joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ad2
Capabilities:
Delete registry key

Disassembly:
push 0x4c
mov eax, 0x45b3ad
call fcn.00441649
test edi, edi
jne 0x420b0d
push str.Attempt_to_delete_a_null_key
lea ecx, [ebp - 0x30]
call fcn.004073f1
and dword [ebp - 4], edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00401273
push 0x4720a0
lea eax, [ebp - 0x58]
push eax
call fcn.00441753
push edi
lea esi, [ebp - 0x30]
call fcn.004074af
cmp dword [eax + 0x14], 0
push 0
push 1
sete byte [ebp - 0xd]
call fcn.00408944
cmp byte [ebp - 0xd], 0
je 0x420b43
push str.Attempt_to_delete_an_empty_key
lea ecx, [ebp - 0x30]
call fcn.004073f1
mov dword [ebp - 4], 1
jmp 0x420af2
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jge 0x420b7d
lea eax, [ebp - 0x14]
push eax
call fcn.004208eb
pop ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
push dword [eax]
push edi
push str.Failed_to_delete_key__S__S
call fcn.004081d4
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.0040d5c6
call fcn.00441721
ret

Function at 0x421244
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x45b37a
call fcn.00441649
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push str.deleteCurVersionKeys
mov dword [ebp - 4], ebx
call fcn.004081d4
xor eax, eax
cmp byte [ebp + 8], bl
mov dword [esp], 0x462940
sete al
lea ecx, [ebp - 0x14]
add eax, 0x80000001
push eax
mov eax, 0x20006
call fcn.0040bc93
test eax, eax
jl 0x4212f8
push str.deleteCurVersionKeys___key_Opened
call fcn.004081d4
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.0042114c
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x4212b1
mov eax, dword [eax + 4]
jmp 0x4212b4
add eax, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00408944
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.004211c8
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x4212e4
mov eax, dword [eax + 4]
jmp 0x4212e7
add eax, 4
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00408944
cmp dword [ebp - 0x14], ebx
je 0x421306
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00441721
ret
Function at 0x4221fe
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x45b19f
call fcn.004416b2
mov esi, ecx
push edi
mov ebx, str.deleteDesktopShortcut____S
push ebx
mov dword [ebp - 0x34], esi
call fcn.004081d4
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push 6
push eax
call fcn.00424655
add esp, 0x1c
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x4222c1
mov eax, dword [0x48778c]
mov ecx, 0x48778c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42225d
lea eax, [ebp - 0x28]
push edi
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.0041c698
add esp, 0xc
push dword [ebp - 0x30]
call fcn.00424b4a
pop ecx
test al, al
je 0x4222b9
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push ebx
call fcn.004081d4
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea eax, [ebp - 0x30]
inc bl
call fcn.0040d5c6
xor esi, esi
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.00408944
mov al, bl
call fcn.00441735
ret
lea eax, [ebp - 0x30]
call fcn.0040d5c6
xor bl, bl
jmp 0x4222a6

Function at 0x4222c5
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x45b19f
call fcn.004416b2
mov eax, dword [ebp + 0xc]
push eax
mov edi, str.deleteProgramsShortcut____S
mov esi, ecx
push edi
mov dword [ebp - 0x34], eax
call fcn.004081d4
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 8], bl
push 1
sete al
push ebx
push ebx
add eax, 3
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00424655
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x42236b
mov eax, dword [0x48778c]
mov ecx, 0x48778c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42232e
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.0041c698
add esp, 0xc
push dword [ebp - 0x30]
call fcn.00424b4a
pop ecx
test al, al
je 0x422363
push dword [ebp - 0x30]
push edi
call fcn.004081d4
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x30]
call fcn.0040d5c6
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00408944
call fcn.00441735
ret
Function at 0x422b13
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.004505f0
mov eax, dword [0x47e180]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2898], 0
push esi
lea eax, [ebp - 0x2898]
push eax
lea eax, [ebp - 0x2894]
push eax
mov esi, ecx
mov dword [ebp - 0x2898], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea eax, [ebp - 0x2894]
mov ecx, dword [eax + 0x1a0]
cmp ecx, 6
je 0x422b93
cmp ecx, 0x47
je 0x422b93
mov eax, dword [eax]
test eax, eax
jne 0x422b57
and dword [ebp - 0x14], eax
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push dword [ebp - 0x14]
push str._08X
call fcn.004244cd
pop ecx
pop ecx
pop edi
jmp 0x422be0
movzx ecx, byte [eax + 0x19b]
push ecx
movzx ecx, byte [eax + 0x19a]
push ecx
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
call fcn.004244cd
add esp, 0x24
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043d7ed
leave
ret

