joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f920
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55c2c8
push eax
mov dword fs:[0], esp
sub esp, 0x14
lea eax, [esp + 0x10]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push str.SoftwareDownloadManagerGrabberSts
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x46f9cb
mov edx, dword [0x5c2a74]
mov dword [esp + 8], edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc]
push str.Gr_SetPID:RegCrKey_failed__err_ld_n
push eax
call fcn.0053afda
mov ecx, dword [0x5c7560]
add esp, 0xc
test ecx, ecx
je 0x46f9aa
mov edx, dword [esp + 8]
push 1
push edx
call fcn.0045eb80
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005421be
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.maxProjectID
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esi + 0x498]
jne 0x46fa01
cmp eax, dword [esp + 4]
jle 0x46fa05
mov dword [esp + 4], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.maxProjectID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x473b70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c5fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], ebx
xor esi, esi
cmp esi, dword [edi + 0xb0]
jge 0x473c4b
mov eax, dword [0x5c2a74]
mov dword [ebp - 0xb8], 0x56b594
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0xb8]
push ebx
push eax
push esi
lea ecx, [edi + 8]
mov byte [ebp - 4], 1
call fcn.0051b270
cmp al, bl
je 0x473c1b
cmp byte [ebp - 0x70], bl
je 0x473c1b
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 8], ebx
jle 0x473c1b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.0043fb90
inc esi
jmp 0x473b9d
mov edx, dword [edi + 0x414]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x473c68
push edx
call fcn.00529006
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474280
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c690
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x5c2a74]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov ecx, dword [0x5c7498]
lea edx, [ebp - 0x14]
push ecx
push str._sGrabberProjects_
push edx
mov byte [ebp - 4], 1
call fcn.0053afda
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4743eb
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, 2
inc esi
lea ecx, [ebp - 0x14]
push esi
push 0x5c
call fcn.00542693
mov esi, eax
cmp esi, 0xffffffff
je 0x4743e2
lea ecx, [ebp - 0x18]
push esi
push ecx
lea ecx, [ebp - 0x14]
call fcn.0053abba
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x18]
sete bl
call fcn.005421be
test bl, bl
je 0x4742f1
lea edx, [ebp - 0x20]
push esi
push edx
lea ecx, [ebp - 0x14]
call fcn.0053abba
mov eax, dword [eax]
push 0
push eax
call edi
test eax, eax
lea ecx, [ebp - 0x20]
sete bl
call fcn.005421be
test bl, bl
je 0x4742f1
mov eax, dword [0x5c2a74]
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 0x1c]
push 0
push ecx
push 0x400
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x5c8004]
push edx
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.0053afda
mov edx, dword [ebp - 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0x30
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.005421be
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
mov eax, 0x7546
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 0x498]
mov eax, dword [ebp - 0x14]
push edx
lea esi, [edi + 0x4a8]
push eax
push str._sproject_ld.igp
push esi
call fcn.0053afda
add esp, 0x10
mov edi, 1
mov eax, dword [esi]
push eax
call ebx
cmp eax, 0xffffffff
je 0x474439
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
inc edi
mov edx, dword [ecx + 0x498]
push edi
push edx
push eax
push str._sproject_ld__d.igp
push esi
call fcn.0053afda
add esp, 0x14
jmp 0x47440f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [edi + 0x60]
mov dword [ebp - 0x14], ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x475e8c
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
push eax
push ecx
call fcn.0052f680
add esp, 8
test eax, eax
je 0x475ead
mov eax, dword [edi + 0x64]
push 1
push eax
call fcn.0044fc50
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
add esp, 8
push 1
push eax
push ecx
call fcn.0044faa0
add esp, 0xc
test eax, eax
jne 0x475ead
mov eax, dword [0x5c2a74]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 0x64]
lea edx, [ebp + 0xc]
push ecx
push 0x5a3e24
push edx
mov byte [ebp - 4], 1
call fcn.0053afda
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0x5c
push eax
call fcn.00526d20
add esp, 8
test eax, eax
je 0x475e80
mov byte [eax + 1], 0
