joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430d20
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x518
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x514], eax
mov eax, dword [esp + 0x51c]
mov ecx, dword [esp + 0x520]
push ebp
push esi
mov esi, dword [esp + 0x52c]
push edi
mov edi, dword [esp + 0x534]
push 0x3ff
lea edx, [esp + 0x125]
push 0
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0
mov byte [esp + 0x12c], 0
call fcn.005dfd60
add esp, 0xc
mov ebp, 0x400
mov dword [esp + 0xc], ebp
test edi, edi
je 0x430dc8
cmp byte [edi], 0
je 0x430dc8
test esi, esi
je 0x430db3
cmp byte [esi], 0
je 0x430db3
push esi
push edi
lea eax, [esp + 0x24]
push str.SoftwareMicroWorldeScan_for_Windows_s_sInstalledSoftware
push eax
call fcn.005dfb23
add esp, 0x10
jmp 0x430df8
push edi
lea ecx, [esp + 0x20]
push str.SoftwareMicroWorldeScan_for_Windows_sInstalledSoftware
push ecx
call fcn.005dfb23
add esp, 0xc
jmp 0x430df8
test esi, esi
je 0x430de6
cmp byte [esi], 0
je 0x430de6
push esi
lea edx, [esp + 0x20]
push str.SoftwareMicroWorldeScan_for_Windows_sInstalledSoftware
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x430df8
lea eax, [esp + 0x1c]
push str.SoftwareMicroWorldeScan_for_WindowsInstalledSoftware
push eax
call fcn.005dfb23
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 8
push 0
lea edx, [esp + 0x28]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430ecf
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x134]
push ecx
push esi
push edx
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x430ec4
lea eax, [esp + 0x120]
push 0x3a
push eax
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x430e9e
lea ecx, [esp + 0x120]
push 0x5c
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x430e9e
mov ecx, dword [esp + 0x14]
push eax
push eax
lea edx, [esp + 0x128]
push edx
call fcn.004f2f50
test eax, eax
jne 0x430e9e
mov ecx, dword [esp + 0x18]
push eax
push 0x3b
lea eax, [esp + 0x128]
push eax
push ecx
call fcn.004e5820
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x134]
push eax
inc esi
push esi
push ecx
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
je 0x430e46
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x520]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x518
ret
Function at 0x430ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6700b0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x1c]
push eax
push str.BlockFileRenamesToMultipleExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x1c], 0
je 0x430fe3
push 0
push 0
push 3
push 0
push 0
push connect
push 0x680a88
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x20], eax
test eax, eax
je 0x430fa2
cmp eax, 0xffffffff
je 0x430fa2
lea ecx, [ebp - 0x20]
push ecx
call fcn.004dca10
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x430fe3
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431450
Capabilities:
Set registry value

Disassembly:
sub esp, 0x614
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x610], eax
mov eax, dword [esp + 0x620]
push ebp
mov ebp, dword [esp + 0x62c]
push esi
mov esi, dword [esp + 0x62c]
push edi
mov edi, dword [esp + 0x624]
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x129]
push 0
push edx
mov byte [esp + 0x130], 0
call fcn.005dfd60
mov eax, dword [edi]
push ebp
push eax
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00430c10
mov eax, dword [esp + 0x650]
mov esi, dword [edi + 0x10]
add esp, 0x28
cmp eax, 1
jne 0x431566
lea edx, [esp + 0x118]
push 0
push edx
call fcn.004f00d0
add esp, 8
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x43166c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x118]
push edx
call edi
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [esp + 0x11c]
push eax
push 1
push 0
push str.ReadDate
push ecx
call ebp
test esi, esi
je 0x43155c
cmp byte [esi], 0
je 0x43155c
push esi
call edi
mov edx, dword [esp + 0xc]
inc eax
push eax
push esi
push 1
push 0
push str.InstallDate
push edx
call ebp
mov eax, dword [esp + 0xc]
push eax
jmp 0x431666
cmp eax, 2
jne 0x43166c
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
lea edx, [esp + 0x20]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
mov ebp, eax
add esp, 0x14
test ebp, ebp
je 0x431661
push 0x3ff
lea eax, [esp + 0x221]
push 0
push eax
mov byte [esp + 0x228], 0
call fcn.005dfd60
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4315f5
cmp byte [esi], 0
je 0x4315f5
mov ecx, dword [edi]
push esi
push ecx
lea edx, [esp + 0x224]
push 0x61c9ec
push edx
call fcn.005dfb23
add esp, 0x10
cmp dword [0x6b35a4], 0
je 0x431633
push ebp
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x1c]
push ecx
jmp 0x431624
mov edx, dword [edi]
push edx
lea eax, [esp + 0x220]
push 0x60c800
push eax
call fcn.005dfb23
add esp, 0xc
cmp dword [0x6b35a4], 0
je 0x431633
push ebp
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x1c]
push edx
push str._CF__Unable_to_open_key__HKLM_s_._Adding___s__rval__0x_x_
push 0
call fcn.004f0f30
add esp, 0x14
mov ecx, dword [esp + 0x10]
push 0
push 0x3b
lea eax, [esp + 0x224]
push eax
push ecx
call fcn.004e5820
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x610]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x614
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x61c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x614
ret
Function at 0x4334c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov byte [ebp - 0x20c], 0
call fcn.005dfd60
push 0x207
lea edx, [ebp - 0x413]
push 0
push edx
mov byte [ebp - 0x414], 0
call fcn.005dfd60
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e2520
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push str._sKave.dll
push eax
call fcn.005dfb23
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.004ec5a0
add esp, 0x24
test eax, eax
jne 0x4335ae
push eax
lea edx, [ebp - 0x108]
push edx
call fcn.004e8c10
lea eax, [ebp - 0x108]
mov edx, esi
mov ecx, eax
add esp, 8
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x433595
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
xor eax, eax
mov cl, byte [eax + 0x6af4b8]
mov byte [ebp + eax - 0x414], cl
inc eax
test cl, cl
jne 0x4335b0
lea edx, [ebp - 0x414]
push edx
call fcn.004e2520
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x108]
push str._sVista
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push str._sKave.dll
push eax
call fcn.005dfb23
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.004ec5a0
add esp, 0x30
test eax, eax
jne 0x43363f
push eax
lea edx, [ebp - 0x108]
push edx
call fcn.004e8c10
lea eax, [ebp - 0x108]
mov edx, esi
mov ecx, eax
add esp, 8
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x433635
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x434240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x60cf0c
push 0x6b3d20
call fcn.005e00ad
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6b3ca0], eax
test esi, esi
jne 0x43426c
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push 1
push 0x33fb8
push eax
call fcn.005e057f
push esi
call fcn.005dff6d
add esp, 0x14
mov eax, 1
pop esi
pop ebp
ret

Function at 0x434a00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x207
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.005dfd60
push 0x40f
lea ecx, [ebp - 0x823]
push ebx
push ecx
mov byte [ebp - 0x824], bl
call fcn.005dfd60
add esp, 0x18
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x828], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6b3ca0], eax
cmp esi, ebx
je 0x434c1b
cmp byte [esi], bl
je 0x434c1b
cmp edi, ebx
je 0x434c1b
cmp byte [edi], bl
je 0x434c1b
lea edx, [ebp - 0x20c]
push edx
push esi
call fcn.004da790
add esp, 8
cmp byte [ebp - 0x20c], bl
je 0x434c04
lea eax, [ebp - 0x20c]
push 0x6e8920
push eax
call fcn.005e324f
add esp, 8
test eax, eax
je 0x434c1b
lea ecx, [ebp - 0x20c]
push 0x61d384
push ecx
call fcn.005e324f
add esp, 8
test eax, eax
je 0x434c1b
push ebx
lea edx, [ebp - 0x824]
push edx
push ebx
call fcn.00504d70
test eax, eax
je 0x434b21
push ebx
push 1
push str.Impersonation_Failed_For_Renaming._Reason_Below
push 0x6aec98
mov dword [ebp - 0x82c], ebx
call fcn.004311c0
push ebx
push 1
lea eax, [ebp - 0x824]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push esi
call fcn.004ee840
add esp, 4
cmp eax, 1
jne 0x434bf6
mov eax, dword [0x6e82f4]
cmp eax, 2
jne 0x434b81
push 0x207
lea ecx, [ebp - 0x413]
push ebx
push ecx
mov byte [ebp - 0x414], bl
call fcn.005dfd60
push 0x6e8920
push esi
lea edx, [ebp - 0x414]
push str._s._s
push edx
call fcn.005dfb23
add esp, 0x1c
push 3
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x434bbd
cmp eax, 1
jne 0x434bc7
push 0x6e8510
call fcn.004eab20
mov ecx, dword [0x682200]
mov edx, dword [ebp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ecx
push edx
push ebx
push 0x6e8510
push edi
push esi
call fcn.004b3540
add esp, 0x2c
cmp eax, 1
jne 0x434bc7
push esi
call fcn.00507760
add esp, 4
mov dword [ebp - 0x828], eax
