joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4760c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x476122
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004760b8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004651ec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00464dec
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476129
lea eax, [ebp - 4]
call fcn.004044a0
ret

Function at 0x479958
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479a92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00415c2c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x4799d4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4799d4
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408650
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x49327c]
mov ebx, dword [ebx]
mov eax, 0x479aa8
call ebx
dec eax
jne 0x4799d4
mov ebx, 1
jmp 0x4799d6
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x479a77
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0047186c
test al, al
jne 0x479a6b
mov eax, dword [ebp - 4]
call fcn.0047994c
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.004044f4
xor edx, edx
push ebp
push 0x479a59
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x479a4f
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00479d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x479a6b
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4799ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479a99
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004044c4
ret
Function at 0x487a10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x487c1b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4938d8]
cmp dword [eax], 1
jne 0x487bed
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x487c2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x487aa1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x487c5c
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x487bb8
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x14], 0
je 0x487bb8
lea eax, [ebp - 0x10]
mov ecx, 0x21
xor edx, edx
call fcn.00404590
mov edi, dword [ebp - 0x14]
dec edi
test edi, edi
jl 0x487bb8
inc edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x21
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404960
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x10]
call fcn.00404960
mov edx, eax
lea eax, [ebp - 0x12c]
call fcn.00403190
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x2c]
call fcn.00404704
push dword [ebp - 0x2c]
push 0x487c78
push 0x487c84
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404820
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404960
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x487bae
mov eax, dword [ebp - 0x10]
call fcn.00404960
mov edx, eax
lea eax, [ebp - 0x130]
call fcn.00404698
mov edx, dword [ebp - 0x130]
mov eax, dword [esi + 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x1c]
dec edi
jne 0x487b03
cmp dword [ebp - 4], 0
je 0x487bc7
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 8], 0
je 0x487bd6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x487bed
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487c22
lea eax, [ebp - 0x130]
call fcn.004044a0
lea eax, [ebp - 0x2c]
call fcn.004044a0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044c4
ret
Function at 0x488a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404950
xor eax, eax
push ebp
push 0x488bc1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004846e4
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00484704
mov ebx, eax
jmp 0x488b8d
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404710
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040912c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408650
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408650
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004048ac
je 0x488b64
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404710
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408650
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408650
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004048ac
jne 0x488b7e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00484724
mov ebx, eax
test ebx, ebx
jne 0x488abf
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488bc8
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004044c4
lea eax, [ebp - 4]
call fcn.004044a0
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40184a
Capabilities:
Get file version info

Disassembly:
push 0x20
mov eax, 0x41916c
call fcn.00414f0b
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
cmp esi, edi
jne 0x401878
mov eax, 0x80004005
jmp 0x401a43
push esi
call fcn.0040976b
mov ebx, eax
pop ecx
mov dword [ebp - 0x24], ebx
cmp ebx, edi
je 0x40186e
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40186e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40186e
mov eax, dword [0x426040]
mov esi, 0x426040
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
mov eax, dword [0x426040]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov eax, dword [0x426040]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
push eax
mov esi, str.000_x
push esi
lea eax, [ebp - 0x10]
call fcn.00408221
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
push 4
pop ecx
lea eax, [ebp - 0x10]
call fcn.00407472
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004071fd
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00408965
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 2]
push eax
push esi
lea eax, [ebp - 0x10]
call fcn.00408221
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
push 4
pop ecx
lea eax, [ebp - 0x10]
call fcn.00407472
mov byte [ebp - 4], 4
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
mov eax, edi
call fcn.004079f4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00408965
mov ebx, dword [ebp - 0x18]
push ebx
push str.StringFileInfo_sProductVersion
lea eax, [ebp - 0x1c]
call fcn.00408221
pop ecx
pop ecx
mov edi, 0x100
push edi
lea esi, [ebp - 0x1c]
call fcn.00407a74
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 8], edi
jge 0x4019ac
push 0x80070057
call fcn.00408ec9
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + 0x200], cx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x24]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x4019ee
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00408965
lea eax, [ebx - 0x10]
call fcn.00408965
lea eax, [esi - 0x10]
call fcn.00408965
jmp 0x40186e
push dword [esi - 8]
push esi
call fcn.0040abd4
pop ecx
pop ecx
test eax, eax
js 0x4019a2
cmp eax, dword [esi - 8]
jg 0x4019a2
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
push 0x41c574
call fcn.00408221
push dword [ebp - 0x24]
call fcn.004097ff
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00408965
lea eax, [ebx - 0x10]
call fcn.00408965
lea eax, [esi - 0x10]
call fcn.00408965
xor eax, eax
call fcn.00414faa
ret
Function at 0x401cd5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x426084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ebx, [ebp - 0x20]
mov esi, ecx
call fcn.00401c7e
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x401cfd
mov eax, ebx
push eax
push 0xff
push esi
push 0x423a34
push 0x41c33c
push str.autoupdate
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x401d3f
mov ebx, 0x80004005
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.00408d33
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040937a
leave
ret
xor ebx, ebx
jmp 0x401d22

