joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430570
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x63a188]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x324]
push edi
mov edi, dword [ebp + 0xc]
push 0x190
push 0
push eax
call fcn.0044e770
mov ebx, 0xc8
lea eax, [ebp - 0xcc]
push ebx
push 0
push eax
call fcn.0044e770
push ebx
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.0044e770
push edi
push esi
lea eax, [ebp - 0x194]
push 0x5b3e78
push eax
call fcn.00408530
push esi
lea eax, [ebp - 0x324]
push str.SOFTWARE_sCapabilitiesFileAssociations
push eax
call fcn.00408530
add esp, 0x40
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0045c434
lea eax, [ebp - 0xcc]
push 0x5b1258
push eax
call fcn.0045c3c3
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.0045c3c3
add esp, 0x18
lea eax, [ebp - 0xcc]
mov esi, reloc.WS2_32.dll_bind
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x194]
push eax
call fcn.0045c456
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push edi
lea eax, [ebp - 0x324]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004315db
mov esp, ebp
pop ebp
ret 8

Function at 0x43075c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x63a188]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.0044e770
add esp, 0xc
mov dword [ebp - 0x218], 0x114
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x214], 6
jb 0x430821
lea eax, [ebp - 0x21c]
push eax
push 0x5b2f5c
push 3
push esi
push 0x5b2f7c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x430821
lea eax, [ebp - 0x104]
mov dword [ebp - 0x220], esi
push 0x5b12b8
push eax
call fcn.0045c434
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x220]
pop ecx
pop ecx
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push 1
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x220], esi
jne 0x430815
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x104]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push esi
push 0x3003
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004315db
mov esp, ebp
pop ebp
ret
Function at 0x432905
Capabilities:
Read .ini file

Disassembly:
push 0x864
mov eax, 0x5ad5b7
call fcn.00431b4a
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00438dce
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x858]
call fcn.00409960
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.0044e770
lea ecx, [ebx + 0xd4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x43296f
mov ecx, dword [ecx]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x810]
push 0x400
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp word [ebp - 0x810], ax
je 0x4329c9
lea eax, [ebp - 0x810]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00408220
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x840]
call fcn.0042e700
test eax, eax
jne 0x432a39
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, ebx
cmovae eax, dword [ebp - 0x828]
push eax
push edi
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.00432b31
push eax
lea ecx, [ebp - 0x858]
call fcn.00409b60
xor ebx, ebx
lea ecx, [ebp - 0x870]
push ebx
push 1
call fcn.0042c46b
jmp 0x432a50
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x840]
push ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.00408100
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.00455325
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.0042c46b
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.0042c46b
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.0042c46b
mov eax, esi
call fcn.00431af4
ret 0xc
Function at 0x432b85
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5ad5ea
call fcn.00431b4a
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x432bb0
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x432c8e
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5b0700
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00408220
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.0044e770
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5b1034
push eax
call fcn.00408530
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x432c43
call fcn.00432aa1
jmp 0x432c48
call fcn.00432b5b
push eax
lea ecx, [ebp - 0x828]
call fcn.00409b60
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0042c46b
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00455325
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0042c46b
mov eax, esi
call fcn.00431af4
ret 0xc

Function at 0x432c98
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5ad634
