joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8ae0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x52fe30]
sub esp, 8
cmp byte [ecx + 0x1133d], 0
je 0x4a8c7d
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x203
jne 0x4a8ba7
mov eax, dword [ecx + 0x11348]
cmp eax, 2
je 0x4a8b82
cmp eax, 1
jne 0x4a8b2a
push 0
call fcn.0044e640
test al, al
jne 0x4a8b82
mov ecx, dword [0x52fe30]
mov eax, dword [ecx + 0x11348]
cmp eax, 3
je 0x4a8b53
cmp eax, 1
jne 0x4a8c7c
push 0
call fcn.0044e640
test al, al
jne 0x4a8c7c
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x11430], 0
jne 0x4a8c67
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4a8c67
xor eax, eax
jmp 0x4a8c6c
mov eax, dword [0x52fe2c]
mov ecx, 0x200
or word [eax + 0x4148], cx
mov ecx, dword [0x52fe2c]
call fcn.00420050
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x205
jne 0x4a8bdd
lea edx, [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [0x52fe2c]
push 0
push eax
push ecx
mov ecx, dword [edx + 0x409c]
call fcn.0044bff0
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x52fe2c]
cmp dword [eax + 0x40e4], 0x51f
jne 0x4a8c3b
push 0
call fcn.0044e640
test al, al
je 0x4a8c35
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
mov ecx, dword [0x52fe14]
shl edx, 0x10
or edx, eax
push edx
push 2
add esi, 0xfffffea0
push esi
push ecx
mov ecx, dword [0x52fe2c]
call fcn.00423520
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0x52fe30]
cmp esi, 0x208
jne 0x4a8c7c
cmp byte [ecx + 0x11430], 0
jne 0x4a8c67
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x4a8c67
xor eax, eax
jmp 0x4a8c6c
mov eax, 1
mov ecx, dword [0x52fe2c]
push 0
push eax
push 0
call fcn.0040fca0
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ae0e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, ecx
cmp byte [esi + 0x3a9], 0
je 0x4ae199
cmp dword [esi + 0x14], 0
je 0x4ae199
cmp dword [esi + 0x3ac], 0
jne 0x4ae199
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004c9b50
mov edx, dword [0x52fe14]
add esp, 0xc
push 0x80
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esi + 0x120], 0
jne 0x4ae168
cmp word [esi + 0x324], 0
jne 0x4ae168
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4ae199
xor edx, edx
push 0x80
lea ecx, [ebp - 0x100]
mov word [esi + 0x120], dx
push ecx
lea edx, [esi + 0x18]
xor eax, eax
push edx
mov word [esi + 0x324], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ae240
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3a9], 0
jne 0x4ae285
push 0x80
lea eax, [esi + 0x18]
mov byte [esi + 0x3b0], 0
mov dword [esi + 0x3b4], 0
mov ecx, dword [0x52fe14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [esi + 0x3a9], 1
pop esi
ret
pop esi
jmp fcn.004ae0e0

Function at 0x4ae290
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [esi + 0x3ac], eax
test edi, edi
je 0x4ae2e4
cmp word [edi], 0
je 0x4ae2e4
push ebx
mov dword [esi + 0xc], 0x17
mov ecx, dword [0x52fe2c]
push 0x40
call fcn.00409d20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push eax
lea ecx, [esi + 0x324]
push ecx
call ebx
push 0x100
push edi
lea edx, [esi + 0x120]
push edx
call ebx
pop ebx
jmp 0x4ae2fd
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xc], 7
mov word [esi + 0x120], ax
mov word [esi + 0x324], cx
cmp byte [esi + 0x3a9], 0
jne 0x4ae342
push 0x80
lea edx, [esi + 0x18]
mov byte [esi + 0x3b0], 0
mov dword [esi + 0x3b4], 0
mov eax, dword [0x52fe14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
mov byte [esi + 0x3a9], 1
pop esi
pop ebp
ret 8
mov ecx, esi
call fcn.004ae0e0
pop edi
pop esi
pop ebp
ret 8
Function at 0x4ae4d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 8
cmp eax, 0x402
push ebx
push esi
push edi
mov edi, ecx
jg 0x4ae57e
je 0x4ae567
sub eax, 0x202
je 0x4ae592
sub eax, 3
jne 0x4ae734
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x52fe2c]
mov byte [ecx + 0x4854], 1
mov edx, dword [0x52fe14]
push edx
call fcn.004c57c0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [0x52fe2c]
add esp, 4
push 0
push eax
push ecx
mov ecx, dword [edx + 0x409c]
call fcn.0044bff0
mov ecx, dword [ebp + 8]
mov eax, dword [0x52fe2c]
push 0
push 0
push 0
push ecx
mov byte [eax + 0x4854], 0