Function at 0x401d43
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4194c7
mov eax, dword fs:[0]
push eax
mov eax, 0x2074
call fcn.00413390
mov eax, dword [0x426084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x202c]
mov ebx, ecx
call fcn.00401b7a
and dword [ebp - 4], 0
mov esi, 0x41c6e4
push esi
call fcn.0040999c
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x202c]
call fcn.00407ca6
cmp dword [ebx + 0x14], 8
jb 0x401da8
mov ebx, dword [ebx]
cmp dword [ebp - 0x2018], 8
mov eax, dword [ebp - 0x202c]
jae 0x401dbd
lea eax, [ebp - 0x202c]
push ebx
push eax
lea eax, [ebp - 0x2010]
push str.__s___s
push eax
call fcn.0040837a
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x2080]
push ebx
push eax
call fcn.00409a20
xor eax, eax
lea edi, [ebp - 0x203c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x1c
cmp dword [ebp - 0x2018], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x202c]
mov dword [ebp - 0x2080], esi
jae 0x401e0d
lea eax, [ebp - 0x202c]
lea ecx, [ebp - 0x203c]
push ecx
lea ecx, [ebp - 0x2080]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x401e47
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
push 1
xor edi, edi
lea esi, [ebp - 0x202c]
call fcn.00408d33
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040937a
leave
ret
push dword [ebp - 0x2034]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x2038]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x203c]
call esi
jmp 0x401e49
Function at 0x401e98
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x419129
call fcn.00414f0b
lea eax, [ebp - 0x14]
push eax
mov edi, str.SoftWareBaidu_
call fcn.00407156
push dword [ebp + 8]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00407267
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], esi
jne 0x401ef3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00408965
xor eax, eax
call fcn.00414faa
ret
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push str.update_available
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
cmp dword [ebp - 0x18], esi
jne 0x401f32
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00408965
mov eax, esi
jmp 0x401eed
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 0x18]
sbb esi, esi
neg esi
jmp 0x401f23
Function at 0x401f43
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419494
mov eax, dword fs:[0]
push eax
mov eax, 0x1240
call fcn.00413390
mov eax, dword [0x426084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x1234]
call fcn.00401b7a
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x401f8c
mov eax, dword [eax]
lea ecx, [ebp - 0x123c]
push ecx
mov edi, eax
call fcn.00407156
push 1
xor edi, edi
lea esi, [ebp - 0x1234]
mov byte [ebp - 4], 2
call fcn.00408d33
mov esi, 0x41c6e4
push esi
call fcn.0040999c
pop ecx
push eax
push esi
lea eax, [ebp - 0x123c]
call fcn.004079f4
lea eax, [ebp - 0x1244]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x40200f
xor esi, esi
mov eax, dword [ebp - 0x123c]
add eax, 0xfffffff0
call fcn.00408965
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040937a
leave
ret
mov eax, dword [ebp - 0x1244]
and dword [ebp - 0x1238], edi
shr eax, 2
mov dword [ebp - 0x1240], eax
test eax, eax
je 0x401fe3
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x204]
push 0
mov esi, str._unknown_
lea edi, [ebp - 0x218]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00409a20
mov eax, dword [ebp - 0x1238]
add esp, 0xc
push dword [ebp + eax*4 - 0x1218]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4020a8
lea eax, [ebp - 0x124c]
push eax
push 4
lea eax, [ebp - 0x1248]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4020a8
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x1248]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x123c]
push eax
call fcn.004072b4
push esi
test eax, eax
je 0x4020df
call ebx
inc dword [ebp - 0x1238]
mov eax, dword [ebp - 0x1238]
cmp eax, dword [ebp - 0x1240]
jb 0x40202e
jmp 0x401fe3
call ebx
xor esi, esi
inc esi
jmp 0x401fe5
Function at 0x4020e9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x419129
call fcn.00414f0b
lea eax, [ebp - 0x14]
push eax
mov edi, str.SoftWareBaidu_
call fcn.00407156
push dword [ebp + 8]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00407267
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], esi
jne 0x402144
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00408965
xor eax, eax
call fcn.00414faa
ret
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push str.update_running
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
cmp dword [ebp - 0x18], esi
jne 0x402183
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00408965
mov eax, esi
jmp 0x40213e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 0x18]
sbb esi, esi
neg esi
jmp 0x402174