call fcn.00431b4a
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.0044e770
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x432cf5
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00409990
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x432d3b
mov eax, dword [esi]
jmp 0x432d3d
mov eax, esi
push ebx
push eax
call fcn.0045c3f4
pop ecx
pop ecx
test eax, eax
jne 0x432d89
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x432d6d
call fcn.00432aa1
jmp 0x432d72
call fcn.00432b5b
push eax
mov ecx, esi
call fcn.00409b60
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0042c46b
mov eax, esi
call fcn.00431af4
ret 0x10
Function at 0x433918
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x63a188]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0044e770
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x433951
mov eax, dword [eax]
push str.conf
push eax
lea eax, [ebp - 0x20c]
push 0x5b572c
push eax
call fcn.00408530
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433989
lea eax, [ebp - 0x20c]
push eax
call fcn.0043bb80
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0044e770
push str.vstginf.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5b3e78
push eax
call fcn.00408530
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x4339c8
mov eax, esi
jmp 0x4339d5
lea eax, [ebp - 0x414]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00408220
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0044e770
push str.userCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5b3e78
push eax
call fcn.00408530
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x433a27
mov eax, esi
jmp 0x433a34
lea eax, [ebp - 0x61c]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00408220
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0044e770
lea eax, [ebp - 0xa44]
push str.BDRoad
push eax
call fcn.0043cbd4
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x433a75
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5b2624
push eax
call fcn.00408530
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.0042c46b
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433ab6
lea eax, [ebp - 0x824]
push eax
call fcn.0043bb80
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.0044e770
push str.userCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5b3e78
push eax
call fcn.00408530
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x433b00
lea eax, [ebp - 0xa2c]
push eax
call fcn.0045c456
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00408220
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004315db
mov esp, ebp
pop ebp
ret
Function at 0x434163
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5ad72e
call fcn.00431b4a
mov ebx, ecx
call fcn.0043288a
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.0042c529
mov esi, str.ZhiNengZip.ini
push esi
call fcn.0045c456
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407da0
push str.zhinengysgf
push 0x5b5794
push str.Intgsftinf
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00432c98
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00409b60
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0042c46b
push str.zhinengysgf
mov ecx, esi
call fcn.004347c1
test eax, eax
jne 0x434252
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0044e770
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x434203
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.zhinengysgf
push eax
push edi
push 0x5b5794
push str.Intgsftinf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x434234
xor eax, eax
jmp 0x434241
lea eax, [ebp - 0x218]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00408220
jmp 0x434257
mov edi, str.zhinengysgf
push edi
mov ecx, esi
call fcn.004347c1
test eax, eax
jne 0x43431a
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0044e770
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00409960
and dword [ebp - 4], 0
push str.ZhiNengZip.ini
call fcn.0045c456
pop ecx
push eax
push str.ZhiNengZip.ini
lea ecx, [ebp - 0x230]
call fcn.00407da0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5b5794
push str.Intgsftinf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x4342eb
xor eax, eax
jmp 0x4342f8
lea eax, [ebp - 0x218]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00408220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.0042c46b
push edi
mov ecx, esi
call fcn.004347c1
test eax, eax
jne 0x434356
push edi
push 0x5b5794
push str.Intgsftinf
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00432b31
push eax
mov ecx, esi
call fcn.00409b60
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0042c46b
call fcn.00431af4
ret
Function at 0x434d7b
Capabilities:
Enumerate processes

Disassembly:
push 0x284
mov eax, 0x5ad766
call fcn.00431b4a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x434f2e
push eax
lea ecx, [ebp - 0x40]
call fcn.00409990
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0043ac43
mov dword [esp], 0x22c
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.0044e770
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x290], edi
cmp edi, 0xffffffff
je 0x434f1e
call fcn.00435997
test al, al
je 0x434e0e
pop ebx
pop ecx
pop esi
push esp
push ebx
push edi
push eax
pop esp
push ecx
push edi
push ebx
pop esp
push edi
push edx
push esi
pop eax
pop ebx
pop ebx
push eax
pop edi
mov ebx, dword [ebp - 0x28c]
mov edi, dword [ebp - 0x290]
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x434ee6
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x434e51
lea eax, [ebp - 0x260]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0043ac43
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042e700
test eax, eax
je 0x434ea5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00442f67
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.0042e700
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x434eac
mov byte [ebp - 0x285], 1
test bl, 1
je 0x434ec0
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.0042c46b
cmp byte [ebp - 0x285], 0
jne 0x434f34
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0042c46b
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x434e2a
call fcn.0043558c
test al, al
je 0x434f17
push ecx
push edi
push ebp
push ebx
pop ebx
pop ebp
pop ecx
push edi
push ecx
pop esi
push esp
pop edx
push edi
push ebp
pop ebp
push ebx
pop ebp
pop esi
push ebp
pop ebx
push ecx
push esp
pop ecx
push ebx
push ebx
pop esi
pop esi
pop edx
pop ebx
push ebx
pop ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0042c46b
mov eax, esi
call fcn.00431af4
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0042c46b
jmp 0x434f20
Function at 0x4352c4
Capabilities:
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x5ad7b9
call fcn.00431b4a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
and dword [ebp - 0x270], 0
push 0x22c
push 0
push eax
call fcn.0044e770
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.00409990
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0043ac43
pop ecx
call fcn.00435997
test al, al
je 0x435325
pop esi
push esi
pop ebx
push ebx
push ecx
push ecx
push esi
pop eax
push eax
pop esi
push esi
push esp
push esp
pop edx
pop eax
pop eax
push ebx
pop esi
call fcn.00435af0
test al, al
je 0x435349
pop edx
push edx
pop ebx
push edi
push ebp
pop edi
push ebp
push edx
push eax
pop esi
push esp
pop ebp
push esi
pop ebx
push esi
pop ebp
push edx
push esp
push eax
pop edx
pop eax
pop edi
pop eax
pop ecx
push esp
pop ecx
pop esp
call fcn.004357f9
test al, al
je 0x435365
pop eax
pop ebp
pop edi
push eax
push edx
pop ebp
pop ebx
pop esi
pop esi
pop ecx
push eax
push ecx
push edx
pop ebp
pop edx
push edx
pop ebx
pop edi
push ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x435380
xor ebx, ebx
jmp 0x43546d
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x435453
call fcn.00435af0
test al, al
je 0x4353b5
push ecx
push ecx
pop ebp
pop esi
push edi
pop ecx
pop ebx
pop eax
pop ebx
push edi
push edi
push ecx
pop esi
pop ecx
pop edi
pop edi
call fcn.00435b35
test al, al
je 0x4353dc
push ebp
push ecx
pop eax
push eax
pop edx
push esp
pop esp
pop ebp
pop esp
push esi
pop edi
pop edi
pop eax
pop ebp
push edi
pop eax
pop ecx
pop ecx
push ecx
pop esi
push esp
pop edi
pop esi
pop ebp
pop esi
pop edx
pop esi
pop esi
pop ebx
pop esi
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x435403
lea eax, [ebp - 0x248]
push eax
call fcn.0045c456
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0043ac43
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042e700
lea ecx, [ebp - 0x28]
push 0
push 1
test eax, eax
je 0x435481
mov byte [ebp - 4], 0
call fcn.0042c46b
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43539c
mov ebx, dword [ebp - 0x270]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0042c46b
mov eax, ebx
call fcn.00431af4
ret
xor ebx, ebx
inc ebx
call fcn.0042c46b
jmp 0x435461
Function at 0x43548b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00434d7b
mov dword [ebp - 4], eax
pop ecx
test eax, eax
jg 0x4354aa
xor eax, eax
jmp 0x435540
call fcn.0043590d
test al, al