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x3b4], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
sub eax, 0x404
je 0x4ae6ca
sub eax, 1
jne 0x4ae734
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1220], 0
je 0x4ae63b
push 0
mov ebx, 8
call fcn.0044e5d0
mov edx, dword [0x52fe14]
movzx esi, al
neg esi
sbb esi, esi
push edx
add esi, 6
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ae606
mov ecx, dword [0x52fe2c]
push 0
call fcn.004098e0
test al, al
jne 0x4ae606
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1235], 0
jne 0x4ae604
cmp byte [eax + 0x1220], 2
je 0x4ae604
mov ecx, dword [0x52fe2c]
call fcn.0040b370
cmp eax, 0x50
jb 0x4ae617
mov ebx, esi
mov ecx, dword [0x52fe2c]
push ebx
call fcn.004200a0
jmp 0x4ae69b
cmp eax, 0xa
jb 0x4ae606
mov ecx, dword [0x52fe2c]
push 0
call fcn.004098e0
test al, al
jne 0x4ae606
mov eax, dword [0x52fe14]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4ae69b
call fcn.00450360
test al, al
je 0x4ae68d
mov ecx, dword [0x52fe14]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ae68d
mov ecx, dword [0x52fe30]
push 0
call fcn.0044e5d0
push 0
test al, al
je 0x4ae674
mov ecx, 0x532a10
call fcn.004ae350
jmp 0x4ae69b
mov edx, dword [0x52fe14]
push 0xf020
push 0x112
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ae69b
push 0
push 0
mov ecx, 0x532a10
call fcn.004ae3e0
cmp dword [edi + 0x3ac], 1
jne 0x4ae734
mov dword [edi + 0x3ac], 0
mov ecx, dword [0x52fe2c]
push 2
call fcn.0040c750
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0x3b0], 0
jne 0x4ae71c
mov esi, dword [edi + 0x3b4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
je 0x4ae6ee
call ebx
sub eax, esi
cmp eax, 0x7d0
ja 0x4ae71c
cmp byte [edi + 0x3b0], 0
jne 0x4ae734
test esi, esi
je 0x4ae734
call ebx
sub eax, dword [edi + 0x3b4]
cmp eax, 0x7d0
jbe 0x4ae734
mov byte [edi + 0x3b0], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 1
mov ecx, 0x532a10
mov dword [edi + 0x3ac], 0
call fcn.004ae3e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ae740
Capabilities:
Get graphical window text

Disassembly:
cmp byte [ecx + 0x3a9], 0
je 0x4ae755
mov byte [ecx + 0x3a9], 0
jmp fcn.004ae240
ret
Function at 0x4aee10
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4aee3b
push eax
call edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4aee3b
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4aee5c
push eax
call edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4aee5c
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x3c], 0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4aee7d
push eax
call edi
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4aee7d
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x40], 0
pop edi
pop esi
ret

Function at 0x4af810
Capabilities:
Delete file
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0x1024
lea eax, [esi + 0x42e]
push eax
push str.Are_you_sure__stop_updates_checking_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4af8f8
mov ecx, dword [esi + 0x20]
push edi
push 0
push 0
push 0xa
call ecx
mov eax, dword [esi + 8]
mov byte [esi + 0x4d], 1
test eax, eax
je 0x4af888
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push eax
call edi
cmp eax, 0x102
jne 0x4af878
mov edx, dword [esi + 0x20]
push 0
push 0
push 0xa
call edx
mov eax, dword [esi + 8]
push 0x9c4
push eax
mov byte [esi + 0x4d], 1
call edi
test eax, eax
je 0x4af888
mov ecx, dword [esi + 8]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.004aee10
mov eax, dword [esi + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esi + 0x50], 0
test eax, eax
je 0x4af8c3
cmp word [eax], 0
je 0x4af8ac
push eax
call edi
mov eax, dword [esi + 0x48]
test eax, eax
je 0x4af8c3
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x48], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4af8f7
cmp word [ecx], 0
je 0x4af8e0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4af8dd
cmp byte [eax + 0x30], 0
jne 0x4af8e0
push ecx
call edi
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4af8f7
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x44], 0
pop edi
pop esi
ret
