joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4174f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 1], bl
cmp dword [esi + 0x4c], ebx
je 0x41752a
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x417525
mov byte [ebp - 1], 1
cmp dword [esi + 0x4c], ebx
jne 0x41752e
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x41754e
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push esi
push 0x418a29
push ebx
push ebx
call fcn.0045e6f5
add esp, 0x18
mov dword [esi + 0x4c], eax
pop esi
pop ebx
leave
ret

Function at 0x417552
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4c9300
call fcn.0045d534
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x417571
xor eax, eax
jmp 0x41769f
push edi
mov edi, 0x50dea8
lea ecx, [esi + 0xc4]
push edi
call fcn.004be04b
lea ecx, [esi + 0xc8]
push edi
call fcn.004be04b
lea ecx, [ebp - 0x64]
call fcn.00420c46
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00420d99
test eax, eax
je 0x4175b5
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004bdffb
lea ecx, [ebp - 0x64]
call fcn.00420e1f
test eax, eax
je 0x4175d0
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004bdffb
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.0045d740
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41766f
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push str.Error_in_bind:
push 0x510690
call fcn.0041901e
pop ecx
pop ecx
mov ecx, eax
call fcn.00418d59
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00418e79
mov ecx, esi
call fcn.00418f40
jmp 0x417690
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.004174f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00420cf2
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x417560
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4c9300
call fcn.0045d534
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x417571
xor eax, eax
jmp 0x41769f
push edi
mov edi, 0x50dea8
lea ecx, [esi + 0xc4]
push edi
call fcn.004be04b
lea ecx, [esi + 0xc8]
push edi
call fcn.004be04b
lea ecx, [ebp - 0x64]
call fcn.00420c46
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00420d99
test eax, eax
je 0x4175b5
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004bdffb
lea ecx, [ebp - 0x64]
call fcn.00420e1f
test eax, eax
je 0x4175d0
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004bdffb
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.0045d740
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41766f
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push str.Error_in_bind:
push 0x510690
call fcn.0041901e
pop ecx
pop ecx
mov ecx, eax
call fcn.00418d59
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00418e79
mov ecx, esi
call fcn.00418f40
jmp 0x417690
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.004174f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00420cf2
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4178b4
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x4c9328
call fcn.0045d534
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
push 0x50dea8
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
call fcn.004bdf30
mov eax, dword [esi + 0xc4]
and dword [ebp - 4], 0
lea edi, [esi + 0xc4]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [eax - 8]
cmp ecx, 4
jle 0x417907
push eax
call ebx
cmp al, 0xa
je 0x41792c
cmp al, 0xc0
jne 0x417907
cmp ah, 0xa8
je 0x41792c
mov eax, dword [esi + 0xc8]
add esi, 0xc8
cmp dword [eax - 8], 4
jle 0x417938
push dword [edi]
call ebx
cmp al, 0xa
je 0x41792f
cmp al, 0xc0
jne 0x417938
cmp ah, 0xa8
je 0x41792f
jmp 0x417938
push edi
jmp 0x417930
push esi
lea ecx, [ebp - 0x10]
call fcn.004bdffb
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
jne 0x41794e
push str.239.255.255.250
lea ecx, [ebp - 0x10]
call fcn.004be04b
push 0x10
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0045d740
add esp, 0xc
push dword [ebp - 0x10]
call ebx
push 0x76c
mov dword [ebp - 0x20], eax
mov word [ebp - 0x24], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push 0
push dword [ebp + 8]
call fcn.0045d7a0
pop ecx
push eax
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004bdec2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x418c51
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x100
push eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x418ccf
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, edi
je 0x418ccf
cmp word [esi + 0xa], 4
jne 0x418ccf
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x418ccf
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 4]
push eax
call fcn.0045dfd0
add esp, 0xc
cmp byte [ebp - 4], 0xa
je 0x418cbe
cmp byte [ebp - 4], 0xc0
je 0x418cbe
cmp byte [ebp - 3], 0xa8
jne 0x418ccc
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x418c98
jmp 0x418ccf
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x418cd6
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x100
push eax
or ebx, 0xffffffff
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x418d52
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x418d52
cmp word [esi + 0xa], 4
jne 0x418d52
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x418d52
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 4]
push eax
call fcn.0045dfd0
mov eax, dword [ebp - 4]
add esp, 0xc
cmp al, 0xa
je 0x418d50
cmp al, 0xc0
jne 0x418d42
cmp ah, 0xa8
je 0x418d50
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x418d1e
jmp 0x418d52
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x41a4ff
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
xor edi, edi
push 0x100
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41a58a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, edi
je 0x41a58a
cmp word [esi + 0xa], 4
jne 0x41a58a
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x41a58a
push ebx
mov ebx, dword [ebp + 8]
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp - 8]
push eax
call fcn.0045dfd0
mov eax, dword [ebx + 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.0041a5e9
cmp dword [ebp - 4], 0
jne 0x41a57d
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x41a54a
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x41ae86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4c9734
call fcn.0045d534
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.004c43c0
mov esi, dword [eax + 0xc]
push str.IMAGE
movzx eax, word [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x41aece
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41aed2
xor eax, eax
jmp 0x41aefe
push 0
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.004c27c2
mov ecx, dword [ebp - 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
call fcn.0041af77
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.004c27fe
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41e895
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4c9d68
call fcn.0045d534
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0
push 0
mov dword [ebp - 0x20], edi
call esi
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x41ea5e
inc eax
push eax
call fcn.004be426
pop ecx
mov ebx, eax
push ebx
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x41e8e7
push ebx
call fcn.004be44f
pop ecx
jmp 0x41ea5e
lea ecx, [ebp - 0x40]
call fcn.004b9a07
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jae 0x41e941
cmp dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
je 0x41e934
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x41e934
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x38]
call fcn.004b9be3
jmp 0x41e934
add dword [ebp - 0x14], 4
add dword [ebp - 0x18], 4
mov dword [ebp - 4], esi
jmp 0x41e8fa
push dword [ebp - 0x24]
call fcn.004be44f
mov eax, dword [0x50e008]
pop ecx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.004bee14
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004bee14
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.00415093
push 0x805c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004150d5
lea esi, [ebp - 0x2c]
lea eax, [ebp - 0x28]
neg esi
sbb esi, esi
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
and esi, eax
push dword [esi]
push 0x2c6ca
push 1
push dword [edi + 0x5c]
call ebx
push 0x8059
lea ecx, [ebp - 0x2c]
call fcn.004150d5
mov eax, dword [esi]
mov ecx, dword [edi + 0x5c]
push eax
mov eax, dword [ebp - 0x1c]
push ecx
push 0x410
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InsertMenuA]
cmp dword [ebp - 0x38], 0
jne 0x41e9f2
push 0x805d
lea ecx, [ebp - 0x2c]
call fcn.004150d5
push dword [esi]
push 0x2c6ca
push 1
push dword [edi + 0x54]
call ebx
xor eax, eax
cmp dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jle 0x41ea1f
jmp 0x41ea01
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
push dword [ecx + eax*4]
add eax, 0x9100
push eax
push 0
push dword [edi + 0x54]
call ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jl 0x41e9fe
push 0x805a
lea ecx, [ebp - 0x2c]
call fcn.004150d5
mov esi, dword [esi]
mov edi, dword [edi + 0x54]
mov eax, dword [ebp - 0x1c]
push esi
push edi
push 0x410
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InsertMenuA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004150c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004b9a3a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41fcc3
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
cmp edi, ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
jne 0x41fd5f
lea eax, [ebp - 4]
push eax
push str.PPStream.TSR
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41fd5a
lea eax, [ebp - 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
mov dword [ebp - 8], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fd4d
cmp dword [ebp + 8], 2
je 0x41fd3d
cmp dword [ebp + 8], 1
jne 0x41fd4d
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x10c]
mov byte [ebp + eax - 0x10c], bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x41fd5f
mov edi, str.tsr.dll
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x41fd7d
push str.Initialize
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x41fd8f
push str.Uninitialize
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x41fdd5
push str.setstringvalue
push eax
call edi
push str.setintvalue
mov dword [esi + 8], eax
push dword [esi + 0x1c]
call edi
push str.getstringvalue
mov dword [esi + 0xc], eax
push dword [esi + 0x1c]
call edi
push str.getintvalue
mov dword [esi + 0x10], eax
push dword [esi + 0x1c]
call edi
push str.getthreadinfo
mov dword [esi + 0x14], eax
push dword [esi + 0x1c]
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x41fddd
call eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41ffb4
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4c9f60
