joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427180
Capabilities:
Read .ini file

Disassembly:
cmp dword [esp + 8], 0
push ebp
push esi
je 0x427229
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x427229
push edi
push 0x201
mov esi, 0x200
call fcn.0043fc2b
add esp, 4
mov edi, eax
mov eax, 0x4c10b4
test ebx, ebx
je 0x4271b9
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
push edx
push 0x200
push edi
push eax
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
call ebp
inc eax
cmp eax, 0x200
jb 0x427221
mov edi, edi
push edi
add esi, 0x200
call fcn.0043fc36
lea ecx, [esi + 1]
push ecx
call fcn.0043fc2b
add esp, 8
mov edi, eax
mov eax, 0x4c10b4
test ebx, ebx
je 0x427205
mov eax, ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 4]
mov edx, dword [esp + 0x18]
push ecx
push esi
push edi
push eax
mov eax, dword [esp + 0x24]
push edx
push eax
call ebp
inc eax
cmp eax, esi
jae 0x4271e0
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
test ebx, ebx
jne 0x427240
push 1
call fcn.0043fc2b
mov esi, eax
add esp, 4
mov byte [esi], bl
pop esi
pop ebp
ret 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427245
sub eax, edx
inc eax
push eax
call fcn.0043fc2b
mov esi, eax
mov eax, ebx
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427260
sub eax, edx
push ebx
inc eax
push eax
push esi
call fcn.004603b6
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x4277e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cf940
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
cmp edi, ebx
jne 0x427836
lea eax, [ebx + 0x57]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x427887
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x4c5144
push esi
push 2
push 0x2e3
push str..YWAssistant.c
push str.B_GetStartPage
call fcn.00429740
add esp, 0x1c
jmp 0x4278df
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
push ebx
push str.Start_Page
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x4278d7
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x4c51c8
push esi
push 2
push 0x2ea
push str..YWAssistant.c
push str.B_GetStartPage
call fcn.00429740
add esp, 0x20
jmp 0x4278df
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [edi], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.00427904
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427920
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cfd28
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov dword [esi], edi
push edi
call fcn.00461745
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4279bf
lea ebx, [edi + 8]
push 0x4c503c
push ebx
push 2
push 0x518
mov dword [ebp - 0x1c], ebx
push str..YWAssistant.c
push str.W_GetStartedService
call fcn.00429740
add esp, 0x18
mov dword [ebp - 4], 0xfffffffe
call fcn.00427aea
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4279e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push str.OpenSCManager__
push ebx
push 2
push 0x520
jmp 0x42798a
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push 1
push 0x30
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x427a25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push str.EnumServicesStatus__
push ebx
push 2
push 0x528
jmp 0x42798a
push eax
call fcn.00461745
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x427a67
mov ebx, 8
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x20]
push eax
push 0x4c5024
push ebx
push 2
push 0x52f
push str..YWAssistant.c
push str.W_GetStartedService
call fcn.00429740
add esp, 0x1c
jmp 0x42799f
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push edi
call fcn.00465b60
add esp, 0xc
push 0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push edi
push 1
push 0x30
mov edx, dword [ebp - 0x2c]
push edx
call esi
test eax, eax
jne 0x427aad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push str.EnumServicesStatus__
push ebx
push 2
push 0x536
jmp 0x42798a
xor esi, esi
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x24]
jae 0x42799f
lea eax, [esi + esi*8]
lea eax, [edi + eax*4]
cmp dword [eax + 0xc], 4
jne 0x427ae1
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0xc]
call fcn.00427280
add esp, 8
mov ebx, eax
mov dword [ebp - 0x1c], ebx
inc esi
jmp 0x427aaf
Function at 0x427b50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
xor eax, eax
push 0x18e
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00465b60
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
jne 0x427bbc
push str.WSAStartup__
push eax
push 2
push 0x560
push str..YWAssistant.c
push str.SocketStartup
call fcn.00429740
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret

Function at 0x428480
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cf900
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov ebx, 1
mov dword [ebp - 0x20], ebx
mov ecx, dword [edi]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x24]
push edx
push 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x428519
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x4c4f9c
push esi
push 2
push 0x6a4
push str..YWAssistant.c
