joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5145
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x84c
mov eax, 0x55f93c
call fcn.00539a44
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00537010
add esp, 0xc
push ebx
push 0x25
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4a529e
xor eax, eax
mov edi, 0x208
push edi
mov word [ebp - 0x83c], ax
lea eax, [ebp - 0x83a]
push ebx
push eax
call fcn.00537010
lea eax, [ebp - 0x218]
push eax
push str._s_rundll32.exe
mov esi, 0x104
lea eax, [ebp - 0x83c]
push esi
push eax
call fcn.00532a01
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00537010
lea eax, [ebp - 0x218]
push eax
push str._s_shell32.dll
lea eax, [ebp - 0x424]
push esi
push eax
call fcn.00532a01
xor eax, eax
push edi
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push ebx
push eax
call fcn.00537010
add esp, 0x44
lea eax, [ebp - 0x218]
push eax
push str._sinetcpl.cpl__4
lea eax, [ebp - 0x630]
push esi
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x858]
call fcn.0040a8b0
push str._Control_RunDLL
lea ecx, [ebp - 0x858]
mov dword [ebp - 4], ebx
call fcn.0040a9e6
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x858]
call fcn.0040a9e6
cmp dword [ebp - 0x840], 8
mov eax, dword [ebp - 0x854]
jae 0x4a5279
lea eax, [ebp - 0x854]
push 1
push ebx
push eax
lea eax, [ebp - 0x83c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.004053e5
call fcn.00539ac7
ret
Function at 0x4a5649
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetRectEmpty]
push dword [0x5e0c90]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4a567c
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [0x5e0c90], eax
mov eax, dword [0x5e0c90]
xor esi, esi
cmp eax, esi
je 0x4a574d
push esi
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
cmp eax, esi
jne 0x4a56bd
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [0x5e0c90]
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
cmp eax, dword [ebp + 8]
jne 0x4a574d
mov esi, dword [sym.imp.SHELL32.dll_SHAppBarMessage]
push 0x24
pop edi
lea eax, [ebp - 0x34]
push eax
push 4
mov dword [ebp - 0x34], edi
call esi
xor ebx, ebx
inc ebx
test bl, al
je 0x4a574d
mov eax, dword [0x5e0c90]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 7
mov dword [ebp - 0x34], edi
pop edi
push edi
call esi
test eax, eax
je 0x4a5705
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x4a574d
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], ebx
call esi
test eax, eax
je 0x4a571b
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], ebx
jmp 0x4a574d
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], 2
call esi
test eax, eax
je 0x4a5735
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], ebx
jmp 0x4a574d
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], 3
call esi
test eax, eax
je 0x4a574d
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a5752
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x22c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
xor esi, esi
lea eax, [ebp - 0x212]
push esi
push eax
call fcn.00537010
push str.bookmark
push str.Software_shouxin
push 0x57c6a4
lea eax, [ebp - 0x214]
push 0x103
push eax
call fcn.00532a01
add esp, 0x20
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x25c], esi
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x230]
push eax
push str.wndplace
lea eax, [ebp - 0x214]
push eax
push 0x80000001
mov dword [ebp - 0x230], 3
mov dword [ebp - 0x228], 0x2c
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4a5974
push esi
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
call dword [sym.imp.USER32.dll_MonitorFromRect]
mov edx, eax
cmp edx, esi
je 0x4a5871
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0x284], 0x28
lea edi, [ebp - 0x280]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x284]
push eax
push edx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4a58ab
push esi
lea eax, [ebp - 0x224]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x4a58ab
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x238]
mov esi, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x23c]
mov ebx, edi
sub ebx, dword [ebp - 0x224]
sub eax, esi
sub ecx, edx
cmp eax, ebx
jg 0x4a58dd
test eax, eax
jg 0x4a58e2
mov eax, 0x320
mov ebx, dword [ebp - 0x218]
sub ebx, dword [ebp - 0x220]
cmp ecx, ebx
jg 0x4a58f6
test ecx, ecx
jg 0x4a58fb
mov ecx, 0x258
mov ebx, dword [ebp - 0x240]
add ebx, eax
cmp ebx, edi
jle 0x4a590b
sub edi, eax
mov esi, edi
cmp esi, dword [ebp - 0x224]
jge 0x4a5919