Function at 0x423825
Capabilities:
Get file version info

Disassembly:
push 0x48
mov eax, 0x4575d9
call fcn.004416b2
mov esi, edi
mov ebx, ecx
call fcn.0042373e
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407413
xor esi, esi
mov dword [ebp - 4], esi
lea ebx, [ebp - 0x2c]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
call fcn.0043839e
cmp dword [eax + 0x18], 8
jb 0x423864
mov eax, dword [eax + 4]
jmp 0x423867
add eax, 4
lea ecx, [ebp - 0x38]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
push esi
push 1
lea esi, [ebp - 0x54]
mov dword [ebp - 0x30], eax
call fcn.00408944
cmp dword [ebp - 0x30], 0
je 0x42392c
push dword [ebp - 0x30]
call fcn.0043ccc4
pop ecx
lea ebx, [ebp - 0x2c]
lea ecx, [ebp - 0x54]
mov dword [edi + 4], eax
call fcn.0043839e
cmp dword [eax + 0x18], 8
jb 0x4238ab
mov eax, dword [eax + 4]
jmp 0x4238ae
add eax, 4
push dword [edi + 4]
push dword [ebp - 0x30]
push dword [ebp - 0x38]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 1
lea esi, [ebp - 0x54]
mov ebx, eax
call fcn.00408944
test ebx, ebx
je 0x42392c
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
lea eax, [edi + 0x10]
push eax
push 0x4628b0
push dword [edi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42392c
lea eax, [ebp - 0x30]
push eax
lea esi, [edi + 8]
push esi
push 0x468dd4
push dword [edi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x423923
mov eax, dword [ebp - 0x30]
cmp eax, 4
jb 0x423923
shr eax, 2
mov dword [edi + 0xc], eax
mov eax, dword [esi]
mov cx, word [eax]
mov word [edi], cx
mov ax, word [eax + 2]
mov word [edi + 2], ax
mov dword [ebp - 0x34], 1
jmp 0x42393e
mov eax, dword [edi + 4]
test eax, eax
je 0x42393e
push eax
call fcn.0043dba9
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040860c
mov eax, dword [ebp - 0x34]
call fcn.00441735
ret
Function at 0x424e59
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x47e180]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x4887d0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x424e9b
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x4887d4
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0043d7ed
mov esp, ebp
pop ebp
ret