push str.B_GetProxy
call fcn.00429740
add esp, 0x1c
jmp 0x4285bb
mov eax, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push str.ProxyEnable
mov eax, dword [ebp - 0x24]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
mov dword [ebp - 0x1c], eax
cmp eax, 2
jne 0x428552
xor esi, esi
mov dword [ebp - 0x1c], esi
jmp 0x4285bb
cmp dword [ebp - 0x2c], 0
je 0x42854b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [edi]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push str.ProxyServer
mov edx, dword [ebp - 0x24]
push edx
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 2
je 0x42854b
test esi, esi
je 0x4285b5
push str.ProxyServer
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x4c4fc4
push esi
push 2
push 0x6c1
push str..YWAssistant.c
push str.B_GetProxy
call fcn.00429740
add esp, 0x20
jmp 0x4285bb
mov eax, dword [ebp - 0x28]
inc eax
mov dword [edi], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.004285de
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428e90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cfcc8
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x164], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x158], eax
or esi, 0xffffffff
mov dword [ebp - 0x160], esi
xor ebx, ebx
mov dword [ebp - 0x168], ebx
push 0x124
push ebx
lea ecx, [ebp - 0x150]
push ecx
call fcn.00465b60
add esp, 0xc
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], 0x128
mov dword [ebp - 4], ebx
mov dword [edi], ebx
push ebx
call fcn.00461745
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x428f75
mov ebx, 8
mov dword [ebp - 0x15c], ebx
push 0x4c503c
push ebx
push 2
push 0x7eb
push str..YWAssistant.c
push str.W_GetRunningProcesses
call fcn.00429740
add esp, 0x18
mov dword [ebp - 4], 0xfffffffe
call fcn.00429048
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x160], esi
cmp esi, 0xffffffff
jne 0x428fa0
push 0x4c5610
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x7f2
jmp 0x428f39
lea edx, [ebp - 0x154]
push edx
push esi
call sub.KERNEL32.dll_Process32First
lea ecx, [ecx]
test eax, eax
je 0x428f4b
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x14c]
push eax
push 0x4c2348
lea ecx, [ebp - 0x28]
push ecx
call fcn.004604f1
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push edi
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x158]
call fcn.00427280
add esp, 8
mov ebx, eax
mov dword [ebp - 0x15c], ebx
test ebx, ebx
jne 0x428f4b
push 0x128
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00465b60
add esp, 0xc
mov dword [ebp - 0x154], 0x128
lea ecx, [ebp - 0x154]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
jmp 0x428fb0
Function at 0x4290b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cf880
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov eax, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebx], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x429146
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x4c563c
push esi
push 2
push 0x826
push str..YWAssistant.c
push str.B_GetJavascript
call fcn.00429740
add esp, 0x1c
jmp 0x4291a1
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
push edi
push str.1402
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x429196
push str.1402
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x4c565c
push esi
push 2
push 0x82d
push str..YWAssistant.c
push str.B_GetJavascript
call fcn.00429740
add esp, 0x20
jmp 0x4291a1
cmp dword [ebp - 0x24], edi
jne 0x4291a1
mov dword [ebx], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004291c6
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4291e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cf860
push 0x4677b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov ebx, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, edi
je 0x429275
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x4c563c
push esi
push 2
push 0x84f
push str..YWAssistant.c
push str.B_SetJavascript
call fcn.00429740
add esp, 0x1c
jmp 0x429319
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push edi
push str.1402
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, edi
je 0x4292c5
push str.1402
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x4c565c
push esi
push 2
push 0x856
push str..YWAssistant.c
push str.B_SetJavascript
call fcn.00429740
add esp, 0x20
jmp 0x429319
cmp dword [ebp - 0x1c], edi
je 0x429319
mov dword [ebp - 0x1c], edi
push ebx
lea edx, [ebp - 0x1c]
push edx
push ebx
push edi
push str.1402
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, edi
je 0x429319
mov ecx, dword [ebp - 0x1c]
push ecx
push str.1402
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x4c5680
push esi
push 2
push 0x862
push str..YWAssistant.c
push str.B_SetJavascript
call fcn.00429740
add esp, 0x24
mov dword [ebp - 4], 0xfffffffe
call fcn.0042933e
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x230], eax
cmp dword [0x4e0cb4], 0
push esi
jne 0x429717
push 0x104
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.00465b60
push 0x104
lea ecx, [esp + 0x139]
push 0