cmp eax, ebx
jne 0x434bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x824]
push str.Error_In_Deleting_File._Error_Code:__d
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x824]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [ebp - 0x82c], 1
jne 0x434c04
call fcn.00504780
mov eax, dword [ebp - 0x828]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4357b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6b3ca0], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
test eax, eax
jne 0x4358a5
push esi
push 0x410
mov dword [ebp - 8], 0x410
call fcn.004d9470
mov esi, eax
add esp, 4
test esi, esi
je 0x43589a
mov edx, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push str.NoNetSwiftDrv
push edx
call edi
cmp eax, 0xea
jne 0x435859
push esi
call fcn.005e0865
mov eax, dword [ebp - 8]
push eax
call fcn.004d9470
mov esi, eax
add esp, 8
test esi, esi
je 0x435899
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push str.NoNetSwiftDrv
push edx
call edi
jmp 0x435890
test eax, eax
jne 0x435890
cmp byte [esi], al
je 0x435890
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435866
sub eax, edx
inc eax
push eax
call fcn.004d9470
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x435890
mov ecx, esi
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x435886
push esi
call fcn.005e0865
add esp, 4
pop edi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440480
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x733fe0], 0
push esi
jne 0x440537
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x6af8c8
push 0x104
push 0x733fe0
push str.File_Added
push 0x61ff5c
push 0x614348
call esi
push 0x6af8c8
push 0x104
push 0x733ed8
push str.File_Deleted
push 0x61fecc
push 0x614348
call esi
push 0x6af8c8
push 0x104
push 0x733dd0
push str.File_Modified
push 0x61ff48
push 0x614348
call esi
push 0x6af8c8
push 0x104
push 0x733cc8
push str.File_Renamed_OldName
push 0x61ff2c
push 0x614348
call esi
push 0x6af8c8
push 0x104
push 0x733bc0
push str.File_Renamed_NewName
push 0x61ff10
push 0x614348
call esi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x440632
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x44055f
cmp byte [esi], 0
jne 0x44055f
mov eax, 0x733fe0
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x440555
mov ecx, dword [ebp + 8]
lea eax, [ecx - 1]
cmp eax, 4
ja case.default.0x44056e
jmp dword [eax*4 + 0x440638]
mov eax, 0x733fe0
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x440580
mov eax, 0x6b5
pop esi
pop ebp
ret
mov eax, 0x733ed8
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4405a0
mov eax, 0x6b6
pop esi
pop ebp
ret
mov eax, 0x733dd0
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4405c0
mov eax, 0x6b7
pop esi
pop ebp
ret
mov eax, 0x733cc8
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4405e0
mov eax, 0x6b8
pop esi
pop ebp
ret
mov eax, 0x733fe0
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x440600
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, 0x6b5
pop esi
pop ebp
ret
push ecx
push str.File_Action_UNKNOWN___d_
push edx
call fcn.005dfb23
add esp, 0xc
mov eax, 0x6ba
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x441a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
push 0x30
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x40], ebx
call fcn.005dfd60
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov esi, dword [eax + 0x10]
add esp, 0xc
xor eax, eax
mov dword [ebp - 8], ebx
mov dword [ebp + 8], edi
cmp edi, ebx
je 0x441a42
cmp esi, ebx
je 0x441a42
cmp byte [edi], al
je 0x441a42
push edi
call fcn.004418b0
add esp, 4
cmp dword [esi + 8], 0xffff
jne 0x441a50
mov eax, 1
cmp edi, ebx
je 0x441b1b
cmp byte [edi], bl
je 0x441b1b
cmp eax, ebx
jne 0x441b1b
push edi
call fcn.004dd6c0
mov edi, eax
lea eax, [edi + 0x40]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
call fcn.005e20e4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x441b16
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0x3c], edx
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x40], ecx
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x30], edx
mov edx, dword [esi + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x34], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp + 8]
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [0x6861a8]
push edx
lea eax, [ebx + 8]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], edi
call fcn.005e13c0
mov edx, dword [ebp - 4]
add esp, 0xc
lea edi, [ebx + edi + 8]
mov ecx, 0xd
lea esi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x6861ac]
push 0
mov dword [ebx + edx + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.005e0865
add esp, 4
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov eax, dword [ebp + 0x1c]
inc dword [eax]
mov eax, dword [eax]
xor edx, edx
mov ecx, 0xc8
div ecx
pop edi
pop esi
pop ebx
test edx, edx
jne 0x441b4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x14]
cmp eax, 0x61a8
jbe 0x441b4b
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
mov esp, ebp
pop ebp
ret
Function at 0x441bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x528], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [0x73327c]
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x524], eax
cmp eax, esi
je 0x441dc3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x6af4b8
lea eax, [ebp - 0x20c]
push eax
call esi
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.CLFNOEX.DA_
lea edx, [ebp - 0x20c]
push edx
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.004e0670
add esp, 4
push 0x6af4b8
lea ecx, [ebp - 0x20c]
push ecx
call esi
lea edx, [ebp - 0x20c]
push edx
call fcn.004e24e0
add esp, 4
push str.CLFNOEX.DAT
lea eax, [ebp - 0x20c]
push eax
call edi
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e0670
add esp, 4
push 0x6af4b8
lea edx, [ebp - 0x518]
push edx
call esi
lea eax, [ebp - 0x518]
push eax
call fcn.004e24e0
add esp, 4
push str.CLFNOEXA.DAT
lea ecx, [ebp - 0x518]
push ecx
call edi
push 0x6af4b8
lea edx, [ebp - 0x20c]
push edx
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004e24e0
add esp, 4
push str.CLFNOEXA.DA_
lea ecx, [ebp - 0x20c]
push ecx
call edi
lea edx, [ebp - 0x20c]
push edx
call fcn.004e0670
push 0
push 0x80
push 4
push 0
push 1
lea eax, [ebp - 0x20c]
push 0x40000000
push eax
call fcn.004e0400
add esp, 0x20
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x441dc3
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x528]
push ecx
mov ecx, dword [ebp - 0x524]
lea edx, [ebp - 0x51c]
push edx
push ebx
lea eax, [ebp - 0x520]
push eax
push esi
push ecx
call fcn.00441b50
add esp, 0x18
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x51c], 0
jne 0x441d8e
push 0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004edd70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x520]
sub eax, ebx
push eax
push ecx
lea edx, [ebp - 0x310]
push str._FACache__Save_FNOTree_:__u___u_ms_
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x441dab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
push eax
lea eax, [ebp - 0x310]
push str._FACache__Save_Aborted____u_ms_
push eax
call fcn.005dfb23
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x310]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x443310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6af4b8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e24e0
add esp, 4
push str.Reload.exe
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x443476
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
xor ebx, ebx
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x2710
jae 0x4433f2
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x314]
push ecx
push str.reload.exe
mov dword [ebp - 0x314], 0
call fcn.00503770
test eax, eax
je 0x4433f2
test ebx, ebx
jne 0x4433dc
mov edx, dword [ebp - 0x314]
push edx
lea eax, [ebp - 0x310]
push str.Reload__pid:_u__running_in_background._Will_wait_for_it_to_finish...
push eax
mov ebx, 1
call fcn.005dfb23
add esp, 0xc
push 0x118
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, 0x2710
jb 0x443391
push str.__ul
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
cmp eax, 1
je 0x443423
cmp eax, 2
je 0x443423
push eax
push str.Need_to_Send_All_Software_Events._Restarting_Monitor_Service__u_.
lea edx, [ebp - 0x310]
push edx
jmp 0x443430
push eax
push str.Monitor_Scanner_Too_Busy__Restarting_Monitor_Service__u_.
lea eax, [ebp - 0x310]
push eax
call fcn.005dfb23
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x310]
push ecx
push 0x6aec98
call fcn.004311c0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x108]
push 0
push edx
call fcn.00506de0
add esp, 0x2c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x310]
push str.Unable_to_find__s__Not_restarting_monitor__u_...
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x310]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x20
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret