
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov ecx, 1
mov word [ebp - 0x828], cx
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
mov dword [ebp - 0x858], 0x44
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x814]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ee78
push eax
call edi
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x41ee85
push eax
call edi
push esi
call fcn.00460f43
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004615db
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41eeb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0041b540
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.004643f7
push 0x4987c0
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0046445a
push str.http:__tera.wan.360.cn_index.html
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0046445a
push 0x40
lea eax, [ebp - 0x854]
push 0
push eax
call fcn.00462010
add esp, 0x30
xor eax, eax
lea edx, [ebp - 0x814]
push edx
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov ecx, 1
mov word [ebp - 0x828], cx
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
mov dword [ebp - 0x858], 0x44
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x814]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ef94
push eax
call esi
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x41efa1
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004615db
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f0d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0041b540
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.004643f7
push 0x4987c0
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0046445a
push str.http:__tera.wan.360.cn_index.html
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0046445a
push 0x40
lea eax, [ebp - 0x854]
push 0
push eax
call fcn.00462010
add esp, 0x30
xor eax, eax
lea edx, [ebp - 0x814]
push edx
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov ecx, 1
mov word [ebp - 0x828], cx
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
mov dword [ebp - 0x858], 0x44
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x814]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41f1b4
push eax
call esi
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x41f1c1
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004615db
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422990
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493770
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ae23c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4ae00c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ae00c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov eax, dword [0x4ae00c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ae00c
mov dword [ebp - 4], 0
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], 1
jge 0x422a10
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00401400
mov edi, dword [ebp - 0x10]
push 0
push 0x10
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.00461076
add esp, 8
test eax, eax
js 0x422b04
cmp eax, dword [edi - 8]
jg 0x422b04
xor ecx, ecx
mov dword [edi - 0xc], eax
push 0x11
mov word [edi + eax*2], cx
push 0x498924
lea ecx, [ebp - 0x10]
call fcn.004016f0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x422a77
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00401400
mov esi, dword [ebp - 0x14]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00461076
add esp, 8
test eax, eax
js 0x422b04
cmp eax, dword [esi - 8]
jg 0x422b04
mov edi, dword [ebp - 0x10]
xor edx, edx
push edx
push edi
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], dx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422ad0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422af3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401050
int3
Function at 0x424070
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push str.http:__tera.download.kunlun.com_TERA_Setup_V1.45_TERA_CLIENT.7z.001
lea ecx, [ebp - 4]
call fcn.0040fb30
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4240e7
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx - 0xc]
lea edx, [eax + eax + 2]
push edx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 4]
mov edx, eax
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x4240c0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop esi
test edx, edx
jg 0x424107
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425090
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x21
mov edi, ecx
call fcn.00463d76
mov esi, eax
add esp, 4
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov eax, ebx