mov esi, dword [ebp - 0x224]
mov edi, dword [ebp - 0x23c]
lea ebx, [edi + ecx]
mov edi, dword [ebp - 0x218]
cmp ebx, edi
jle 0x4a5930
sub edi, ecx
mov edx, edi
cmp edx, dword [ebp - 0x220]
jge 0x4a593e
mov edx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], edx
add esi, eax
add edx, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], edx
test edi, edi
je 0x4a596f
push 0xb
pop ecx
lea esi, [ebp - 0x25c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
inc eax
jmp 0x4a5976
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x4a5985
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
push str.bookmark
push str.Software_shouxin
push 0x57c6a4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
add esp, 0x20
push 0x2c
push esi
push 3
push str.wndplace
lea eax, [ebp - 0x20c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0052f7d0
leave
ret
Function at 0x4a6200
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get startup folder

Disassembly:
push 0x46c
mov eax, 0x55ee13
call fcn.00539a44
call fcn.00407346
cmp eax, 4
jne 0x4a6343
xor edi, edi
push edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x424], 7
call fcn.004056b6
xor eax, eax
mov esi, 0x206
mov dword [ebp - 4], edi
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4a6335
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00406430
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
lea ecx, [ebp - 0x43c]
call fcn.0040a9e6
xor eax, eax
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00537010
mov eax, dword [ebp - 0x438]
add esp, 0xc
cmp dword [ebp - 0x424], 8
jae 0x4a62c2
lea eax, [ebp - 0x438]
push 0x583ed0
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a6335
push 0x38
lea eax, [ebp - 0x474]
push edi
push eax
mov dword [ebp - 0x478], 0x3c
call fcn.00537010
lea eax, [ebp - 0x218]
mov dword [ebp - 0x468], eax
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
mov dword [ebp - 0x474], 0x400
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x46c], str.startunpin
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
push 1
lea ecx, [ebp - 0x43c]
call fcn.004053e5
call fcn.00539ac7
ret

Function at 0x4a793b
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
xor eax, eax
push 1
mov ebx, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
push eax
push esi
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
call edi
test eax, eax
jne 0x4a7992
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
cmp eax, 0x80090016
jne 0x4a7992
push 8
push 1
push ebx
push 0
push esi
call edi
test eax, eax
jne 0x4a7992
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
pop edi
mov eax, esi
pop ebx
ret
Function at 0x4a7bfd
Capabilities:
Check if file exists
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x24
mov eax, 0x5660ce
call fcn.005399db
mov ebx, ecx
cmp dword [ebx + 0x18], 8
lea edi, [ebx + 4]
jb 0x4a7c18
mov eax, dword [edi]
jmp 0x4a7c1a
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a7c2c
xor al, al
jmp 0x4a7d0f
lea esi, [ebp - 0x30]
call fcn.004a793b
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push esi
push esi
push 0x54
push 0x579168
mov dword [ebp - 4], esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp eax, 1
jne 0x4a7cc8
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 0x8003
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a7c77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x4a7cc8
cmp dword [ebx + 0x18], 8
jb 0x4a7c81
mov eax, dword [edi]
jmp 0x4a7c83
mov eax, edi
push eax
lea ecx, [ebp - 0x30]
call fcn.0040111a
test al, al
je 0x4a7cc8
cmp dword [ebx + 0x18], 8
jb 0x4a7c98
mov edi, dword [edi]
push edi
lea esi, [ebp - 0x30]
call fcn.00401019
test al, al
je 0x4a7cc6
push 0
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
cmp eax, 1
jne 0x4a7cc6
mov bl, al
xor esi, esi
jmp 0x4a7cca
xor esi, esi
xor bl, bl
cmp dword [ebp - 0x14], esi
je 0x4a7cdb
push dword [ebp - 0x14]
call fcn.0052f9c9
pop ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x28], esi
je 0x4a7ce9
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x2c], esi
je 0x4a7cfe
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x4a7cfe
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x30], esi
je 0x4a7d0d
push esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
call fcn.00539ab3
ret
Function at 0x4a7e89
Capabilities:
Check if file exists

Disassembly:
push 0x430
mov eax, 0x55ede0
call fcn.00539a44
xor eax, eax
mov edi, 0x206
xor ebx, ebx
push edi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov esi, ecx
push ebx
push eax
mov dword [esi + 0xa4], ebx
call fcn.00537010
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x5c0b4c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4a800d
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00532331
pop ecx
pop ecx
cmp eax, ebx
je 0x4a7efa
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00406430
push 0x58cb98
lea eax, [ebp - 0x43c]
push esi
push eax
call fcn.0040a99f
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], ebx
call fcn.00405304
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.004053e5
xor eax, eax
push edi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.00537010
lea eax, [ebp - 0x218]
push eax
push str._supdate_
mov edi, 0x103
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00532a01
add esp, 0x1c
lea eax, [ebp - 0x420]
push eax
lea ecx, [esi + 0x38]
call fcn.00406430
lea eax, [ebp - 0x218]
push eax
push str._supdateupdate.ini
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
lea ecx, [esi + 0x70]
call fcn.00406430
lea eax, [ebp - 0x218]
push eax
push str._supdatedownload_
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x420]
add esi, 0x54
push eax
mov ecx, esi
call fcn.00406430
cmp dword [esi + 0x18], 8
jb 0x4a7fe8
mov eax, dword [esi + 4]
jmp 0x4a7feb
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a800d
cmp dword [esi + 0x18], 8
jb 0x4a8001
mov esi, dword [esi + 4]
jmp 0x4a8004
add esi, 4
mov ebx, esi
call fcn.0049699b
jmp 0x4a800f
xor eax, eax
call fcn.00539ac7
ret

Function at 0x4a8015
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 8
push esi
jb 0x4a803a
mov eax, dword [eax + 0x74]
jmp 0x4a803d
add eax, 0x74
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004a78a5
lea eax, [ebp - 0x210]
push eax
push 0
push str.lastchecktime
push 0x580e70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
and dword [ebp - 0x218], 0
and dword [ebp - 0x214], 0
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.005334f8
mov eax, esi
cdq
pop ecx
mov ecx, dword [ebp - 0x218]
sub ecx, eax
mov eax, dword [ebp - 0x214]
sbb eax, edx
js 0x4a80ad
jg 0x4a809b
test ecx, ecx
jb 0x4a80ad
test eax, eax
jg 0x4a80ad
jl 0x4a80a9
cmp ecx, 0x5460
ja 0x4a80ad
xor eax, eax
jmp 0x4a80c7
cmp byte [ebp + 0xc], 0
je 0x4a80c4
push dword [ebp - 0x218]
lea esi, [ebp - 0x210]
call fcn.004aaa3e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret 8
Function at 0x4a80d6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1588
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea esi, [edi + 0xa8]
push esi
call fcn.00490aac
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x108], ax
xor ebx, ebx
lea eax, [ebp - 0x106]
inc ebx
push eax
mov dword [esi + 0x2468], ebx
call fcn.00537010
add esp, 0xc
push 0
lea eax, [ebp - 0x108]
push 0x40
push eax
call fcn.0049a6b7
add esp, 0xc
call fcn.0040abdb
call fcn.0040ae0a
mov dword [ebp - 0x1584], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push eax
call fcn.00537010
add esp, 0xc
call fcn.00416b38
push dword [eax + 4]
call fcn.005519e6
push dword [ebp - 0x1584]
movzx eax, al
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ebp - 0x318]
push ecx
push str._d__d
push 0x104
push eax
call fcn.00532a01
add esp, 0x14
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x157c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1580]
push eax
push 0x57d2d0
push str.Software_shouxin
push 0x80000001
mov dword [ebp - 0x1580], ebx
mov dword [ebp - 0x157c], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4a81f9
cmp word [ebp - 0x88], ax
jne 0x4a8214
push 0x57d2fc
push 0x57cb68
lea eax, [ebp - 0x88]
push 0x3c
push eax
call fcn.00532a01
add esp, 0x10
xor eax, eax
push 0x1048
push eax
mov word [ebp - 0x1578], ax
lea eax, [ebp - 0x1576]
push eax
call fcn.00537010
xor eax, eax
add esp, 0xc
cmp ax, word [0x5db980]
jne 0x4a8246
call fcn.00412ed1
mov ebx, eax
jmp 0x4a824b
mov ebx, 0x5db980
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
push str.http:__ie.xinshuru.com_update_update.cab_mid_spid_sver_sto_st_d
lea eax, [ebp - 0x1578]
push 0x824
push eax
call fcn.00532a01
add esp, 0x20
lea eax, [ebp - 0x1578]
push eax
mov eax, esi
call fcn.0042bd35
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x528], ax
lea eax, [ebp - 0x526]
push eax
call fcn.00537010
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x4a82b8
mov eax, dword [edi + 4]
jmp 0x4a82bb
lea eax, [edi + 4]
push eax
push str._supdateupdate.temp
lea eax, [ebp - 0x528]
push 0x104
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x528]
push eax
mov eax, esi
call fcn.0042bd69
mov dword [edi + 0x2758], 0x2710
mov dword [esi + 0x26a4], 0x4a8310
mov dword [esi + 0x26a0], edi
call fcn.004909e9
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x4a8329
Capabilities:
Check if file exists

Disassembly:
push 0x440
mov eax, 0x55f909
call fcn.00539a44
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4a843d
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a834e
sub eax, edx
sar eax, 1
je 0x4a843d
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.00537010
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x4a838c
mov edi, dword [edi + 4]
jmp 0x4a838f
add edi, 4
push 0x57cb10
push edi
push 0x57c6a4
mov ebx, 0x104
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.00532a01
add esp, 0x14
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a843d
xor eax, eax
push esi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.00537010
add esp, 0xc
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x21c]
call fcn.00496756
mov eax, esi
push eax
lea ecx, [ebp - 0x444]
call fcn.0040a8b0
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
jae 0x4a8413
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x448]
call fcn.0049681a
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x444]
push 1
test eax, eax
jle 0x4a8438
call fcn.004053e5
xor eax, eax
inc eax
jmp 0x4a843f
call fcn.004053e5
xor eax, eax
call fcn.00539ac7
ret 4
Function at 0x4a9954
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
inc dword [ebx + 0x94]
mov eax, dword [ebx + 0x94]
push esi
push edi
js 0x4a9a6b
lea esi, [ebx + 0xc5f78]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
sar ecx, 2
cmp eax, ecx
jae 0x4a9a6b
mov eax, dword [ebx + 0x98]
lea edi, [ebx + 0x62ff0]
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call fcn.00490aac
mov dword [edi + 0x2468], 1
mov edi, dword [ebx + 0x94]
mov dword [ebx + 0x656a0], 0x2bf20
call fcn.004264b0
mov eax, dword [eax]
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x4a99cf
mov eax, dword [eax + 4]
jmp 0x4a99d2
add eax, 4
push eax
mov eax, dword [ebp - 4]
call fcn.0042bd35
mov edi, dword [ebx + 0x94]
call fcn.004264b0
mov eax, dword [eax]
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x4a99f6
mov eax, dword [eax + 4]
jmp 0x4a99f9
add eax, 4
push eax
mov eax, dword [ebp - 4]
call fcn.0042bd69
mov edi, dword [ebx + 0x94]
call fcn.004264b0
mov eax, dword [eax]
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x4a9a1d
mov eax, dword [eax + 4]
jmp 0x4a9a20
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx + 0x94]
call fcn.004264b0
mov eax, dword [eax]
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x4a9a42
mov eax, dword [eax + 4]
jmp 0x4a9a45
add eax, 4
mov ebx, eax
call fcn.0049699b
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [esi + 0x26a4], 0x4a9a72
mov dword [esi + 0x26a0], eax
call fcn.004909e9
mov al, 1
jmp 0x4a9a6d
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4aaaa6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b24
mov eax, dword fs:[0]
push eax
mov eax, 0x10024
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xfffe
lea eax, [ebp - 0x10010]
push 0
push eax
mov esi, ecx
call fcn.00537010
add esp, 0xc
push esi
push 0x7ffe
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea esi, [ebp - 0x10010]
cmp word [esi], 0
je 0x4aab59
push esi
lea ecx, [ebp - 0x1002c]
call fcn.0040a8b0
and dword [ebp - 4], 0
lea eax, [ebp - 0x1002c]
push eax
mov ecx, ebx
call fcn.00406326
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x1002c]
call fcn.004053e5
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4aab43
sub eax, ecx
sar eax, 1
lea esi, [esi + eax*2 + 2]
test esi, esi
jne 0x4aab07
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f7d0
leave
ret

Function at 0x4aad98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4aadc6
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4aae14
push ecx
mov eax, esp
mov dword [eax], edi
push ecx
mov eax, esp
mov dword [eax], edi
lea eax, [esi + 8]
call fcn.004ac0ba
jmp 0x4aae14
lea ebx, [esi + 0x2c]
cmp dword [ebx], edi
jne 0x4aae14
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push edi
push esi
push 0x4aae1b
push edi
push edi
mov dword [esi + 0x30], eax
call fcn.0053364a
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
mov dword [ebp + 8], eax
cmp eax, edi
je 0x4aae0c
push 0x12c
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call ebx
push dword [esi + 0x30]
call ebx
mov dword [esi + 0x30], edi
pop edi
pop ebx
pop ecx
pop ebp
ret 4