Function at 0x4afe50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [ebp + 0x14]
push ebx
push esi
add ecx, 0xd6
push edi
push ecx
push eax
mov byte [ebp - 1], 0
mov dword [ebp - 8], ecx
call fcn.00428400
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor ecx, ecx
add esp, 8
xor edx, edx
mov word [ebx], cx
mov dword [ebp - 0x2c], str.ConEmu_Stable_2
mov dword [ebp - 0x28], str.stable:_t
mov dword [ebp - 0x24], str._stable
mov dword [ebp - 0x20], str.ConEmu_Preview_2
mov dword [ebp - 0x1c], str._npreview:_t
mov dword [ebp - 0x18], str._preview
mov dword [ebp - 0x14], str.ConEmu_Devel_2
mov dword [ebp - 0x10], str._nalpha:_t
mov dword [ebp - 0xc], str._alpha
mov word [edi], dx
lea esi, [ebp - 0x24]
mov dword [ebp + 0x10], 3
nop
mov eax, dword [esi - 4]
push eax
push 0x64
push ebx
call fcn.004017b0
mov ecx, dword [ebp + 8]
mov eax, dword [esi - 8]
push ecx
push 0x40
lea edx, [ebp - 0xac]
push edx
push 0x4e5034
push str.version
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4affe0
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setge bl
cmp byte [ebp - 1], 0
jne 0x4aff37
test bl, bl
je 0x4aff37
mov eax, dword [esi]
mov ecx, dword [ebp + 0x14]
push eax
push 0x64
push ecx
mov byte [ebp - 1], 1
call fcn.004017b0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xac]
push eax
push 0x64
xor edx, edx
push ecx
mov word [ebp - 0x98], dx
call fcn.004017b0
push 0x505b4c
push 0x64
push edi
call fcn.004017b0
lea edx, [ebp - 0xac]
push edx
push 0x64
push edi
call fcn.004017b0
mov eax, dword [esi]
push eax
push 0x64
push edi
call fcn.004017b0
test bl, bl
je 0x4affce
mov ecx, dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ecx
lea edx, [ebp - 0xac]
push edx
call ebx
test eax, eax
mov eax, str.__newer_
jg 0x4aff9e
mov eax, str.__equal_
push eax
mov eax, dword [ebp + 0xc]
push 0x64
push eax
call fcn.004017b0
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0xac]
push edx
call ebx
test eax, eax
mov eax, str.__newer_
jg 0x4affc5
mov eax, str.__equal_
push eax
push 0x64
push edi
call fcn.004017b0
push 0x4e75fc
push 0x64
push edi
call fcn.004017b0
mov ebx, dword [ebp + 0xc]
jmp 0x4affed
push str._Not_found_
push 0x64
push ebx
call fcn.004017b0
add esi, 0xc
sub dword [ebp + 0x10], 1
jne 0x4afed0
cmp word [edi], 0
jne 0x4b000e
push str._Not_found_
push edi
call fcn.00428400
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b0ac0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52fe2c]
sub esp, 0x444
test eax, eax
jne 0x4b0ad8
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
push esi
add eax, 0x3be
push edi
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004afd90
add esp, 8
push 0x4e82fc
push 0x118
lea ecx, [ebp - 0x444]
push ecx
call fcn.004017b0
cmp dword [0x52fe5c], 6
jb 0x4b0bbf
call fcn.004c5e00
test al, al
jne 0x4b0c1c
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0x2b
xor ebx, ebx
mov edi, dword [ebp + ebx*4 - 8]
xor esi, esi
xor eax, eax
test esi, esi
setne al
lea edx, [ebp - 0x214]
push edx
push eax
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4b0baf
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b0b60
sub eax, edx
sar eax, 1
je 0x4b0baf
cmp word [ebp + eax*2 - 0x216], 0x5c
je 0x4b0b94
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x214], cx
inc eax
xor edx, edx
mov word [ebp + eax*2 - 0x214], dx
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x444]
push ecx
call fcn.004cb321
add esp, 0xc
test eax, eax
je 0x4b0bff
inc esi
cmp esi, 1
jbe 0x4b0b36
inc ebx
cmp ebx, 2
jb 0x4b0b30
push str.ConEmuUpdate.flag
push 0x118
lea edx, [ebp - 0x444]
push edx
call fcn.004017b0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4b0c08
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b10c0
Capabilities:
Create process on windows
Delete file
Set environment variable
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
xor ebx, ebx
push edi
cmp eax, ebx
je 0x4b111d
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call edi
cmp eax, 0x102
jne 0x4b1100
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 0xa
call eax
mov ecx, dword [esi + 8]
push 0x9c4
push ecx
mov byte [esi + 0x4d], 1
call edi
cmp eax, ebx
je 0x4b1110
mov edx, dword [esi + 8]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov ecx, esi
call fcn.004aee10
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x4b1131
push ebx
push ebx
push 7
call eax
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x4b1144
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x530]
cmp eax, ebx
je 0x4b115d
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x530], ebx
mov edi, dword [esi + 0x34]
cmp edi, ebx
je 0x4b1177
mov ecx, edi
call fcn.004c6690
push edi
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x34], ebx
cmp dword [esi + 0x50], 5
jne 0x4b1270
cmp dword [esi + 0x48], ebx
je 0x4b1270
mov ecx, esi
call fcn.004b0e80
push ebx
push str.cmd.exe
call fcn.0044c570
mov ecx, dword [esi + 0x48]
add esp, 8
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x10
push 2
push eax
call fcn.0044c490
mov edx, dword [esi + 0x48]
push edx
mov edi, eax
push str._c____s__
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x4e9958
push str.ConEmuInUpdate
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [esi + 0x4c], 0
mov eax, str.runas
jne 0x4b11eb
mov eax, str.open
push 2
push 0
push edi
push ebx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4b1254
push eax
mov eax, dword [esi + 0x48]
push eax
lea ecx, [ebp - 0x820]
push str.Failed_to_start_update_batch_n_s_nError_code_i
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
push 0
push 0x4e5ea4
lea edx, [ebp - 0x820]
push 0x1010
push edx
call fcn.004262f0
mov eax, dword [esi + 0x48]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4b124a
cmp byte [eax + 0x30], 0
jne 0x4b1254
mov ecx, dword [esi + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x4b1261
push ebx
call fcn.0044c4f0
add esp, 4
test edi, edi
je 0x4b126e
push edi
call fcn.0044c4f0
add esp, 4
xor ebx, ebx
mov eax, dword [esi + 0x48]
cmp eax, ebx
je 0x4b1283
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x48], ebx
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x4b1296
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x44], ebx
mov edi, dword [esi + 0x28]
cmp edi, ebx
je 0x4b12b0
mov ecx, edi
call fcn.004b2a60
push edi
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9123
push eax
mov dword fs:[0], esp
sub esp, 0x510
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x4b22e1
mov ecx, dword [esi + 8]
xor eax, eax
cmp ecx, ebx
je 0x4b2279
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x50]
cmp ecx, ebx
jle 0x4b2291
cmp ecx, 2
jle 0x4b228a
cmp ecx, 4
jne 0x4b2291
cmp eax, ebx
jne 0x4b2291
mov dword [esi + 0x50], ebx
mov eax, dword [esi + 0x50]
cmp eax, ebx
je 0x4b22e1
cmp eax, 5
jne 0x4b22c2
mov ecx, dword [0x52fe2c]
cmp ecx, ebx
je 0x4b2459
call fcn.00411c20
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], ebx
je 0x4b2459
push 1
push 0xffffffffffffffff
push ebx
push 0x10
push str.Checking_for_updates_already_started
call fcn.004262f0
jmp 0x4b2456
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x52fe30]
mov dword [ecx + 0x11890], eax
mov ecx, esi
call fcn.004b0ac0
mov byte [esi + 0x4c], al
mov byte [esi + 0x4d], bl
cmp dword [esi + 0x28], ebx
jne 0x4b232e
push 0x38
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4b2322
mov ecx, eax
call fcn.004b2470
jmp 0x4b2324
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], eax
mov edx, dword [0x52fe30]
mov ecx, dword [esi + 0x28]
add edx, 0x1185c
push edx
call fcn.004b28c0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x24], eax
call fcn.004c6b20
mov ecx, dword [esi + 0x34]
push 0xffffffffffffffff
push 1
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.004c6b30
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x4b237b
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x30], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004c75e0
mov ecx, dword [esi + 0x28]
lea edx, [ebp - 0x11c]
push edx
call fcn.004b2c70
test al, al
jne 0x4b23d7
lea eax, [ebp - 0x51c]
push str.Updates_are_not_enabled_in_ConEmu_settings_r_n
push eax
call fcn.00402f50
add esp, 8
lea ecx, [ebp - 0x11c]
push ecx
push 0xff
lea edx, [ebp - 0x51c]
push edx
call fcn.004017b0
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x51c]
push eax
jmp 0x4b2451