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4250f7
sub eax, ecx
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
call fcn.00424ee0
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x14]
push edx
mov ecx, edi
call fcn.00424fb0
xor edi, edi
mov ebx, esi
movzx eax, byte [ebp + edi - 0x14]
push eax
push 0x499074
push ebx
call fcn.00464907
inc edi
add esp, 0xc
add ebx, 2
cmp edi, 0x10
jl 0x425120
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004615db
mov esp, ebp
pop ebp
ret 4

Function at 0x425a70
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x58], ecx
mov byte [eax + 0x5c], cl
ret
Function at 0x425b00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
jne 0x425c7a
mov ecx, dword [esi + 0x58]
lea eax, [ecx*8]
add dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
add ecx, ecx
add ecx, ecx
add ecx, ecx
cmp eax, ecx
jae 0x425b3a
inc dword [esi + 0x14]
movzx ecx, byte [esi + 0x11]
movzx edx, byte [esi + 0x10]
mov byte [ebp - 0xb], cl
movzx ecx, byte [esi + 0x13]
mov byte [ebp - 0xc], dl
movzx edx, byte [esi + 0x12]
mov byte [ebp - 9], cl
movzx ecx, byte [esi + 0x15]
mov byte [ebp - 0xa], dl
movzx edx, byte [esi + 0x14]
mov byte [ebp - 7], cl
movzx ecx, byte [esi + 0x17]
shr eax, 3
mov byte [ebp - 8], dl
movzx edx, byte [esi + 0x16]
and eax, 0x3f
mov byte [ebp - 5], cl
mov byte [ebp - 6], dl
mov ecx, 0x38
cmp eax, 0x38
jb 0x425b87
mov ecx, 0x78
sub ecx, eax
push ebx
push edi
test ecx, ecx
je 0x425bb5
mov ebx, ecx
mov edi, 0x4ad9a0
mov al, byte [edi]
mov edx, dword [esi + 0x58]
mov byte [esi + edx + 0x18], al
inc dword [esi + 0x58]
dec ebx
inc edi
cmp dword [esi + 0x58], 0x40
jb 0x425bb1
mov ecx, esi
call fcn.00425290
test ebx, ebx
jne 0x425b96
mov ebx, 8
lea edi, [ebp - 0xc]
lea ecx, [ecx]
mov ecx, dword [esi + 0x58]
mov dl, byte [edi]
mov byte [esi + ecx + 0x18], dl
inc dword [esi + 0x58]
dec ebx
inc edi
cmp dword [esi + 0x58], 0x40
jb 0x425bdb
mov ecx, esi
call fcn.00425290
xor eax, eax
cmp ebx, eax
jne 0x425bc0
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
mov byte [esi + 0x5d], cl
movzx ecx, byte [esi + 2]
mov byte [esi + 0x5e], dl
movzx edx, byte [esi + 3]
mov byte [esi + 0x5f], cl
movzx ecx, byte [esi + 4]
mov byte [esi + 0x60], dl
movzx edx, byte [esi + 5]
mov byte [esi + 0x61], cl
movzx ecx, byte [esi + 6]
mov byte [esi + 0x62], dl
movzx edx, byte [esi + 7]
mov byte [esi + 0x63], cl
movzx ecx, byte [esi + 8]
mov byte [esi + 0x64], dl
movzx edx, byte [esi + 9]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 0xa]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 0xb]
mov byte [esi + 0x67], cl
movzx ecx, byte [esi + 0xc]
mov byte [esi + 0x68], dl
movzx edx, byte [esi + 0xd]
mov byte [esi + 0x69], cl
movzx ecx, byte [esi + 0xe]
mov byte [esi + 0x6a], dl
movzx edx, byte [esi + 0xf]
mov byte [esi + 0x6b], cl
mov byte [esi + 0x6c], dl
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x58], eax
mov byte [esi + 0x5c], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004615db
mov esp, ebp
pop ebp
ret
Function at 0x427e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x10]
push eax
push ecx
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x427f5e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x427f52
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
push esi
call edi
push esi
call edi
mov edi, eax
test edi, edi
je 0x427f52
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x427f52
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.00461930
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [ebp + 0xc]
push edx
push 1
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x427f4b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
push eax
call fcn.00427c30
test eax, eax
jne 0x427f40
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x429020
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocStringLen
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x429063
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp - 4]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x429070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00462010
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x81
je 0x4290a5
mov ecx, 0xa
mov word [ebp - 0x24], cx
jmp 0x4290ab
xor edx, edx
mov word [ebp - 0x24], dx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4290e9
mov eax, dword [ebp - 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x10]
push ecx
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4290f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x429162
cmp word [edi], si
je 0x429162
push 0x38
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00462010
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push ecx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x1c], esi
call edi
cmp eax, esi
jne 0x429164
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42a780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493beb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x234], ebx
push 0x1b
push str.MIMEDatabaseContent_Type_
lea ecx, [ebp - 0x22c]
mov byte [ebp - 0x210], bl
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 0x22c], bl
call fcn.00402f10
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], ebx
call fcn.00402850
mov eax, dword [ebp - 0x22c]
mov edi, 0x10
mov dword [ebp - 0x230], ebx
cmp dword [ebp - 0x218], edi
jae 0x42a81b
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x230]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42a87b
mov ecx, dword [ebp - 0x230]
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push str.Extension
push ecx
mov dword [ebp - 0x234], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42a86e
mov byte [ebp - 0x210], bl
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42a890
sub eax, edx
push eax
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.00402f10
cmp dword [ebp - 0x218], edi
jb 0x42a8bf
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.00460f43
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret
Function at 0x4358f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x102
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x435948
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x435942
shr eax, 8
cmp al, 1
jne 0x435942
mov eax, dword [0x4b03a4]
call fcn.00435810
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret
Function at 0x438b10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494708
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xd], 0
jne 0x438d21
mov ecx, dword [esi + 0x2ac]
xor edi, edi
mov eax, 1
mov byte [esi + 0xd], al
cmp dword [ebp + 8], edi
jne 0x438cce
mov dword [esi + 0x234], eax
cmp ecx, edi
je 0x438b7a
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push str._I_Complete_
push 3
push 4
call edx
mov ecx, dword [esi + 0x28c]
call fcn.0043b3c0
push 0xffffffffffffffff
push edi
cmp dword [esi + 0x100], edi
jne 0x438ba7
lea eax, [esi + 0x10c]
push eax
lea ecx, [esi + 0xf0]
call fcn.00437610
jmp 0x438c54
xor eax, eax
lea ebx, [esi + 0xf0]
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
call fcn.00437610
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], edi
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x438bd9
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x438beb
lea ecx, [ebp - 0x2c]
cmp dword [esi + 0x120], 8
lea edi, [esi + 0x10c]
jb 0x438bfe
mov eax, dword [edi]
jmp 0x438c00
mov eax, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x438c18
push 0xffffffffffffffff
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00437610
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, ebx
call fcn.00437610
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], 0xffffffff
jb 0x438c40
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00460f43
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp byte [esi + 0x1d4], 0
je 0x438c92
mov eax, dword [esi + 0x258]
cmp eax, 5
je 0x438d21
mov ecx, dword [esi + 0x2ac]
test ecx, ecx
je 0x438c83
mov edx, dword [ecx]
push 0
push 0
push 5
push eax
mov eax, dword [edx]
call eax
mov dword [esi + 0x258], 5
jmp 0x438d21
mov eax, dword [esi + 0x1d8]
mov edx, dword [esi + 0x1dc]
mov ecx, eax
or ecx, edx
je 0x438cc1
mov ecx, dword [esi + 0x28c]
cmp dword [ecx + 0x28], eax
jne 0x438cb4
cmp dword [ecx + 0x2c], edx
je 0x438cc1
push 0x69
push 6
mov ecx, esi
call fcn.00435b90
jmp 0x438d21
push 0
push 5
mov ecx, esi
call fcn.00435b90
jmp 0x438d21
cmp ecx, edi
je 0x438ce2
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push str._F_Error_occured__
push 4
push 4
call eax
mov eax, dword [esi + 0x258]
cmp eax, 6
je 0x438d0d
mov ecx, dword [esi + 0x2ac]
cmp ecx, edi
je 0x438d03
mov edx, dword [ecx]
push edi
push 0x69
push 6
push eax
mov eax, dword [edx]
call eax
mov dword [esi + 0x258], 6
cmp byte [esi + 0x266], 0
jne 0x438d21
mov ecx, dword [esi + 0x28c]
call fcn.0043b3c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret 4
Function at 0x43a2c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4b03a4]
push esi
push 0
push eax
push 0
push 0
push 2
push 2
push 0xfffffffffffffff6
push 0xfffffffffffffff6
push 0xcf0000
push str.pro_mydowndl
push str.pro_mydowndl
push 0x8000080
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, esi
pop esi
pop ebp
ret