joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40911b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x547b32
call fcn.0054565c
sub esp, 0x10
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0x558c08
mov dword [edi + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
and dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00409894
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 4
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041beb3
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4091b6
push 1
call fcn.004180b5
pop ecx
mov dword [ebx], eax
xor edx, edx
jmp 0x4091ba
xor edx, edx
mov ebx, edx
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], ebx
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], edx
mov eax, dword [esi + 0x20]
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
mov eax, dword [esi + 0xc]
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov dword [eax], edx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], 4
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x40b83f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xd
ja 0x40ba53
xchg edi, edi
add dword [eax], eax
add byte [esi], dl
push ss
ja 0x40b7e3
xchg edx, eax
fisttp word [ebx - 0x44]
push cx
sbb ecx, dword [esi]
jo 0x40b869
mov edi, 0xbb97df11
pop ebx
test dword [eax - 0x6a], ebx
pop eax
xchg esi, eax
test eax, 0x48fc983a
sub al, 0x99
mov ah, 0x32
ja 0x40b84f
sar byte [ebx - 0xa], cl
xchg esi, eax
jmp 0x40b8d5
not byte [esi - 0x6da714d2]
adc al, 0xed
jbe 0x40b896
cmp eax, 0xfe2fe3a7
imul eax, ebp, 0x46
ror byte [esi - 0x1c], 0xd0
mov al, 0x16
add dword [ecx - 0x48], ebx
pop edx
imul ecx, ecx, 0xe9cae4ad
retf 0x445a
lodsd eax, dword [esi]
in al, 0xca
jmp 0x23851368
mov esp, eax
pop ss
inc eax
or cl, bl
sbb eax, 0xf19ce79d
pop es
xor ebx, dword [ecx + 0x14]
rol byte [ebp + 0x784b0396], 1
rcl dword [ebx - 0x73], cl
pop esp
imul eax, dword [eax], 0x3b82f71
invalid
jne 0x40b899
pop edx
dec edx
lds esp, [eax]
popfd
lodsd eax, dword [esi]
push edi
jnp 0x40b878
aad 0xd1
jno 0x40b8a6
insd dword es:[edi], dx
push es
pop ds
sbb byte [edi - 0x25406d8b], cl
adc bh, byte [esi - 0x15]
lds ecx, [edx + 0x33]
push dword [edx]
inc ecx
int3
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 4

Function at 0x40bcb7
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x33
ja 0x40becb
sal dword [ebx + ebx*2], cl
js 0x40bcea
cmp al, 0xf1
out 0x77, eax
pop esi
ja 0x40bd34
sbb byte [0xa6d64778], cl
jb 0x40bd25
dec ebp
sbb eax, 0xa90b2b9
adc al, byte [esi + 0x4d6af9b5]
sub ebp, dword [ebp - 0x38]
inc ebp
dec esi
and al, 0x81
mov edi, 0xc5ab9d39
fcmovnu st(0), st(0)
sar edi, cl
dec esi
pop ebp
fsub dword [ebx + 0x7f]
fsub dword [ebx + 0x7f]
sahf
fadd qword [edx - 0x4e9b811e]
cmp eax, dword [eax]
jbe 0x40bcfd
push edi
dec esi
out 0xd2, eax
pop edi
jle 0x40bcd4
aas
pop edx
or dh, ch
lcall 0x777c, 0xd0a7ef3
pushfd
pop ds
xor al, 0xcd
imul eax, dword [ebp + 0x3b2908c5], 0x11
sbb dword [ebp - 0x2c], edx
dec esp
sub dword [ebx], edi
adc dword [ecx], ebx
push ebp
aam 0x2e
dec esp
pushal
imul edi, dword [eax + 0xf]
stosb byte es:[edi], al
js 0x40bd56
js 0x40bd56
jnp 0x40bd1f
fbstp tbyte [eax]
mov esp, 0xa7dce80e
ret
cmpsb byte [esi], byte es:[edi]
cmp ah, byte [eax + 0x39]
add ebx, dword [eax]
sub eax, 0xa5b423e0
xlatb
popal
into
push ss
test byte [ebx + ebx*4 - 0x3974a68c], bl
dec edi
cli
push ecx
mov ah, 3
mov byte [0xc32f0c52], al
inc esp
ja 0x40bde1
in al, dx
mov dword [esi + ebp + 0x1e90bcf0], esp
inc ebp
mov al, byte [edx + ebp*2]
stosb byte es:[edi], al
ret
retf 0xc8cc
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
pop esi
cmp ecx, 0x80070002
je 0x40bef6
cmp ecx, 0x80070003
jne 0x40bef9
xor ecx, ecx
inc ecx
mov eax, ecx
pop ebp
ret 4
Function at 0x40c8dd
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
xchg ecx, eax
salc
idiv byte [ebp + 0x55162925]
mov ah, 0xb3
adc eax, 0xefa673c2
pop ebp
arpl bp, cx
iretd
jle 0x40c929
add al, 0x91
jl 0x40c8e7
std
js 0x40c849
mov eax, 0xeb856949
clc
invalid
adc al, 0
push ebx
inc esp
daa
or esp, dword [edi + 0x3f0ffe2d]
mov dh, 0xad
popal
jo 0x40c8bb
sal dword [ecx - 0x7ae0c38a], cl
adc ebx, dword [edi + edi*8 + 0x36]
call fcn.0041b9c0
pop ecx
pop esi
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x48
ja 0x40caf1
push esp
add byte [ebx - 0x78f0b708], al
inc dword [ecx]
add byte [eax], al
adc esp, esi
jns 0x40c8c6
or byte [eax + 0x6a], bl
pop edi
jae 0x40c90c
sahf
hlt
les eax, [ecx - 0x409aa043]
loop 0x40c8a9
adc al, 0
jbe 0x40c92b
sub eax, 0x21cd583f
cmp dword [0xfe7c1d7b], esp
dec ecx
out 0xc1, al
mov edx, eax
or byte [ebx + 0x3f], bh
jnp 0x40c96a
inc ebp
das
mov al, 0xde
invalid
cmc
std
jl 0x40c9d9
retf
push esi
jl 0x40ca09
mov eax, dword [0xaabbcede]
out 0x84, eax
pushal
mov al, byte [0xa97f0495]
mov dword [edx + ebx*8], edi
iretd
adc eax, 0xa6e45c00
ret
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
pop esi
lea eax, [ecx + eax*4]
pop ebp
ret 4

Function at 0x40e610
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x54930e
call fcn.0054565c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040eb91
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0040eb91
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040eb91
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040eb91
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040eb91
mov byte [ebp - 4], 4
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], 0
call fcn.0040eb91
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.0040eb91
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40e681
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x549360
call fcn.0054565c
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
or dword [esi], 0xffffffff
push 4
pop ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 4], vtable.CObjectVector_struct_CProperty_.0
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x18], vtable.CObjectVector_struct_CUpdateArchiveCommand_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
mov byte [esi + 0x2c], 1
call fcn.0040e610
mov byte [ebp - 4], 2
lea ecx, [esi + 0x8c]
mov byte [esi + 0x88], 0
call fcn.0040eb91
mov byte [ebp - 4], 3
lea ecx, [esi + 0x9c]
mov word [esi + 0x98], 0
call fcn.0040eb91
mov byte [ebp - 4], bl
xor ebx, ebx
lea ecx, [esi + 0xac]
mov word [esi + 0xa8], bx
mov byte [esi + 0xaa], bl
call fcn.0040eb91
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 5
call fcn.0040eb91
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], 8
mov dword [esi + 0xc4], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410d95
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags

Disassembly:
mov eax, 0x549ad5
call fcn.0054565c
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push ebx
mov dword [ebp - 0x10], edi
call fcn.0040eba9
and dword [ebp - 4], 0
add edi, 0xc
lea esi, [ebx + 0xc]
push esi
mov ecx, edi
mov dword [ebp + 8], edi
call fcn.0040eba9
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.0040eba9
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.0040eba9
lea eax, [esi + 0x24]
push eax
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 3
call fcn.0040eba9
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 4
call fcn.0040eba9
mov byte [ebp - 4], 5
mov al, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
lea eax, [esi + 0x40]
push eax
lea ecx, [edi + 0x40]
call fcn.0040eba9
lea eax, [esi + 0x4c]
push eax
lea ecx, [edi + 0x4c]
mov byte [ebp - 4], 6
call fcn.0040eba9
mov eax, dword [ebp - 0x10]
push 7
pop ecx
lea esi, [ebx + 0x64]
lea edi, [eax + 0x64]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x412f58
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x54a88d
call fcn.0054565c
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
call fcn.0040eb91
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x430e18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004237bb
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x430e50
xor eax, eax
jmp 0x430e7c
cmp esi, dword [ebp - 4]
je 0x430e79
cmp dword [ebp + 0xc], 0
je 0x430e79
push dword [edi + 0x9c]
call fcn.00430a26
push dword [edi + 0x9c]
mov esi, eax
call fcn.0041b53d
pop ecx
pop ecx
cmp esi, eax
je 0x430e4c
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x43139e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x571844]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004210d6
mov dword [ebp - 0x14], eax
cmp dword [0x576410], edi
jne 0x43148f
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x43141c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43156f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x43156f
push 0x553150
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43156f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x576410], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x576414], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x576418], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x576420], eax
test eax, eax
je 0x43148c
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57641c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4314b4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4314a7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4314c9
push 4
pop eax
jmp 0x431571
cmp dword [ebp - 0x14], edi
je 0x4314c9
push dword [0x576410]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4314ae
mov eax, dword [0x57641c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x431527
cmp dword [0x576420], esi
je 0x431527
push eax
call ebx
push dword [0x576420]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x431527
test eax, eax
je 0x431527
call ecx
test eax, eax
je 0x43151c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43151c
test byte [ebp - 8], 1
jne 0x431527
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x431557
mov eax, dword [0x576414]
cmp eax, esi
je 0x431554
push eax
call ebx
test eax, eax
je 0x431554
call eax
mov edi, eax
test edi, edi
je 0x431554
mov eax, dword [0x576418]
cmp eax, esi
je 0x431554
push eax
call ebx
test eax, eax
je 0x431554
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x576410]
call ebx
test eax, eax
je 0x43156f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x431571
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f131
leave
ret
Function at 0x437c96
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x545e89
call fcn.0054565c
sub esp, 0xb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xe
ja 0x437ebb
mov dword [0xbf55effa], eax
invalid
mov dword [ebp - 0x18], vtable.RegKey.0
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
cmp dword [ebp + 0x40], 8
lea eax, [ebp + 0x2c]
cmovae eax, dword [ebp + 0x2c]
push 0x20019
push eax
lea ecx, [ebp - 0x18]
call fcn.0047be21
mov ecx, dword [ebp + 0xc]
push ebx
push 0x553ec0
mov esi, eax
call fcn.00402a1d
push 0x553e58
lea ecx, [ebp - 0x30]
call fcn.004017f5
mov byte [ebp - 4], 3
test esi, esi
jne 0x437fa1
push 0x553ec0
lea ecx, [ebp - 0x10]
call fcn.00401a3b
mov byte [ebp - 4], 4
cmp dword [ebp + 0x28], 8
lea ecx, [ebp - 0x10]
lea eax, [ebp + 0x14]
cmovae eax, dword [ebp + 0x14]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0047b4bc
test eax, eax
jne 0x437f8a
push ecx
mov ecx, dword [ebp - 0x10]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00402beb
add eax, 0x10
lea ecx, [ebp - 0x48]
mov dword [esi], eax
call fcn.0049ddc1
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00401940
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004023ba
call fcn.004ae8cf
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
call fcn.004ae369
push eax
lea ecx, [ebp - 0x30]
call fcn.00401847
lea ecx, [ebp - 0x48]
call fcn.0040187f
lea ecx, [ebp - 0x18]
call fcn.0047b994
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004013c0
cmp byte [ebp + 0x10], 0
jne 0x437fb3
cmp dword [ebp - 0x20], 0
setne bl
jmp 0x43804d
cmp dword [ebp - 0x20], 0
je 0x43804d
lea eax, [ebp - 0x30]
push eax
call fcn.0043808e
test al, al
je 0x43801e
call fcn.004a76bc
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.004017cf
lea ecx, [ebp - 0x48]
call fcn.004a78f0
add esp, 0x18
lea ecx, [ebp - 0x30]
push eax
call fcn.00401847
lea ecx, [ebp - 0x48]
call fcn.0040187f
call fcn.004ae8cf
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.004ae617
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00401940
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004023ba
lea ecx, [ebp - 0xc0]
call fcn.00468e91
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.00468e00
lea ecx, [ebp - 0xc0]
mov bl, al
call fcn.00401798
lea ecx, [ebp - 0x30]
call fcn.0040187f
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.RegKey.0
call fcn.0047b994
push 0
push 1
lea ecx, [ebp + 0x14]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp + 0x2c]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret 0x3c
Function at 0x438e3b
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x545feb
call fcn.0054565c
sub esp, 0xa4
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 1
ja 0x438e70
and ah, 0xd0
inc ebp
call 0xf735f24c
invalid
xor ebx, ebx
push ebx
xor eax, eax
mov edi, 0x553ec0
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00402a1d
mov dword [ebp - 4], ebx
push ebx
xor eax, eax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
call fcn.00402a1d
sub esp, 0x18
mov ecx, esp
push str.URL_APPCION_EVENTS
mov byte [ebp - 4], 1
call fcn.004018f6
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0xf8]
call fcn.004468d8
sub esp, 0x18
mov ecx, esp
push str.OBJ_APPCION_EVENTS
call fcn.004018f6
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0xf8]
call fcn.004468d8
call fcn.004ae8cf
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.004ae369
push 0x10
pop esi
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], esi
jb 0x438f0c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004017f5
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0040187f
call fcn.004ae8cf
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xa4]
call fcn.004ae369
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], esi
jb 0x438f42
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x74]
call fcn.004017f5
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 7
call fcn.0040187f
cmp dword [ebp - 0x18], 0
je 0x438ffd
cmp dword [ebp - 0x30], 0
je 0x438ffd
lea ecx, [ebp - 0xac]
call fcn.00473d6b
mov byte [ebp - 4], 8
push dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xac]
call fcn.00473b0f
mov byte [ebp - 4], 9
cmp dword [ebp - 0x44], esi
push ebx
push ecx
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00401a83
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x60], esi
push ecx
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401a83
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x78], esi
push ecx
lea eax, [ebp - 0x8c]
cmovae eax, dword [ebp - 0x8c]
mov ecx, esp
push eax
call fcn.00401a83
mov byte [ebp - 4], 9
call fcn.0046272b
lea ecx, [ebp - 0x58]
call fcn.0040187f
lea ecx, [ebp - 0xac]
call fcn.004013dc
lea ecx, [ebp - 0x74]
call fcn.0040187f
lea ecx, [ebp - 0x8c]
call fcn.0040187f
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x43a91e
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x54628d
call fcn.0054565c
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 1
ja 0x43a950
xor bl, byte [ecx]
popal
add dword [esi + 0x57], esp
pop ebx
cmp eax, 0xa2cf057a
inc edi
jmp 0x860164cc
cmp byte [ebp + 8], 0
jne 0x43ab52
sub esp, 0x18
mov ecx, esp
push 0x554010
call fcn.004018f6
lea eax, [ebp - 0x40]
lea esi, [edi + 0xf8]
push eax
mov ecx, esi
call fcn.004459ac
and dword [ebp - 4], 0
sub esp, 0x18
lea eax, [edi + 0x9c]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.004018ce
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x55406c
call fcn.004018f6
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004018ce
sub esp, 0x18
mov ecx, esp
mov ebx, str.SOFTWARE_
push ebx
mov byte [ebp - 4], 3
call fcn.004018f6
push 0
push ecx
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0043ae93
call fcn.004ae8cf
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00444ff5
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0046d6ac
mov edx, eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.004ae617
sub esp, 0x18
mov byte [ebp - 4], 6
mov esi, esp
mov dword [ebp + 8], esp
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040191b
push esi
call int.0043ab63
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.LocalData
call fcn.004018f6
mov byte [ebp - 4], 8
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004018ce
sub esp, 0x18
mov ecx, esp
push ebx
mov byte [ebp - 4], 9
call fcn.004018f6
push 1
push ecx
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0043ae93
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004023ba
lea ecx, [ebp - 0x70]
call fcn.0040187f
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0046ef20
call fcn.004ae8cf
lea eax, [ebp - 0x28]
push eax
lea ecx, [edi + 0x10c]
call fcn.00444ff5
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0046d6ac
mov edx, eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xb
call fcn.004ae617
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov esi, esp
mov dword [ebp + 8], esp
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040191b
push esi
call int.0043ab63
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.TrackInstall
call fcn.004018f6
sub esp, 0x18
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004018ce
sub esp, 0x18
mov ecx, esp
push ebx
mov byte [ebp - 4], 0xf
call fcn.004018f6
push 1
push ecx
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.0043ae93
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.004023ba
lea ecx, [ebp - 0x58]
call fcn.0040187f
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0046ef20
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4