push ecx
mov byte [esp + 0x140], 0
call fcn.00465b60
push str.Chinese_simplified
push 0
call fcn.00465166
add esp, 0x20
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [esp + 0x12c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x128]
push 0x5c
push ecx
call fcn.004604da
mov esi, eax
add esp, 8
test esi, esi
jne 0x42963f
lea esi, [esp + 0x128]
jmp 0x429640
inc esi
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4c5704
push esi
lea ecx, [esp + 0x28]
push ecx
push str._s_s__s
push 0x104
push 0x4e0798
call fcn.0046056e
push 0x4c5704
push esi
lea edx, [esp + 0x40]
push edx
push str._s_s__s
push 0x104
push 0x4e09a2
call fcn.0046056e
push 0x4c5704
push esi
lea eax, [esp + 0x58]
push eax
push str._s_s__s
push 0x104
push 0x4e089d
call fcn.0046056e
add esp, 0x48
push 0x4c5704
push esi
lea ecx, [esp + 0x28]
push ecx
push str._s_s__s
push 0x104
push 0x4e0aa7
call fcn.0046056e
push 0x4c56f0
push esi
lea edx, [esp + 0x40]
push edx
push str._s_s__s
push 0x104
push 0x4e0bac
call fcn.0046056e
add esp, 0x30
lea eax, [esp + 8]
push eax
mov dword [0x4e0cb4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x234]
imul eax, eax, 0x105
pop esi
xor ecx, esp
add eax, 0x4e0798
call fcn.0045f97b
mov esp, ebp
pop ebp
ret
Function at 0x429a00
Capabilities:
Create http request
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a4718
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [ebx], vtable.CAutoUpdater.0
mov dword [esp + 0x10], vtable.CRegistry.0
call fcn.0044dc0d
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x429a4f
push 0x80004005
call fcn.00402ae0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], reloc.OLEAUT32.dll_SysReAllocString
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38], esi
call fcn.00402900
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
push edi
lea edx, [esp + 0x10]
push edx
push edi
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push str.CertificateRevocation
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x429ae4
push eax
call edi
mov dword [esp + 0x20], esi
push esi
push esi
push esi
push esi
push str.AutoUpdateAgent
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esp + 0x30], 0xffffffff
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], vtable.CRegistry.0
cmp eax, esi
je 0x429b15
push eax
call edi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429b35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x429b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a46e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [ecx], vtable.CAutoUpdater.0
mov ecx, dword [ecx + 4]
xor esi, esi
cmp ecx, esi
je 0x429bb1
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], vtable.CRegistry.0
call fcn.0044dc0d
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x429bd3
push 0x80004005
call fcn.00402ae0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], reloc.OLEAUT32.dll_SysReAllocString
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea ecx, [esp + 0x30]
mov dword [esp + 0x40], esi
call fcn.00402900
lea ecx, [esp + 0x24]
push ecx
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
push edi
lea edx, [esp + 0x14]
push edx
push edi
push esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push str.CertificateRevocation
push eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x429c6e
push eax
call edi
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x14], vtable.CRegistry.0
cmp eax, esi
je 0x429c89
push eax
call edi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429ca9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42a8f0
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2e50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
push 0x80
push 2
push edi
push 3
push 0x40000000
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x42a95b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push edi
push edi
push edi
push edi
push ecx
mov dword [ebp - 4], edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
cmp eax, edi
jne 0x42a976
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xa000
call fcn.0043fc2b
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x42a99b
push 0xa000
push edi
push esi
call fcn.00465b60
add esp, 0xc
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
push 0xa000
push 0
push esi
call fcn.00465b60
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
push 0x1000
push esi
push eax
call ebx
mov ecx, dword [ebp - 0x1c]
mov edi, ecx
test eax, eax
je 0x42aa07
test ecx, ecx
jbe 0x42aa2f
mov eax, dword [ebp + 0xc]
add dword [ebp - 0x14], ecx
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [ebp - 0x20]
je 0x42a9a1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4cf13c
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], 0x103
call fcn.004679cb
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4cf13c
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], 0x103
call fcn.004679cb
mov eax, 0x42aa2c
ret
test esi, esi
je 0x42aa3c
push esi
call fcn.0043fc36
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8