joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4260a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, dx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x42614f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42614f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x42614f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42614f
lea esi, [ebx + 1]
test esi, esi
js 0x426158
mov edi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [edi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, esi
or ecx, eax
jge 0x426115
push esi
mov ecx, edi
call fcn.0040a780
mov edx, dword [edi]
test edx, edx
je 0x426126
push ebx
push dword [ebp - 4]
push edx
call fcn.005a5500
add esp, 0xc
test esi, esi
js 0x426158
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x426158
push dword [ebp - 8]
mov dword [ecx - 0xc], esi
mov ecx, dword [edi]
mov byte [esi + ecx], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00405600
int3
Function at 0x427780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 0
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
call fcn.005a52f0
add esp, 0xc
lea ecx, [ebp - 0x220]
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push reloc.WS2_32.dll_bind
call fcn.00405670
mov edi, dword [ebp - 0x220]
test eax, eax
jne 0x427847
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x427847
mov eax, dword [ebp - 0x214]
cmp eax, 1
je 0x42782c
cmp eax, 2
jne 0x427847
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x427866
test al, 1
jne 0x427847
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x42786f
xor esi, esi
test edi, edi
je 0x427854
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00483ab6
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0x20c], ax
mov esi, 1
jmp 0x427849
Function at 0x42cbb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 1
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0xd], 0
je 0x42cd69
mov eax, dword [ebp + 0xc]
cmp eax, 0x18
ja 0x42cd1a
je 0x42ccfe
add eax, 0xfffffffe
cmp eax, 0xd
ja case.0x42cbfc.4
movzx eax, byte [eax + 0x42cd94]
jmp dword [eax*4 + 0x42cd80]
cmp dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x14]
jne 0x42cc27
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x42cc98
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
je 0x42cc98
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x42cc8b
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x42cc82
or al, 2
mov ecx, esi
push edi
mov byte [esi + 0x14], al
call fcn.0042ceb0
push 8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
cmp dword [esi + 0x18], ebx
je 0x42cc8b
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov ebx, 1
jmp 0x42cd69
cmp byte [esi + 0xc], 0
jne 0x42cd69
cmp byte [esi + 0x1c], 0
je 0x42cd69
push edi
call fcn.0042ceb0
mov byte [esi + 0x1c], 0
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov word [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], bl
je 0x42cd69
cmp dword [ebp + 0x10], 0
jne 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xf9
jmp 0x42cd69
sub eax, 0x1a
je 0x42cd4f
sub eax, 0x1fc
je 0x42cd69
sub eax, 0x1c
je 0x42cd2f
xor ebx, ebx
jmp 0x42cd69
cmp byte [esi + 0xc], 0
je 0x42cd41
push edi
call fcn.0042ce40
mov byte [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], 2
je 0x42cd69
push edi
call fcn.0042ceb0
jmp 0x42cd69
mov eax, dword [ebp + 0x10]
cmp eax, 0x2f
je case.0x42cbfc.3
cmp eax, 0x18
je case.0x42cbfc.3
test eax, eax
jne 0x42cd69
sub esp, 8
push edi
call fcn.0042cdb0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42cc03
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 1
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0xd], 0
je 0x42cd69
mov eax, dword [ebp + 0xc]
cmp eax, 0x18
ja 0x42cd1a
je 0x42ccfe
add eax, 0xfffffffe
cmp eax, 0xd
ja case.0x42cbfc.4
movzx eax, byte [eax + 0x42cd94]
jmp dword [eax*4 + 0x42cd80]
cmp dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x14]
jne 0x42cc27
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x42cc98
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
je 0x42cc98
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x42cc8b
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x42cc82
or al, 2
mov ecx, esi
push edi
mov byte [esi + 0x14], al
call fcn.0042ceb0
push 8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
cmp dword [esi + 0x18], ebx
je 0x42cc8b
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov ebx, 1
jmp 0x42cd69
cmp byte [esi + 0xc], 0
jne 0x42cd69
cmp byte [esi + 0x1c], 0
je 0x42cd69
push edi
call fcn.0042ceb0
mov byte [esi + 0x1c], 0
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov word [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], bl
je 0x42cd69
cmp dword [ebp + 0x10], 0
jne 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xf9
jmp 0x42cd69
sub eax, 0x1a
je 0x42cd4f
sub eax, 0x1fc
je 0x42cd69
sub eax, 0x1c
je 0x42cd2f
xor ebx, ebx
jmp 0x42cd69
cmp byte [esi + 0xc], 0
je 0x42cd41
push edi
call fcn.0042ce40
mov byte [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], 2
je 0x42cd69
push edi
call fcn.0042ceb0
jmp 0x42cd69
mov eax, dword [ebp + 0x10]
cmp eax, 0x2f
je case.0x42cbfc.3
cmp eax, 0x18
je case.0x42cbfc.3
test eax, eax
jne 0x42cd69
sub esp, 8
push edi
call fcn.0042cdb0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42ccd4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 1
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0xd], 0
je 0x42cd69
mov eax, dword [ebp + 0xc]
cmp eax, 0x18
ja 0x42cd1a
je 0x42ccfe
add eax, 0xfffffffe
cmp eax, 0xd
ja case.0x42cbfc.4
movzx eax, byte [eax + 0x42cd94]
jmp dword [eax*4 + 0x42cd80]
cmp dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x14]
jne 0x42cc27
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x42cc98
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
je 0x42cc98
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x42cc8b
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x42cc82
or al, 2
mov ecx, esi
push edi
mov byte [esi + 0x14], al
call fcn.0042ceb0
push 8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
cmp dword [esi + 0x18], ebx
je 0x42cc8b
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], ebx
mov ebx, 1
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov ebx, 1
jmp 0x42cd69
cmp byte [esi + 0xc], 0
jne 0x42cd69
cmp byte [esi + 0x1c], 0
je 0x42cd69
push edi
call fcn.0042ceb0
mov byte [esi + 0x1c], 0
jmp 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov word [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], bl
je 0x42cd69
cmp dword [ebp + 0x10], 0
jne 0x42cd69
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xf9
jmp 0x42cd69
sub eax, 0x1a
je 0x42cd4f
sub eax, 0x1fc
je 0x42cd69
sub eax, 0x1c
je 0x42cd2f
xor ebx, ebx
jmp 0x42cd69
cmp byte [esi + 0xc], 0
je 0x42cd41
push edi
call fcn.0042ce40
mov byte [esi + 0xc], 0
jmp 0x42cd69
test byte [esi + 0x14], 2
je 0x42cd69
push edi
call fcn.0042ceb0
jmp 0x42cd69
mov eax, dword [ebp + 0x10]
cmp eax, 0x2f
je case.0x42cbfc.3
cmp eax, 0x18
je case.0x42cbfc.3
test eax, eax
jne 0x42cd69
sub esp, 8
push edi
call fcn.0042cdb0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42cdb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0xc], 0
jne 0x42ce2b
test byte [esi + 0x14], 2
je 0x42ce2b
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
sub eax, edx
je 0x42ce1c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
je 0x42ce1c
sub edx, dword [esi + 0x10]
sub ecx, dword [esi + 0x10]
push 0x11
push 0
push 0
push edx
push ecx
push edi
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 0xc
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42ce40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x42cea3
and byte [esi + 0x14], 1
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x42ce78
mov cl, byte [esi + 0x14]
or cl, 4
mov byte [esi + 0x14], cl
test eax, 0x20000000
jne 0x42ce78
or cl, 2
mov byte [esi + 0x14], cl
test byte [esi + 0x14], 2
je 0x42ce98
push dword [ebp + 8]
mov ecx, esi
call fcn.0042ceb0
push 8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
Function at 0x42e040
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x65cadc]
test eax, eax
jne 0x42e168
push ebx
push 0x118
xor ebx, ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.005a52f0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42e0b2
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42e15f
mov eax, dword [ebp - 0x110]
sub eax, 1
je 0x42e14a
sub eax, 1
je 0x42e0cd
xor ebx, ebx
jmp 0x42e15f
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x42e116
mov eax, dword [ebp - 0x118]
cmp eax, 1
jne 0x42e0f0
xor ebx, ebx
cmp byte [ebp - 6], al
setne bl
add ebx, 8
jmp 0x42e15f
test eax, eax
jne 0x42e106
xor ebx, ebx
cmp byte [ebp - 6], 1
setne bl
lea ebx, [ebx*2 + 7]
jmp 0x42e15f
cmp eax, 2
jne 0x42e15f
cmp byte [ebp - 6], 1
jne 0x42e15f
lea ebx, [eax + 8]
jmp 0x42e15f
cmp eax, 5
jne 0x42e13e
mov eax, dword [ebp - 0x118]
cmp eax, 2
jne 0x42e12b
lea ebx, [eax + 3]
jmp 0x42e15f
cmp eax, 1
jne 0x42e135
lea ebx, [eax + 5]
jmp 0x42e15f
test eax, eax
jne 0x42e15f
lea ebx, [eax + 3]
jmp 0x42e15f
cmp eax, 4
ja 0x42e15f
mov ebx, 4
jmp 0x42e15f
mov eax, dword [ebp - 0x114]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb ebx, ebx
add ebx, 2
mov dword [0x65cadc], ebx
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483ab6
mov esp, ebp
pop ebp
ret
Function at 0x42f770
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d302d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x64c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor edx, edx
lea ecx, [ebp - 0x18]
call fcn.00407710
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b20
mov byte [ebp - 4], 1
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x42f93e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x635e28
push eax
call fcn.00408c40
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
add esp, 0xc
push 0x635b44
push esi
call fcn.0040caf0
push 0
push str.admin_type
mov ecx, edi
call fcn.0040f0e0
