joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4265c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba9cc
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x228], edi
call fcn.00464a00
add esp, 0xc
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4267d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SOFTWARELuDaShi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42664d
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x426659
push 0x10
push str.SOFTWARELuDaShi
call fcn.0040c380
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 1
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x426750
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426750
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4267da
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x426708
movzx eax, ax
mov ecx, edi
push eax
call fcn.004150e0
jmp 0x42672f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426711
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040c380
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4267b1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4267b1
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4267e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x4c06e8
mov byte [ebp - 4], 3
mov ecx, edi
test eax, 0xffff0000
jne 0x426786
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x426792
push 0
push 0x4c06e8
call fcn.0040c380
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4267b1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
int3
Function at 0x4267f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baa2c
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x228], edi
call fcn.00464a00
add esp, 0xc
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x426a00
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SOFTWARELdsLite
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42687d
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x426889
push 0x10
push str.SOFTWARELdsLite
call fcn.0040c380
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 1
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x426980
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426980
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x426a0a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x426938
movzx eax, ax
mov ecx, edi
push eax
call fcn.004150e0
jmp 0x42695f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426941
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040c380
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4269e1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4269e1
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x426a14
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x4c06e8
mov byte [ebp - 4], 3
mov ecx, edi
test eax, 0xffff0000
jne 0x4269b6
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x4269c2
push 0
push 0x4c06e8
call fcn.0040c380
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4269e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
int3
Function at 0x426f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bab21
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0
mov dword [ebp - 0x228], esi
push dword [ecx + 0x34]
push eax
call fcn.00426d10
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00464a00
add esp, 0xc
mov dword [ebp - 0x224], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push str.repop_time_slot
push dword [ebp - 0x21c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x427055
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4270db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x427002
movzx eax, ax
mov ecx, esi
push eax
call fcn.004150e0
jmp 0x42702e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427010
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c380
mov edi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4270bc
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4270bc
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4270e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x4c06e8
mov byte [ebp - 4], 2
mov ecx, esi
test eax, 0xffff0000
jne 0x42708b
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x427097
push 0
push 0x4c06e8
call fcn.0040c380
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4270bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
int3
Function at 0x427c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bac48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4e949c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push 0
mov edi, 0x12c
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x493e0
mov dword [ebx + 4], 0
push dword [eax + 0x34]
push ecx
mov ecx, eax
call fcn.00426d10
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp + 8], 4
push eax
push str.auto_elapse
push dword [ebp - 0x1c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jle 0x427cad
mov eax, ecx
cdq
mov dword [ebx], eax
mov eax, 0x10624dd3
mov dword [ebx + 4], edx
imul ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x427de5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov eax, str.mininews.exe
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
test eax, 0xffff0000
jne 0x427ce5
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x427cf1
push 0xc
push str.mininews.exe
call fcn.0040c380
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
call fcn.00428530
mov edx, dword [ebp + 8]
or esi, 0xffffffff
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x427d28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x427d9a
mov ecx, dword [ebp - 0x14]
call fcn.00426200
mov ecx, edx
mov dword [ebp + 8], eax
push ecx
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push dword [eax + 0x34]
push str._mini_utils_from__d___elapseColseTime__d
push eax
call fcn.00429760
mov eax, edi
add esp, 0x14
cdq
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
jg 0x427dd1
mov ecx, dword [ebp + 8]
jl 0x427d69
cmp ecx, dword [ebp - 0x14]
jae 0x427dd1
test eax, eax
jl 0x427dd1
jg 0x427d73
test ecx, ecx
je 0x427dd1
push 0
imul eax, edi, 0x3e8
push 0x3e8
push dword [ebp - 0x18]
push ecx
cdq
mov esi, eax
mov edi, edx
call fcn.00462b50
sub esi, eax
mov dword [ebx], esi
sbb edi, edx
or esi, 0xffffffff
mov dword [ebx + 4], edi
xor edi, edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x427dbb
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx], 0
mov edi, 1
mov dword [ebx + 4], 0
jmp 0x427d9c
push 0x80004005
call fcn.00401af0
int3
Function at 0x428530
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bad6b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
push eax
push 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.004239a0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4285ab
xor ebx, ebx
jmp 0x428640
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00464a00
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4285e7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x428640
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
nop
cmp ebx, dword [ebp - 0x234]
je 0x428626
mov esi, dword [ebp - 0x248]
cmp esi, dword [ebp - 0x244]
je 0x428626
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call fcn.00491f26
add esp, 8
test eax, eax
je 0x428690
add esi, 4
cmp esi, dword [ebp - 0x244]
jne 0x428606
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4285f0
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
mov dword [ebp - 4], 1
test eax, eax
je 0x4286a1
push dword [ebp - 0x244]
lea ecx, [ebp - 0x248]
push eax
call fcn.00420a70
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x248]
sub ecx, edx
and ecx, 0xfffffffc
mov eax, edx
cmp ecx, 0x1000
jb 0x428697
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4286bf
jmp 0x428697
mov ebx, 1
jmp 0x428639
push ecx
push edx
call fcn.00462596
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret
call fcn.0046f938
int3
Function at 0x429180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
mov edi, ecx
call fcn.0042b210
test esi, esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
jne 0x429232
push 0
push dword [edi + 0x34]
lea eax, [ebp - 4]
mov dword [ebp + 8], 0
push eax
mov ecx, edi
call fcn.00426d10
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp + 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push str.auto_24_elapse
push dword [ebp - 4]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 8]
mov ecx, 0x5265c00
mov edx, dword [ebp - 4]
test eax, eax
cmovle eax, ecx
add edx, 0xfffffff0
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429215
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x17d5
push dword [edi + 4]
call esi
push 0
push dword [ebp - 0x10]
push 0x17d5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [edi + 0x50], 0
mov eax, dword [edi + 4]
je 0x429253
push str.Has_pop_second_times__will_NOT_pop_again.
push dword [edi + 0x48]
call fcn.00429760
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x19c8
push eax
mov dword [edi + 0x44], eax
call esi
push 0
lea ecx, [edi + 0x40]
call fcn.004259a0
push eax
push 0x19c8
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [edi + 0x40]
call fcn.004259a0
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push edx
push str.start_timer_to_check_repop__seconds_d
push dword [edi + 0x48]
call fcn.00429760
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x429760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bafc6
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x42989e
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00464a00
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push 0x1ff
push eax
call fcn.0040b880
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00482d18
or edi, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, edi
test eax, eax
js 0x4297f0
cmp eax, 0x1ff
ja 0x4297f0
jne 0x4297f6
xor eax, eax
mov word [ebp - 0x12], ax
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x4298b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x414], eax
mov eax, 0x4c553c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x414]
test eax, 0xffff0000
jne 0x429837
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x429843
push 0xd
push 0x4c553c
call fcn.0040c380
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429853
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x414]
call fcn.0041b8a0
mov esi, dword [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42989e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401af0
int3
Function at 0x42b870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb2a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e949c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x42ba1c
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x40]
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0x1c], eax
cmp ecx, 0x113
jne 0x42b8f7
push ebx
lea ecx, [esi + 0x40]
mov dword [esi + 0x40], 1
call fcn.00429aa0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x40], 0
mov eax, dword [ebp + 0x1c]
je 0x42b8f4
mov dword [esi + 0x40], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
cmp ecx, 0x113
jne 0x42ba1c
mov dword [esi + 0x24], 1
cmp ebx, 0x17d4
jne 0x42b9d8
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push ebx
push dword [esi + 4]
call edi
push 0
push dword [esi + 0x34]
lea eax, [ebp + 0x1c]
mov dword [ebp + 0xc], 0
push eax
mov ecx, esi
call fcn.00426d10
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp + 0x10], 4
push eax
push str.auto_elapse
push dword [ebp + 0x1c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x42b97e
cdq
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
push dword [esi + 0x34]
mov ecx, esi
call fcn.00428230
test eax, eax
je 0x42b9ab
push 0x17d6
push dword [esi + 4]
call edi
push 0
push dword [esi + 0x38]
push 0x17d6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x42b9b4
push 0
mov ecx, esi
call fcn.00429180
mov edx, dword [ebp + 0x1c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ba09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42ba09
cmp ebx, 0x17d5
jne 0x42b9ee
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
jmp 0x42ba02
cmp ebx, 0x17d6
jne 0x42ba09
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
mov ecx, esi
call fcn.00429ca0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x24], 0
jne 0x42b8db
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x42c270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x14]
test esi, esi
je 0x42c374
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00464a00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x4c128c
push dword [esi + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c374
lea eax, [ebp - 0x20c]
push eax
call fcn.0045f230
add esp, 4
test eax, eax
je 0x42c374
lea eax, [ebp - 0x20c]
push eax
call fcn.00414f60
mov ecx, eax
call fcn.00415000
push dword [ebp - 0x210]
call fcn.00414f60
mov ecx, eax
call fcn.00414f20
push eax
lea ecx, [edi + 4]
call fcn.0042bbe0
mov ecx, dword [edi + 4]
push edi
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [edi + 4]
push 0x4c62a0
push 0
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x42c376
push dword [ebp - 0x210]
call fcn.00414f60
mov ecx, eax
call fcn.00414f20
push eax
lea ecx, [edi + 0xc]
call fcn.0042bbe0
mov ecx, dword [edi + 0xc]
push edi
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [edi + 0xc]
push str.http:__www.ludashi.com_appstore_app_times.php
push 0
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462391
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00462391
mov esp, ebp
pop ebp
ret

Function at 0x42c860
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4e949c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.00464a00
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.00464a00
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42c8c3
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x42c8c8
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x42c8e6
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x42c8e8
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x42c8fc
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x4ecef8]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00462391
mov esp, ebp
pop ebp
ret 0x18