joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48b758
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.004053c0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.0041fd00
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.004767c3
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x42307e
push 0
lea ecx, [esp + 0x1c]
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x42305c
cmp eax, 0xffffffff
jae 0x42305c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x42307e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x4230cb
test edi, edi
je 0x4230c1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4230aa
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4230aa
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4230b3
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4230c1
mov byte [esp + 0x8d], al
jmp 0x4230c3
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x423107
test esi, esi
je 0x423105
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x4230f7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x4230f7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x423100
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x423107
xor esi, esi
test edi, edi
jne 0x423130
test esi, esi
je 0x423134
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x42313d
cmp dword [esp + 0x14], 0
jne 0x42313d
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x423140
test esi, esi
je 0x42310f
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x423113
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0045b0da
add esp, 0x6c
ret 0x28
Function at 0x423180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4891c8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x80]
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
call fcn.004053c0
push eax
push 0x800
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x74], 0
call fcn.0041f7b0
mov ebp, eax
mov eax, dword [esp + 0x3c]
add esp, 0x18
test eax, eax
mov dword [esp + 0x5c], 0xffffffff
je 0x423267
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x423241
cmp eax, 0xffffffff
jae 0x423241
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x423263
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00476503
mov ebp, dword [esp + 0x7c]
add esp, 0x10
cmp byte [esp + 0x70], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
jne 0x4232cd
test ebp, ebp
je 0x4232c6
mov eax, dword [ebp + 0x20]
cmp dword [eax], 0
je 0x4232b1
mov ecx, dword [ebp + 0x30]
cmp dword [ecx], 0
jle 0x4232b1
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4232bb
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, ebp
call edx
cmp eax, 0xffffffff
je 0x4232c6
mov byte [esp + 0x71], al
jmp 0x4232c8
xor ebp, ebp
mov byte [esp + 0x70], 1
cmp byte [esp + 0x7c], 0
mov esi, dword [esp + 0x78]
jne 0x423303
test esi, esi
je 0x423301
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x4232f3
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x4232f3
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4232fc
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x423303
xor esi, esi
test ebp, ebp
jne 0x42330d
test esi, esi
je 0x423311
jmp 0x423314
test esi, esi
je 0x423314
or dword [edi], 1
lea eax, [esp + 0x30]
cmp dword [esp + 0x2c], eax
je 0x423331
cmp dword [esp + 0x18], 0
jne 0x423331
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x423334
or dword [edi], 2
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0045b0da
add esp, 0x50
ret 0x28
Function at 0x425950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x489618
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x4259a5
mov ecx, esi
call fcn.004215d0
xor esi, esi
call fcn.00484f60
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
xor eax, eax
jmp 0x425a09
mov ecx, dword [0x4ad86c]
push ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [0x4ad86c]
push edx
push eax
call ebp
mov ebx, dword [esp + 0x2c]
push ebx
push 1
mov ecx, esi
mov dword [esp + 0x2c], edi
call fcn.00423680
test eax, eax
je 0x4259f9
cmp edi, 0xffffffff
je 0x4259eb
add edi, 1
push ebx
push 1
mov ecx, esi
call fcn.00423680
test eax, eax
jne 0x4259e3
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4ad86c]
push ecx
push edx
call ebp
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x4262f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x489808
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x1c]
sub esp, 0x28
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x4c]
xor edx, edx
mov dword [eax + 8], ecx
mov dword [esp + 0x30], esp
lea ecx, [eax + 0xc]
push 0xffffffffffffffff
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], 0xf
push edx
mov dword [esp + 0x44], edx
mov byte [ecx + 4], dl
lea edx, [esp + 0x58]
push edx
call fcn.0040204d
mov ecx, dword [esi + 8]
call fcn.00425720
cmp dword [esp + 0x40], 0x10
jb 0x426370
mov eax, dword [esp + 0x2c]
push eax
call fcn.00451909
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x28
Function at 0x426a10
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x48995b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
push 0x13b
push str.CDownloader::FinalRelease
push str.MINIDL__s_Line:__d_n
lea eax, [esp + 0x38]
push 0x3fc
push eax
mov esi, ecx
call fcn.0045c2d6
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esi + 0x598]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], 0
call fcn.00410380
cmp byte [esi + 0x65], 0
mov dword [esp + 0x838], 0
je 0x426ad1
cmp byte [esp + 0x18], 0
mov dword [esp + 0x838], 0xffffffff
je 0x426bfa
mov eax, dword [esp + 0x14]
add dword [eax], 0xffffffff
jne 0x426bfa
xor ecx, ecx
lea edx, [eax + 4]
xchg dword [edx], ecx
jmp 0x426bc9
mov eax, 0x4262a0
mov edx, eax
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x588]
call fcn.0041c9d0
mov ecx, dword [esi + 0x58c]
test ecx, ecx
lea edi, [esi + 0x58c]
mov byte [esi + 0x65], 1
je 0x426b19
call fcn.00484da0
mov ecx, edi
call fcn.004179c0
mov eax, dword [esi + 0x5f4]
mov ebp, dword [eax]
lea edi, [esi + 0x5f0]
mov esi, edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
test esi, esi
mov ebx, dword [edi + 4]
je 0x426b3c
cmp esi, edi
je 0x426b41
call fcn.0045c182
cmp ebp, ebx
je 0x426b75
test esi, esi
jne 0x426b4e
call fcn.0045c182
cmp ebp, dword [esi + 4]
jne 0x426b58
call fcn.0045c182
mov edx, dword [ebp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.004174b0
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
jmp 0x426b31
push 0x14e
push str.CDownloader::FinalRelease
push str.MINIDL__s_Line:__d_n
lea eax, [esp + 0x438]
push 0x3fc
push eax
call fcn.0045c2d6
add esp, 0x14
lea ecx, [esp + 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esp + 0x18], 0
mov dword [esp + 0x838], 0xffffffff
je 0x426bfa
mov eax, dword [esp + 0x14]
add dword [eax], 0xffffffff
jne 0x426bfa
xor edx, edx
lea ecx, [eax + 4]
xchg dword [ecx], edx
lea ecx, [eax + 8]
mov edx, ecx
mov eax, SysReAllocString
lock xadd dword [edx], eax
test eax, 0x40000000
jne 0x426bfa
cmp eax, 0x80000000
jle 0x426bfa
mov eax, ecx
lock bts dword [eax], 0x1e
jb 0x426bfa
call fcn.0040bb70
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0045b0da
add esp, 0x828
ret
Function at 0x42b0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489a48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0040b9e0
test edi, edi
mov dword [esp + 0x18], 0
je 0x42b114
add edi, 0x28
jmp 0x42b116
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42b12e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42c7c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x489c18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
mov dword [edi], ecx
lea esi, [edi + 8]
push eax
lea edx, [esp + 0x30]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], eax
push edx
mov ecx, esi
mov dword [esp + 0x24], eax
mov word [esi + 4], ax
call fcn.00402157
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], eax
jb 0x42c847
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00451909
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x42d760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489d28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004033ef
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x42d7aa
add edi, 0x28
jmp 0x42d7ac
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42d7c4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42d800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489d28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004033ef
mov dword [esi], vtable.boost::gregorian::bad_year.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x42d84a
add edi, 0x28
jmp 0x42d84c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42d864
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x42d8a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489d28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004033ef
mov dword [esi], vtable.boost::gregorian::bad_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x42d8ea
add edi, 0x28
jmp 0x42d8ec
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42d904
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x430350
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
push 1
push 0
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [esp + 0x20]
mov ebx, eax
test ebx, ebx
mov dword [esi + 4], ebx
jne 0x4303ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [esp + 0x14], edi
call fcn.00484f60
neg edi
sbb edi, edi
test edi, fcn.004318e0
mov dword [esp + 0x18], eax
je 0x4303ae
push str.thread.entry_event
lea eax, [esp + 0x18]
push eax
call fcn.0040cc50
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + 8], eax
mov dword [esi + 8], eax
cmp dword [ebp + 8], 0
jne 0x430402
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov dword [esp + 0x14], edi
call fcn.00484f60
neg edi
sbb edi, edi
test edi, fcn.004318e0
mov dword [esp + 0x18], eax
je 0x430402
push str.thread.exit_event
lea ecx, [esp + 0x18]
push ecx
call fcn.0040cc50
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0x428890
push eax
push 0
mov dword [esp + 0x28], 0
call fcn.0045d1d4
add esp, 0x18
test eax, eax
mov dword [ebp + 4], eax
jne 0x430480
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test ebx, ebx
je 0x43044a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x430458
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], edi
call fcn.00484f60
neg edi
sbb edi, edi
test edi, fcn.004318e0
mov dword [esp + 0x18], eax
je 0x430480
push str.thread
lea ecx, [esp + 0x18]
push ecx
call fcn.0040cc50
test ebx, ebx
je 0x430494
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4362d0
Capabilities:
Copy file

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x28]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov dword [esp], eax
mov eax, dword [esp + 0x24]
lea edx, [esp]
push edx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov word [esp + 0x14], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
add esp, 0x20
ret

Function at 0x436330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x228], eax
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x238]
mov eax, dword [esp + 0x230]
push esi
mov esi, dword [esp + 0x244]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x240]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jl 0x4363b4
mov eax, dword [esp + 8]
push eax
push str.CLSID_sLocalServer32
lea ecx, [esp + 0x2c]
push 0x103
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edx, dword [esp + 0x18]
add esp, 0x10
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x436406
mov ecx, dword [esp + 4]
lea edx, [esp + 0xc]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43641e
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0045b0da
add esp, 0x22c
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
pop esi
xor ecx, esp
mov al, 1
call fcn.0045b0da
add esp, 0x22c
ret

Function at 0x436450
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.0045bc20
push 0x103
lea ecx, [esp + 0x10]
push 0x493558
push ecx
call fcn.0045c730
add esp, 0x18
lea edx, [esp]
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045b0da
add esp, 0x108
ret
Function at 0x4364c0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xfffffffffffffffe
push 0x4a13b0
push 0x45b490
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ab13c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
mov word [ebp], bx
push 0x206
push ebx
lea eax, [ebp + 2]
push eax
call fcn.0045bc20
add esp, 0xc
push 0x104
lea ecx, [ebp]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
push ebx
push 0x4935ac
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x4365b3
push edi
call fcn.0045190e
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x4365b3
push edi
push ebx
push esi
call fcn.0045bc20
add esp, 0xc
push esi
push edi
push ebx
push 0x4935ac
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4365b3
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0x4935a8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4365b3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4365b3
mov cx, word [eax + 0xa]
mov word [ebp - 0x20], cx
movzx edx, word [eax + 8]
mov dword [ebp - 0x1c], edx
movzx ebx, word [eax + 0xe]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00436636
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
push ebx
mov esi, dword [ebp - 0x1c]
push esi
mov edi, dword [ebp - 0x20]
push edi
push str.restart
lea eax, [ebp]
push eax
push 0x493588
push 0x493574
call fcn.0045a9d8
push ebx
push esi
push edi
push 0x493574
call fcn.004017e1
add esp, 0x40
push 0x4991b8
push 0
push 0x1e
call fcn.0045a512
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045b0da
add ebp, 0x20c
mov esp, ebp
pop ebp
ret