joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a580
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x5c74b0]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.StartDlgShowing
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43a5b5
mov al, 1
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
setne al
add esp, 8
ret

Function at 0x43cec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], ecx
push edi
mov ecx, 0x5c73a8
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.00487270
test ax, ax
je 0x43cfaf
mov edx, dword [0x5c74b0]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push 0
push str.LastCheckLNG
push edx
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43cf7e
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x1c], esp
mov eax, esp
push edx
push 0
mov dword [eax], ecx
call fcn.00528272
add esp, 4
lea ecx, [ebp - 0x24]
push eax
call fcn.00437780
mov ecx, eax
call fcn.00437790
mov ecx, dword [eax]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
xor eax, eax
cmp edx, 0xe
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e5a0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov edx, dword [0x5c74b0]
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push str.SPChecked
push edx
mov dword [esp + 0x20], 4
call esi
test eax, eax
je 0x43e690
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:Program_FilesSpyHunterSpyHunter.exe
call ebx
cmp eax, 0xffffffff
je 0x43e5fa
pop esi
mov eax, 1
pop ebx
add esp, 0x214
ret
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEE5B8E34_973C_4FBE_AC83_99F064009FC7
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43e690
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.InstallLocation
push eax
mov dword [esp + 0x20], 0x208
call esi
test eax, eax
jne 0x43e685
push ebp
push edi
mov edi, str.SpyHunter.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
pop edi
cmp eax, 0xffffffff
pop ebp
je 0x43e685
pop esi
mov eax, 1
pop ebx
add esp, 0x214
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
add esp, 0x214
ret
Function at 0x43e6a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x557f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5c2a74]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push str.idmmbc.dll
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x5a47ec
push ecx
mov dword [esp + 0x30], ebp
call fcn.0053afda
mov edx, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x14
push edx
call ebx
cmp eax, 0xffffffff
jne 0x43e701
mov ebp, 1
push str.idmmkb.dll
push esi
push edi
lea eax, [esp + 0x1c]
push 0x5a47ec
push eax
call fcn.0053afda
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x43e727
inc ebp
push str.Uninstall.exe
push esi
push edi
lea edx, [esp + 0x1c]
push 0x5a47ec
push edx
call fcn.0053afda
mov eax, dword [esp + 0x24]
add esp, 0x14
push eax
call ebx
cmp eax, 0xffffffff
jne 0x43e74d
inc ebp
push 0x5a5638
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x5a47ec
push ecx
call fcn.0053afda
mov edx, dword [esp + 0x24]
add esp, 0x14
push edx
call ebx
cmp eax, 0xffffffff
jne 0x43e773
inc ebp
push str.IDMIECC.dll
push esi
push edi
lea eax, [esp + 0x1c]
push 0x5a47ec
push eax
call fcn.0053afda
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x43e799
inc ebp
push str.IDMGetAll.dll
push esi
push edi
lea edx, [esp + 0x1c]
push 0x5a47ec
push edx
call fcn.0053afda
mov eax, dword [esp + 0x24]
add esp, 0x14
push eax
call ebx
cmp eax, 0xffffffff
jne 0x43e7bf
inc ebp
push str.IEExt.htm
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x5a47ec
push ecx
call fcn.0053afda
mov edx, dword [esp + 0x24]
add esp, 0x14
push edx
call ebx
cmp eax, 0xffffffff
jne 0x43e7e5
inc ebp
push str.IEGetAll.htm
push esi
push edi
lea eax, [esp + 0x1c]
push 0x5a47ec
push eax
call fcn.0053afda
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x43e80b
inc ebp
push str.IDMGrHlp.exe
push esi
push edi
lea edx, [esp + 0x1c]
push 0x5a47ec
push edx
call fcn.0053afda
mov eax, dword [esp + 0x24]
add esp, 0x14
push eax
call ebx
cmp eax, 0xffffffff
jne 0x43e831
inc ebp
push str.idmmzcc.xpi
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x5a47ec
push ecx
call fcn.0053afda
mov edx, dword [esp + 0x24]
add esp, 0x14
push edx
call ebx
cmp eax, 0xffffffff
jne 0x43e857
inc ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005421be
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x43e880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x558076
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x97c
mov eax, dword [0x5c2a74]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x9a0]
mov ecx, dword [esp + 0x99c]
mov edx, dword [esp + 0x998]
push edi
push ecx
push edx
lea eax, [esp + 0x18]
xor ebx, ebx
push 0x5a47ec
push eax
mov dword [esp + 0x9a4], ebx
call fcn.0053afda
mov ecx, dword [esp + 0x20]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43e90a
lea ecx, [esp + 0xc]
mov dword [esp + 0x990], 0xffffffff
call fcn.005421be
mov eax, 1
jmp 0x43eaea
push ebx
lea ecx, [esp + 0x14]
call fcn.00424b90
push str._data_v4_
lea ecx, [esp + 0x88]
mov byte [esp + 0x994], 1
call fcn.00542347
push edi
lea ecx, [esp + 0x84]
call fcn.00542347
lea edx, [esp + 0xc]
lea ecx, [esp + 0x74]
push edx
call fcn.005422f7
mov eax, dword [esi + 0x144]
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], bl
mov dword [esp + 0x6c], eax
call fcn.0053e1a5
cmp eax, 1
jne 0x43ea2d
lea ecx, [esp + 0xc8]
mov byte [esp + 0x990], 9
call fcn.004ff780
lea ecx, [esp + 0x8c]
mov byte [esp + 0x990], 8
call fcn.00549f10
lea ecx, [esp + 0x88]
mov byte [esp + 0x990], 7
call fcn.005421be
lea ecx, [esp + 0x84]
mov byte [esp + 0x990], 6
call fcn.005421be
lea ecx, [esp + 0x80]
mov byte [esp + 0x990], 5
call fcn.005421be
lea ecx, [esp + 0x7c]
mov byte [esp + 0x990], 4
call fcn.005421be
lea ecx, [esp + 0x74]
mov byte [esp + 0x990], 3
call fcn.005421be
lea ecx, [esp + 0x70]
mov byte [esp + 0x990], 2
call fcn.005421be
lea ecx, [esp + 0x10]
mov byte [esp + 0x990], bl
call fcn.0053dde6
lea ecx, [esp + 0xc]
mov dword [esp + 0x990], 0xffffffff
call fcn.005421be
mov eax, 1
jmp 0x43eaea
lea ecx, [esp + 0xc8]
mov byte [esp + 0x990], 0x11
call fcn.004ff780
lea ecx, [esp + 0x8c]
mov byte [esp + 0x990], 0x10
call fcn.00549f10
lea ecx, [esp + 0x88]
mov byte [esp + 0x990], 0xf
call fcn.005421be
lea ecx, [esp + 0x84]
mov byte [esp + 0x990], 0xe
call fcn.005421be
lea ecx, [esp + 0x80]
mov byte [esp + 0x990], 0xd
call fcn.005421be
lea ecx, [esp + 0x7c]
mov byte [esp + 0x990], 0xc
call fcn.005421be
lea ecx, [esp + 0x74]
mov byte [esp + 0x990], 0xb
call fcn.005421be
lea ecx, [esp + 0x70]
mov byte [esp + 0x990], 0xa
call fcn.005421be
lea ecx, [esp + 0x10]
mov byte [esp + 0x990], bl
call fcn.0053dde6
lea ecx, [esp + 0xc]
mov dword [esp + 0x990], 0xffffffff
call fcn.005421be
xor eax, eax
mov ecx, dword [esp + 0x988]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x988
ret 0xc
Function at 0x4423b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558bb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
mov edx, dword [0x5c74b0]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0
mov esi, 3
mov ebx, 4
push str.RememberDuplLinksA
push edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x442415
cmp dword [ebp - 0x14], 1
je 0x442483
mov eax, dword [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0xf8]
call fcn.0044b720
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 1
call fcn.0053e1a5
mov ecx, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
not eax
and eax, ecx
mov esi, eax
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.005421be
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.0054a098
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
call fcn.00549f48
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0
call fcn.0053dde6
jmp 0x4424b4
mov eax, dword [0x5c74b0]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
push edx
push 0
push 0
push str.DuplLinksA
push eax
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x4424b4
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x4424b4
mov esi, 3
jmp 0x4424b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], esp
mov eax, dword [edi + 0x1c0]
mov dword [ebp - 4], 0
shl ecx, 4
mov edx, dword [eax + 4]
mov esi, dword [edx + ecx]
mov eax, dword [esi + 0x65c]
cmp eax, 1
je 0x44260d
cmp eax, 5
je 0x44260d
cmp eax, 4
je 0x44260d
cmp eax, 3
jne 0x4425c5
mov eax, dword [esi + 0x54]
test eax, eax
je 0x4425c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4425c5
mov ecx, esi
call fcn.00502490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
mov ecx, esi
call fcn.00502b50
mov eax, dword [edi + 0x1c]
mov ecx, esi
push eax
call fcn.00502c20
push esi
call fcn.00456f40
mov ecx, dword [edi + 0x144]
add esp, 4
mov dword [esi], ecx
mov ecx, esi
push 1
call fcn.00503100
mov ecx, esi
call fcn.005031f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x5c7998]
mov eax, dword [0x5c799c]
push 0
push edx
push eax
mov ecx, edi
call fcn.005401b5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444220
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558fd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov edx, dword [0x5c74b0]
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
xor ebx, ebx
push eax
push ecx
push ebx
push ebx
push str.bShBTtFQCI
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4443bf
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x44439a
mov edi, dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x44439a
cmp byte [esi + 0xe72], bl
jne 0x44439a
cmp byte [esi + 0x1fb], bl
je 0x4442b9
push 0x16
push edi
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x1fb], bl
mov edx, dword [esi + 0x4b4]
lea ecx, [ebp - 0x30]
push ecx
push 2
push 0x1207
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x30]
lea ecx, [esi + 0x498]
push eax
call fcn.0054500f
mov edx, dword [esi + 0x474]
lea ecx, [ebp - 0x40]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x40]
lea ecx, [esi + 0x458]
push eax
call fcn.0054500f
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov edx, ecx
sub edx, eax
test edx, edx
jle 0x4443bf
cmp eax, dword [ebp - 0x40]
jl 0x4443bf
cmp ecx, dword [ebp - 0x38]
jg 0x4443bf
mov ecx, dword [0x5c74b0]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push str.bShBTtFQCI
push ecx
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4443bf
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add edx, 0xfffffffc
add eax, 0xfffffffc
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov edx, dword [0x5c7908]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x5c790c]
push ecx
mov ecx, dword [esi + 0x474]
push ebx
push edx
push eax
push ecx
call fcn.004566b0
add esp, 0x14
mov dword [esi + 0xd74], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x1fb], bl
jne 0x4443bf
mov edx, dword [esi + 0x1c]
push ebx
push 0x1f4
push 0x16
push edx
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
je 0x4443bf
mov byte [esi + 0x1fb], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4456e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 0xc]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push str.SoftwareDownloadManagerScheduler
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x445820
mov ecx, dword [esp + 0xc]
push ebx
lea edx, [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
mov ebx, 4
push str.isLimitEnabled
push ecx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
je 0x445750
mov dword [esi + 8], 0
jmp 0x445757
mov edx, dword [esp + 0x10]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push str.m_MBytes
push edx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
je 0x445782
mov dword [esi + 0xc], 0xc8
jmp 0x445789
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push 0
cdq
push 0x100000
push edx
push eax
call fcn.005291e0
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1c], edx
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0
push str.m_hours
push eax
mov dword [esp + 0x24], ebx
call edi
test eax, eax
je 0x4457cc
mov dword [esi + 0x10], 5
jmp 0x4457d3
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push str.showLimitExceededWarning
push ecx
mov dword [esp + 0x24], ebx
call edi
pop edi
pop ebx
test eax, eax
je 0x44580e
mov eax, dword [esp + 0xc]
mov dword [esi + 0x14], 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov dword [esi + 0x14], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x10
ret
Function at 0x445830
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push str.SoftwareDownloadManagerScheduler
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44591a
mov ecx, dword [esp + 4]
push ebx
push edi
mov edi, dword [esi + 8]
lea eax, [esp + 0x10]
push 4
xor edx, edx
push eax
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0
push str.isLimitEnabled
setne dl
push ecx
mov dword [esp + 0x28], edx
call edi
mov edx, dword [esp + 0xc]
lea ebx, [esi + 0xc]
push 4
push ebx
push 4
push 0
push str.m_MBytes
push edx
call edi
mov ecx, dword [ebx]
mov eax, 0x51eb851f
shl ecx, 0x14
imul ecx
sar edx, 5
mov eax, edx
lea ecx, [esi + 0x10]
shr eax, 0x1f
add edx, eax
push 4
push ecx
push 4
lea eax, [edx + edx*2]
push 0
shl eax, 4
add eax, edx
push str.m_hours
shl eax, 1
cdq
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x20]
push edx
call edi
mov ebx, dword [esi + 0x14]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 4
xor eax, eax
push ecx
test ebx, ebx
push 4
push 0
setne al
push str.showLimitExceededWarning
push edx
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x446400
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x559390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, ecx
push esi
push 0x5c6ff0
lea ecx, [esp + 0xc]
call fcn.0054222c
mov esi, dword [ebp + 4]
mov dword [esp + 0x2c], 0
test esi, esi
je 0x44646f
mov eax, esi
mov esi, dword [esi]
lea ecx, [esp + 0x18]
push 0xa
mov edx, dword [eax + 8]
push ecx
push edx
call fcn.0052c4cd
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.0054259a
test esi, esi
je 0x44646f
push 0x20
lea ecx, [esp + 0xc]
call fcn.005425c1
jmp 0x446439
mov ecx, dword [0x5c2a74]
mov dword [esp + 0xc], ecx
mov edx, dword [0x5c7498]
lea eax, [esp + 0xc]
push edx
push str._sScheduler
push eax
mov byte [esp + 0x38], 1
call fcn.0053afda
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4464b4
mov edx, dword [esp + 0xc]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.005421be
mov eax, dword [0x5c2a74]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x64]
mov edx, dword [0x5c7498]
push ecx
push edx
lea eax, [esp + 0x18]
push str._sSchedulerq__ld.dt
push eax
mov byte [esp + 0x3c], 2
call fcn.0053afda
mov ecx, dword [esp + 0x20]
push 0x5a9104
push ecx
call fcn.0052825f
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x44656a
call fcn.00529287
mov edx, dword [0x5c2a74]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
push esi
lea ecx, [esp + 0x10]
push esi
push ecx
push 0x400
push eax
push esi
push 0x1100
mov byte [esp + 0x48], 3
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [0x5c7b80]
push edx
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0053afda
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.005421be
jmp 0x44658f
mov edx, dword [esp + 8]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 1
push edx
call fcn.005280f5
push esi
call fcn.00528078
add esp, 0x14
pop edi
cmp dword [ebp + 0x64], 1
jne 0x4465a1
mov ecx, dword [esp + 8]
push ecx
mov ecx, ebp
call fcn.004465e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.005421be
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005421be
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4465e0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push esi
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push str.SoftwareDownloadManagerQueue
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x446645
mov esi, dword [esp + 4]
test esi, esi
je 0x446645
mov edx, dword [esp + 0x10]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push str.Queue
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret 4

Function at 0x446650
Capabilities:
Set registry value

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x10]
mov edi, dword [esp + 0x50]
mov ebp, dword [esi + 8]
cmp eax, ebx
mov byte [esp + 0x20], bl
jne 0x44669d
mov eax, dword [esi + 0x18]
push 0x14
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.0053d0d3
mov ecx, dword [esi + 0x18]
add eax, 4
lea edx, [ecx + ecx*4]
dec ecx
test ecx, ecx
lea eax, [eax + edx*4 - 0x14]
jl 0x44669d
inc ecx
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x14
dec ecx
jne 0x44668f
mov eax, dword [esi + 0x10]
xor edx, edx
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov dword [eax + 4], ebp
mov dword [eax], 0
mov ebp, dword [esi + 0xc]
inc ebp
lea ecx, [eax + 8]
mov dword [esi + 0xc], ebp
mov ebp, ecx
mov dword [ebp], edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov edx, dword [esp + 0x20]
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4466dc
mov dword [ecx], eax
jmp 0x4466df
mov dword [esi + 4], eax
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00446400
push edi
mov ecx, esi
call fcn.00446a20
test eax, eax
je 0x4466fe
mov ecx, dword [esi + 0x64]
mov dword [eax + 0x424], ecx
push edi
lea edx, [esp + 0x28]
push str.SoftwareDownloadManager_ld
push edx
call fcn.00527718
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x50]
lea edx, [esp + 0x24]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44676c
mov edx, dword [esp + 0x50]
mov eax, dword [esi + 0x64]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.queueID
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x5c757c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x446799
mov edx, dword [0x5c757c]
push edi
push 0x1396
push 0x111
push edx
call esi
mov eax, dword [0x5c7580]
push eax
call ebx
test eax, eax
je 0x4467b9
mov ecx, dword [0x5c7580]
push edi
push 0x139a
push 0x111
push ecx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4