joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011f0
Capabilities:
Check for time delay via gettickcount
Check http status code
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4091d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [str.Accept:___r_n_r_n]
mov ecx, dword [0x40d070]
mov edx, dword [0x40d074]
push ebx
push ebp
push esi
mov dword [esp + 0x20], eax
mov eax, dword [0x40d078]
push edi
push 0x4000
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
xor edi, edi
add esp, 4
cmp esi, edi
setne byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x28]
push 0x84000100
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x48], ebx
je 0x401357
mov edx, dword [esp + 0x4c]
push 0x40d068
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
cmp ebp, edi
je 0x401357
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x20000013
push ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x40134d
mov eax, dword [esp + 0x14]
cmp eax, 0xc8
jb 0x4013aa
cmp eax, 0x12c
jae 0x4013aa
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
lea edx, [esp + 0x10]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x48]
push edx
push 0x4000
push esi
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40134d
mov eax, dword [esp + 0x10]
push ebp
test eax, eax
je 0x401369
push eax
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [esp + 0x20]
add esp, 0x10
add edi, eax
call ebx
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x50]
sub eax, edx
cmp eax, ecx
ja 0x40134d
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push ecx
push 0x4000
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x401307
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov al, byte [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
test al, al
je 0x4013cd
jmp 0x4013c4
call dword [sym.imp.MSVCRT.dll_fflush]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov al, byte [esp + 0x24]
add esp, 8
test al, al
mov dword [esp + 0x3c], 0xffffffff
je 0x401392
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov al, byte [esp + 0x20]
add esp, 4
test al, al
mov dword [esp + 0x3c], 0xffffffff
je 0x4013cd
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x401c30
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
sub esp, 0x158
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
push str.QIHOOFIXTOOL
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401c91
push 0x1000
push 0x41025c
push 0x410244
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 0x5c]
push 0x104
push eax
mov ecx, esi
call fcn.00401d00
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0x44
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x30], ecx
push ecx
lea ecx, [esp + 0x7c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
jne 0x401cf3
add esp, 0x158
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402150
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x164
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [esp + 0xc], 1
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4021ac
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x164
ret
lea edx, [esp + 0x10]
lea eax, [esp + 0x68]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0x412100
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4021e7
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x164
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x68]
push edx
call esi
test eax, eax
je 0x4021a1
lea eax, [esp + 0x68]
push str..._firstaidSuperKiller.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x68]
push ecx
call esi
test eax, eax
jne 0x40223c
push 0x1000
push 0x41025c
push 0x41027c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x40], edx
push edx
lea edx, [esp + 0x8c]
mov dword [esp + 0x48], 0x44
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4021a1
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4022b0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
mov dword [esp + 8], 0x104
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
pop edi
je 0x40230a
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 4]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0x412100
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402343
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
neg eax
add esp, 0x110
ret
Function at 0x402430
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40925b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push esi
push edi
lea ecx, [esp + 0x1c]
call fcn.00401000
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x23c]
mov dword [esp + 0x234], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [esi], 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4024b9
mov ecx, dword [esp + 8]
push ecx
jmp 0x4024e6
lea edx, [esp + 0x14]
lea eax, [esp + 0x128]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0x412100
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402519
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x234], 0xffffffff
call fcn.00401040
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x128]
push edx
call edi
test eax, eax
jne 0x402565
lea ecx, [esp + 0x1c]
mov dword [esp + 0x234], 0xffffffff
call fcn.00401040
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
lea eax, [esp + 0x128]
push str..._firstaidSuperKiller.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x128]
push ecx
call edi
test eax, eax
jne 0x4025b3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x234], 0xffffffff
call fcn.00401040
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
lea edx, [esp + 0x128]
lea ecx, [esp + 0x1c]
push edx
call fcn.00401070
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00401130
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4025f5
push str.4__3__0__1002
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jge 0x4025f5
mov dword [esi], 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x234], 0xffffffff
call fcn.00401040
mov ecx, dword [esp + 0x22c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x402630
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push esi
push eax
xor esi, esi
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402664
cmp dword [esp + 8], 6
jb 0x402664
mov ecx, dword [esp + 0xc]
mov eax, 1
cmp ecx, eax
jae 0x402666
mov eax, esi
pop esi
add esp, 0x94
ret
Function at 0x402670
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
sub esp, 0x14
push str.main_Start_FunC_r_n
call fcn.00402ce0
push str.SeShutdownPrivilege
call fcn.004020e0
push str.SeDebugPrivilege
call fcn.004020e0
add esp, 0xc
call fcn.004022b0
test eax, eax
je 0x4026f0
call fcn.00402370
test eax, eax
jne 0x4026f0
mov dword [esp + 8], eax
call fcn.00402630
test eax, eax
je 0x4026eb
lea eax, [esp + 8]
push eax
call fcn.00402430
add esp, 4
test eax, eax
je 0x4026eb
mov eax, dword [esp + 8]
test eax, eax
je 0x4026eb
push 0x1000
push 0x41025c
push 0x41027c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
call fcn.00402150
lea ecx, [esp + 4]
call fcn.00401400
lea ecx, [esp]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.004027a0
lea ecx, [esp]
call fcn.00402ad0
cmp eax, 1
jne 0x402736
push str.CheckNeedUpDate_UPDATE_NEED_r_n
call fcn.00402ce0
add esp, 4
lea ecx, [esp]
call fcn.004028b0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00401410
test eax, eax
jne 0x40275e
push 0x1000
push 0x41025c
push 0x41037c
jmp 0x40277a
lea ecx, [esp + 4]
call fcn.00401c30
test eax, eax
jne 0x402782
push 0x1000
push 0x41025c
push 0x41034c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp]
call fcn.004027d0
lea ecx, [esp + 4]
call fcn.00402ce0
xor eax, eax
add esp, 0x14
ret 0x10

