joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4297f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bddba
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004601f8
test al, al
je 0x429838
push edi
cmp byte [0xa05b9c4], 0xcd
out dx, eax
sbb byte [eax - 0x4a73e8a8], 0x98
wait
and al, 0x64
out dx, eax
call fcn.004607a1
test al, al
je 0x429851
clc
stc
mov cs, word [ebx + 0x3f7b2008]
outsd dx, dword [esi]
in eax, 0x24
dec ebp
call 0x45cfaff2
test al, 0x50
lea eax, [ebp - 0x58]
push eax
call fcn.00468442
add esp, 4
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x42986c
mov eax, dword [eax]
push 0x625f30
push str.880a8
push str.OISet
push eax
lea eax, [ebp - 0x40]
push str.SmartCloudWB
push eax
call int.0046b7a9
add esp, 0x18
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x4298a6
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402610
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp dword [ebp - 0x30], eax
je 0x42999d
mov eax, dword [0x63fa20]
test eax, eax
jne 0x4298f8
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4298ed
mov ecx, eax
call fcn.00450f00
jmp 0x4298ef
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x63fa20], eax
mov ecx, eax
call fcn.004617b1
push eax
lea ecx, [ebp - 0x28]
call fcn.004023b0
mov byte [ebp - 4], 4
call fcn.00460420
test al, al
je 0x429925
fdivr st(3)
xchg edx, eax
pop ebp
sbb al, 0xc4
and dword [edx], edi
mov ecx, 0x4a2eea14
mov es, esi
out dx, al
call fcn.004603db
test al, al
je 0x429945
and byte [esi - 0x5a], dh
outsd dx, dword [esi]
daa
xor eax, 0x575374ea
sub byte [edx - 0x56], 0x71
aas
invalid
push 0xd
push str.SWWordMgr.exe
lea ecx, [ebp - 0x28]
call fcn.00404190
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0046396c
add esp, 8
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42999d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402610
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4299b2
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x42c320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.004607e6
test al, al
je 0x42c34b
push ecx
out dx, al
push ebp
wait
scasb al, byte es:[edi]
ljmp 0x4ad1
call fcn.0046009f
test al, al
je 0x42c369
fiadd word [edi]
dec ebp
cld
cli
xor ebx, eax
or esi, dword [ebp + edi*8 + 0x3b]
add eax, 0x384a3f4f
push 0xfffffffffffffff4
adc al, 0xa4
aam 0x8b
xor eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x42c4e0
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SWHost
push dword [ebp - 8]
call esi
test eax, eax
jne 0x42c4e0
call fcn.00460396
test al, al
je 0x42c3da
jnp 0x42c3b9
or eax, 0xf7719af1
sti
dec edi
pushfd
cmp ecx, dword ds:[ebx - 0x7f]
mov dword [edi + 0x46], edx
pop edi
mov al, byte [0xe828486a]
dec esp
inc esp
add eax, dword [eax]
call fcn.0046082b
test al, al
je 0x42c400
pop edx
sahf
bound ebx, qword [edx]
jnp 0x42c456
sbb byte [esi - 0x2a], al
jmp 0x726162e5
fxch st(4)
xchg ecx, eax
out 0xe8, eax
daa
invalid
call fcn.004601b3
test al, al
je 0x42c422
or dword [ecx - 0x5cef93d5], edx
aas
out 0xb1, al
dec esi
cdq
inc ecx
mov ecx, 0x60b4ad53
ret 0x7f0d
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
adc eax, sym.imp.ADVAPI32.dll_RegQueryValueExW
call fcn.004606d2
test al, al
je 0x42c467
aaa
xor bl, dh
xchg ebp, eax
sti
xor byte [ecx], al
mov ah, 0x36
push ebx
iretd
je 0x42c43b
jbe 0x42c3f9
push edx
add eax, 0xde998e07
int 0
jo 0x42c3f2
sbb byte [esp + edx - 0x18], dl
add bh, byte [0xc0840003]
call fcn.0046016e
test al, al
je 0x42c486
cdq
cmpsd dword [esi], dword es:[edi]
push es
inc esp
int3
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x42c496
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x42c4a0
push eax
call esi
call fcn.004607e6
test al, al
je 0x42c4c2
hlt
call fcn.0046009f
test al, al
je 0x42c4e0
mov word [ebx + 0x2a], cs
test al, 3
jnp 0x42c4d8
xor esi, esp
mov esp, 0xfcf03af4
cld
xor byte [ebx + 0x62], bl
pop ecx
inc bl
adc dword [edi + 0x5e], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43bea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.00486960
add esp, 0xc
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x80c], 0
call fcn.00460420
test al, al
je 0x43bf13