Function at 0x402194
Capabilities:
Terminate process

Disassembly:
push 0x258
mov eax, 0x419572
call fcn.00414f74
push 0x41c778
mov ebx, str.bdupdate_
push ebx
push 0x25
mov esi, ecx
call fcn.00408f0a
push esi
call fcn.00401e98
add esp, 0x10
test eax, eax
jne 0x4021dd
push str.IsUpdateAvailable
push ebx
push 0x25
call fcn.00408f0a
xor eax, eax
add esp, 0xc
inc eax
call fcn.00414fbe
ret
push str.__pending_install
lea eax, [ebp - 0x22c]
call fcn.00408e5a
xor edi, edi
mov dword [ebp - 4], edi
mov esi, str.show
cmp dword [ebp + 8], edi
jne 0x402201
mov esi, str.hide
push str.__visible
lea eax, [ebp - 0x264]
call fcn.00408e5a
push esi
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 1
call fcn.00408396
add esp, 0xc
push edi
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.00407c09
push 1
xor edi, edi
lea esi, [ebp - 0x248]
call fcn.00408d33
push 1
lea esi, [ebp - 0x264]
mov byte [ebp - 4], 0
call fcn.00408d33
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00409a20
mov eax, dword [ebp - 0x22c]
add esp, 0xc
cmp dword [ebp - 0x218], 8
jae 0x40228d
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x210]
push str.StartAutoUpdateWithParam
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x25
call fcn.00408f0a
add esp, 0x18
lea ecx, [ebp - 0x22c]
call fcn.00401d43
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40232d
Capabilities:
Check mutex on windows

Disassembly:
push 0x24c
mov eax, 0x4195b0
call fcn.00414f74
lea eax, [ebp - 0x24c]
mov edi, ecx
push eax
call fcn.00407156
push 0xd
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, str.BaiduBrowser_MessageWindow
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x41c93c
mov edi, str.bdupdate_
push edi
push 0x25
call fcn.00408f0a
add esp, 0xc
push ebx
lea eax, [ebp - 0x48]
push eax
push ebx
push 0xfffffffffffffffd
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x254], eax
cmp eax, ebx
jne 0x40239f
lea esi, [ebp - 0x24c]
call fcn.00401b0a
test al, al
jne 0x40239f
xor esi, esi
inc esi
jmp 0x4023ae
xor esi, esi
mov eax, str.b0R
cmp dword [ebp - 0x254], ebx
jne 0x4023b3
mov eax, 0x41c954
push eax
push 0x41c95c
push edi
push 0x25
call fcn.00408f0a
xor eax, eax
push 0x1fe
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push ebx
push eax
call fcn.00409a20
add esp, 0x1c
lea ecx, [ebp - 0x248]
call fcn.00401cd5
cmp esi, ebx
je 0x402501
lea eax, [ebp - 0x248]
push eax
call fcn.004020e9
pop ecx
test eax, eax
je 0x402440
call fcn.00401f43
test eax, eax
je 0x402440
push str.RGS
push edi
push 0x25
call fcn.00408f0a
push 1
lea ecx, [ebp - 0x248]
call fcn.00402194
mov eax, dword [ebp - 0x24c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00408965
xor eax, eax
inc eax
call fcn.00414fbe
ret
mov eax, dword [0x426040]
mov ecx, 0x426040
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x248]
push eax
push str.baidu__s_autoupdate_install_mutex
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
call fcn.00408221
pop ecx
pop ecx
push dword [ebp - 0x250]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x258], eax
call esi
call esi
cmp eax, 0xb7
jne 0x4024f0
call fcn.00401f43
test eax, eax
je 0x4024f0
push 0x41c9fc
push edi
push 0x25
call fcn.00408f0a
add esp, 0xc
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
call fcn.00408965
xor esi, esi
inc esi
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
call fcn.00408965
mov eax, esi
jmp 0x40243a
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
call fcn.00408965
mov eax, dword [ebp - 0x24c]
xor esi, esi
cmp dword [eax - 0xc], ebx
je 0x402523
push str.init
lea eax, [ebp - 0x24c]
push eax
call fcn.0040728d
test eax, eax
jne 0x4024db
lea eax, [ebp - 0x248]
push eax
call fcn.00401e98
pop ecx
test eax, eax
jne 0x402570
lea eax, [ebp - 0x248]
push eax
call fcn.004020e9
pop ecx
test eax, eax
jne 0x402570
cmp dword [ebp - 0x254], ebx
jne 0x4024db
call fcn.00401a49
test eax, eax
je 0x4024db
push 0x41ca80
push edi
push 0x25
call fcn.00408f0a
add esp, 0xc
call fcn.004022c6
jmp 0x4024db
cmp dword [ebp + 8], ebx
jne 0x4024db
cmp dword [ebp - 0x254], ebx
jne 0x4024db
push 0x41ca40
push edi
push 0x25
call fcn.00408f0a
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x248]
call fcn.00402194
add esp, 0x10
jmp 0x4024db