joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x4033fc], eax
mov eax, dword [ebp + 4]
mov dword [0x40323a], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40323a]
mov dword [ebp - 0x48], eax
mov eax, 0x4016df
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40323a]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403448], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403448]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x40935a
Capabilities:
Move file

Disassembly:
mov eax, 0x431f20
call fcn.0041e75c
mov eax, 0x503c
call fcn.0041e830
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4048]
push edi
mov ebx, 0x800
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x40951b
cmp eax, ebx
jae 0x40951b
push ebx
lea eax, [ebp - 0x5048]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40951b
cmp eax, ebx
jae 0x40951b
lea eax, [ebp - 0x4048]
push eax
call fcn.0040be74
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x5048]
push eax
call fcn.0040be74
mov edi, eax
xor ebx, ebx
cmp word [edi], bx
je 0x40951b
push edi
push dword [ebp - 0x10]
call fcn.00411b9b
test eax, eax
je 0x40951b
push edi
push esi
call fcn.0040be74
push eax
call fcn.00411b9b
test eax, eax
jne 0x40951b
mov word [ebp - 0x1010], ax
mov edi, ebx
test ax, ax
jne 0x40947b
push 0x800
push esi
lea eax, [ebp - 0x1010]
push eax
call fcn.004101e2
push edi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.0040be74
push eax
call fcn.00404084
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.0040a201
test al, al
je 0x409460
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x409467
mov ax, word [ebp - 0x1010]
add edi, 0x7b
cmp edi, 0x2710
jl 0x40940e
test ax, ax
je 0x40951b
mov edi, 0x800
lea eax, [ebp - 0x3048]
push edi
push esi
push eax
call fcn.004101e2
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3048]
push eax
call fcn.0040beea
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x3048]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40951b
lea ecx, [ebp - 0x2048]
call fcn.0040952e
push esi
mov dword [ebp - 4], ebx
call fcn.0040a201
test al, al
jne 0x4094de
push 0x12
push esi
lea ecx, [ebp - 0x2048]
call fcn.0040963e
mov bl, al
lea eax, [ebp - 0x3048]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x40950c
lea ecx, [ebp - 0x2048]
call fcn.004095f0
lea ecx, [ebp - 0x2048]
call fcn.0040971e
lea ecx, [ebp - 0x2048]
call fcn.00409572
mov al, 1
jmp 0x40951d
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4098b0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1050
call fcn.0041e830
push ebx
mov ebx, dword [esp + 0x105c]
push ebp
push edi
mov edi, ecx
and dword [edi + 0x1034], 0
cmp byte [edi + 0x30], 0
jne 0x4098dc
test bl, 4
jne 0x4098dc
xor al, al
jmp 0x4098de
mov al, 1
push esi
mov esi, ebx
shr esi, 1
not esi
and esi, 1
inc esi
shl esi, 0x1e
test bl, 1
je 0x4098f7
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test al, al
je 0x409906
or ebx, 2
lea ecx, [esp + 0x18]
call fcn.00406ecb
cmp byte [edi + 0x24], 0
je 0x40991b
or esi, 0x100
push 0
push 0x8000000
push 3
push 0
push ebx
push esi
push dword [esp + 0x107c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40998b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push 0x800
push eax
push dword [esp + 0x106c]
call fcn.0040b6ec
test al, al
je 0x409998
push 0
push 0x8000000
push 3
push 0
push ebx
push esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x409993
mov dword [esp + 0x10], eax
jmp 0x409993
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
cmp ebp, 0xffffffff
jne 0x4099a9
cmp dword [esp + 0x10], 2
jne 0x4099a9
mov dword [edi + 0x1034], 1
cmp byte [edi + 0x24], 0
pop esi
je 0x4099cf
cmp ebp, 0xffffffff
je 0x4099cf
or dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
or dword [esp + 0x10], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x1c], al
mov dword [edi + 0x10], eax
setne bl
mov byte [edi + 0x15], al
