joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425180
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov eax, edi
or eax, ecx
mov dword [ebp - 8], ebx
jne 0x4251a1
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp + 0xf], 1
push esi
test ecx, ecx
ja 0x425224
jb 0x4251b4
cmp edi, 0x3200000
ja 0x425224
push edi
call fcn.00492db5
push edi
mov esi, eax
push 0
push esi
call fcn.0049c630
push 0x4c0db0
push ebx
call fcn.00495e19
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x42526d
push ebx
push 1
push edi
push esi
call fcn.0049645f
add esp, 0x10
cmp eax, 1
jae 0x42520b
push ebx
mov byte [ebp + 0xf], 0
call fcn.004968d5
push esi
call fcn.00494b53
add esp, 8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call fcn.004968d5
push esi
call fcn.00494b53
mov al, byte [ebp + 0xf]
add esp, 8
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x3200000
push ecx
push edi
call fcn.0049cdb0
mov dword [ebp - 0xc], eax
imul eax, eax, 0x3200000
push 0x3200000
sub edi, eax
call fcn.00492db5
push 0x3200000
mov esi, eax
push 0
push esi
mov dword [ebp - 4], esi
call fcn.0049c630
push 0x4c0db0
push ebx
call fcn.00495e19
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x42527f
push esi
call fcn.00494b53
add esp, 4
xor al, al
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp dword [ebp - 0xc], esi
jle 0x4252a4
push ebx
push 1
push 0x3200000
push dword [ebp - 4]
call fcn.0049645f
add esp, 0x10
cmp eax, 1
jb 0x4252df
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x425286
push dword [ebp - 4]
call fcn.00494b53
push edi
call fcn.00492db5
push ebx
push 1
mov esi, eax
push edi
push esi
call fcn.0049645f
add esp, 0x18
push esi
cmp eax, 1
jb 0x4252e2
call fcn.00494b53
push ebx
call fcn.004968d5
mov al, byte [ebp + 0xf]
add esp, 8
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call fcn.00494b53
push ebx
call fcn.004968d5
add esp, 8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4270b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2566
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x4d77ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x47c], eax
push 0x40
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x46c]
push 0
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x480], 0
mov dword [ebp - method.CMD5Checksum.virtual_0], vtable.CMD5Checksum.0
call fcn.0049c630
add esp, 0xc
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x424], 0x67452301
mov dword [ebp - 0x420], 0xefcdab89
mov dword [ebp - 0x41c], 0x98badcfe
mov dword [ebp - 0x418], 0x10325476
mov byte [ebp - 4], 1
call fcn.004243e0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x42717b
push 0x80004005
call fcn.00424010
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x474], eax
mov byte [ebp - 4], 2
test edi, edi
jne 0x427197
xor esi, esi
xor ecx, ecx
jmp 0x42720a
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4271a0
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jle 0x4271c0
xor esi, esi
xor ecx, ecx
jmp 0x42720a
add ebx, ebx
mov eax, ebx
call fcn.004a67d0
mov esi, esp
mov dword [ebp - 0x10], esp
test esi, esi
je 0x4271f2
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4271f4
xor esi, esi
xor ecx, ecx
jmp 0x42720a
xor esi, esi
test esi, esi
jne 0x4271fc
xor ecx, ecx
jmp 0x42720a
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427201
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x474]
call fcn.00427490
mov esi, dword [ebp - 0x474]
cmp dword [esi - 4], 1
jle 0x427237
push dword [esi - 0xc]
lea ecx, [ebp - 0x474]
call fcn.00427380
mov esi, dword [ebp - 0x474]
push esi
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.00496210
add esp, 0xc
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x470]
push dword [esi - 0xc]
push eax
call fcn.00427000
mov edi, dword [ebp - 0x47c]
lea ecx, [ebp - 0x470]
push edi
call fcn.00426da0
add esi, 0xfffffff0
mov byte [ebp - 4], 1
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427291
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
jmp 0x4272b8
lea esp, [ebp - 0x490]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00493864
mov esp, ebp
pop ebp
ret
Function at 0x429720
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x429735
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x429740
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429740
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x429770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x429789
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429795
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x429790
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x429e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b28f6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4d77ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x429ecc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x429ecc
call fcn.004291e0
mov esi, eax
jmp 0x429fbc
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x429eef
call fcn.004291e0
jmp 0x429faf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x429f0d
call fcn.004291e0
jmp 0x429faf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x429f2e
mov esi, 0x8007000e
jmp 0x429fb1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0042be70
jmp 0x429f58
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x429f6f
mov esi, 0x8007000e
jmp 0x429fb1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x429f8f
call fcn.004291e0
jmp 0x429faf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0042ac30
mov esi, eax
test edi, edi
je 0x429fbc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x429fe0
lea ecx, [ebp - 0x418]
call fcn.0042bf50
jmp 0x429fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00493864
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42bb30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [0x4d77ac]
xor eax, esp
mov dword [esp + 0xac], eax
push esi
mov esi, dword [ebp + 0x10]
lea ecx, [esp + 8]
push edi
push esi
call fcn.004272e0
push ecx
mov ecx, esp
push esi
call fcn.004272e0
call fcn.00424d10
add esp, 4
test al, al
je 0x42bced
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x28]
mov dword [0x4dc108], eax
call fcn.00471f40
mov ecx, dword [eax]
call fcn.00472080
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
cmp eax, ecx
je 0x42bb9f
push eax
call fcn.00493921
add esp, 4
xor dl, dl
mov ecx, str.skin.zip
call fcn.004721b0
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
push 0
call esi
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
sub esp, 0xc
call fcn.0042b9f0
push 0
call esi
test eax, eax
js 0x42bced
push 0x38d0
call fcn.00493a54
add esp, 4
test eax, eax
je 0x42bc2a
mov ecx, eax
call fcn.0042c9b0
jmp 0x42bc2c
xor eax, eax
mov dword [0x4db560], eax
test eax, eax
je 0x42bced
push ecx
push 0x80000000
push 0x80000000
push 0x190
push 0x258
push 0x60000
push 0x96c80000
push str.US:g8n
push 0
mov ecx, eax
call fcn.004635b0
mov ecx, dword [0x4db560]
call fcn.00463670
mov eax, dword [0x4db560]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00474d70
cmp byte [0x4db6ce], 0
je 0x42bca8
mov ecx, dword [0x4dc10c]
test ecx, ecx
je 0x42bca8
call fcn.00492d60
mov dword [0x4dc10c], 0
call fcn.0042ba30
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x4db4d6], 0
jne 0x42bced
push 0x42ff80
call fcn.004946c8
add esp, 4
push 0x430a70
call fcn.004946c8
add esp, 4
mov edx, dword [esp + 0xc]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42bd0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0xb4]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00493864
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42d8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b2dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4d77ac]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x4d77ac]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov edi, ecx
push 0xfffffffffffffff0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfe3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [edi + 4]
lea ebx, [edi + 0x804]
mov ecx, ebx
call fcn.00471eb0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x158], 1
mov dword [esp + 0x15c], 0
mov dword [esp + 0x160], 0
mov dword [esp + 0x178], 0
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x28]
cmp eax, 4
jne 0x42da71
mov esi, dword [0x4dc104]
mov ecx, edi
mov eax, dword [edi]
test esi, esi
push 0x4c14a4
cmove esi, dword [0x4dc108]
call dword [eax + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x42dac0
mov ecx, dword [0x4dc104]
test ecx, ecx
push esi
cmove ecx, dword [0x4dc108]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x14], eax
push esi
test eax, eax
jne 0x42da0c
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x42dac0
mov eax, dword [0x4dc104]
test eax, eax
cmove eax, dword [0x4dc108]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42dac0
push ebx
call fcn.00492db5
add esp, 4
mov dword [0x4dc3c0], eax
test eax, eax
je 0x42da57
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x4dc3c0]
call fcn.004985a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [0x4dc3c0]
mov edx, ebx
call fcn.00472110
lea ebx, [edi + 0x804]
cmp byte [edi + 0x1029], 0
lea eax, [esp + 0x18]
push 0
push ebx
push eax
push 0
push ecx
mov dword [esp + 0x2c], vtable.CDialogBuilderCallbackEx.0
lea ecx, [esp + 0x30]
mov eax, esp
jne 0x42da9b
mov dword [eax], 0x4c14b0
jmp 0x42daa1
mov dword [eax], 0x4c12a8
call fcn.0046d8f0
push eax
mov ecx, ebx
call fcn.004740b0
lea eax, [edi + 0x20]
mov ecx, ebx
push eax
call fcn.00475510
mov ecx, edi
call fcn.0042d2c0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x42dad1
push eax
call fcn.00493921
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x42dae2
push eax
call fcn.00493921
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.00493864
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42ecb0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2fa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d77ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0x4e2128
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4c03f0
push 0x4e2128
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4e2128
lea ecx, [ebp - 0x10]
call fcn.00425340
push 1
push 0x4c0418
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00426200
mov esi, dword [0x4db560]
push 0x5c
mov eax, dword [esi + 0x389c]
push eax
mov edi, dword [eax - 0xc]
call fcn.0049535b
add esp, 8
test eax, eax
jne 0x42ed3f
or eax, 0xffffffff
jmp 0x42ed47
sub eax, dword [esi + 0x389c]
sar eax, 1
mov ecx, dword [0x4db560]
sub edi, eax
dec edi
lea eax, [ebp - 0x14]
push edi
push eax
lea ecx, [ecx + 0x389c]
call fcn.00425550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00426200
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ed95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax - 0xc]
add esi, 0xfffffffd
jns 0x42edaa
push 0x80070057
call fcn.00424010
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x42edc7
push esi
lea ecx, [ebp - 0x10]
call fcn.00426420
mov eax, dword [ebp - 0x10]
cmp esi, dword [eax - 8]
jg 0x42eda0
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
push ecx
mov word [eax + esi*2], cx
mov eax, dword [0x4db560]
push dword [ebp - 0x10]
push dword [eax + 0x389c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [0x4db560]
push dword [eax + 0x389c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x10]
mov ecx, 0x4dc9d0
push eax
call fcn.00425a50
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x42ee2d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x4db560]
push esi
push edi
push 1
push str.install
lea ecx, [ebx + 0xd78]
call fcn.0048d8b0
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xd4]
push 0x10
call fcn.00493a54
add esp, 4
lea ecx, [ebx + 0xd78]
mov esi, eax
push 1
push str.downrate
call fcn.0048d8b0
push 1
push str.downsetupbar
lea ecx, [ebx + 0xd78]
mov dword [esi], eax
call fcn.0048d8b0
mov ecx, dword [0x4db560]
push 0
push 0
push esi
mov dword [esi + 4], eax
mov eax, dword [esi]
push 0x42c890
push 0
mov dword [ecx + 0x38a8], eax
mov eax, dword [esi + 4]
push 0
mov dword [ecx + 0x38ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov byte [ebx + 0x38a0], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b31f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4d77ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0x4c02b8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
call fcn.00425340
push 0xff
mov dword [ebp - 4], 0
call fcn.00492db5
add esp, 4
mov dword [ebp - 0x1c], 1
mov esi, eax
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4c0e10
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430925
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.Start_Page
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x430925
mov byte [edi], 1
jmp 0x4309a3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4309a3
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.Start_Page
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4309a0
push esi
call fcn.00494b53
add esp, 4
xor bl, bl
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43098c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0
push esi
lea eax, [ebp - 0x14]
push 0x4c02c8
push eax
call fcn.00426500
push esi
call fcn.00494b53
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [0x4dca10]
xor bl, bl
sub edi, dword [0x4dca0c]
xor esi, esi
sar edi, 3
test edi, edi
jle 0x430968
jmp 0x4309e0
mov eax, dword [0x4dca0c]
mov edx, dword [eax + esi*8]
lea ecx, [eax + esi*8]
mov eax, dword [edx - 0xc]
cmp eax, 1
jne 0x430a2b
test eax, eax
js 0x430a5f
cmp word [edx], 0x30
jne 0x430a2b
lea eax, [ecx + 4]
mov ecx, 0x4dca2c
push eax
call fcn.00425a50
mov eax, dword [0x4dca0c]
push dword [eax + esi*8 + 4]
push dword [ebp - 0x14]
call fcn.00495401
add esp, 8
test eax, eax
jne 0x430966
mov bl, 1
jmp 0x430a55
mov eax, edx
mov edx, dword [eax - 0xc]
cmp edx, 1
jne 0x430a55
test edx, edx
js 0x430a5f
cmp word [eax], 0x31
jne 0x430a55
push dword [ecx + 4]
push dword [ebp - 0x14]
call fcn.00495401
add esp, 8
test eax, eax
jne 0x430966
inc esi
cmp esi, edi
jl 0x4309e0
jmp 0x430968
push 0x80070057
call fcn.00424010
int3
Function at 0x431590
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b33ca
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x4d77ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x614], esi
call fcn.004243e0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4315e5
push 0x80004005
call fcn.00424010
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.004243e0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x431613
push 0x80004005
call fcn.00424010
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004243e0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x43163e
push 0x80004005
call fcn.00424010
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
push 0x38
lea eax, [ebp - 0x64c]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.0049c630
lea eax, [ebp - 0x210]
mov dword [ebp - 0x650], 0x3c
mov dword [ebp - 0x640], eax
add esp, 0xc
lea eax, [ebp - 0x410]
mov dword [ebp - 0x63c], 0x100
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x610]
mov dword [ebp - 0x61c], eax
lea eax, [ebp - 0x650]
push eax
push 0x80000000
push 0
push edi
mov dword [ebp - 0x620], 0x100
mov dword [ebp - 0x618], 0x100
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4316d2
push str.Error:InternetCrackUrl_failed__n
call fcn.00496f3c
add esp, 4
mov eax, dword [ebp - 0x644]
lea edx, [ebp - 0x210]
mov dword [esi], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4316e3
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
lea ecx, [esi + 4]
push edx
push eax
call fcn.00425e50
movzx eax, word [ebp - 0x638]
lea edx, [ebp - 0x410]
mov dword [esi + 8], eax
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x431715
sub edx, edi
lea eax, [ebp - 0x410]
sar edx, 1
lea ecx, [esi + 0xc]
push edx
push eax
call fcn.00425e50
mov edx, dword [ebp - 0x61c]
test edx, edx
jne 0x431742
xor ecx, ecx
jmp 0x431756
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431747
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x10]
call fcn.00425e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493864
mov esp, ebp
pop ebp
ret 4