je 0x4354d3
push ebx
push ebx
push esi
pop edi
push ebx
pop edx
pop ebx
pop edx
pop ebp
push ecx
pop esp
pop esi
push ebx
push esp
push esi
pop edx
pop ecx
push esi
push ebx
pop esp
push edi
push ecx
push esp
pop ecx
pop ebp
push edi
pop esp
push esi
push edi
pop esp
pop esi
pop ebp
push dword [ebp - 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
test eax, eax
je 0x4354a3
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
call fcn.00435af0
test al, al
je 0x43550d
push ecx
push ecx
pop ebp
pop esi
push edi
pop ecx
pop ebx
pop eax
pop ebx
push edi
push edi
push ecx
pop esi
pop ecx
pop edi
pop edi
call fcn.00435b35
test al, al
je 0x435534
push ebp
push ecx
pop eax
push eax
pop edx
push esp
pop esp
pop ebp
pop esp
push esi
pop edi
pop edi
pop eax
pop ebp
push edi
pop eax
pop ecx
pop ecx
push ecx
pop esi
push esp
pop edi
pop esi
pop ebp
pop esi
pop edx
pop esi
pop esi
pop ebx
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435ed8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and dword [ebp - 4], 0
call fcn.00471e00
mov edi, eax
test edi, edi
je 0x435f18
push 0x5b5bdc
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0045b1d0
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x435f22
push edi
call fcn.00471dc0
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x2a
push edi
call fcn.00471e60
push dword [ebp + 8]
push 0x2712
push edi
call fcn.00471e60
push 1
push 0x34
push edi
mov esi, eax
call fcn.00471e60
push 0x1e
push 0xd
push edi
call fcn.00471e60
push 1
push 0x63
push edi
call fcn.00471e60
push 0x493e0
push 0x9b
push edi
call fcn.00471e60
add esp, 0x48
test esi, esi
je 0x435f83
push dword [ebp - 4]
call fcn.0045afa0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x435f11
push 0x436829
push 0x4e2b
push edi
call fcn.00471e60
add esp, 0xc
test eax, eax
jne 0x435f71
push eax
push 0x40
push edi
call fcn.00471e60
push 0
push 0x51
push edi
call fcn.00471e60
push dword [ebp - 4]
push 0x2711
push edi
call fcn.00471e60
add esp, 0x24
test eax, eax
jne 0x435f71
push edi
call fcn.00471e40
mov esi, eax
pop ecx
test esi, esi
je 0x436002
push dword [ebp - 4]
call fcn.0045afa0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.004723c0
pop ecx
push eax
push str.curl_easy_perform___failed:__s_n
push 2
call fcn.0045aea6
pop ecx
push eax
call fcn.004233c0
add esp, 0xc
or esi, 0xffffffff
jmp 0x436033
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x200002
push edi
call fcn.00471de0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x436027
cmp dword [ebp - 8], 0xc8
je 0x43602a
push 0x16
pop esi
push dword [ebp - 4]
call fcn.0045afa0
pop ecx
push edi
call fcn.00471dc0
pop ecx
mov eax, esi
jmp 0x435f1b
Function at 0x43833b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x43846a
call fcn.00435997
test al, al
je 0x438385
pop esi
push esi
pop ebx
push ebx
push ecx
push ecx
push esi
pop eax
push eax
pop esi
push esi
push esp
push esp
pop edx
pop eax
pop eax
push ebx
pop esi
call fcn.00435af0
test al, al
je 0x4383a9
pop edx
push edx
pop ebx
push edi
push ebp
pop edi
push ebp
push edx
push eax
pop esi
push esp
pop ebp
push esi
pop ebx
push esi
pop ebp
push edx
push esp
push eax
pop edx
pop eax
pop edi
pop eax
pop ecx
push esp
pop ecx
pop esp
call fcn.004357f9
test al, al
je 0x4383c5
pop eax
pop ebp
pop edi
push eax
push edx
pop ebp
pop ebx
pop esi
pop esi
pop ecx
push eax
push ecx
push edx
pop ebp
pop edx
push edx
pop ebx
pop edi
push ecx
mov esi, dword [ebp - 8]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00435997
test al, al
je 0x43840d
pop esp
push edi
push esi
push edi
push edx
push ecx
pop esp
push edi
push edi
pop ecx
push edx
pop edi
push eax
push ecx
pop edi
pop eax
pop edx
push edi
push esi
push eax
pop eax
pop ebp
pop esi
push ebp
pop ecx
pop edx
push ebx
call fcn.0043590d
test al, al
je 0x438431
pop edx
push ebp
pop ebp
pop edi
push ecx
push edx
pop edi
pop eax
push esp
push esp
pop esp
push edx
push ecx
push ebx
push ecx
pop esi
pop edi
push esp
pop ebx
pop eax
push ecx
pop edx
pop edx
push eax
pop edi
pop esp
pop esi
call fcn.0043558c
test al, al
je 0x438457
pop ebx
pop edx
push edx
push esp
pop esi
pop ebx
pop esp
push esi
push ebp
push esi
pop ebx
pop edi
push ebp
pop ebx
push edi
pop ebp
push ebp
push ecx
pop ecx
push ebx
push ebx
pop ecx
pop esp
push ebx
push esp
pop eax
pop ecx
push eax
pop ecx
cmp dword [ebp - 8], 0
je 0x43846a
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jne 0x43846a
xor eax, eax
inc eax
jmp 0x43846c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret