joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405600
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e043
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x405767
xor edx, edx
mov word [ebp - 0x41c], dx
push 0x3fe
push 0
lea eax, [ebp - 0x41a]
push eax
call fcn.0053f680
add esp, 0xc
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405730
lea ecx, [ebp - 0x420]
call fcn.00410610
mov byte [ebp - 4], 3
lea edx, [ebp - 0x41c]
push edx
push 0x5a1094
lea eax, [ebp - 0x420]
push eax
call fcn.004089d0
add esp, 0xc
lea ecx, [ebp + 0x14]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00406fc0
add esp, 8
movzx eax, al
test eax, eax
je 0x40571f
lea ecx, [ebp + 0x14]
call fcn.00408860
shl eax, 1
push eax
lea ecx, [ebp + 0x14]
call fcn.004072e0
push eax
push 1
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x420]
call fcn.004072c0
jmp 0x40575b
lea ecx, [ebp + 0x14]
call fcn.00408860
shl eax, 1
push eax
lea ecx, [ebp + 0x14]
call fcn.004072e0
push eax
push 1
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057cb
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4057c1
lea ecx, [ebp + 0x14]
call fcn.00408860
shl eax, 1
push eax
lea ecx, [ebp + 0x14]
call fcn.004072e0
push eax
push 1
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004072c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405810
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd4], 0
xor eax, eax
mov word [ebp - 0xd0], ax
push 0xc6
push 0
lea ecx, [ebp - 0xce]
push ecx
call fcn.0053f680
add esp, 0xc
push 0x64
lea edx, [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp - 0xd0]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406900
mov ecx, dword [ebp - 0xd4]
or ecx, 1
mov dword [ebp - 0xd4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret
Function at 0x409460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x409469
xor ecx, ecx
jne 0x409469
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4094b0
mov eax, dword [ebp - 0xc]
jmp 0x40950d
cmp dword [ebp - 4], 1
je 0x4094c3
cmp dword [ebp - 4], 2
je 0x4094c3
mov eax, 0xd
jmp 0x40950d
cmp dword [ebp + 0xc], 0
je 0x409501
cmp dword [ebp - 8], 0
je 0x4094f9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4094f0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4094f7
mov eax, 0xd
jmp 0x40950d
jmp 0x409501
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4140f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56de58
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x414130
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x41413c
mov al, 1
jmp 0x4142df
mov dword [ebp - 0x10], 8
call fcn.004095c0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004095c0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.004095a0
add esp, 8
movzx eax, al
test eax, eax
je 0x41417f
xor al, al
jmp 0x4142df
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004127b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00412870
mov ecx, eax
call fcn.00414580
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0042bf40
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00412870
mov ecx, eax
call fcn.00414580
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00416060
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4141fa
cmp dword [ebp - 0x6c], 1
je 0x414201
cmp dword [ebp - 0x6c], 3
je 0x41429b
jmp 0x4142b3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00412870
mov ecx, eax
call fcn.00414580
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x414264
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00412870
mov ecx, eax
call fcn.00414580
push eax
call fcn.0053a1eb
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x414264
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402030
mov al, byte [ebp - 0x61]
jmp 0x4142df
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x414287
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402030
mov al, byte [ebp - 0x62]
jmp 0x4142df
cmp dword [ebp - 0x38], 0
jne 0x414299
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004127f0
jmp 0x4142cb
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402030
mov al, byte [ebp - 0x63]
jmp 0x4142df
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402030
mov al, byte [ebp - 0x64]
jmp 0x4142df
jmp 0x414192
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret
Function at 0x4209f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x1c], eax
call fcn.00403140
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x250], 0x22c
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
jne 0x420a59
mov dword [ebp - 0x254], 0
lea ecx, [ebp + 8]
call fcn.004072c0
mov eax, dword [ebp - 0x254]
jmp 0x420bce
mov edx, 1
test edx, edx
je 0x420bad
mov dword [ebp - 0x250], 0x22c
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x420a89
jmp 0x420bad
lea ecx, [ebp + 8]
call fcn.004072e0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x420aa6
mov dword [ebp - 0x25c], 0
jmp 0x420b07
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3fffffff
jle 0x420acb
mov dword [ebp - 0x260], 0
jmp 0x420afb
mov eax, dword [ebp - 8]
shl eax, 1
call fcn.00542680
mov dword [ebp - 0x264], esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x264]
push eax
call fcn.004031a0
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x25c], ecx
lea edx, [ebp - 0x22c]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x420b22
mov dword [ebp - 0x268], 0
jmp 0x420b83
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3fffffff
jle 0x420b47
mov dword [ebp - 0x26c], 0
jmp 0x420b77
mov eax, dword [ebp - 8]
shl eax, 1
call fcn.00542680
mov dword [ebp - 0x270], esp
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
shl edx, 1
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x270]
push ecx
call fcn.004031a0
mov dword [ebp - 0x26c], eax
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
call fcn.0053ca0c
add esp, 8
test eax, eax
jne 0x420ba8
mov edx, dword [ebp - 0x248]
mov dword [ebp - 4], edx
jmp 0x420bad
jmp 0x420a59
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x258], ecx
lea ecx, [ebp + 8]
call fcn.004072c0
mov eax, dword [ebp - 0x258]
lea esp, [ebp - 0x270]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret
Function at 0x421060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dcb8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5bda40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0xd], 0
lea ecx, [ebp + 8]
call fcn.0041cbb0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4210a8
mov byte [ebp - 0xd], 0
jmp 0x4210ac
mov byte [ebp - 0xd], 1
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00407110
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004072c0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x429b90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571550
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x5bda40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x450], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00410610
mov byte [ebp - 4], 2
push 0x104
push 0
lea eax, [ebp - 0x43c]
push eax
call fcn.0053f680
add esp, 0xc
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 0xc]
call fcn.00408860
shl eax, 1
mov dword [ebp - 0x20], eax
lea ecx, [ebp + 0xc]
call fcn.00408860
push eax
lea ecx, [ebp + 0xc]
call fcn.004070d0
mov dword [ebp - 0x440], eax
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
call fcn.00407110
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
lea ecx, [ebp - 0x24]
call fcn.00406900
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004072e0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x429c96
mov dword [ebp - 0x444], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov eax, dword [ebp - 0x444]
jmp 0x429db8
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp + 8]
call fcn.004072e0
push eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429cd8
lea eax, [ebp - 0x43c]
push eax
push 0x59cacc
lea ecx, [ebp - 0x18]
push ecx
call fcn.004089d0
add esp, 0xc
jmp 0x429d4c
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp + 8]
call fcn.004072e0
push eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x429d4c
mov dword [ebp - 0x448], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov eax, dword [ebp - 0x448]
jmp 0x429db8
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
push ecx
push 0x1f4
push 2
push 0x59cad4
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov dword [ebp - 0x44c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x42bd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42bdc2
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42be0b
push 4
lea edx, [ebp + 0x14]
push edx
push 4
push 0
lea ecx, [ebp + 0x10]
call fcn.004072e0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call fcn.004072c0
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4351d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5713e0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x435347
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x18]
push ecx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp + 0xc]
call fcn.004072e0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x59b634
mov edx, dword [ebp - 0x20]
push edx
call sub.VERSION.dll_VerQueryValueW
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x30], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x2e], ax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x2c], dx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x2a], cx
lea ecx, [ebp - 0x24]
call fcn.00410610
mov byte [ebp - 4], 1
movzx edx, word [ebp - 0x2a]
push edx
movzx eax, word [ebp - 0x2c]
push eax
movzx ecx, word [ebp - 0x2e]
push ecx
movzx edx, word [ebp - 0x30]
push edx
push 0x59b638
lea eax, [ebp - 0x24]
push eax
call fcn.004089d0
add esp, 0x18
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
call fcn.004068e0
mov ecx, dword [ebp - 0x3c]
or ecx, 1
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov eax, dword [ebp + 8]
jmp 0x43536f
push 0x59b650
mov ecx, dword [ebp + 8]
call fcn.00406900
mov edx, dword [ebp - 0x3c]
or edx, 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret
Function at 0x4370e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572da1
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x5bda40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x158]
call fcn.0051ee63
push 0
call fcn.005209c3
add esp, 4
push 0
mov ecx, dword [ebp - 0x158]
add ecx, 0x460
push ecx
mov edx, dword [ebp - 0x158]
add edx, 0x45c
push edx
call sub.gdiplus.dll_GdiplusStartup
mov ecx, dword [ebp - 0x158]
call fcn.00437370
test eax, eax
jne 0x437186
push 0
push 0x59a1f4
push 0x59a200
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4372bd
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x158]
call fcn.00436e60
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x160], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x160]
push edx
mov ecx, dword [ebp - 0x158]
add ecx, 0x3d8
call fcn.00406980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.004072c0
mov eax, dword [ebp - 0x158]
add eax, 0x3d8
push ecx
mov ecx, esp
mov dword [ebp - 0x14c], esp
push eax
call fcn.004068e0
mov dword [ebp - 0x164], eax
call fcn.0044c7a0
add esp, 4
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x43722a
mov ecx, dword [ebp - 0x158]
add ecx, 0x3d8
call fcn.004072e0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp - 0x150]
push ecx
call fcn.00435150
add esp, 4
mov dword [ebp - 0x16c], eax
mov edx, dword [ebp - 0x16c]
mov dword [ebp - 0x170], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [ebp - 0x158]
add ecx, 0x3e8
call fcn.00406980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.004072c0
push 0
lea ecx, [ebp - 0x144]
call fcn.0044fcd0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x144]
call fcn.00521d4a
mov dword [ebp - 0x154], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.004372d0
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4373d0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x43741d
mov ecx, dword [ebp - 4]
and ecx, 0x40
je 0x4373f8
mov eax, 0x40
jmp 0x437463
mov edx, dword [ebp - 4]
and edx, 8
je 0x437407
mov eax, 8
jmp 0x437463
mov eax, dword [ebp - 4]
and eax, 0x20
je 0x437416
mov eax, 0x20
jmp 0x437463
mov eax, 0x41
jmp 0x437463
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x43742e
mov eax, 1
jmp 0x437463
mov edx, dword [ebp - 4]
and edx, 2
je 0x43743f
mov eax, 2
jmp 0x437463
mov eax, dword [ebp - 4]
and eax, 4
je 0x437450
mov eax, 4
jmp 0x437463
mov ecx, dword [ebp - 4]
and ecx, 8
je 0x437461
mov eax, 0x10
jmp 0x437463
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43a2d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp + 8]
call fcn.004072e0
mov dword [ebp - 0x2c], eax
lea ecx, [ebp + 0xc]
call fcn.004072e0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
movzx eax, byte [ebp + 0x14]
sub eax, 1
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea ecx, [ebp + 8]
call fcn.004072c0
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov esp, ebp
pop ebp
ret
Function at 0x43fa40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5747a3
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5bda40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 0xc
call fcn.00519a8e
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x43fad2
push 0xa0
mov eax, dword [ebp - 0x24]
add eax, 0xc0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004068e0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x597b08
call fcn.00406900
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.00449af0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
jmp 0x43fad9
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xb4], edx
mov ecx, dword [ebp - 0x24]
add ecx, 0xc0
call fcn.004072e0
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xb4]
call fcn.0044a330
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
push 0x443cb0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
mov ecx, dword [ebp - 0x24]
call fcn.00439c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret