joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bffc
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x210
mov eax, 0x489d97
call fcn.0043bd66
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0045ea50
add esp, 0xc
lea eax, [ebp - 0x218]
mov ebx, 0x104
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x48fc4c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c0f8
call fcn.00401f79
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040171b
push ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.0040237b
push ebx
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.00402509
lea eax, [ebp - 0x218]
push eax
push ebx
push esi
push 0x48f370
push str.state
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call fcn.004024c0
mov esi, dword [ebp - 0x21c]
push str.AnyUpdate
push esi
call fcn.0040b8ae
pop ecx
pop ecx
test eax, eax
je 0x41c0eb
push str.bigupdate
push esi
call fcn.0040b8ae
pop ecx
pop ecx
test eax, eax
jne 0x41c0ee
xor edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.004024a8
mov eax, edi
call fcn.0043bd10
ret

Function at 0x41c984
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
push edi
push 0x210
xor edi, edi
push edi
push eax
call fcn.0045ea50
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x108
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 1
push 1
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], edi
push eax
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040ead9
pop edi
pop esi
test eax, eax
jne 0x41c9fb
push str._n_Adjustprivilege:_CreateProcess_fail.__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
jmp 0x41c9fd
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bcea
leave
ret

Function at 0x41ca09
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp word [0x4b59e0], 0
push esi
mov esi, 0x4b59e0
jne 0x41ca2e
push str.config.ini
call fcn.0041cb37
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp byte [ebp + 8], 0
je 0x41ca4e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41ca4e
push 0x20a
push eax
push esi
call fcn.0045ea50
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x41cab4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41cb26
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x41cb17
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00468b64
pop ecx
pop ecx
test eax, eax
je 0x41cb1d
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41caf7
jmp 0x41cb1f
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcea
leave
ret

Function at 0x41cbdc
Capabilities:
Check if file exists

Disassembly:
push 0x24c
mov eax, 0x489ee5
call fcn.0043bd66
mov dword [ebp - 0x23c], str.UtilsCef69LibCef.dll
mov dword [ebp - 0x238], str.UtilsCef69CefView.exe
call fcn.0041cb37
push eax
lea ecx, [ebp - 0x234]
call fcn.0040349c
xor esi, esi
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
call fcn.00411b73
lea edi, [ebp - 0x23c]
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0045ea50
add esp, 0xc
lea eax, [ebp - 0x254]
cmp dword [ebp - 0x240], 8
cmovae eax, dword [ebp - 0x254]
push dword [edi]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cca0
add edi, 4
lea eax, [ebp - 0x234]
cmp edi, eax
jne 0x41cc39
lea ecx, [ebp - 0x254]
call fcn.00406654
xor esi, esi
inc esi
jmp 0x41ccab
lea ecx, [ebp - 0x254]
call fcn.00406654
lea ecx, [ebp - 0x234]
call fcn.00406654
mov eax, esi
call fcn.0043bd10
ret

Function at 0x41ccbe
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0045ea50
add esp, 0xc
push esi
call fcn.0041cb37
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00428480
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bcea
leave
ret
Function at 0x41cd25
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.0043be70
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1058]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x44
pop edi
push edi
push 0
push eax
call fcn.0045ea50
add esp, 0xc
mov dword [ebp - 0x1058], edi
lea eax, [ebp - 0x1058]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x102c], 1
mov word [ebp - 0x1028], ax
lea edi, [ebp - 0x1014]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x41cdd6
push 0x1000
xor edi, edi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.0045ea50
push ebx
push esi
lea eax, [ebp - 0x1004]
push 0x48f378
push eax
call fcn.0040baab
add esp, 0x1c
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1004]
push eax
push edi
jmp 0x41cdee
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x41ce10
push dword [ebp - 0x1010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1014]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcea
leave
ret
Function at 0x425860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a881
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.00401f79
mov ecx, eax
test ecx, ecx
je 0x4259f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4259b5
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4259a7
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4259b5
add eax, 0x10
push 0x4b5f28
push eax
mov dword [ebp - 0x20], eax
call fcn.0043c146
mov esi, eax
add esp, 8
test esi, esi
je 0x4259b5
push dword [ebp - 0x20]
push 0
push esi
call fcn.0045ea50
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42596a
push esi
call fcn.0043be66
add esp, 4
jmp 0x4259b5
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425970
sub ecx, edx
sar ecx, 1
je 0x42599e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425986
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00402534
push esi
call fcn.0043be66
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4259b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4259d4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00401bdf
int3
Function at 0x425a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x425a24
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x425a86
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x425a86
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x425aa1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x426780
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a9df
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b0364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00401f79
mov ecx, eax
test ecx, ecx
je 0x426934
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00401f79
mov ecx, eax
test ecx, ecx
je 0x42693e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00401f79
mov ecx, eax
test ecx, ecx
je 0x426948
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x426858
xor ecx, ecx
jmp 0x426870
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426860
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00402534
push edi
mov ecx, ebx
call fcn.00426b80
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42688c
xor ecx, ecx
jmp 0x4268a4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426894
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00402534
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00427640
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.00426b80
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4268e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x42691e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42691e
cmp dword [esi + 0x10], 0
je 0x426915
push dword [edi]
call fcn.00471e14
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00401bdf
push 0x80004005
call fcn.00401bdf
push 0x80004005
call fcn.00401bdf
int3
Function at 0x4274c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48aae8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x427621
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x427518
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x427621
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x427532
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x427621
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x42754c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x427621
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x427566
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x427621
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x427621
push 3
mov ecx, esi
call fcn.00427480
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.004225ff
push 0x494f40
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0040e8af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4275be
push 0
mov ecx, esi
call fcn.00427480
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4275cf
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x427611
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x427611
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x427611
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.0040349c
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.00403b1f
lea ecx, [ebp - 0x2c]
call fcn.00418c33
lea ecx, [ebp - 0x28]
call fcn.00403b1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret 4
Function at 0x4290f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ae2b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi]
mov eax, dword [ebp + 8]
push eax
call dword [edx]
cmp byte [edi + 0xc], 0
je 0x429226
mov ebx, dword [edi + 0x14]
lea esi, [edi + 0x20]
push 0x180
push 0x40
push 0x8109
push ebx
push esi
call fcn.00472772
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x429206
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0045ea50
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.00403368
push 0x494cb8
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push ebx
push str.open
push eax
call fcn.0040277d
add esp, 8
push eax
call fcn.0040277d
add esp, 8
push eax
call fcn.0040277d
add esp, 8
mov ecx, eax
call fcn.00409f34
push eax
call fcn.0040277d
add esp, 8
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00429030
cmp dword [eax + 0x14], 8
jb 0x4291e9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xd8]
call fcn.00403b1f
lea ecx, [ebp - 0xa8]
call fcn.004040b0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42921c
push 2
push 0
push eax
call fcn.00472c40
add esp, 0xc
jmp 0x42921f
or eax, 0xffffffff
mov dword [edi + 8], eax
mov byte [edi + 0xc], 0
mov eax, dword [edi + 4]
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x429344
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor bl, bl
push 0
push eax
call esi
test eax, eax
movzx edx, bl
mov ecx, 1
cmove edx, ecx
mov dword [ebp - 0xac], edx
test dl, dl
jne 0x429279
cmp dword [ebp + 0xc], 0
je 0x429271
push 0xffffffffffffffff
push dword [edi + 4]
call esi
mov byte [ebp - 0xac], 1
jmp 0x429279
test dl, dl
je 0x429344
lea ecx, [edi + 0x24]
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
cmp eax, ecx
je 0x42931d
mov esi, dword [ecx]
mov dword [ecx], 0
mov edx, dword [ecx + 4]
mov dword [ecx + 4], 0
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], eax
mov dword [ecx + 8], 0
cmp esi, edx
je 0x42931d
nop dword [eax]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x4292ea
mov ecx, dword [esi]
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x429309
push dword [esi + 0x10]
push ecx
push eax
call fcn.00473477
mov edx, dword [ebp - 0xbc]
add esp, 0xc
mov ecx, eax
jmp 0x42930c
or ecx, 0xffffffff
mov ebx, dword [edi + 8]
add esi, 0x18
add ebx, ecx
mov dword [edi + 8], ebx
cmp esi, edx
jne 0x4292e0
jmp 0x429320
mov ebx, dword [edi + 8]
lea ecx, [ebp - 0xb8]
call fcn.0040bbc1
cmp byte [ebp - 0xac], 0
je 0x429340
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x429347
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret 8
Function at 0x429ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x4b7300], 0
jne 0x429e1b
cmp dword [ecx + 0x2c], 8
lea eax, [ecx + 0x18]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
jb 0x429d2a
mov eax, dword [eax]
push edi
push 0x20219
push eax
push dword [ecx + 0x30]
lea ecx, [ebp - 0x818]
call fcn.0040cf24
mov edi, dword [ebp - 0x818]
test eax, eax
jne 0x429dfc
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push str.FROM
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429dfc
mov eax, dword [ebp - 0x80c]
cmp eax, 1
je 0x429d8e
cmp eax, 2
jne 0x429dfc
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x429dab
test al, 1
jne 0x429dfc
shr eax, 1
cmp word [ebp + eax*2 - 0x806], 0
je 0x429db4
jmp 0x429dfc
xor eax, eax
mov word [ebp - 0x804], ax
push esi
mov ecx, 0x4b7300
lea esi, [ebp - 0x804]
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x429dee
movzx eax, word [esi + ecx]
test ax, ax
je 0x429dee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x429dd0
test edx, edx
lea eax, [ecx - 2]
pop esi
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x429e07
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4b7300
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x4b7300
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret
Function at 0x42a510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x4b6b00], 0
push esi
jne 0x42a637
cmp dword [ecx + 0x2c], 8
lea eax, [ecx + 0x18]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
jb 0x42a55b
mov eax, dword [eax]
push edi
push 0x20219
push eax
push dword [ecx + 0x30]
lea ecx, [ebp - 0x818]
call fcn.0040cf24
mov edi, dword [ebp - 0x818]
test eax, eax
jne 0x42a62b
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x495154
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a62b
mov eax, dword [ebp - 0x80c]
cmp eax, 1
je 0x42a5bf
cmp eax, 2
jne 0x42a62b
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x42a5dc
test al, 1
jne 0x42a62b
shr eax, 1
cmp word [ebp + eax*2 - 0x806], 0
je 0x42a5e5
jmp 0x42a62b
xor eax, eax
mov word [ebp - 0x804], ax
mov ecx, 0x4b6b00
lea esi, [ebp - 0x804]
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42a61e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42a61e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42a600
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x42a636
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push 0x4b6b00
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x42a68b
mov ecx, 0x4b6b00
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42a67e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42a67e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42a660
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 0x4b6b00
xor ecx, ebp
pop esi
call fcn.0043bcea
mov esp, ebp
pop ebp
ret
Function at 0x42b8f0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b1b3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4b0364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x42b995
cmp word [esi], di
je 0x42b995
test eax, eax
je 0x42b951
cmp word [eax], di
je 0x42b951
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x42b995
jmp 0x42b990
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0045ea50
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x42b995
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
cmp dword [ebp + 0x34], 0
je 0x42ba10
lea esi, [ebx + 0x38]
push esi
mov dword [ebp - 0x42c], esi
call fcn.0041ee13
add esp, 4
test eax, eax
je 0x42b9ba
push eax
call fcn.0041f253
add esp, 4
mov byte [ebp - 0x428], 1
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x42ba30
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
push esi
mov byte [ebp - 4], 2
call fcn.0041ee38
add esp, 4
test eax, eax
je 0x42b9f8
push eax
call fcn.0041f253
add esp, 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x42ba10
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bcea
mov esp, ebp
pop ebp
ret 0x30
call fcn.0041ddf1
int3