invalid
jbe 0x43bf3f
dec ebp
mov dh, 0xce
ret
call fcn.0046023d
test al, al
je 0x43bf32
lea edx, [edx]
inc ecx
mov byte [0xfa75cdc4], al
mov edi, 0xe7bf2efe
adc byte [edi], ch
ret
call fcn.00460534
test al, al
je 0x43bf50
mov cl, 0x94
fadd qword [eax - 0x7b150368]
mov cl, 0xaf
pop ebp
jle 0x43becb
cwde
cld
ljmp 0x837e
and dword [ecx - 0x6e], ebp
adc eax, 0x1e862769
call fcn.004604aa
test al, al
je 0x43bf79
jne 0x43beee
push ebp
add al, 0xbf
pop edx
bound eax, qword [edi - 0x40]
xchg edi, eax
sbb eax, 0x2197c30a
mov esi, 0xfcc2d1dd
test al, 0x58
dec ebp
inc esp
sub dh, bl
xor eax, 0x7b47c333
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
call fcn.004607a1
test al, al
je 0x43bfc3
xchg ebp, eax
and eax, 0x3a0f19ef
pop edx
jno 0x43c01f
cli
pop eax
and al, 0x57
mov byte [0x48e4c9d3], al
rcr dword [ebx + 0x1a], 0x84
mov dh, 0x65
and eax, 0x1b0d311
call fcn.00460579
test al, al
je 0x43bfe8
aas
push esp
int3
cmp dword [ebp - 0x810], 0
jne 0x43c05d
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.49BFDA83_F9F7_456A_94F4_B04BB3B937B5
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.SmartCloudWB_Shell_Extension
lea eax, [ebp - 0x804]
test esp, edi
idiv edi
jmp dword [esi - 0x75]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43c04a
test dx, dx
je 0x43c046
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43c04a
add eax, 4
add ecx, 4
test dx, dx
jne 0x43c024
xor eax, eax
jmp 0x43c04f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43c09d
mov dword [ebp - 0x80c], 1
call fcn.004607e6
test al, al
je 0x43c076
into
inc edi
cmp al, 0xb0
neg byte [ecx + 0x17d46e6]
mov dl, 0xcd
push ebx
hlt
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x80c], 0
jmp 0x43c076
Function at 0x4448a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00486960
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.0040ad20
add esp, 0x18
call fcn.004601f8
test al, al
je 0x4448fe
sti
mov ecx, gs
mov eax, 0x3923143
or byte [eax + 0x44], cl
inc edx
xlatb
inc ebx
insd dword es:[edi], dx
sbb eax, 0x9ee88496
mov esi, 0xc0840001
call fcn.004607a1
test al, al
je 0x444917
add bh, ch
movsd dword es:[edi], dword [esi]
jmp 0x9cf51fd3
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x444950
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
in eax, 0x5d
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 4
push eax
push 0
push 0
push str.Start
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00460420
test al, al
je 0x4449ac
test eax, ebp
std
invalid
mov esp, 0xea2307cf
inc esp
jp 0x444951
dec edx
out 0x3d, eax
loope 0x44494b
fucompi st(5)
push 0xffffffffffffffe8
sub bh, byte [edx - 0x3f7bffff]
call fcn.004603db
test al, al
je 0x4449cc
mov ebx, 0x7b328865
cmp byte [esi + 0x68], ch
push eax
pcmpeqw mm4, qword [ecx]
jmp 0x4449dd
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], 2
pop edi
sete al
xor ecx, ebp
pop esi
int 0x5e
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x4449f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00486960
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.0040ad20
add esp, 0x18
call fcn.004606d2
test al, al
je 0x444a50
push ss
xchg ecx, eax
leave
pop ss
fsub dword [esi - 0x7f]
mov ebp, 0x424c70b8
stc
or ah, 0x37
js 0x444a6d
pushfd
int1
cmc
jge 0x444a39
call fcn.00460465
test al, al
adc byte [edx - 0x3f7bffff], bh
je 0x444a72
push 0x1dbf2de2
sbb al, 0x17
shl ch, cl
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
arpl word [ebx - 0x3b], dx
inc ebx
push 0x9b7884d1
wait
loopne 0x444ae2
mov ebx, esp
call fcn.00460282
test al, al
je 0x444a8f
invalid
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444bd0
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00486960
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
call dword [eax + 0x6a]
add byte [edx], ch
push str.ImagePath
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00460351
test al, al
je 0x444b21
leave
pop es
and al, 0x5b
pop esi
jg 0x444b30
pop es
retf
call fcn.004602c7
test al, al
je 0x444b41
mov bh, 1
add byte [eax + eax*8 - 0x888e88c], al
ja 0x444b23
sub dword [eax + edx*2 + 0x2c], ebp
outsb dx, byte [esi]
leave
outsd dx, dword [esi]
mov edi, 0x29035b78
