joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446167
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x94], 0x94
and dword [eax], 0
lea eax, [ebp - 0x94]
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 1
jne 0x4461e2
cmp dword [ebp - 0x8c], 0
je 0x4461da
cmp dword [ebp - 0x8c], 0xa
je 0x4461c5
cmp dword [ebp - 0x8c], 0x5a
je 0x4461ce
xor al, al
mov dword [esi], 0x80
jmp 0x446246
call fcn.0044651f
test al, al
je 0x4461d2
mov al, 1
jmp 0x4461ba
mov dword [esi], 0x40
jmp 0x446230
mov dword [esi], 0x10
jmp 0x446230
cmp dword [ebp - 0x84], 2
jne 0x446244
mov eax, dword [ebp - 0x90]
sub eax, 4
je 0x44623c
mov ecx, dword [ebp - 0x8c]
dec eax
je 0x44620c
dec eax
je 0x446234
xor al, al
mov dword [esi], 0x1000000
jmp 0x446246
test ecx, ecx
jne 0x446218
mov dword [esi], 0x100000
jmp 0x446230
cmp ecx, 1
jne 0x446225
mov dword [esi], 0x400000
jmp 0x446230
cmp ecx, 2
jne 0x446234
mov dword [esi], 0x800000
mov al, 1
jmp 0x446246
test ecx, ecx
jne 0x446202
mov al, 1
jmp 0x446204
mov dword [esi], 0x10000
jmp 0x446230
xor al, al
pop esi
leave
ret

Function at 0x446633
Capabilities:
Get common file path

Disassembly:
mov eax, 0x466a97
call fcn.004341ac
sub esp, 0x15c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
mov esi, 0x104
pop ebx
cmp dword [ebp + 0xc], ebx
jne 0x4466de
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4466de
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x482364], eax
je 0x4466de
lea ecx, [ebp - 0x168]
push esi
push ecx
call eax
test eax, eax
je 0x4466de
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x46baf8
mov esi, 0x46baf0
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.0040250b
push 0x47c870
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00446770
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00403f4f
mov dword [ebp - 0x14], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
jmp 0x446759
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x446706
lea ecx, [ebp - 0x30]
call fcn.00444846
lea eax, [ebp - 0x30]
push 0x475ec8
push eax
call fcn.00435895
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x46baf8
mov esi, 0x46baf0
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.0040250b
push 0x47c870
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.00446770
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00403f4f
and byte [ebp - 4], 0
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3c]
call fcn.004020a2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x447ad3
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x466d1f
call fcn.004341ac
sub esp, 0x4c
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0xd]
push ebx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 3
mov dword [ebp - 0x58], 0x469580
mov dword [ebp - 0x38], 0x469578
call fcn.00402c39
mov dword [ebp - 0x14], ebx
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 5
call fcn.0040316b
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x447b41
lea ecx, [ebp - 0x14]
call fcn.0040d832
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
cmp eax, ebx
push edi
mov esi, eax
jne 0x447bba
mov esi, dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
lea ecx, [ebp + 0x38]
call fcn.0040316b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push esi
call edi
mov esi, eax
cmp esi, ebx
jne 0x447bba
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x58]
push eax
call fcn.004025f2
mov esi, eax
mov ecx, dword [esi]
mov byte [ebp - 4], 6
call fcn.0040316b
lea ecx, [ebp + 0x38]
mov dword [ebp - 0x18], eax
mov dword [esi + 8], eax
call fcn.0040316b
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1c], ebx
push ecx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push ecx
push ebx
push eax
push dword [ebp - 0x14]
call edi
lea ecx, [ebp - 0x30]
mov esi, eax
mov byte [ebp - 4], 5
call fcn.00402704
cmp esi, ebx
mov dword [0x486844], esi
pop edi
lea eax, [ebp - 0x58]
je 0x447bcb
lea eax, [ebp + 0x60]
mov esi, dword [ebp + 8]
push ebx
push eax
mov ecx, esi
mov dword [esi], 0x469580
mov dword [esi + 0x20], 0x469578
call fcn.00403f4f
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x14], ebx
je 0x447bfc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004020a2
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 2
call fcn.004020a2
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 1
call fcn.004020a2
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], bl
call fcn.004020a2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44837a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4483a2
xor al, al
leave
ret
cmp dword [ebp - 0x84], 2
jne 0x4483b9
cmp dword [ebp - 0x90], 5
jb 0x4483b9
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x44a179
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x44a1be
mov eax, dword [ebp + 8]
test eax, eax
je 0x44a193
and dword [eax], 0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44a21a
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44a21a
cmp dword [ebp + 8], 0
jne 0x44a1f3
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44a21a
push 1
add esi, 0xc
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00449fac
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x44c4ab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44c4bf
push 1
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44c4f3
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44c526
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c526
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x44c52e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x44c544
mov dword [ebp + 0xc], 1
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44c579
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8
Function at 0x44c581
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44c595
push 1
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44c5c9
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44c5fc
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c5fc
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x44c604
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x44c61a
mov dword [ebp + 0xc], 1
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44c64f
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8

Function at 0x44c657
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44c66d
mov eax, 0x1ed
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44c6a1
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44c6d4
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c6d4
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x44c6dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44c6f2
mov eax, 0x28e
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44c726
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44c759
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c759
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x44c761
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44c774
xor eax, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44c7a8
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44c7db
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44c7db
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x44d9a5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x467987
call fcn.004341ac
sub esp, 0x138
and byte [ebp - 0x144], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x143]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x10]
pop ebx
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44da82
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x18], 0x104
mov eax, str.CommonFilesDir
je 0x44da0f
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push esi
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x144]
mov edi, 0x46baf8
mov esi, 0x46baf0
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.0040250b
push 0x47c870
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00446770
lea ecx, [ebp - 0x40]
call fcn.0044d5ea
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00403f4f
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
jmp 0x44dad1
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x144]
mov edi, 0x46baf8
mov esi, 0x46baf0
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.0040250b
push 0x47c870
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00446770
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00403f4f
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.004020a2
cmp dword [ebp - 0x10], 0
je 0x44daea
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44daea
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44e696
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x44e6ac
mov dword [ebp + 0xc], 4
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44e6e1
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8
Function at 0x44e6e9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x44e6ff
mov dword [ebp + 0xc], 1
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44e734
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8

Function at 0x44e73c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x44e750
push 4
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44e784
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0044f58c
test al, al
jne 0x44e7b7
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0044a073
lea eax, [ebp - 0x4c]
push 0x476b18
push eax
call fcn.00435895
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e7b7
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.004447da
lea eax, [ebp - 0x48]
push 0x4758d0
push eax
call fcn.00435895
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x44f06a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push edi
mov edi, ecx
call fcn.0040b367
xor ebx, ebx
cmp eax, 1
jne 0x44f107
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44f0f4
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x44f0cb
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x830]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x44f0f4
mov byte [ebp - 0x830], bl
cmp dword [ebp - 4], ebx
je 0x44f107
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x44f107
push dword [ebp - 4]
call eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044eb46
add esp, 0x14
xor ecx, ecx
cmp eax, ebx
mov dword [edi + 4], eax
setne cl
pop edi
mov al, cl
pop ebx
leave
ret 0x14
Function at 0x44f82c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x74]
cmp eax, 0x7530
jbe 0x44f864
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], ecx
mov ecx, dword [esi + 0x6c]
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x6c], eax
call edi
mov dword [esi + 0x74], eax
mov edi, dword [esi + 0x64]
test edi, edi
jne 0x44f870
mov eax, dword [esi + 0x5c]
jmp 0x44f8b9
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x44f8b7
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0x5c]
cmp ebx, eax
jbe 0x44f895
shr ebx, 1
shr edi, 1
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], edi
mov eax, dword [esi + 0x5c]
mov edi, dword [esi + 0x64]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x44f879
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x44fd9e
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 0x20000013
push dword [esi + 4]
mov dword [ebp - 4], 4
call fcn.0044ed22
add esp, 0x14
test eax, eax
je 0x44fddc
mov eax, dword [ebp - 8]
cmp eax, 0xc8
jb 0x44fde0
cmp eax, 0x12c
jae 0x44fde0
mov al, 1
jmp 0x44fdf6
add eax, 0xd3c0
or eax, 0x80040000
push eax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
leave
ret

Function at 0x450d6f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x450dc1
push eax
call fcn.004342c0
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x450dc1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x47ceac
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x450dc5
xor al, al
jmp 0x450e26
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x450e24
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.004342c0
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x450e24
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x450e12
mov al, 1
pop ebx
leave
ret 4
Function at 0x454a9d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x454b6f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.004342c0
pop ecx
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
push 0
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp + 8]
jne 0x454b6f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x30]
lea ecx, [esi + 0x28]
push dword [ecx + 4]
call fcn.0045522d
push dword [esi + 0x20]
lea ecx, [esi + 0x18]
push dword [ecx + 4]
call fcn.004551d7
mov edi, 0x48391c
push edi
call fcn.00434610
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00403dd8
mov edi, dword [ebp - 4]
mov ecx, esi
and byte [edi + ebx], 0
mov dword [esi + 0x38], edi
call fcn.004545c1
push eax
push 0
mov ecx, esi
call fcn.00454736
test eax, eax
je 0x454b6f
mov ecx, esi
call fcn.004545c1
push eax
push 9
mov ecx, esi
call fcn.00454736
test eax, eax
je 0x454b6f
push esi
mov ecx, esi
call fcn.00454a11
test eax, eax
jne 0x454b73
xor eax, eax
jmp 0x454b7d
push edi
call fcn.004338ba
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x454ca2
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x468360
call fcn.004341ac
sub esp, 0x5c
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], ecx
mov edi, dword [eax + 0x2c]
mov eax, dword [eax + 0x30]
cmp edi, eax
je 0x454d93
push ebx
push esi
and dword [ebp - 0x14], 0
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
test eax, eax
jne 0x454cda
mov eax, 0x4695a0
lea ecx, [ebp - 0xd]
push 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401a6d
mov ecx, dword [ebp + 0xc]
push 0xf003f
mov byte [ebp - 4], 1
mov esi, dword [ecx]
mov ecx, eax
call fcn.00401c5e
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00413a57
test eax, eax
setne bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401306
test bl, bl
jne 0x454d6f
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00454ca2
cmp dword [edi + 0x14], 0
jne 0x454d6f
mov eax, dword [edi + 4]
test eax, eax
jne 0x454d3c
mov eax, 0x4695a0
lea ecx, [ebp - 0xe]
push 1
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00401a6d
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov esi, dword [ecx]
mov ecx, eax
call fcn.00401c5e
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00401306
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x454d82
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add edi, 0x38
cmp edi, dword [eax + 0x30]
jne 0x454cc6
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
mov dword fs:[0], ecx
leave
ret 8