mov ecx, dword [ebp + 0xc]
push 1
push ecx
call fcn.0044fd10
add esp, 8
test eax, eax
jne 0x475e80
mov esi, 2
jmp 0x475dee
mov ebx, dword [ebp - 0x14]
inc esi
lea ecx, [ebp + 0xc]
push esi
push 0x5c
call fcn.00542693
mov esi, eax
cmp esi, 0xffffffff
je 0x475e6a
lea edx, [ebp - 0x18]
push esi
push edx
lea ecx, [ebp + 0xc]
call fcn.0053abba
mov eax, dword [eax]
push 1
push eax
mov byte [ebp - 4], 2
call fcn.0044fd10
add esp, 8
lea ecx, [ebp - 0x18]
test eax, eax
sete bl
mov byte [ebp - 4], 1
call fcn.005421be
test bl, bl
je 0x475deb
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 0xc]
call fcn.0053abba
mov eax, dword [eax]
push 1
push eax
mov byte [ebp - 4], 3
call fcn.0044fe10
add esp, 8
lea ecx, [ebp - 0x1c]
test eax, eax
sete bl
mov byte [ebp - 4], 1
call fcn.005421be
test bl, bl
je 0x475deb
mov ebx, dword [ebp - 0x14]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
push 1
push eax
push ecx
call fcn.0044faa0
add esp, 0xc
test eax, eax
jne 0x475ea1
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.005421be
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.005421be
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
cmp eax, dword [ebx + 0x4fc]
jge 0x475ecd
mov edx, dword [ebx + 0x4f8]
cmp dword [edx + eax*8], esi
lea edx, [edx + eax*8]
jne 0x475f1f
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x475ee6
mov eax, dword [edi + 0x18]
test eax, eax
je 0x475ef7
push eax
mov ecx, ebx
call fcn.00475f90
mov ecx, eax
test ecx, ecx
je 0x475ef7
push 3
mov dword [ecx + 0x1c0], 1
call fcn.00502b50
mov eax, dword [edi + 0x64]
push 0
push 0
push eax
call fcn.00505710
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc eax
jmp 0x475eb4
Function at 0x476070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c843
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], ebx
xor esi, esi
cmp esi, dword [edi + 0xb0]
jge 0x4761be
mov eax, dword [0x5c2a74]
mov dword [ebp - 0xbc], 0x56b594
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0xbc]
push ebx
push eax
push esi
lea ecx, [edi + 8]
mov byte [ebp - 4], 1
call fcn.0051b270
cmp al, bl
je 0x47618e
mov eax, dword [ebp - 0x40]
cmp dword [eax - 8], ebx
jle 0x47611a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x5c]
cmp dword [eax - 8], ebx
jle 0x47617f
cmp dword [ebp - 0xa4], ebx
jne 0x47617f
mov ecx, dword [0x5c2a74]
mov dword [ebp - 0x14], ecx
push eax
lea edx, [ebp - 0x14]
push 0x5a3e24
push edx
mov byte [ebp - 4], 2
call fcn.0053afda
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
push 0x5c
push ecx
call fcn.00526d20
add esp, 8
cmp eax, ebx
je 0x476173
mov byte [eax], bl
mov edx, dword [ebp - 0x14]
push edx
call fcn.00529006
add esp, 4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005421be
lea eax, [ebp - 0xbc]
mov ecx, edi
push eax
push esi
call fcn.00475af0
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], bl
call fcn.0043fb90
inc esi
jmp 0x47609d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4769a0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55c8d6
push eax
mov dword fs:[0], esp
sub esp, 0x148
or ecx, 0xffffffff
xor eax, eax
push ebp
mov ebp, dword [esp + 0x15c]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp - 1], 0x5c
jne 0x476adc
mov eax, dword [0x5c2a74]
push ebx
push esi
mov esi, 1
mov dword [esp + 0x10], eax
push ebp
lea ecx, [esp + 0x14]
push str._sf
push ecx
mov dword [esp + 0x16c], 0
call fcn.0053afda
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x476ac6
test esi, esi
je 0x476abf
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x476a66
mov al, byte [esp + esi + 0x44]
cmp al, 0x2e
je 0x476a66
movsx ecx, al
push ecx
call fcn.0052727d
add esp, 4
test eax, eax
jne 0x476a61
cmp byte [esp + esi + 0x44], 0x66
jne 0x476aac
inc esi
cmp esi, edi
jl 0x476a42
mov edx, dword [0x5c2a74]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x44]
lea ecx, [esp + 0x14]
push eax
push ebp
push 0x5a4b44
push ecx
mov byte [esp + 0x170], 1
call fcn.0053afda
mov edx, dword [esp + 0x24]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], 0
call fcn.005421be
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
jmp 0x476a24
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov dword [esp + 0x160], 0xffffffff
call fcn.005421be
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x154
ret
Function at 0x47bfa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5c2a74]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
lea ecx, [esi + 0x890]
mov byte [ebp - 4], 1
call fcn.004a77d0
mov ebx, dword [ebp + 8]
cmp ebx, eax
jge 0x47c034
mov edx, dword [esi + ebx*4 + 0x894]
mov edi, dword [0x5c7480]
xor eax, eax
cmp eax, dword [0x5c7484]
jge 0x47c02e
lea ecx, [eax + eax*2]
cmp edx, dword [edi + ecx*4]
lea ecx, [edi + ecx*4]
jne 0x47c05f
mov edx, dword [ecx + 8]
lea eax, [ebp - 0x14]
push edx
push 0x5a3e24
push eax
call fcn.0053afda
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47c062
mov al, 1
test al, al
je 0x47c062
push ebx
lea ecx, [esi + 0x890]
call fcn.004a79e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc eax
jmp 0x47bff7
lea ecx, [esi + 0x720]
call fcn.00467f80
mov edx, dword [ebp - 0x14]
mov ecx, esi
push edx
call fcn.0047d850
jmp 0x47c040
Function at 0x47e210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push esi
push edi
lea eax, [ebp - 0x170]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x104
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x370]
lea edx, [ebp - 0x470]
push ecx
lea eax, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x170]
push ecx
push edx
call fcn.0052776a
mov eax, dword [0x5c2a74]
add esp, 0x14
mov dword [ebp - 0x1c], eax
push str.mailto:support_internetdownloadmanager.com
mov ecx, 0x5c7d58
mov byte [ebp - 4], 1
call fcn.00542347
lea ecx, [ebp - 0x270]
push str.idmpldr.ini
lea edx, [ebp - 0x20]
push ecx
push edx
lea eax, [ebp - 0x1c]
push 0x5a47ec
push eax
mov dword [ebp - 0x18], ebx
call fcn.0053afda
mov ecx, dword [ebp - 0x1c]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47e319
mov edx, dword [ebp - 0x1c]
push 0x5a5c8c
push edx
call fcn.0052825f
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x47e310
push esi
lea eax, [ebp - 0x6c]
push 0x20
push eax
call fcn.0052834e
add esp, 0xc
test eax, eax
je 0x47e310
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x6c]
push ecx
push 0x5a5cf0
push edx
call fcn.005284dc
add esp, 0xc
cmp eax, 1
je 0x47e310
mov dword [ebp - 0x18], ebx
push esi
call fcn.00528078
add esp, 4
push 0x5c6ff0
lea ecx, [ebp - 0x14]
call fcn.0054222c
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x47e343
push eax
lea eax, [ebp - 0x14]
push str.c_ld
push eax
call fcn.0053afda
add esp, 0xc
mov ecx, 0xb
mov esi, str.https:__secure.internetdownloadmanager.com_
lea edi, [ebp - 0x4c]
lea edx, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
push ecx
push str.v515
push edx
push str._sbuy_idm.html__s_s
push 0x5c8410
call fcn.0053afda
mov eax, dword [ebp - 0x14]
add esp, 0x14
lea ecx, [ebp - 0x4c]
push eax
push str.v515
push ecx
push str._sbuy1.html__s_s
push 0x5c840c
call fcn.0053afda
mov edx, dword [ebp - 0x14]
add esp, 0x14
push edx
push str.v515
push str.http:__www.internetdownloadmanager.com___s_s
push 0x5c8408
call fcn.0053afda
mov eax, dword [ebp - 0x18]
add esp, 0x10
sub eax, 0x32
je 0x47e3bd
dec eax
jne 0x47e3cf
push str._a_svfs_2c_
jmp 0x47e3c2
push str._a_dc_
push 0x5c8400
call fcn.0053afda
add esp, 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005421be
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.005421be
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ed00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x55dacb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x47ede8
add edi, 0x64
mov dword [esi + 0x34], edi
lea eax, [edi*8 + 4]
push eax
call fcn.0054276d
add esp, 4
mov dword [esp + 0x10], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x47ed6c
push fcn.00407720
push 0x48bc40
lea ebx, [eax + 4]
push edi
push 8
push ebx
mov dword [eax], edi
call fcn.0052798f
mov dword [esp + 0x10], ebx
jmp 0x47ed72
mov dword [esp + 0x10], ebp
mov ebx, ebp
cmp ebx, ebp
mov dword [esp + 0x1c], 0xffffffff
jne 0x47ed95
lea ecx, [esp + 0x24]
push 0x589640
push ecx
mov dword [esp + 0x2c], 0xc0000017
call fcn.00528fcc
mov eax, dword [esi + 0x30]
xor edi, edi
cmp eax, ebp
jle 0x47edc1
mov edx, dword [esi + 0x2c]
mov ecx, ebx
lea ebp, [edx + edi*8]
push ebp
call fcn.005422f7
mov eax, dword [ebp + 4]
inc edi
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x30]
add ebx, 8
cmp edi, eax
jl 0x47ed9e
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x47ede5
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push fcn.00407720
push ecx
push 8
push eax
call fcn.005278b1
push edi
call fcn.00542796
add esp, 4
mov dword [esi + 0x2c], ebx
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
mov ebx, dword [esp + 0x24]
lea edi, [eax + edx*8]
push ebx
mov ecx, edi
call fcn.005422f7
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esi + 0x30], eax
mov esi, eax
pop edi
mov dword fs:[0], ecx
lea eax, [esi - 1]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x47ee30
Capabilities:
Set registry value

Disassembly:
mov ax, word [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0x26]
mov dword [esi + 0x28], edi
mov word [ebp], ax
call fcn.0047f070
mov ax, word [ebp]
cmp ax, 9
je 0x47eee6
mov ecx, dword [esi + 0x54]
cmp ecx, edi
jle 0x47eee6
mov ebx, dword [esi + 0x50]
mov edx, eax
and edx, 0xffff
lea eax, [ebx + 8]
cmp dword [eax], edx
je 0x47ee81
inc edi
add eax, 0x20
cmp edi, ecx
jl 0x47ee73
jmp 0x47eee6
shl edi, 5
add ebx, edi
lea ecx, [esi + 0x18]
push ebx
mov dword [esi + 0x28], 1
call fcn.005422f7
mov ecx, dword [esi + 0x50]
lea edx, [ecx + edi + 0xc]
lea ecx, [esi + 4]
push edx
call fcn.005422f7
mov eax, dword [esi + 0x50]
lea ecx, [eax + edi + 0x10]
push ecx
lea ecx, [esi + 8]
call fcn.005422f7
mov edx, dword [esi + 0x50]
lea ecx, [esi + 0xc]
lea eax, [edx + edi + 0x14]
push eax
call fcn.005422f7
mov ecx, dword [esi + 0x50]
lea edx, [ecx + edi + 0x18]
lea ecx, [esi + 0x10]
push edx
call fcn.005422f7
mov eax, dword [esi + 0x50]
lea ecx, [eax + edi + 0x1c]
push ecx
lea ecx, [esi + 0x14]
call fcn.005422f7
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47ef15
mov edx, dword [0x5c74b0]
push 4
push ebp
push 4
push 0
push str.languageID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, esi
call fcn.00481e70
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x47ef22
mov word [ebp], 9
mov ecx, esi
call fcn.00481e70
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x47ef30
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x5c6ff0
push 0
push str.SoftwareDownloadManagermenuExt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47f066
mov edx, dword [0x5c78f0]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl1_str
push edx
call esi
mov edx, dword [0x5c78d8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.ffdownlAll_str
push eax
call esi
mov edx, dword [0x5c78e8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push str.ffdownlFLV_str
push ecx
call esi
mov edx, dword [0x5c78e4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl10FLV_str
push edx
call esi
mov edx, dword [0x5c78ec]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.ffdownlppFLV_str
push eax
call esi
mov edx, dword [0x5c78e0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
mov ecx, dword [esp + 0x14]
push eax
push str.ffdownlFLVa_str
push ecx
call esi
mov edx, dword [0x5c78dc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl10FLVa_str
push edx
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret
Function at 0x481cc0
Capabilities:
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x55db16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push esi
push edi
mov esi, ecx
call fcn.00425230
mov ecx, esi
call fcn.0047e210
mov edx, dword [0x5c74b0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
push str.LanguageID
push edx
mov dword [esp + 0x24], 4
call edi
test eax, eax
jne 0x481d47
mov eax, dword [esp + 8]
push 0
mov word [esi + 0x24], ax
and eax, 0x3ff
push eax
mov ecx, esi
call fcn.0047ee30
pop edi
pop esi
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
add esp, 0xac
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esi + 0x24], ax
and eax, 0x3ff
push 0
push eax
mov ecx, esi
call fcn.0047ee30
cmp word [esi + 0x26], 9
je 0x481e07
mov eax, dword [esi + 0x28]
test eax, eax
je 0x481e07
mov edx, dword [0x5c74b0]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
push str.LIDwa
push edx
mov dword [esp + 0x24], 4
call edi
test eax, eax
je 0x481e07
push 0
lea ecx, [esp + 0x14]
call fcn.004b2300
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0
call fcn.0053e1a5
mov ecx, dword [0x5c74b0]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
mov esi, 1
push str.LIDwa
push ecx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x6c]
mov dword [esp + 0xb0], esi
call fcn.00549fae
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.0053dde6
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xac
ret
Function at 0x487270
Capabilities:
Identify system language via api

Disassembly:
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp ax, 9
jne 0x487289
xor ax, ax
pop edi
ret
push ebx
push esi
mov esi, dword [edi + 0x54]
xor edx, edx
test esi, esi
jle 0x4872ae
mov ecx, dword [edi + 0x50]
mov ebx, eax
and ebx, 0xffff
add ecx, 8
cmp dword [ecx], ebx
je 0x4872b7
inc edx
add ecx, 0x20
cmp edx, esi
jl 0x4872a2
pop esi
pop ebx
and eax, 0xffff
pop edi
ret
pop esi
pop ebx
xor eax, eax
pop edi
ret