joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c7f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e20d
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x440040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x440b34]
mov ecx, dword [eax + 4]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 0x6c]
call fcn.0040f270
test eax, eax
je 0x41c9a7
cmp dword [ebx + 0x144], 0xffffffff
lea edi, [ebx + 0x144]
jne 0x41c9a7
mov ecx, esi
call fcn.004183b0
push str.Attempting_to_connect_to_your_Cronus_Zen..._r_n
push 0xc8c8c8
push esi
call fcn.00418430
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x14], edi
cmp byte [ecx + 0x3a5], 0
jne 0x41c8b8
mov eax, dword [0x440b34]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0x321
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x3c]
push edi
mov byte [ecx + 0x3a5], 1
call esi
push 0
push 0x323
push edi
call esi
lea eax, [ebx + 0x144]
mov dword [ebp - 0x14], eax
lea edi, [ebx + 0x144]
lea esi, [ebx + 0xc4]
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x41c8cf
mov eax, dword [esi]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x41c91e
cmp dword [esi + 0x14], 7
jbe 0x41c8f7
mov esi, dword [esi]
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x41c9b9
push eax
mov ecx, ebx
call fcn.0041d950
test eax, eax
je 0x41c9d4
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41c9ef
lea eax, [ebx + 0xc]
push eax
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x41ca0a
jmp 0x41c9a7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.An_error_occured_while_opening_a_connection_to_the_Cronus_Zen.
lea ecx, [ebp - 0x50]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_associating_the_device_handle_with_an_I_O_completion_port.
lea ecx, [ebp - 0x68]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_resuming_the_I_O_completion_port_event_thread.
lea ecx, [ebp - 0x80]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x80]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_posting_the_connection_completion_status_to_the_I_O_completion_port.
lea ecx, [ebp - 0x98]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x98]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x41ca30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e23d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x440040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
movups xmmword [eax + 0x3c], xmm0
mov dword [eax + 0x4c], 0
movzx ecx, word [eax + 0x148]
mov eax, 0x10
mov dword [ebp - 0x10], ecx
cmp ecx, 1
jbe 0x41ca90
lea eax, [ecx - 1]
cmp eax, 0xffffffec
ja 0x41cbcc
add eax, 0x13
and eax, 0xfffffffc
push eax
call fcn.0042b863
push dword [ebp - 0x10]
mov edi, eax
push 0
lea esi, [edi + 0xc]
mov dword [edi + 4], 1
push esi
mov dword [edi + 8], 1
mov dword [edi], vtable.._AV___Ref_count_unbounded_array___BY0A_E_00_std__.0
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov dword [ecx + 0x13c], esi
mov esi, ecx
mov eax, dword [esi + 0x140]
mov dword [esi + 0x140], edi
mov edi, eax
test edi, edi
je 0x41cafb
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x41cafb
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x41cafb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
movzx eax, word [esi + 0x148]
lea ecx, [esi + 0x3c]
push ecx
push 0
push eax
push dword [esi + 0x13c]
push dword [esi + 0x144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41cbbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41cbbb
mov esi, dword [0x440b34]
lea ecx, [ebp - 0x2c]
push 0x34
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.An_error_occured_while_reading_data_from_the_device.
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.00402500
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00421e40
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x41cbb3
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41cba9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41cba9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b893
add esp, 8
mov ecx, dword [ebp - 0x14]
call fcn.0041c630
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004024e0
int3
Function at 0x41cbe0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c8bd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x440040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebx + 8]
lea ecx, [edi + 0x54]
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
movzx eax, word [edi + 0x14a]
push 0
push eax
push esi
push dword [edi + 0x144]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cced
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41cced
mov esi, dword [0x440b34]
lea ecx, [ebp - 0x2c]
push 0x32
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.An_error_occured_while_writing_data_to_the_device.
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.00402500
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00421e40
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x41cce3
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41ccd9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41ccd9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b893
add esp, 8
mov ecx, edi
call fcn.0041c630
mov esi, dword [ebp - 0x14]
mov eax, dword [0x440b34]
cmp dword [eax + 0x40], 0
je 0x41cd00
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0042b8a6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x41d950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e340
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x440040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 1
push 0
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 4], eax
test eax, eax
je 0x41da0c
push 0
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x41da27
push 0
push 4
push esi
push 0x41da70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x41da42
jmp 0x41d9f3
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.An_error_occured_while_creating_an_I_O_completion_port.
lea ecx, [ebp - 0x30]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x30]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_associating_the_I_O_completion_port_with_the_provided_file_handle.
lea ecx, [ebp - 0x48]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x48]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_creating_the_I_O_completion_port_event_thread.
lea ecx, [ebp - 0x60]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x60]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x41ee40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e48d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00401a10
mov ecx, eax
call fcn.004211b0
mov edi, eax
mov ecx, edi
call fcn.00402670
cmp byte [eax], 2
jne 0x41eeb4
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040b1c0
call fcn.0040e150
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.0040d210
push eax
push ecx
mov ecx, edi
call fcn.0040ab00
lea ecx, [ebp - 0x14]
call fcn.0040d1b0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x420a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6ad
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp eax, dword [ecx + 8]
jne 0x420b5f
cmp dword [edi + 8], 0x70b
jne 0x420b5f
cmp dword [edi + 0xc], 0x201
jne 0x420b5f
mov eax, dword [edi + 0x1c]
xor ebx, ebx
sub eax, dword [edi + 0x18]
mov ecx, 2
inc eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0042b8ab
add esp, 4
mov esi, eax
mov dword [ebp - 0x30], esi
push ebx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x1c], esi
add esp, 0xc
mov word [esi], ax
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x44b
mov byte [ebp - 4], 1
push dword [edi + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x420b82
push 1
push 0
push 0
push esi
push str.open
push dword [edi + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x420b9d
jmp 0x420b56
push esi
call fcn.0042b8a6
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0042b832
mov esp, ebp
pop ebp
ret 4
push str.An_error_occured_while_trying_to_read_the_URL.
lea ecx, [ebp - 0x4c]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x4c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_ocurred_while_trying_to_open_the_URL.
lea ecx, [ebp - 0x64]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4234e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec20
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x20], 0
jbe 0x423534
mov ecx, dword [ecx]
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, 0
je 0x42356f
sub eax, 2
jne 0x4235bd
jmp 0x42356b
mov eax, edi
jmp 0x42359f
cmp dword [esi + 0x14], 7
jbe 0x423577
mov esi, dword [esi]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call fcn.004235e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b832
mov esp, ebp
pop ebp
ret 8
push 0x438fa8
lea ecx, [ebp - 0x3c]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x3c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x4236c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec50
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 7
mov dword [ebp - 0x18], 0
jbe 0x423707
mov ecx, dword [ecx]
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x423792
cmp dword [esi + 0x14], 7
jbe 0x423732
mov esi, dword [esi]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4237ad
jmp 0x423760
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x423774
push eax
call fcn.004235e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b832
mov esp, ebp
pop ebp
ret 8
push str.An_error_occured_while_creating_a_numeric_value_in_the_Windows_Registry.
lea ecx, [ebp - 0x34]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x34]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_setting_a_numeric_value_in_the_Windows_Registry.
lea ecx, [ebp - 0x4c]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x4c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4237d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec80
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x440040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x423830
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x439228
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4238a8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi], eax
test eax, eax
je 0x4238c3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 4], eax
test eax, eax
je 0x4238de
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 8], eax
test eax, eax
je 0x4238f9
jmp 0x423892
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.An_error_occured_while_locating_the_resource_file.
lea ecx, [ebp - 0x30]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x30]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_retrieving_the_resource_file_size.
lea ecx, [ebp - 0x48]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x48]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_loading_the_resource_file.
lea ecx, [ebp - 0x60]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x60]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.An_error_occured_while_copying_the_resource_file.
lea ecx, [ebp - 0x78]
call fcn.00402600
push 0x43dcb8
lea eax, [ebp - 0x78]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x429070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4290a1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x429090
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x4293a0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42efed
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x440b34]
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x440b34]
movzx ecx, word [ebp - 0x18]
cmp dword [eax + 0x30], 0
je 0x429407
movzx edx, word [ebp - 0x1c]
jmp 0x429417
movzx eax, word [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x30], 0xc
div dword [ebp - 0x30]
movzx eax, word [ebp - 0x1a]
push ecx
push eax
push edx
push str.__02u:_02u:_02u_
push 0xc8c8c8
push esi
call fcn.00418430
push str.Checking_for_news_and_updates..._r_n
push 0xc8c8c8
push esi
call fcn.00418430
add esp, 0x24
push 0
push 0
push edi
push 0x41cd80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
jne 0x4294d2
mov esi, dword [0x440b34]
lea ecx, [ebp - 0x2c]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x436e10
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.00402500
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00421e40
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x4294d2
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4294c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4294c8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b893
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b832
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x42c3d2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42c411
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c411
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c411
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c411
cmp dword [ecx + 0x74], 0xe
jbe 0x42c411
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000260a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10002619
pop dword [ebp - 0x40]
mov eax, 0x10002619
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x9a008fbc
add dword [ebp - 0x50], 0xb451b58f
mov dword [ebp - 0x4c], 0x7b159b43
sub dword [ebp - 0x4c], 0x48e24efe
mov dword [ebp - 0x48], 0x4b428e36
sub dword [ebp - 0x48], 0xfef64a08
mov dword [ebp - 0x44], 0xe565edaa
sub dword [ebp - 0x44], 0xe565edaa
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x6a76f31c
add dword [ebp - 0x50], 0x9fb763a
mov dword [ebp - 0x4c], 0xaad83c0e
add dword [ebp - 0x4c], 0x96942567
mov dword [ebp - 0x48], 0xbc8660f0
add dword [ebp - 0x48], 0xa6e90b7c
mov dword [ebp - 0x44], 0x13edfece
add dword [ebp - 0x44], 0xec120132
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xcebc1c14
sub eax, 0xbebb6bc8
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a9e9
push 0
call eax
mov ecx, 0x9ddc5367
sub ecx, 0x9ddbff3d
mov edi, eax
mov ebx, 0x10015000
add ebx, dword [ebp - 0x40]
mov esi, 0xa02b34c3
add esi, 0xa60c1527
xor dword [ebp - 0x18], 0x987b8c35
mov edx, dword [ebx]
xor dword [ebp - 0xc], 0x97809c69
xor edx, esi
add dword [ebp - 8], 0x44c5707
mov dword [edi], edx
sub dword [ebp - 0x34], eax
add edi, 0x51b4ceac
sub edi, 0x51b4cea8
add ebx, 0xf9d33162
add ebx, 0x62ccea2
loop 0x1000272b
add eax, 0xb2c41b7e
sub eax, 0xb2c2d803
xor ebx, ebx
add ebx, eax
add eax, 0xd4a7117d
sub eax, 0xd4a71178
mov ecx, 0x99956f3f
sub ecx, 0x89956f3f
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x69005f30
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
mov eax, 0x54
sub esp, 0x3c
mov dword [esp + 8], eax
mov eax, 8
mov ebp, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], eax
mov edi, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
mov ecx, dword fs:[0x18]
mov dword [esp + 0x24], edx
mov eax, dword [ecx + 0x30]
mov dword [esp + 0x2c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebp
mov dword [edi], eax
sub esp, 0xc
test eax, eax
je 0x690060ff
mov dword [eax], 4
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x20], 0
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 0x2c], 1
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x50]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0xc]
mov esi, 4
mov dword [ebx + 0x18], eax
mov eax, 8
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebp
mov dword [ebx + 0x24], eax
sub esp, 0xc
mov eax, 4
mov ecx, dword [esp + 0x24]
mov ebx, dword [edi]
mov dword [esp + 8], eax
mov eax, 8
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebp
mov dword [ebx + 0x28], eax
mov eax, dword [edi]
sub esp, 0xc
mov edx, dword [eax + 0x24]
test edx, edx
je 0x69006090
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x69006090
movss xmm0, dword [0x6907d020]
add eax, 0x3c
movss dword [edx], xmm0
movss dword [ecx], xmm0
mov dword [eax - 0xc], 0
mov dword [eax - 8], 0
mov dword [eax - 4], 0
movss dword [esp + 0x10], xmm0
movss dword [esp + 4], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sym.gdiplus.dll_GdipSetMatrixElements
xor eax, eax
sub esp, 0x1c
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edx
xor eax, eax
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], eax
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [edi]
xor edx, edx
mov eax, dword [eax + 0x28]
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [edi]
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, 3
mov dword [edi], 0
sub esp, 0xc
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 3
jmp 0x69006087