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x4b2110
push ebx
push ebx
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x4b2459
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x31c]
push str.ConEmu_automatic_update_check_failed__r_n
push edx
mov esi, eax
call fcn.00402f50
add esp, 8
cmp esi, 5
jne 0x4b2430
push str.Check_your_antivirus_software_r_n
push 0xff
lea eax, [ebp - 0x31c]
push eax
call fcn.004017b0
push str._r_nCreateThread_CheckThreadProc__failed_r_n
push 0xff
lea ecx, [ebp - 0x31c]
push ecx
call fcn.004017b0
push ebx
push ebx
push ebx
push esi
lea edx, [ebp - 0x31c]
push edx
call fcn.004263e0
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b28c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.004b2820
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x4b28e8
cmp word [eax], 0
je 0x4b28e8
push 0
push eax
call fcn.0044c570
add esp, 8
jmp 0x4b28ea
xor eax, eax
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov cl, byte [edi + 5]
mov byte [esi + 5], cl
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
mov al, byte [edi + 7]
cmp al, 1
jb 0x4b290d
cmp al, 3
movzx eax, al
jbe 0x4b2912
mov eax, 2
mov byte [esi + 7], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov ecx, dword [edi + 0xc]
push 0
push ecx
call fcn.0044c570
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0x10]
push 0
push edx
call fcn.0044c570
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push 0
push eax
call fcn.0044c570
mov dword [esi + 0x14], eax
mov cl, byte [edi + 8]
mov byte [esi + 8], cl
movzx edx, byte [edi + 9]
mov byte [esi + 9], dl
mov eax, dword [edi + 0x18]
push 0
push eax
call fcn.0044c570
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
push 0
push ecx
call fcn.0044c570
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x20]
push 0
push edx
call fcn.0044c570
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
push 0
push eax
call fcn.0044c570
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x2c]
push 0
push ecx
call fcn.0044c570
mov dword [esi + 0x2c], eax
movzx edx, byte [edi + 0x30]
add esp, 0x40
mov byte [esi + 0x30], dl
mov eax, dword [edi + 0x28]
push 0
push eax
call fcn.0044c570
add esp, 8
pop edi
mov dword [esi + 0x28], eax
pop esi
pop ebp
ret 4

Function at 0x4b2a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0
jne 0x4b2a14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x34], eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x34]
cmp eax, 0x36ee80
jb 0x4b2a31
mov ecx, dword [0x52fe2c]
push 0
call fcn.0040c750
pop esi
ret
Function at 0x4b2b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov al, byte [ecx + 8]
mov dword [ebp - 4], ecx
test al, al
jne 0x4b2c67
cmp byte [ecx + 9], al
jne 0x4b2c58
mov eax, dword [0x52fe2c]
push ebx
push esi
push edi
add eax, 0x3be
push eax
lea ecx, [ebp - 0x424]
push ecx
call fcn.004b2aa0
add esp, 8
push 0x4e82fc
push 0x106
lea edx, [ebp - 0x424]
push edx
call fcn.004017b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
jmp 0x4b2b60
test edi, edi
jne 0x4b2b68
xor eax, eax
jmp 0x4b2b79
mov eax, edi
dec eax
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0x200
or eax, 0x20019
mov esi, str.InstallDir
test edi, edi
je 0x4b2b91
cmp edi, 1
je 0x4b2b91
mov esi, str.InstallDir_x64
lea ecx, [ebp - 8]
push ecx
push eax
push 0
push str.SOFTWAREConEmu
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4b2c3c
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push esi
push ecx
mov dword [ebp - 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b2c32
cmp word [ebp - 0x218], ax
je 0x4b2c32
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b2be3
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x21a], 0x5c
je 0x4b2c13
push 0x4e82fc
push 0x106
lea edx, [ebp - 0x218]
push edx
call fcn.004017b0
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4b2c32
mov edx, dword [ebp - 4]
mov byte [edx + 9], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, 2
jbe 0x4b2b60
mov ecx, dword [ebp - 4]
cmp byte [ecx + 9], 0
pop edi
pop esi
pop ebx
jne 0x4b2c58
mov edx, ecx
mov byte [edx + 9], 2
mov al, byte [ecx + 9]
test al, al
movzx eax, al
jne 0x4b2c67
mov eax, 2
mov esp, ebp
pop ebp
ret