out dx, al
fild qword [esi - 0x5ea1dd3e]
pushal
dec eax
lea eax, [ebp - 0x414]
push eax
call fcn.00494cf8
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x444b79
test dx, dx
je 0x444b75
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x444b79
add eax, 4
add ecx, 4
test dx, dx
jne 0x444b53
xor eax, eax
jmp 0x444b7e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x444b9a
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
call fcn.004600e4
test al, al
je 0x444bb3
fucomi st(6)
fldcw word [eax + 0x4129feba]
add dword [eax - 0x3c], edx
mov byte [0xe80010da], al
sti
mov ch, 1
add byte [eax + eax*8 - 0x4121eb8c], al
jmp 0x95ba1670
call fcn.004601b3
test al, al
je 0x444bd0
fidivr word [esi + 0x75caade9]
xchg ebp, eax
dec ebp
sbb eax, 0x9b35dc57
push ds
xchg ebx, eax
lahf
fstp xword [esi]
add ch, byte [ebx + ecx*4]
dec ebp
cld
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
Function at 0x445ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfd52
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
xor eax, eax
mov dword [ebp - 0x2c], 7
push str.SWUpd.exe
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00402510
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
je 0x44608e
jmp [eax + 0x52]
call fcn.004607e6
test al, al
je 0x445f4a
sub byte [edi], cl
jae 0x445f4a
mov eax, 0xee73c441
pop esp
in eax, 0x41
xlatb
jp 0x445ed4
clc
jl 0x445f7e
xor eax, eax
mov dword [ebp - 0x14], 7
push eax
push 0x625f30
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
rol bh, 0x45
in al, dx
pop es
add byte [eax], al
add byte [eax + 0x68], dl
xor byte [edi + 0x62], bl
add byte [ebp + 0x45c7d84d], cl
call 0x445f63
mov word [ebp - 0x28], ax
call fcn.00402510
mov eax, dword [0x63fa20]
mov byte [ebp - 4], 1
test eax, eax
jne 0x445fa5
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x445f9a
mov ecx, eax
call fcn.00450f00
jmp 0x445f9c
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x63fa20], eax
mov ecx, eax
call fcn.004617b1
mov edx, eax
cmp word [edx], 0
jne 0x445fb8
xor ecx, ecx
jmp 0x445fcf
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445fc0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402510
push 9
push str.SWUpd.exe
lea ecx, [ebp - 0x28]
call fcn.00404190
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446079
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004607e6
test al, al
je 0x446022
clc
test edx, 0x22a97f26
xchg edx, eax
sub esp, dword [ecx - 0xb2970a2]
fsub dword [ebx]
call fcn.004600e4
test al, al
je 0x44603c
rcr byte [esi + ebp*2], 0x10
dec edx
pushfd
test eax, 0x6a08a7d7
inc edi
adc dword [eax - 0x17b3673b], 0x1a0e8
call fcn.00460129
test al, al
je 0x44605a
sbb al, byte [ebx]
and edi, dword [ebx + 1]
sbb ecx, dword [ecx - 0x6e]
stosb byte es:[edi], al
cmp eax, 0x6a1bcd41
test bl, dh
stc
enter 0x291a, 0x3f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0x5c9f1c
push eax
call fcn.004679f1
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44608e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402610
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4460a3
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x445ed4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfd52
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
xor eax, eax
mov dword [ebp - 0x2c], 7
push str.SWUpd.exe
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00402510
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
je 0x44608e
jmp [eax + 0x52]
call fcn.004607e6
test al, al
je 0x445f4a
sub byte [edi], cl
jae 0x445f4a
mov eax, 0xee73c441
pop esp
in eax, 0x41
xlatb
jp 0x445ed4
clc
jl 0x445f7e
xor eax, eax
mov dword [ebp - 0x14], 7
push eax
push 0x625f30
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
rol bh, 0x45
in al, dx
pop es
add byte [eax], al
add byte [eax + 0x68], dl
xor byte [edi + 0x62], bl
add byte [ebp + 0x45c7d84d], cl
call 0x445f63
mov word [ebp - 0x28], ax
call fcn.00402510
mov eax, dword [0x63fa20]
mov byte [ebp - 4], 1
test eax, eax
jne 0x445fa5
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x445f9a
mov ecx, eax
call fcn.00450f00
jmp 0x445f9c
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x63fa20], eax
mov ecx, eax
call fcn.004617b1
mov edx, eax
cmp word [edx], 0
jne 0x445fb8
xor ecx, ecx
jmp 0x445fcf
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445fc0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402510
push 9
push str.SWUpd.exe
lea ecx, [ebp - 0x28]
call fcn.00404190
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446079
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004607e6
test al, al
je 0x446022
clc
test edx, 0x22a97f26
xchg edx, eax
sub esp, dword [ecx - 0xb2970a2]
fsub dword [ebx]
call fcn.004600e4
test al, al
je 0x44603c
rcr byte [esi + ebp*2], 0x10
dec edx
pushfd
test eax, 0x6a08a7d7
inc edi
adc dword [eax - 0x17b3673b], 0x1a0e8
call fcn.00460129
test al, al
je 0x44605a
sbb al, byte [ebx]
and edi, dword [ebx + 1]
sbb ecx, dword [ecx - 0x6e]
stosb byte es:[edi], al
cmp eax, 0x6a1bcd41
test bl, dh
stc
enter 0x291a, 0x3f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0x5c9f1c
push eax
call fcn.004679f1
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44608e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402610
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4460a3
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x458d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x643e00], ecx
inc eax
cmp eax, 0x100
jb 0x458d72
cmp eax, 0x800
jae 0x458e43
nop
mov edx, dword [eax*4 + 0x643a00]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x643e00]
mov dword [eax*4 + 0x643e00], edx
inc eax
cmp eax, 0x800
jb 0x458e20
mov dword [0x63fdc0], 0x459be0
call fcn.00459a10
mov ecx, dword [0x63fdc0]
test eax, eax
mov edx, 0x459c80
cmove ecx, edx
mov dword [0x63fdc0], ecx
ret
Function at 0x459f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x459f80
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x459fb2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x459faf
inc esi
cmp esi, edx
jb 0x459fa0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x45a0dc
cmp ecx, 3
jbe 0x459ff2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x45a030
cmp cl, 0xff
je 0x45a030
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x459f94
dec ecx
shl eax, cl
and eax, 7
je 0x459fca
movzx ecx, byte [eax + 0x5ca48c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5ca484], 0
mov cl, byte [edx + 4]
je 0x45a01a
test cl, cl
je 0x45a01a
cmp cl, 0xff
jne 0x459fca
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x459f94
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x45a05e
lea edx, [edi + ebx]
add edx, esi
jmp 0x45a064
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x45a0a2
movzx edi, byte [eax + 0x5ca48c]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x45a08e
cmp cl, 0xff
jne 0x45a0a2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x45a051
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x459f94
pop edi
pop esi
cmp ecx, 3
jbe 0x45a0f1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c1233
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x634274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x63fdc4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x63fdc4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5c6615
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0045fbb0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4617c9
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5bdc9b
call fcn.004aa3a5
mov esi, ecx
mov ebx, 0x5c6508
lea eax, [ebp - 0x230]
push ebx
push str.InstallTime
push str.AppInfo
push eax
call fcn.00461c72
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push ebx
call fcn.00434330
test eax, eax
jne 0x461879
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00486960
lea eax, [esi + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x46182d
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push str.InstallTime
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x461859
xor eax, eax
jmp 0x461866
lea eax, [ebp - 0x218]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402510
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.0048f705
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.00402450
mov eax, esi
call fcn.004aa360
ret