Function at 0x4027e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
push str.GetUploadIniPath_FunC_r_n
call fcn.00402ce0
mov ecx, dword [esp + 0x118]
mov esi, dword [esp + 0x114]
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push 0x3048
lea ecx, [esp + 0x10]
push str.fixtool
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
call fcn.00402ce0
push 0x410454
call fcn.00402ce0
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40287b
call fcn.00402ce0
push str.INI_File_Already_Existing___r_n
call fcn.00402ce0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret 8
push 0x493e0
push esi
push str.http:__update.360safe.com_safe_fixtool.ini
call fcn.00401180
add esp, 0xc
neg eax
sbb eax, eax
xor edx, edx
and eax, 2
pop edi
dec eax
pop esi
cmp eax, 1
sete dl
mov eax, edx
add esp, 0x104
ret 8
Function at 0x4028b0
Capabilities:
Get common file path
Move file
Read .ini file
Terminate process

Disassembly:
sub esp, 0x414
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x321]
mov byte [esp + 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.DoUpdate_FunC_r_n
stosb byte es:[edi], al
call fcn.00402ce0
add esp, 4
lea eax, [esp + 0x118]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x118]
lea ecx, [esp + 0x14]
mov esi, 0x104
lea eax, [esp + 0x14]
sub edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x402966
mov byte [eax], cl
inc eax
dec esi
jne 0x402957
jmp 0x40296a
cmp esi, ebx
jne 0x40296b
dec eax
mov byte [eax], bl
mov ecx, 0x104
lea eax, [esp + 0x14]
cmp byte [eax], bl
je 0x402980
inc eax
dec ecx
jne 0x402976
jmp 0x4029c3
cmp ecx, ebx
je 0x4029c3
lea edx, [esp + 0x10]
test edx, edx
je 0x402995
mov eax, 0x104
sub eax, ecx
jmp 0x402999
mov eax, dword [esp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x14]
je 0x4029c3
mov esi, str..old
sub esi, eax
mov cl, byte [esi + eax]
cmp cl, bl
je 0x4029bc
mov byte [eax], cl
inc eax
dec edx
jne 0x4029ad
jmp 0x4029c0
cmp edx, ebx
jne 0x4029c1
dec eax
mov byte [eax], bl
lea eax, [esp + 0x14]
push 1
lea ecx, [esp + 0x11c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4029fc
push str.MoveFileEx_ERROR_r_n
call fcn.00402ce0
add esp, 4
call fcn.00402ce0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x414
ret
lea edx, [esp + 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x320]
lea ecx, [esp + 0x21c]
push eax
push 0x3048
push str.fixtool
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea edx, [esp + 0x320]
lea eax, [esp + 0x21c]
push edx
push 0x104
push eax
push ebx
push 0x410538
push str.TrackSuperKiller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x118]
push 0x493e0
lea edx, [esp + 0x220]
push ecx
push edx
call fcn.00401180
add esp, 0xc
test eax, eax
jne 0x402a7d
push str.InternetDownloadFile_TrackSuperKiller_ERROR___r_n
jmp 0x402aae
push str.InternetDownloadFile_TrackSuperKiller_Successful___r_n
call fcn.00402ce0
add esp, 4
mov ecx, ebp
call fcn.00402c60
test eax, eax
je 0x402aa9
push str.StartAnotherInstance_Successful___r_n
call fcn.00402ce0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.StartAnotherInstance_ERROR___r_n
call fcn.00402ce0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x414
ret
Function at 0x402ad0
Capabilities:
Check if file exists
Delete file
Get common file path
Read .ini file
Terminate process