je 0x4099fe
push 0x800
push dword [esp + 0x1064]
lea ecx, [edi + 0x32]
mov dword [edi + 8], ebp
push ecx
call fcn.004101e2
mov byte [edi + 0x25], 0
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x1050
ret 8
Function at 0x40b6ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041e830
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi], 0
je 0x40b86d
push esi
call fcn.0040b881
push esi
call fcn.00423483
pop ecx
push esi
mov edi, eax
call fcn.0040b8ac
test al, al
je 0x40b7a1
push esi
call fcn.0040b881
test al, al
je 0x40b75b
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x40b86d
push dword [ebp + 0x10]
push 0x4338ac
push dword [ebp + 0xc]
call fcn.004101e2
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.004101ba
mov al, 1
jmp 0x40b86f
push 0x5c
pop eax
cmp word [esi], ax
jne 0x40b86d
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x40b86d
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x40b86d
push esi
push 0x4338ac
push dword [ebp + 0xc]
call fcn.004101e2
push esi
push 0x4338b8
push dword [ebp + 0xc]
call fcn.004101ba
push esi
push ebx
jmp 0x40b74c
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40b86d
cmp eax, ebx
ja 0x40b86d
movzx eax, word [esi]
push eax
call fcn.0040b986
test al, al
je 0x40b80c
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x40b86d
push edi
push 0x4338ac
push dword [ebp + 0xc]
call fcn.004101e2
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004101ba
push edi
jmp 0x40b74b
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040b279
lea eax, [ebp - 0x1000]
push eax
call fcn.00423483
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x40b86d
push edi
push 0x4338ac
push dword [ebp + 0xc]
call fcn.004101e2
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.004101ba
cmp word [esi], 0x2e
jne 0x40b806
movzx eax, word [esi + 2]
push eax
call fcn.0040b986
test al, al
je 0x40b806
add esi, 4
jmp 0x40b806
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4062ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
pop ebx
push 2
movzx ecx, word [eax]
pop edx
push 0x22
pop esi
cmp cx, si
jne 0x4062d6
add eax, edx
movzx ecx, word [eax]
cmp cx, si
je 0x4062e9
test cx, cx
jne 0x4062c5
jmp 0x4062f3
cmp cx, bx
jbe 0x4062eb
add eax, edx
cmp word [eax], bx
ja 0x4062db
jmp 0x4062eb
cmp cx, bx
ja 0x4062f3
add eax, edx
movzx ecx, word [eax]
test cx, cx
jne 0x4062e4
xor esi, esi
push eax
mov dword [0x4bb754], esi
call fcn.00416c9f
mov edx, eax
and eax, 0x60
jne 0x406354
test dl, 8
je 0x406312
push 8
pop eax
jmp 0x406354
test edx, 0x1eee
jne 0x40631e
xor eax, eax
jmp 0x406354
push edi
xor edi, edi
mov ecx, esi
inc edi
shl edi, cl
test edi, 0x1eee
je 0x40633d
test edx, edi
je 0x40633d
mov eax, edx
sub eax, edi
test eax, 0x1eee
jne 0x406357
inc esi
cmp esi, ebx
jb 0x40631f
mov eax, edx
xor ecx, ecx
and eax, 0x104
cmp eax, 4
cmove edx, ecx
mov eax, edx
pop edi
pop esi
pop ebx
ret
xor eax, eax
jmp 0x406353

Function at 0x406988
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4bb754]
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
mov dword [0x4bf964], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4bf960], eax
test eax, eax
jne 0x4069ac
xor eax, eax
ret
mov edx, 0x9c9c
cmp dword [eax], edx
jne 0x4069a9
mov ecx, dword [eax + 4]
push esi
push edi
mov edi, 0x20001
lea esi, [edi - 1]
cmp ecx, esi
je 0x4069ce
cmp ecx, edi
jne 0x406a29
cmp ecx, esi
jne 0x4069d2
cmp dword [eax], edx
jne 0x406a29
cmp ecx, edi
jne 0x4069da
cmp dword [eax], edx
jne 0x406a29
cmp ecx, esi
jne 0x4069e2
cmp dword [eax], edx
jne 0x406a29
push edx
push eax
push 0x4bf96c
call fcn.0044ec08
add esp, 0xc
mov dword [0x4bf970], esi
cmp dword [0x4bf990], 0
je 0x406a29
cmp dword [0x4bf984], 0
je 0x406a29
cmp dword [0x4bf98c], 0
je 0x406a29
cmp dword [0x4bb748], 0
jne 0x406a24
cmp dword [0x4bf994], 0
je 0x406a29
xor eax, eax
inc eax
jmp 0x406a2b
xor eax, eax
pop edi
pop esi
ret
Function at 0x406cac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov dword [0x4ca178], ebx
mov dword [0x4bb96c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x2cd8
push ebx
push 0x4bcc88
mov dword [0x4bb964], eax
mov dword [0x4bb750], ebx
mov dword [0x4ca12c], ebx
call fcn.0044f154
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
push 0x4bcccc
call esi
call fcn.00406c30
test eax, eax
jne 0x406d1e
push 0x30303030
call fcn.0044b12a
jmp 0x406edf
push 0xa5a8
push ebx
push 0x4bf960
call fcn.0044f154
push 0x60
push ebx
push 0x4d01b0
call fcn.0044f154
push 0x224
push ebx
push 0x4c9f08
call fcn.0044f154
add esp, 0x24
push 0x4d01b8
call esi
push 0x4ca17c
call esi
push 0x4ca194
call esi
push 0x4bb6f8
call esi
mov esi, 0x800
push esi
push ebx
push 0x4bb978
call fcn.0044f154
push esi
push ebx
push 0x4bc178
call fcn.0044f154
push 0x70
push ebx
push 0x4bc978
call fcn.0044f154
push 0x70
push ebx
push 0x4bc9e8
call fcn.0044f154
add esp, 0x30
push 0x4c9ac0
call fcn.0041e978
push 0x4c9ad0
call fcn.0041e978
push 0x100
push 0x10
push 4
push 0x4bcc84
call fcn.0044b2a4
push ebx
push 0x4bcc60
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push str.imm32.dll
call fcn.0041f187
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b8268], eax
test eax, eax
je 0x406e1b
cmp eax, 0xffffffff
je 0x406e1b
push str.ImmDisableIME
push eax
call esi
mov dword [0x4ca2cc], eax
test eax, eax
jne 0x406e1b
push dword [0x4b8268]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4b8268], ebx
push 0x47caa8
call fcn.0041f187
mov dword [0x4b84e4], eax
test eax, eax
je 0x406ea4
cmp eax, 0xffffffff
je 0x406ea4
push str.CoInitializeSecurity
push eax
call esi
push 0x47cacc
push dword [0x4b84e4]
mov dword [0x4ca2d0], eax
call esi
push 0x47cae0
push dword [0x4b84e4]
mov dword [0x4ca2d4], eax
call esi
push 0x47caf0
push dword [0x4b84e4]
mov dword [0x4ca2d8], eax
call esi
mov dword [0x4ca2dc], eax
cmp dword [0x4ca2d0], ebx
je 0x406e92
cmp dword [0x4ca2d4], ebx
je 0x406e92
cmp dword [0x4ca2d8], ebx
je 0x406e92
test eax, eax
jne 0x406ea4
push dword [0x4b84e4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4b84e4], ebx
push 0x104
lea eax, [ebp - 0x20c]
mov dword [0x4bb710], ebx
push eax
push ebx
mov dword [0x4bb714], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406edf
lea eax, [ebp - 0x210]
push eax
push 0x4bb710
lea eax, [ebp - 0x20c]
push eax
call fcn.0041bf60
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d772
mov esp, ebp
pop ebp
ret
Function at 0x408f22
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
pop ebx
mov edi, dword [esi]
and edi, 7
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x408f4d
push str.OkToReportFromTheseQueues
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x408fac
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push str.OkToReportFromTheseQueues
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408f80
cmp eax, 2
jne 0x408fa2
mov eax, dword [esi]
and eax, 0x10000000
push eax
push edi
call fcn.0040b89f
jmp 0x408f83
mov eax, dword [ebp + 8]
or eax, edi
push ebx
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
push 0
push str.OkToReportFromTheseQueues
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x408fac
push 0x30303030
call fcn.0044b12a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408fb5
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x61c]
push 0x410
push ebx
push eax
mov dword [ebp - 0x620], ebx
call fcn.0044f154
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0044f154
mov edi, dword [ebp + 8]
add esp, 0x18
test edi, edi
jne 0x40901c
push 0x30303030
call fcn.0044b12a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044d772
mov esp, ebp
pop ebp
ret 8
call fcn.0040aa28
test eax, eax
je 0x40903f
cmp dword [ebp + 0xc], ebx
je 0x40903f
call fcn.0041e1d1
test eax, eax
je 0x40900a
push str.Persistent_run_key_is_set._r_n
call fcn.0041fda5
jmp 0x40900a
mov eax, dword [edi]