call fcn.0045d534
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, esi
jl 0x420029
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, esi
je 0x41fffd
mov dword [ebp - 0x18], esi
jmp 0x42000c
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
je 0x420038
push str.ppStream
push dword [ebp + 8]
call fcn.0045d630
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x420050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4200a9
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x4200ae
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
lea eax, [ebp - 0x25c]
push edi
push eax
mov edi, SysReAllocStringLen
push str..htm
push edi
call fcn.00420050
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x4201be
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x25c]
push str._shellopencommand
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x25c]
push eax
push edi
call fcn.00420050
add esp, 0xc
test eax, eax
jne 0x4201be
lea eax, [ebp - 0x25c]
push str.__1_
push eax
call fcn.0045fb1a
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x420159
lea eax, [ebp - 0x25c]
push 0x502530
push eax
call fcn.0045ed50
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x420159
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x25d]
jmp 0x42015b
mov byte [edi], bl
push 0x5018fc
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push 0x44
lea eax, [ebp - 0x54]
pop esi
push esi
push ebx
push eax
call fcn.0045d740
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x54], esi
call fcn.0045d740
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x25c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4201be
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push 1
pop eax
jmp 0x4201db
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4210ac
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4ca0d0
call fcn.0045d534
sub esp, 0x124
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0x68]
push edi
lea ebx, [esi + 0x68]
mov dword [ebp - 0x20], esi
cmp dword [ecx - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
jne 0x4211bc
lea ecx, [ebp - 0x130]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x130]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x4211bc
and dword [ebp - 0x1c], 0
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x130]
push esi
push edi
push dword [ebp - 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x500988
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x10]
mov cx, word [eax + 0x10]
mov edi, dword [eax + 0x14]
mov ax, word [eax + 0x14]
mov word [ebp - 0x22], ax
mov eax, dword [0x505810]
shr esi, 0x10
mov word [ebp - 0x26], cx
mov dword [ebp - 0x10], eax
shr edi, 0x10
and dword [ebp - 4], 0
push 0x809d
lea ecx, [ebp - 0x10]
call fcn.004bf55b
movzx eax, word [ebp - 0x22]
push eax
movzx eax, di
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, si
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b82e3
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004bdec2
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
add esi, 0x64
mov ecx, dword [ebp + 8]
neg esi
sbb esi, esi
and esi, ebx
push esi
call fcn.004bdc37
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4210bd
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4ca0d0
call fcn.0045d534
sub esp, 0x124
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0x68]
push edi
lea ebx, [esi + 0x68]
mov dword [ebp - 0x20], esi
cmp dword [ecx - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
jne 0x4211bc
lea ecx, [ebp - 0x130]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x130]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x4211bc
and dword [ebp - 0x1c], 0
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x130]
push esi
push edi
push dword [ebp - 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x500988
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x10]
mov cx, word [eax + 0x10]
mov edi, dword [eax + 0x14]
mov ax, word [eax + 0x14]
mov word [ebp - 0x22], ax
mov eax, dword [0x505810]
shr esi, 0x10
mov word [ebp - 0x26], cx
mov dword [ebp - 0x10], eax
shr edi, 0x10
and dword [ebp - 4], 0
push 0x809d
lea ecx, [ebp - 0x10]
call fcn.004bf55b
movzx eax, word [ebp - 0x22]
push eax
movzx eax, di
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, si
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b82e3
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004bdec2
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
add esi, 0x64
mov ecx, dword [ebp + 8]
neg esi
sbb esi, esi
and esi, ebx
push esi
call fcn.004bdc37
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x424cee
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.004364f2
test eax, eax
je 0x424d04
push 0
push 1
jmp 0x424d68
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x424d6e
push esi
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x429260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4292cc
lea eax, [ebp - 0x140]
push eax
call fcn.0041ff8b
test eax, eax
pop ecx
je 0x4292cc
lea eax, [ebp - 0x140]
push str.update.exe
push eax
call fcn.0045d630
lea eax, [ebp - 0x140]
pop ecx
mov dword [ebp - 0x2c], eax
pop ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4292da
push 5
push str.http:__www.ppStream.com_download_
call fcn.004200ae
pop ecx
pop ecx
pop esi
leave
ret 4