mov ebx, 0xffffffff
sub eax, 1
jne 0x42f82e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00430c20
mov edi, eax
test edi, edi
jne 0x42f8d0
lea eax, [ebp - 0x28]
push eax
call fcn.0042f950
push eax
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00408450
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
mov edi, dword [eax]
xor edx, edx
call fcn.00407710
push 5
push 0
push edi
push dword [ebp - 0x20]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x20]
cmp eax, 0x20
mov eax, ebx
setg byte [ebp - 0xd]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f890
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movzx edi, byte [ebp - 0xd]
mov eax, ebx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f8b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f8d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42f8eb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f909
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42f928
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00405600
int3
Function at 0x430150
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3195
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x64c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0044cce0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00409570
push ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.00409690
or esi, 0xffffffff
test eax, eax
je 0x430252
push ecx
push 0x6380a0
push 0x6380a8
lea ecx, [ebp - 0x24]
call fcn.0040a300
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b20
push ecx
push 0x6380b0
push 0x6380a8
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0040a300
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b20
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x43020d
test al, 0x10
jne 0x43020d
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
push 0
push 1
push 0
call fcn.0044b760
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430234
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430252
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
push dword [eax + 4]
lea eax, [ebp - 0x20]
push eax
mov ecx, eax
call fcn.0040aa70
push 0x1c
push dword [ebp - 0x20]
call fcn.00483ac4
mov edx, dword [ebp - 0x24]
add esp, 8
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43028e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4302ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d35cb
mov eax, dword fs:[0]
push eax
sub esp, 0x548
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004327d0
mov ecx, dword fs:[0x2c]
mov dword [ebp - 0x538], eax
mov esi, dword [ecx]
mov ecx, dword [0x65ccf8]
cmp ecx, dword [esi + 4]
jle 0x431f02
push 0x65ccf8
call fcn.00483c2d
add esp, 4
cmp dword [0x65ccf8], 0xffffffff
jne 0x431f02
push 0x5d7ea0
call fcn.00484084
add esp, 4
push 0x65ccf8
call fcn.00483be3
add esp, 4
call fcn.0044f160
test eax, eax
jne 0x431f9f
push eax
push 1
call fcn.00451de0
mov ecx, eax
call fcn.004523f0
mov eax, dword [0x65ccf8]
cmp eax, dword [esi + 4]
jle 0x431f5b
push 0x65ccf8
call fcn.00483c2d
add esp, 4
cmp dword [0x65ccf8], 0xffffffff
jne 0x431f5b
push 0x5d7ea0
call fcn.00484084
add esp, 4
push 0x65ccf8
call fcn.00483be3
add esp, 4
call fcn.0044f160
test eax, eax
jne 0x431f9a
call fcn.00450520
test eax, eax
je 0x432095
call fcn.00451de0
call fcn.00450f60
test eax, eax
je 0x43208b
call fcn.0044f3d0
test eax, eax
je 0x43208b
call fcn.0044ff30
call fcn.0043ee30
call fcn.00451de0
push str.pre_download
mov ecx, edi
call fcn.0040efd0
test eax, eax
setne bl
call fcn.00451de0
mov esi, dword [ebp - 0x538]
lea ecx, [ebp - 0x534]
push esi
push dword [ebp + 8]
call fcn.004818c0
push esi
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], 0
call fcn.00440780
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x538], 0
test eax, eax
je 0x432021
lea ecx, [ebp - 0x538]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x538], 0x103
je 0x43206c
push 0xc
call fcn.00483d03
add esp, 4
lea ecx, [ebp - 0x550]
mov dword [eax], ecx
push 0
push 0
push eax
push 0x43ed80
push 0
push 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0x440a30
call fcn.005b7d25
mov ecx, dword [ebp - 0x548]
add esp, 0x18
mov esi, eax
test ecx, ecx
je 0x432066
push ecx
call edi
mov dword [ebp - 0x548], esi
sub esp, 8
lea ecx, [ebp - 0x534]
call fcn.00433d50
mov esi, eax
test bl, bl
jne 0x4320c6
cmp esi, 1
jne 0x4320b1
push 0
push 2
jmp 0x4320ba
call fcn.00451de0
call fcn.00451de0
push 1
push 3
call fcn.00451de0
mov ecx, eax
call fcn.004523f0
call fcn.00451de0
mov eax, 2
jmp 0x432103
cmp esi, 3
je 0x4320c6
push 2
push 3
call fcn.00451de0
mov ecx, eax
call fcn.004523f0
lea ecx, [ebp - 0x544]
mov dword [ebp - method.ToolUpdDownloader.virtual_0], vtable.ToolUpdDownloader.0
call fcn.00440d90
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x548]
test eax, eax
je 0x4320f6
push eax
call edi
mov dword [ebp - 0x548], 0
lea ecx, [ebp - 0x534]
call fcn.00481c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00483ab6
mov esp, ebp
pop ebp
ret 4