joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426020
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x214
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x12]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x18], ax
call fcn.004b83b0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x42607d
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004b8307
add esp, 0x214
ret
push esi
push str.kernel32.dll
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea ecx, [esp + 0x14]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x4260ee
push edi
push esi
call fcn.0048097b
add esp, 4
mov edi, eax
push edi
push esi
push ebx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4260e4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x53bab0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4260e4
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + 8]
push edi
call fcn.004b7eaf
add esp, 4
pop edi
mov ecx, dword [esp + 0x218]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004b8307
add esp, 0x214
ret

Function at 0x426230
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea ecx, [esp]
call fcn.0050b000
lea ecx, [esp]
call fcn.0050afd0
push eax
mov eax, dword [esp + 0xc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp]
test eax, eax
je 0x426262
call fcn.0050afe0
xor al, al
pop ecx
ret
push ebx
push 0
push 0
push 0
call fcn.0050afc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.0050afe0
mov al, bl
pop ebx
pop ecx
ret

Function at 0x4262f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea ecx, [esp]
mov dword [esp + 4], 0x64
call fcn.0050b000
lea ecx, [esp]
call fcn.0050afd0
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x42632e
lea ecx, [esp]
call fcn.0050afe0
xor al, al
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
push eax
push 0
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.0050afc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp]
test eax, eax
jne 0x426323
call fcn.0050afe0
mov al, 1
add esp, 8
ret
Function at 0x427f30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5147cb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00480a8f
push 4
mov dword [esp + 0x24], 0
call fcn.004bd0c6
mov edi, eax
add esp, 4
test edi, edi
je 0x427fb2
call fcn.00480d41
mov dword [edi], eax
call fcn.00480b6f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00480a50
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x427fa7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00480a78
jmp 0x427fb4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x42a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42a389
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42a3c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x42a3c0
lea ebx, [ebx]
cmp esi, eax
jae 0x42a3c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x42a3b0
cmp esi, eax
jb 0x42a3ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x42b3a0
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x514b98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x14]
lea esi, [ebx + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp dword [esi + 0x28], 0
mov ecx, dword [esi]
push ecx
sete byte [esp + 0x17]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x13], 0
jne 0x42b438
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, dword [ebp + 0xc]
ja 0x42b438
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi]
push 0xffffffffffffffff
push edx
call edi
cmp dword [esi + 0x28], 0
mov eax, dword [esi]
push eax
sete bl
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
mov ebx, dword [ebp + 8]
je 0x42b403
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jle 0x42b44f
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
push eax
push ecx
mov dword [ebx + 4], 0
call edi
test eax, eax
je 0x42b470
mov edx, dword [ebx + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 8], 0xffffffff
mov ecx, dword [esi]
push 0xffffffffffffffff
push ecx
call edi
cmp dword [esi + 0x28], 0
mov edx, dword [esi]
push edx
sete bl
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
jne 0x42b513
lea esp, [esp]
lea eax, [esp + 0x14]
push eax
mov ebx, esi
call fcn.0042b710
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x28], 0xffffffff
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x42b4f8
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x42b4f8
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x42b4f8
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
mov ecx, dword [esi]
push 0xffffffffffffffff
push ecx
call edi
cmp dword [esi + 0x28], 0
mov edx, dword [esi]
push edx
sete bl
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x42b4a0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x514b71
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov eax, dword [ebx]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x28], 1
mov esi, dword [ebx + 0x24]
lea edi, [ebx + 0xc]
lea ecx, [esp + 0x18]
call fcn.004703f0
mov eax, dword [edi + 0x18]
cmp eax, esi
ja 0x42b778
mov ecx, dword [edi + 0x1c]
add ecx, eax
cmp esi, ecx
jbe 0x42b77d
call fcn.004bb13c
push edi
lea ecx, [esp + 0x1c]
call fcn.004026e0
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x18]
call fcn.0042bbe0
mov esi, ebp
call fcn.00425590
mov esi, edi
mov dword [esp + 0x10], 1
call fcn.0042b830
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 4

Function at 0x42c060
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x516f4d
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push ebp
push esi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
call fcn.00402ab0
add esi, 0x118
mov dword [esp + 0xd0], ebx
mov ebp, 1
mov ecx, esi
mov dword [esp + 0x14], ebp
call fcn.00402a90
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42c1af
lea eax, [esp + 0x34]
push eax
call fcn.0042cb50
mov ecx, esi
mov dword [esp + 0xd0], ebp
call fcn.00402a90
push 0x21
mov ecx, eax
lea esi, [esp + 0x40]
call fcn.0042df20
test eax, eax
jne 0x42c115
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x3c]
lea ecx, [esp + ecx + 0x34]
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x42c10e
or eax, 4
push ebx
push eax
call fcn.0042abf0
push 2
lea esi, [esp + 0x38]
call fcn.0042c870
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 4]
test byte [esp + eax + 0x3c], 6
jne 0x42c14b
mov ecx, dword [esp + eax + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
push ebp
push ebp
push ebx
lea edx, [esp + 0x28]
push edx
call eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
jmp 0x42c156
mov eax, dword [0x520458]
xor ecx, ecx
mov dword [esp + 0x28], ebx
push ebx
lea esi, [esp + 0x38]
lea ebp, [ecx + eax]
call fcn.0042c870
push ebx
lea ecx, [ebp + 1]
push ecx
mov ecx, edi
call fcn.00401570
mov ecx, edi
call fcn.00401180
push ebp
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0042d8f0
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd0], bl
call fcn.0042cc80
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x90], vtable.std::ios_base.0
call fcn.0048117a
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret
Function at 0x42c1f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x515e30
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
push str.SoftwareKuaiZipReport
lea ecx, [esp + 0x14]
call fcn.00403370
xor edi, edi
push edi
push 1
lea eax, [esp + 0x18]
push eax
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x58]
mov dword [esp + 0x90], edi
call fcn.0050af40
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 2
call fcn.00402b40
lea ecx, [esp + 0x48]
call fcn.0050adc0
test al, al
jne 0x42c278
lea ecx, [esp + 0x48]
call fcn.0050af20
mov al, 1
jmp 0x42c2e8
push str.timestamp
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], edi
call fcn.00403370
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x50]
call fcn.0050ae50
test al, al
lea ecx, [esp + 0x2c]
sete bl
call fcn.00402b40
test bl, bl
jne 0x42c26b
mov eax, dword [esp + 0xc]
push eax
call fcn.00436540
add esp, 4
mov edi, eax
call fcn.004364e0
cmp eax, edi
jne 0x42c26b
lea ecx, [esi + 0x118]
call fcn.00402a90
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea ecx, [esp + 0x48]
test eax, eax
je 0x42c26f
call fcn.0050af20
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004b8307
add esp, 0x78
ret

Function at 0x42c400
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.004b83b0
add esp, 0xc
push 0
push 0x1a
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.Kuaizip
lea edx, [esp + 8]
push edx
call edi
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42c481
push eax
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x42c481
lea edx, [esp + 4]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.report_config.txt
lea eax, [esp + 8]
push eax
call edi
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x118]
call fcn.00402a70
mov ecx, dword [esp + 0x108]
pop edi
xor ecx, esp
call fcn.004b8307
add esp, 0x108
ret
Function at 0x42cb50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x516a37
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [ebp], 0x53bd0c
mov dword [ebp + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 4], ebx
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
mov dword [esp + 0x18], 1
call fcn.0042a240
lea esi, [ebp + 8]
push 0x20
mov ecx, edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.004290e0
mov byte [edi + 0x30], al
cmp dword [edi + 0x28], ebx
jne 0x42cbe6
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.0042abf0
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00427f30
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x5711b8]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x42d640
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5169e7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x53bb74
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
mov dword [esp + 0x1c], ebx
push edi
mov edx, esi
mov dword [esp + 0x14], 1
call fcn.0042d890
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00427f30
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x5711b8]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x42e7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x51625a
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x14], ecx
mov edi, edx
mov dword [esp + 0x18], esi
call fcn.00405f40
mov dword [esp + 0x98], esi
mov ebx, 1
push edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], ebx
call fcn.00402b00
lea ecx, [esp + 0x38]
mov dword [esp + 0x98], ebx
xor ebp, ebp
call fcn.004033e0
test eax, eax
jbe 0x42e8bb
cmp esi, dword [esp + 0x4c]
jbe 0x42e83c
call fcn.004bb13c
lea ecx, [esp + 0x38]
call fcn.00402cb0
add eax, esi
movsx eax, byte [eax]
cmp eax, dword [esp + 0xa0]
jne 0x42e8a9
mov eax, esi
sub eax, ebp
push eax
push ebp
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0x44]
call fcn.00401260
push 0xd
lea edi, [esp + 0x74]
lea ebx, [esp + 0x20]
mov byte [esp + 0x9c], 2
lea ebp, [esi + 1]
call fcn.0042e740
mov byte [esp + 0x98], 3
mov ecx, dword [esp + 0x14]
push eax
call fcn.00405fd0
mov ecx, ebx
call fcn.00402b40
mov ecx, edi
mov byte [esp + 0x98], 1
call fcn.00402b40
lea ecx, [esp + 0x38]
inc esi
call fcn.004033e0
cmp esi, eax
jb 0x42e831
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x44]
call fcn.00401260
push 0xd
lea edi, [esp + 0x58]
lea ebx, [esp + 0x20]
mov byte [esp + 0x9c], 4
call fcn.0042e740
mov byte [esp + 0x98], 5
mov esi, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.00405fd0
mov ecx, ebx
call fcn.00402b40
mov ecx, edi
call fcn.00402b40
lea ecx, [esp + 0x38]
call fcn.00402b40
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004b8307
add esp, 0x88
ret 4
Function at 0x431810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x914
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x910], eax
push esi
push edi
push 0xff
lea eax, [esp + 0x1d]
push 0
push eax
mov esi, ecx
or edi, 0xffffffff
mov dword [esp + 0x14], 0
mov byte [esp + 0x24], 0
call fcn.004b83b0
push esi
lea ecx, [esp + 0x28]
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push ecx
call fcn.004b894b
add esp, 0x18
lea edx, [esp + 8]
push edx
push 0x20019
push 0
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43193d
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x122]
push edx
mov word [esp + 0x124], cx
call fcn.004b83b0
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
push 0
push 0
push str.PnpInstanceID
push edx
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x431932
push 3
push 0x53bdc4
lea eax, [esp + 0x120]
push eax
push 0
call dword [sym.imp.SHLWAPI.dll_StrIsIntlEqualW]
test eax, eax
je 0x431932
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.MediaSubType
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call esi
cmp eax, 2
je 0x431930
test eax, eax
jne 0x431932
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x431930
cmp eax, 2
jne 0x431932
lea edi, [eax - 1]
jmp 0x431932
xor edi, edi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x918]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004b8307
add esp, 0x914
ret
Function at 0x432790
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push 2
call fcn.004d9450
call fcn.004d94e0
push 1
mov esi, eax
push 0x29
push esi
call fcn.004d9520
push str.User_Agent:Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_42.0.2311.90_Safari_537.36
push 0
call fcn.004d9360
push str.Accept:_
push eax
call fcn.004d9360
mov ebx, eax
push ebx
push 0x2727
push esi
call fcn.004d9520
add esp, 0x2c
mov ecx, edi
call fcn.00402a90
push eax
push 0x2712
push esi
call fcn.004d9520
push 0x432700
push 0x4e2b
push esi
call fcn.004d9520
push edi
push 0x2711
push esi
call fcn.004d9520
push 0
push 0x2b
push esi
call fcn.004d9520
push edi
push 0x2749
push esi
call fcn.004d9520
push 0x432740
push 0x4e58
push esi
call fcn.004d9520
mov eax, dword [edi + 0x20]
add esp, 0x48
test eax, eax
je 0x432849
push eax
push 0x13
push esi
call fcn.004d9520
mov eax, dword [edi + 0x24]
push eax
push 0x14
push esi
call fcn.004d9520
add esp, 0x18
push esi
call fcn.004d9720
add esp, 4
test eax, eax
je 0x43287f
push eax
call fcn.004d9780
add esp, 4
push eax
lea ecx, [edi + 0x30]
call fcn.00402a70
cmp dword [edi + 0x28], 0
je 0x432879
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [edi + 0x2c]
push ecx
push 0x200002
push esi
call fcn.004d9760
add esp, 0xc
test eax, eax
jne 0x432856
push esi
call fcn.004d9740
push ebx
call fcn.004d93a0
add esp, 8
cmp dword [edi + 0x28], 0
je 0x4328b4
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx]
push edi
call eax
pop esi
xor eax, eax
pop ebx
ret