Disassembly:
sub esp, 0x208
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push 0x3048
push str.fixtool
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x402b8e
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402b8e
push 0x1004
push 0x41025c
push 0x4105a8
push eax
call edi
cmp eax, 6
jne 0x402b83
call fcn.004020d0
jmp 0x402b8e
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
lea edx, [esp + 0xc]
push 0x104
push edx
mov ecx, esi
call fcn.004027e0
test eax, eax
jne 0x402bb0
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x208
ret
lea eax, [esp + 0xc]
push eax
push 0
push str.update
push str.TrackSuperKiller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push 0x104
push edx
push 0
push 0x41059c
push str.TrackSuperKiller
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x110]
push str.4.3.0.2003
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jle 0x402c3e
push 0x1024
push 0x41025c
push 0x410578
push 0
call edi
cmp eax, 7
jne 0x402c4a
test esi, esi
je 0x402c3e
push 0x1000
push 0x41025c
push 0x410568
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x208
ret
cmp eax, 6
jne 0x402c3e
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x208
ret

Function at 0x402c60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x158
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x59]
mov byte [esp + 0x58], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x14]
mov dword [esp + 4], ecx
push edx
mov dword [esp + 0xc], ecx
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 0x44
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x78]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
add esp, 0x158
ret
Function at 0x402d30
Capabilities:
Delete file

Disassembly:
sub esp, 0x130
push ebx
push esi
mov esi, dword [esp + 0x140]
push edi
mov ebx, dword [esp + 0x140]
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push 1
push esi
push ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.00408db0
mov edx, dword [esp + 0x20]
add esp, 0x14
mov edi, eax
push edx
push str.index_d_n
call fcn.00402ce0
add esp, 8
test edi, edi
jne 0x402e20
push str.____FindZipItem_returned_OK
call fcn.00402ce0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
push 2
push edi
push esi
push eax
push ebx
call fcn.00408e00
add esp, 0x14
test eax, eax
jne 0x402e07
push str.____UnzipItem_returned_OK
call fcn.00402ce0
push 4
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0xc
test eax, eax
jne 0x402dee
push str.____Target_file_created_OK
call fcn.00402ce0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x130
ret
push str.____UnzipItem_failed_to_create_target_file
call fcn.00402ce0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x130
ret
push str.____UnzipItem_returned_failed
call fcn.00402ce0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x130
ret
push str.____FindZipItem_returned_failed
call fcn.00402ce0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x130
ret
Function at 0x404190
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x18]
push edi
test eax, eax
je 0x404290
mov ecx, dword [ebx + 0x1c]
mov eax, dword [esp + 0x20]
mov edx, dword [ebx + 0x20]
add ecx, eax
cmp ecx, edx
jb 0x404262
add edx, edx
cmp edx, ecx
jbe 0x4041c6
mov edi, edx
mov dword [esp + 0x10], edi
jmp 0x4041cc
mov dword [esp + 0x10], ecx
mov edi, ecx
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x4041f6
pop edi
pop esi
pop ebp
mov eax, 0x300
pop ebx
add esp, 8
ret 8
push edi
push 0
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
jne 0x404223
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x300
pop ebx
add esp, 8
ret 8
mov ecx, dword [ebx + 0x20]
mov esi, dword [ebx + 0x18]
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x18], ebp
mov edi, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
mov esi, dword [esp + 0x1c]
mov ecx, eax
add edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, dword [ebx]
test eax, eax
je 0x4042c4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
mov dword [ebx + 0xc], 0x1000000
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8