lea ecx, [ebp - 0x620]
push ebx
push ecx
push ebx
and eax, 0x10000000
push 0x2001f
neg eax
push ebx
push ebx
sbb eax, eax
push ebx
neg eax
add eax, 0x80000001
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x409082
call fcn.0041e1d1
test eax, eax
je 0x40900a
push str.Failed_to_create_run_reg_key_r_n
jmp 0x409038
cmp dword [ebp + 0xc], ebx
jne 0x40909d
push str.DWQueuedReporting
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40900a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40900a
push 0x5c
pop ecx
jmp 0x4090c5
test eax, eax
je 0x40900a
dec eax
cmp word [ebp + eax*2 - 0x20c], cx
jne 0x4090bd
add eax, eax
mov edx, 0x208
cmp eax, edx
jae 0x409144
push 0x74
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
lea eax, [ebp - 0x20c]
push str.dwtrig20.exe
push eax
push str.__s_s____c
push edx
lea eax, [ebp - 0x61c]
push eax
call fcn.004026a1
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call fcn.00401f4a
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push str.DWQueuedReporting
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40900a
jmp 0x409000
call fcn.0044dbcc
int3
Function at 0x40a5bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftPCHealthErrorReportingDW
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a5e6
xor eax, eax
jmp 0x40a616
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push dword [ebp + 8]
push esi
push esi
push str.LastQueuePesterTime
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa28
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40aa58
xor eax, eax
jmp 0x40aa85
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push str.DWPersistentQueuedReporting
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
jne 0x40aa85
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b3b1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
test dword [esi], 0x10000000
lea edi, [esi + 0xc]
je 0x40b417
push 0x104
push edi
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
inc ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b3ea
cmp eax, 0x104
jbe 0x40b444
call fcn.0041e1d1
test eax, eax
je 0x40b406
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_windows_folder_path_for_queue:__u_r_n
call fcn.0041f2fe
pop ecx
pop ecx
push 0x30303030
call fcn.0044b12a
xor eax, eax
jmp 0x40b57d
push 1
push 0x1c
push edi
push 0
mov dword [ebp + 8], SysStringLen
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40b444
call fcn.0041e1d1
test eax, eax
je 0x40b406
push str.Failed_to_get_folder_path_for_queue_r_n
call fcn.0041fda5
jmp 0x40b406
push 0x104
push edi
push str.PCHealthErrorRep_
call fcn.00430486
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push str.SoftwareMicrosoftPCHealthErrorReportingDW
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40b490
call fcn.0041e1d1
test eax, eax
je 0x40b48c
push str.Failed_to_open_reg_key_for_queue_r_n
call fcn.0041fda5
and dword [esi + 8], 0
mov eax, dword [esi]
and eax, 7
sub eax, 1
je 0x40b538
sub eax, 1
je 0x40b4fd
dec eax
sub eax, 1
je 0x40b4cd
call fcn.0041e1d1
test eax, eax
je 0x40b410
mov eax, dword [esi]
and eax, 7
push eax
push str.Failed_to_set_info__bad_queue_type:__u
call fcn.0041f2fe
pop ecx
pop ecx
jmp 0x40b410
push 0x104
push edi
push str.QHeadles
call fcn.00430486
cmp dword [0x4b83f0], 0
mov ecx, str.DWAdminQueueHeadless
push 0x32
pop eax
cmovne eax, dword [0x4b83f4]
mov dword [esi + 4], eax
mov eax, str.DWQueueHeadless
jmp 0x40b52b
push 0x104
push edi
push str.QSignoff
call fcn.00430486
cmp dword [0x4b83f0], 0
mov ecx, str.DWAdminQueueSignOff
push 0x32
pop eax
cmovne eax, dword [0x4b83f4]
mov dword [esi + 4], eax
mov eax, str.DWQueueSignOff
test ebx, ebx
cmovne eax, ecx
mov dword [esi + 0x218], eax
jmp 0x40b566
push 0x104
push edi
push str.QRegular
call fcn.00430486
cmp dword [0x4b83f0], 0
push 0x32
pop eax
cmovne eax, dword [0x4b83f4]
mov dword [esi + 4], eax
mov dword [esi + 0x218], str.DWQueueRegular
