joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c1b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41c1d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041c290
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x41c1f5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x41c1f7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x41c274
jg 0x41c20a
test esi, esi
je 0x41c274
test ecx, ecx
jl 0x41c24e
jg 0x41c214
test eax, eax
je 0x41c24e
cmp edi, ecx
jg 0x41c226
jl 0x41c21e
cmp esi, eax
jae 0x41c226
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00499d10
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x41c251
mov edx, dword [ebp + 8]
test edi, edi
jl 0x41c274
jg 0x41c25b
test esi, esi
je 0x41c274
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x41c274
push eax
push esi
push 1
push edx
call fcn.004c8b31
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41c3e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41c45a
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x503acc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
Function at 0x41c9e0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5267b0
push 0x49b3f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a18
call fcn.0046ac60
mov eax, dword [0x5374e4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2a2c], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2a30], esi
test esi, esi
je 0x41cbb2
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ca40
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x41cbb2
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov dword [ebp - 4], 0xfffffffe
jmp 0x41ca8d
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.0049a810
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.0049a810
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41cbb2
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004c8f3c
lea eax, [ebp - 0x224]
push eax
call fcn.004b9e44
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x41cbb2
nop
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
mov ecx, ebx
call fcn.0041c510
test eax, eax
je 0x41cba5
lea eax, [ebp - 0xa24]
push eax
call fcn.004b9e44
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41cb76
test dx, dx
je 0x41cb72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41cb76
add eax, 4
add ecx, 4
test dx, dx
jne 0x41cb50
xor eax, eax
jmp 0x41cb7b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41cba5
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41cba5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x41cb10
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 8
Function at 0x41cbe0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5267f0
push 0x49b3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x5374e4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 4], 0
test esi, esi
je 0x41cd53
cmp word [esi], 0
je 0x41cd53
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cc40
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x41cd53
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cd53
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.0049a810
push esi
push str.__s_
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.0041cd80
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.0049a810
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x503afc
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
cmp dword [ebp + 0x18], 0
je 0x41ccf3
push esi
call fcn.00462890
add esp, 4
test eax, eax
je 0x41cd53
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x41cd1a
cmp dword [ebp + 0x1c], 0
je 0x41cd1a
push 0xffffffffffffffff
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x41cd2f
test esi, esi
je 0x41cd3f
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x41cd3f
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41cd5c
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x41ce00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x41ce1c
pop edi
pop ebp
ret 8
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 8
Function at 0x41eb90
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi]
call edi
test eax, eax
jne 0x41ec99
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ec99
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41ebe7
push dword [esi]
call edi
test eax, eax
jne 0x41ec99
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049a810
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x41ec7b
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x41ec99
push 4
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
push 4
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
Function at 0x421fc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f461a
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], edi
lea eax, [edi + 8]
mov dword [edi], vtable.CSmartLogger.0
push eax
mov dword [edi + 4], vtable._BaseModule::CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov byte [ebp - 4], 1
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x42214d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x2c], eax
push 0x504a74
push 0
mov byte [ebp - 4], 2
mov dword [edi + 0x30], 1
call fcn.004ca0e3
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049a810
add esp, 0x14
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0049a810
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x504a78
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [0x53be7c], eax
lea eax, [ebp - 0x218]
push str.Logupdate.log
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x422110
sub edx, ecx
lea eax, [ebp - 0x218]
sar edx, 1
lea ecx, [edi + 0x2c]
push edx
push eax
call fcn.0040dd50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004034a0
int3
Function at 0x424070
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x42409a
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4240c6
push 1
mov ecx, esi
call fcn.00423b90
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x4240a6
mov edi, dword [esi + 0x34]
jmp 0x4240a9
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4240c5
test edi, edi
je 0x4240c5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4240d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x424101
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42412d
push 1
lea ecx, [esi - 0x24]
call fcn.00423b90
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x42410d
mov edi, dword [esi + 0x10]
jmp 0x424110
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42412c
test edi, edi
je 0x42412c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x424a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x424a3d
xor edi, edi
jmp 0x424b94
cmp dword [ebp + 0x14], 0
je 0x424b6d
push 0x1440
call fcn.0046a756
mov edi, eax
add esp, 4
test edi, edi
je 0x424b03
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov dword [ebp - 0x28], edx
test ecx, ecx
je 0x424a77
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea esi, [edi + 0x1418]
mov dword [edi], ecx
mov dword [edi + 0x1414], 1
mov dword [esi + 0x24], 0
test edx, edx
je 0x424aa1
mov eax, dword [edx]
mov ecx, edx
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0x1000
lea esi, [edi + 4]
push 0
push esi
call fcn.0049a810
push 0x800
push ebx
push esi
call fcn.004c8f3c
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.0049a810
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x424ae9
push 0x208
push eax
push esi
call fcn.004c8f3c
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x424b05
mov edx, dword [ecx]
lea eax, [ebp - 0x4c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x424b05
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x424bc0
push 0
push 0
mov dword [ebp - 0xc], 0x424bc0
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.004ca5a7
add esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], vtable.CSimpleThread.0
test eax, eax
je 0x424b66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x424b94
sub esp, 0x28
mov edi, esp
mov dword [edi + 0x24], 0
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x424b88
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.00424e10
mov edi, eax
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x424bac
mov esi, dword [ecx]
lea eax, [ebp + 0x1c]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x424ca0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0046ac60
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push eax
call fcn.0049a810
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x424d98
test edi, edi
je 0x424d98
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x424d98
cmp eax, 0x3fff
ja 0x424d98
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x424d98
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x5031e4
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x424d98
mov esi, dword [ebp + 0x14]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0049a810
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00425c50
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x10

Function at 0x424dd0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x424df5
test byte [ebp - 4], 7
je 0x424df5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x424e10
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4988
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x424eb2
cmp word [esi], di
je 0x424eb2
test eax, eax
je 0x424e6e
cmp word [eax], di
je 0x424e6e
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x424eb2
jmp 0x424ead
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0049a810
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x424eb2
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x424ee3
mov dword [ebp - 0x424], edi
lea edx, [ebp - 0x424]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x424ee3
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4282f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ecx + 8]
lea eax, [ebp - 8]
push esi
push 0
push dword [ecx + 0x34]
push eax
call fcn.004296e0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.test_check_repop_timer_seconds
push dword [ebp - 8]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov esi, dword [ebp - 4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42835a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
imul eax, esi, 0x3e8
mov ecx, 0x36ee80
pop esi
test eax, eax
cmove eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x428370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4efd
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4284bf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
mov dword [ebp - 0x220], 1
call fcn.004296e0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.0049a810
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.CloseTime
push dword [ebp - 0x21c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42847e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428460
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040dd50
mov esi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4284a0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004034a0
int3
Function at 0x428630
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4286a8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x503acc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret

Function at 0x4286c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push dword [ecx + 0x34]
lea eax, [ebp - 8]
push eax
call fcn.004296e0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.default_repop_go_on
push dword [ebp - 8]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 8]
or ecx, 0xffffffff
mov esi, dword [ebp - 4]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x428727
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret