joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ace
Capabilities:
Identify system language via api

Disassembly:
push 0x38
mov eax, 0x46b76c
call fcn.0046b3ad
mov eax, ecx
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [ebp - 0x18], edi
and dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x10], esi
lea ebx, [eax + 8]
mov byte [ebp - 4], 1
mov ecx, dword [ebx]
test ecx, ecx
je 0x419b00
call fcn.00417eee
and dword [ebx], esi
push ebx
call fcn.0041c54b
mov ebx, eax
test ebx, ebx
jns 0x419b18
mov ecx, ebx
call fcn.0041802b
jmp 0x419c82
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
jne 0x419b36
mov ebx, 0x80070002
mov ecx, 0x407c2c
push 2
mov edx, ebx
call fcn.0041932d
jmp 0x419b0c
push 0xaa
lea ebx, [eax + 0xc]
push 0
push ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, 0xb6
push 0x55
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
jne 0x419b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov ebx, eax
jmp 0x419b0c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov edx, ebx
push 0x55
call fcn.004212af
test eax, eax
je 0x419b5e
lea eax, [ebp - 0x18]
push eax
call fcn.0041b2b2
mov ebx, eax
test ebx, ebx
jns 0x419ba3
mov ecx, ebx
call fcn.0041802b
mov edi, dword [ebp - 0x18]
jmp 0x419c82
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + 0xc]
test eax, eax
je 0x419bc2
lea ecx, [ebp - 0x20]
push ecx
push 0x55
pop edx
mov ecx, eax
call fcn.00414456
mov ecx, dword [ebp - 0x14]
mov ebx, eax
jmp 0x419bc7
mov ebx, 0x80070057
test ebx, ebx
js 0x419b94
push 9
lea esi, [ecx + 0x160]
xor eax, eax
and dword [ebp - 0x1c], eax
lea edi, [ebp - 0x44]
and dword [esi], 0
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00419d74
mov edi, dword [ebp - 0x18]
mov ebx, eax
test ebx, ebx
jns 0x419c03
mov ecx, ebx
call fcn.0041802b
mov esi, dword [ebp - 0x10]
jmp 0x419c77
cmp dword [ebp - 0x1c], 0
jne 0x419c1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov ebx, eax
jmp 0x419bf7
mov ecx, esi
call fcn.004215cb
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
mov edx, dword [edx + 8]
call fcn.00421348
mov ebx, eax
test ebx, ebx
js 0x419bf7
mov ebx, dword [ebp - 0x44]
test ebx, ebx
js 0x419bf7
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x419c59
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ecx + 0xc]
push eax
call fcn.0041b3b5
mov ebx, eax
test ebx, ebx
jns 0x419c77
mov ecx, ebx
call fcn.0041802b
test esi, esi
je 0x419c82
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, ebx
call fcn.00418048
mov byte [ebp - 4], 0
test esi, esi
je 0x419c9c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x419caf
mov ecx, edi
call fcn.00417eee
and dword [ebp - 0x18], 0
mov eax, ebx
call fcn.0046b380
ret 0xc
Function at 0x419d74
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test eax, eax
jne 0x419d9f
mov ecx, 0x80070057
mov esi, ecx
call fcn.0041802b
jmp 0x419e51
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x419d8e
mov dword [eax], esi
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0x407c84
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x419dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov esi, eax
mov ecx, esi
jmp 0x419d95
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x407cb0
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x419dc0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x419e4b
cmp eax, 0x80
je 0x419e4b
cmp eax, 0x102
je 0x419e44
cmp eax, 0xffffffff
je 0x419e2b
mov esi, 0x80004005
jmp 0x419dcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00417da6
mov esi, dword [ebp - 8]
test eax, eax
jne 0x419e51
jmp 0x419dcf
mov esi, 0x800705b4
jmp 0x419dcf
mov dword [ebx], 1
mov ecx, esi
call fcn.00418048
cmp dword [ebp - 4], 0
je 0x419e67
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41ae1c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push 2
mov ecx, 0x80000002
call fcn.0041ae9b
mov edi, eax
test edi, edi
js 0x41ae70
xor ecx, ecx
call fcn.00418048
push dword [ebp + 0x10]
and dword [ebp - 8], 0
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00417da6
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41ae77
mov ecx, edi
call fcn.0041802b
mov ecx, edi
call fcn.00418048
cmp dword [ebp - 4], 0
je 0x41ae8d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b0ad
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push 2
mov ecx, 0x80000002
call fcn.0041ae9b
mov edi, eax
test edi, edi
js 0x41b102
xor ecx, ecx
call fcn.00418048
push dword [ebp + 0x10]
and dword [ebp - 8], 0
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00417da6
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41b109
mov ecx, edi
call fcn.0041802b
mov ecx, edi
call fcn.00418048
cmp dword [ebp - 4], 0
je 0x41b11f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c429
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x470008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x418]
mov esi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push eax
push 0x407a68
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x41c483
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov esi, eax
jmp 0x41c496
mov edx, esi
lea ecx, [ebp - 0x418]
call fcn.00417dc4
mov esi, eax
test esi, esi
jns 0x41c49d
mov ecx, esi
call fcn.0041802b
mov ecx, esi
call fcn.00418048
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00450290
mov esp, ebp
pop ebp
ret

Function at 0x41c4ba
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x470008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x418]
mov esi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push eax
push 0x40863c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x41c514
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov esi, eax
jmp 0x41c527
mov edx, esi
lea ecx, [ebp - 0x418]
call fcn.00417dc4
mov esi, eax
test esi, esi
jns 0x41c52e
mov ecx, esi
call fcn.0041802b
mov ecx, esi
call fcn.00418048
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00450290
mov esp, ebp
pop ebp
ret

Function at 0x41ca1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 1
push ebx
push 0x406510
push 0x80000002
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00417da6
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41ca61
mov ecx, edi
call fcn.0041802b
jmp 0x41ca67
mov esi, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, edi
call fcn.00418048
cmp dword [ebp - 4], ebx
je 0x41ca7f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
test edi, edi
jns 0x41ca8f
mov ecx, edi
call fcn.0041802b
jmp 0x41cac8
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x406d04
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub eax, ebx
je 0x41cac0
dec eax
dec eax
je 0x41cac3
lea edx, [ebp - 8]
call fcn.00417da6
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41cac3
jmp 0x41ca86
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov ecx, edi
call fcn.00418048
test esi, esi
je 0x41cada
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420156
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
push esi
mov esi, edx
mov dword [ebp - 8], edx
push edi
mov edi, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
cmp dword [ebp + 8], edx
jne 0x420184
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x420234
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x420178
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea edx, [ebp - 4]
call fcn.00417dc4
mov ebx, eax
test ebx, ebx
js 0x420232
xor eax, eax
push eax
push eax
push eax
push 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push eax
lea ecx, [ebp - 0xc]
call fcn.00414c6b
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x420223
push 0
push 0x50
push dword [ebp + 8]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
push eax
lea ecx, [ebp - 8]
call fcn.00414c6b
mov eax, dword [ebp - 8]
test eax, eax
je 0x420223
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp - 4]
push 0x408b9c
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
push eax
lea ecx, [ebp - 0x10]
call fcn.00414c6b
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x420223
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x420223
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x420239
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov ebx, eax
mov ecx, ebx
call fcn.0041802b
mov ecx, ebx
call fcn.00418048
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x42024c
call fcn.00417eee
test esi, esi
je 0x420257
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 8]
test eax, eax
je 0x420265
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test edi, edi
je 0x420270
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4221fb
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x470008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
push edi
mov edi, edx
test ecx, ecx
je 0x422301
xor eax, eax
cmp ax, word [ecx]
je 0x422301
test edi, edi
je 0x422301
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4222f0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4222cb
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4222cb
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4222a7
cmp dword [ebp - 8], esi
jne 0x4222a7
mov eax, dword [ebp - 0xc]
mov dword [edi], esi
mov dword [edi + 4], esi
xor esi, esi
mov dword [edi + 8], eax
jmp 0x4222da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4222b6
push 0x1f
pop esi
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4222da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4222da
push 0x1f
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jle 0x422304
movzx esi, si
or esi, 0x80070000
jmp 0x422304
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4222e3
push 0x1f
pop esi
jmp 0x4222e5
push 0x57
pop esi
lea ecx, [ebp - 0x18]
call fcn.00425b63
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450290
mov esp, ebp
pop ebp
ret

Function at 0x422ec0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push dword [ebp + 8]
lea edi, [esi + 8]
push dword [ebp + 0xc]
push edi
push ebx
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp ecx, 0x103
jne 0x422f01
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ecx, eax
test ecx, ecx
js 0x422f11
mov ecx, dword [edi]
test ecx, ecx
js 0x422f11
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x422f11
mov eax, dword [esi + 0xc]
mov dword [edx], eax
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 0xc
Function at 0x43263a
Capabilities:
Check http status code
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x470008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], 4
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov edi, ecx
push eax
push ebx
push 0x20000013
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x4326a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov edx, dword [edi + 0x5c]
mov ebx, eax
push 0x2f2
push 0x40f008
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x473450]
lea ecx, [edi + 0x5c]
jmp 0x432869
mov eax, dword [ebp - 8]
cmp eax, 0x64
je 0x43289a
cmp eax, 0xc7
jbe 0x4326dc
cmp eax, 0xce
jbe 0x43289a
cmp eax, 0x130
je 0x43289a
cmp eax, 0x133
je 0x43289a
add edi, 0x5c
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
mov ecx, edi
call esi
test eax, eax
je 0x432718
push dword [ebp - 8]
mov eax, dword [edi]
push 0x40f060
push 4
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
mov ecx, edi
call esi
push eax
call fcn.00444fe2
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, 0x19a
cmp eax, ecx
ja 0x4327e4
je 0x4327d8
add ecx, 0xfffffff6
cmp eax, ecx
ja 0x43278e
je 0x43282e
cmp eax, 0x65
je 0x43277f
cmp eax, 0xcc
je 0x4327d8
mov ecx, 0x12c
cmp eax, ecx
je 0x432882
jbe 0x43284b
cmp eax, 0x12f
jbe 0x4327d8
cmp eax, 0x131
jne 0x43284b
mov ebx, 0x800704d0
push 0x35b
jmp 0x432855
mov ebx, 0x8007045d
push 0x316
jmp 0x432855
cmp eax, 0x193
jbe 0x4327cc
cmp eax, 0x194
je 0x4327d8
cmp eax, 0x195
jbe 0x43284b
cmp eax, 0x197
jbe 0x4327cc
cmp eax, 0x198
je 0x432876
cmp eax, 0x199
jne 0x43284b
push 0x21
pop ebx
jmp 0x4328d7
mov ebx, 0x80070005
push 0x33b
jmp 0x432855
mov ebx, 0x80070002
push 0x367
jmp 0x432855
mov ecx, 0x1f4
cmp eax, ecx
ja 0x43283a
je 0x432882
cmp eax, 0x19c
jbe 0x43282e
add ecx, 0xffffffa9
cmp eax, ecx
je 0x432824
jbe 0x43284b
cmp eax, 0x19f
jbe 0x43282e
cmp eax, 0x1a0
je 0x43288e
cmp eax, 0x1c1
jne 0x43284b
mov ebx, 0x800704d5
push 0x342
jmp 0x432855
mov ebx, 0xdf
jmp 0x4328d7
mov ebx, 0x8007000d
push 0x330
jmp 0x432855
sub eax, 0x1f5
je 0x43288e
dec eax
dec eax
je 0x432882
dec eax
je 0x432876
dec eax
je 0x43288e
mov ebx, 0x80004005
push 0x372
mov eax, dword [edi]
push 0x40f008
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
mov ecx, edi
call esi
mov edx, ebx
mov ecx, eax
call fcn.00444f99
jmp 0x4328d7
mov ebx, 0x800705b4
push 0x31e
jmp 0x432855
mov ebx, 0x8007001f
push 0x34b
jmp 0x432855
mov ebx, 0x80070032
push 0x354
jmp 0x432855
mov eax, dword [edi + 0x5c]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
lea ecx, [edi + 0x5c]
call esi
test eax, eax
je 0x4328d7
push dword [ebp - 8]
mov eax, dword [edi + 0x5c]
push 0x40f060
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
lea ecx, [edi + 0x5c]
call esi
push eax
call fcn.00444fe2
add esp, 0x10
mov ecx, ebx
call fcn.00418048
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450290
mov esp, ebp
pop ebp
ret 4
Function at 0x43de23
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x46cff1
call fcn.0046b3e5
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x18], eax
push eax
push eax
push ebx
push 0x4376e0
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 0x18]
call fcn.0042939f
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x43de91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov edx, dword [ebx + 0x60]
push 0xbae
push 0x410ef8
mov dword [ebp - 0x14], eax
mov edi, dword [edx + 4]
mov ecx, edi
call dword [0x473450]
lea ecx, [ebx + 0x60]
call edi
mov ebx, dword [ebp - 0x14]
jmp 0x43dfa7
add ebx, 0x60
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x473450]
mov ecx, ebx
call edi
test eax, eax
je 0x43deca
mov eax, dword [ebx]
push 0x410f30
push 2
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x473450]
mov ecx, ebx
call edi
push eax
call fcn.00444fe2
add esp, 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43df15
cmp eax, 0xffffffff
je 0x43def1
mov eax, dword [ebp - 0x14]
mov ebx, 0x8000ffff
push 0xbc6
mov eax, dword [eax + 0x60]
jmp 0x43df8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43df08
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x43dfb0
push 0xbc1
jmp 0x43df89
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x473450]
mov ecx, ebx
call edi
test eax, eax
je 0x43df4b
mov eax, dword [ebx]
push 0x410f78
push 2
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x473450]
mov ecx, ebx
call edi
push eax
call fcn.00444fe2
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x43df70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417d89
mov ebx, eax
push 0xbbc
jmp 0x43df89
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jle 0x43df82
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x43dfb0
push 0xbbd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x60]
mov edi, dword [eax + 4]
mov ecx, edi
push 0x410ef8
call dword [0x473450]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx + 0x60]
call edi
mov edx, ebx
mov ecx, eax
call fcn.00444f99
mov ecx, ebx
call fcn.00418048
test esi, esi
je 0x43dfc2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0046b399
ret
Function at 0x43f1cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
mov eax, 0x46d103
call fcn.0046b3e5
mov ebx, ecx
lea eax, [ebx + 0xe0]
push eax
lea ecx, [ebp - 0x30]
call fcn.00444aae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, dword [ebx]
push ecx
lea ecx, [ebp - 0x38]
push ecx
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x473450]
mov ecx, ebx
call esi
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x43f23b
mov edx, dword [ebx + 0x60]
push 0xdf2
mov esi, dword [edx + 4]
push 0x411650
mov ecx, esi
call dword [0x473450]
lea ecx, [ebx + 0x60]
call esi
mov esi, dword [ebp - 0x14]
mov edx, esi
mov ecx, eax
call fcn.00444f99
jmp 0x43f37f
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 0x310]
jne 0x43f349
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebx + 0x314]
jne 0x43f349
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x304]
cmp eax, dword [ebx + 0x2f8]
jb 0x43f37c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x88]
call fcn.00429c31
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x43f294
mov eax, dword [ebx + 0x60]
push 0xe04
mov esi, dword [eax + 4]
jmp 0x43f218
cmp dword [ebp - 0x18], 3
je 0x43f2ce
cmp dword [ebp - 0x18], 5
je 0x43f2ce
mov eax, dword [ebx + 0x60]
push 0xe06
push 0x411650
mov dword [ebp - 0x14], 0x8000ffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
lea ecx, [ebx + 0x60]
call esi
mov esi, 0x8000ffff
jmp 0x43f22d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x18], 3
mov dword [ebx + 0x304], eax
mov eax, dword [ebx + 8]
push 0
mov esi, dword [eax + 0xc]
mov ecx, esi
jne 0x43f329
push 3
call dword [0x473450]
lea ecx, [ebx + 8]
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x43f37f
push 0xe0f
mov eax, dword [ebx + 0x60]
push 0x411650
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473450]
lea ecx, [ebx + 0x60]
call esi
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.00444f99
jmp 0x43f37c
push 0x10002
call dword [0x473450]
lea ecx, [ebx + 8]
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x43f37f
push 0xe15
jmp 0x43f305
mov ecx, ebx
call fcn.0043f894
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x43f35e
push 0xdfa
jmp 0x43f305
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x310], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x314], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x304], eax
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.00418048
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x4090d8
call fcn.00444b4d
mov eax, dword [ebp - 0x14]
call fcn.0046b399
ret