cmp dword [ebp + 0xc], 0
je 0x40b57a
push esi
call fcn.0040b586
test eax, eax
je 0x40b410
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b586
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xafc
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea ecx, [esi + 0x21c]
mov eax, dword [ecx]
test eax, eax
jne 0x40b5d9
push 5
push 5
push 0x44c
push ecx
call fcn.0044b2a4
test eax, eax
jne 0x40b5f6
call fcn.0041e1d1
test eax, eax
je 0x40b5d2
push str.OOM_Failed_to_alloc_queue_plex_r_n
call fcn.0041fda5
xor eax, eax
jmp 0x40b764
push dword [eax]
push edi
push eax
call fcn.0044b363
test eax, eax
jne 0x40b5f6
call fcn.0041e1d1
test eax, eax
je 0x40b5d2
push str.Failed_to_remove_all_items_from_plex_r_n
jmp 0x40b5cd
push esi
call fcn.0040a61d
test eax, eax
je 0x40b5d2
push ebx
mov ebx, 0x104
lea ecx, [ebp - 0x20c]
push ebx
lea eax, [esi + 0xc]
push ecx
push eax
call fcn.00406256
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x47d638
call fcn.00430486
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
jmp 0x40b73f
test dword [ebp - 0x8a8], 0xffffffef
je 0x40b723
push 0x44c
lea eax, [ebp - 0x658]
push edi
push eax
call fcn.0044f154
add esp, 0xc
lea eax, [ebp - 0x658]
push 0x104
push eax
lea eax, [esi + 0xc]
push eax
call fcn.00406256
push 0x104
lea eax, [ebp - 0x658]
push eax
push 0x47d358
call fcn.00430486
push 0x104
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x87c]
push eax
call fcn.00430486
push 0x104
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.0040a564
test eax, eax
jne 0x40b6d4
push 0x30303030
call fcn.0044b12a
jmp 0x40b73f
lea eax, [ebp - 0xaf8]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xafc], eax
cmp eax, 0xffffffff
je 0x40b71c
test dword [ebp - 0xaf8], 0xffffffef
je 0x40b71c
lea eax, [ebp - 0x658]
push eax
push dword [esi + 0x21c]
call fcn.0044b692
cmp eax, 0xffffffff
je 0x40b776
mov eax, dword [ebp - 0xafc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x8a8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40b73f
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or ebx, 0xffffffff
cmp ebx, 0xffffffff
jne 0x40b644
xor edi, edi
inc edi
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
test edi, edi
jne 0x40b762
push esi
call fcn.004097e1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044d772
mov esp, ebp
pop ebp
ret 4
call fcn.0041e1d1
test eax, eax
je 0x40b74b
push str.OOM_Failed_to_append_to_queue_plex_r_n
call fcn.0041fda5
jmp 0x40b74b
Function at 0x40b7fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.00420643
test eax, eax
je 0x40b814
xor eax, eax
inc eax
jmp 0x40b899
push esi
push edi
push 1
xor esi, esi
push esi
push 0x80
push 2
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00437054
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b854
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.0041e1d1
test eax, eax
je 0x40b890
push dword [ebp - 4]
push str.Failed_to_create_snt._GLE:__u_r_n
jmp 0x40b889
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x40b894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.0041e1d1
test eax, eax
je 0x40b890
push dword [ebp - 4]
push str.Failed_to_write_snt._GLE:__u_r_n
call fcn.0041f2fe
pop ecx
pop ecx
xor eax, eax
jmp 0x40b897
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40c414
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040e746
test eax, eax
je 0x40c475
push dword [0x4b831c]
call fcn.0041b604
test eax, eax
jne 0x40c470
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.0041e1d1
test eax, eax
je 0x40c454
push dword [0x4b831c]
push str.FReportToQueue:_File_Tree_Root_does_not_exist:__S_r_n
call fcn.0041f2fe
pop ecx
pop ecx
call fcn.0041e1d1
test eax, eax
je 0x40c46c
push dword [ebp - 4]
push str.FReportToQueue:_GetLastError_u_r_n
call fcn.0041f2fe
pop ecx
pop ecx
xor eax, eax
jmp 0x40c487
xor eax, eax
inc eax
jmp 0x40c487
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4