Function at 0x42505c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4887bc
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x4250a4
call dword [sym.imp.KERNEL32.dll_TerminateThread]
leave
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x4250bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
mov dword [esp + 8], eax
mov dword [esi + 4], eax
cmp eax, edi
jne 0x425114
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.0040fc65
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.entry_event
call fcn.00424d00
pop ecx
push edi
push edi
push 1
push edi
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], edi
jne 0x42515c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.0040fc65
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.exit_event
call fcn.00424d00
pop ecx
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x4251f2
push edi
push edi
mov dword [esp + 0x2c], edi
call fcn.0044007e
add esp, 0x18
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x4251ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [esp + 8], edi
je 0x42519f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
cmp ebx, edi
je 0x4251ad
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.0040fc65
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread
call fcn.00424d00
pop ecx
cmp dword [esp + 8], edi
je 0x4251ea
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4259b8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
mov esi, eax
je 0x425a7d
cmp byte [ebp + 0x10], 0
je 0x425a01
mov edi, dword [ebp + 0xc]
test byte [edi], 8
je 0x425a01
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 6], ax
call fcn.0040fc65
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov eax, edi
call fcn.00425e30
pop ecx
pop ecx
mov edi, dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
call edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
call ebx
push eax
call fcn.0042bd38
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x425a7d
call fcn.0040fc65
cmp dword [esi + 4], eax
jne 0x425a36
cmp dword [esi], 0x2733
je 0x425a48
call fcn.0040fc65
cmp dword [esi + 4], eax
jne 0x425a77
cmp dword [esi], 0x4d5
jne 0x425a77
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
and byte [eax], 0xfc
push 0
call edi
push dword [ebp + 8]
call ebx
push eax
call fcn.0042bd38
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x425a89
xor edi, edi
call fcn.0040fc65
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425a91
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, eax
cmp ebx, 0xffffffff
jne 0x425aa7
mov edi, 0x2719
jmp 0x425ac8
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
push eax
call fcn.0042bd38
pop ecx
test eax, eax
jne 0x425ad2
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], edi
mov edi, 0x2734
call fcn.0040fc65
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.00424ce1
test al, al
je 0x425b0a
dec edi
call fcn.0040fc65
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.00424ce1
test al, al
jne 0x425b45
mov eax, esi
mov ecx, ebx
call fcn.00425ff8
test eax, eax
jl 0x425b45
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], 4
call fcn.00425e93
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x425b45
call fcn.0040fc65
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x425f04
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x425f2d
mov edi, 0x2719
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x425f79
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0042bd38
mov edi, eax
pop ecx
cmp edi, ebx
je 0x425f6d
jle 0x425f77
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425f7e
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x425fa7
mov edi, 0x2719
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x425ff3
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0042bd38
mov edi, eax
pop ecx
cmp edi, ebx
je 0x425fe7
jle 0x425ff1
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425ff8
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x426020
mov edi, 0x2719
call fcn.0040fc65
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42607a
xor eax, eax
inc eax
push 0
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0042bd38
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jl 0x426077
xor edi, edi
call fcn.0040fc65
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x42a792
Capabilities:
Resolve dns

Disassembly:
push 0x64
mov eax, 0x45be46
call fcn.00441649
mov edi, ecx
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.0042b200
mov esi, eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
call fcn.0042b1e5
cmp dword [esi + 0x18], 0x10
jb 0x42a7d4
mov ecx, dword [esi + 4]
jmp 0x42a7d7
lea ecx, [esi + 4]
cmp dword [eax + 0x18], 0x10
jb 0x42a7e2
mov esi, dword [eax + 4]
jmp 0x42a7e5
lea esi, [eax + 4]
mov dword [ebp - 0x1c], ecx
cmp esi, ebx
je 0x42a7f1
cmp byte [esi], 0
jne 0x42a7f3
xor esi, esi
cmp ecx, ebx
je 0x42a7fc
cmp byte [ecx], 0
jne 0x42a7ff
mov dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
lea esi, [ebp - 0x20]
call fcn.0042607e
mov ecx, dword [eax]
mov dword [edi], ecx
mov eax, dword [eax + 4]
push ebx
push 1
lea ecx, [ebp - 0x54]
mov dword [edi + 4], eax
call fcn.0040860c
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.0040860c
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push 2
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
neg eax
sbb eax, eax
test eax, fcn.0040bb1e
je 0x42a875
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 1
jmp 0x42a8c2
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0042b200
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
call fcn.0042b1e5
mov dword [ebp - 4], 5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
mov edx, edi
mov ecx, eax
mov dword [ebp - 0x14], 6
call fcn.0042b21b
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xe
xor edi, edi
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0042961d
or dword [ebp - 0x14], 0x10
test byte [ebp - 0x14], 8
je 0x42a8e2
and dword [ebp - 0x14], 0xfffffff7
lea eax, [ebp - 0x34]
call fcn.004018de
test byte [ebp - 0x14], 4
je 0x42a8f7
and dword [ebp - 0x14], 0xfffffffb
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.0040860c
test byte [ebp - 0x14], bl
je 0x42a90b
and dword [ebp - 0x14], 0xfffffffd
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.0040860c
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x42a920
and dword [ebp - 0x14], 0xfffffffe
lea eax, [ebp - 0x28]
call fcn.004018de
cmp esi, edi
je 0x42a92b
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp + 8]
call fcn.00441721
ret 8
Function at 0x435ff2
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x14
mov eax, 0x45bdb7
call fcn.0044167c
mov esi, dword [ebp + 0x14]
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x436012
mov eax, dword [edi]
jmp 0x436014
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43607c
cmp dword [esi + 0x18], 8
jb 0x436029
mov eax, dword [edi]
jmp 0x43602b
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43607c
lea eax, [ebp - 0x14]
push eax
call fcn.004208eb
pop ecx
mov byte [ebp - 4], 1
cmp dword [esi + 0x18], 8
mov ebx, dword [eax]
jb 0x436055
mov edi, dword [edi]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
push ebx
push edi
push str.Failed_to_delete_fileName__S_:__S
mov esi, eax
call fcn.004081d4
add esp, 0xc
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0040d5c6
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x43608c
mov eax, dword [esi]
jmp 0x43608e
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4360f6
cmp dword [ebx + 0x18], 8
jb 0x4360a3
mov eax, dword [esi]
jmp 0x4360a5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4360f6
lea eax, [ebp - 0x18]
push eax
call fcn.004208eb
pop ecx
mov byte [ebp - 4], 2
cmp dword [ebx + 0x18], 8
mov edi, dword [eax]
jb 0x4360cf
mov esi, dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
push edi
push esi
push str.Failed_to_delete_path__S_:__S
mov esi, eax
call fcn.004081d4
add esp, 0xc
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0040d5c6
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx + 4], al
push 0
sete al
push str.SoftwareRobloxRegETags
add eax, 0x80000001
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00420a27
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp dword [eax + 0x18], 8
jb 0x436128
mov eax, dword [eax + 4]
jmp 0x43612b
add eax, 4
push 1
push 0x46471c
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040bbb4
cmp dword [ebp - 0x20], 0
je 0x43614b
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00441721
ret 0x10
Function at 0x4365c1
Capabilities:
Allocate thread local storage

Disassembly:
push 0x5c
mov eax, 0x457202
call fcn.004416b2
xor ebx, ebx
mov dword [ebp - 0x68], 0xc15730e2
mov dword [ebp - 0x64], 0x7f0725e3
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x58], bl
mov eax, dword [0x488604]
cmp eax, dword [ebp - 0x68]
je 0x43670f
mov edi, 0x488604
mov ecx, dword [ebp - 0x64]
mov edx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
cmp eax, ebx
je 0x436672
cmp byte [ebp - 0x60], bl
jne 0x436658
xor ecx, ecx
mov eax, 0x488608
inc ecx
lock xadd dword [eax], ecx
mov eax, dword [0x488604]
mov byte [ebp - 0x60], 1
cmp eax, dword [ebp - 0x68]
je 0x43670f
cmp dword [ebp - 0x5c], ebx
jne 0x436658
cmp byte [ebp - 0x58], bl
jne 0x43663f
lea ebx, [ebp - 0x58]
call fcn.00436568
xor ebx, ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
lea esi, [ebp - 0x5c]
call fcn.0040ff5e
jmp 0x436663
push 0xffffffffffffffff
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x488604]
cmp eax, dword [ebp - 0x68]
jne 0x4365f9
jmp 0x43670f
cmp dword [ebp - 0x5c], ebx
jne 0x4366a4
cmp byte [ebp - 0x58], bl
jne 0x436686
lea ebx, [ebp - 0x58]
call fcn.00436568
xor ebx, ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
lea esi, [ebp - 0x5c]
call fcn.0040ff5e
cmp dword [ebp - 0x5c], ebx
je 0x4366ad
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.0043694a
cmp byte [ebp - 0x60], bl
jne 0x4366c7
xor ecx, ecx
mov eax, 0x488608
inc ecx
lock xadd dword [eax], ecx
mov byte [ebp - 0x60], 1
mov eax, dword [ebp - 0x68]
xchg dword [edi], eax
cmp dword [ebp - 0x5c], ebx
jne 0x436706
mov eax, dword [0x488608]
cmp eax, 1
jle 0x436701
cmp byte [ebp - 0x58], bl
jne 0x4366ea
lea ebx, [ebp - 0x58]
call fcn.00436568
xor ebx, ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
lea esi, [ebp - 0x5c]
call fcn.0040ff5e
cmp dword [ebp - 0x5c], ebx
je 0x43670f
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x5c]
call fcn.0040ff7b
call fcn.00441735
ret