joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b6970
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100b698f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100b6996
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x100b69ad
mov ecx, dword [ebp - 4]
push ecx
call fcn.100ae990
add esp, 4
or eax, 0xffffffff
jmp 0x100b69af
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100b69f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100b6a28
push str._path___NULL_
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.100a25a0
add esp, 0x14
cmp eax, 1
jne 0x100b6a28
int3
cmp dword [ebp - 8], 0
jne 0x100b6a69
call fcn.100aeaf0
mov dword [eax], 0
call fcn.100aeac0
mov dword [eax], 0x16
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._waccess_s
push str._path___NULL_
call fcn.100a2a90
add esp, 0x14
mov eax, 0x16
jmp 0x100b6b41
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff9
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0xc], edx
jne 0x100b6a99
push str.__amode___6____0_
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.100a25a0
add esp, 0x14
cmp eax, 1
jne 0x100b6a99
int3
cmp dword [ebp - 0xc], 0
jne 0x100b6ad7
call fcn.100aeaf0
mov dword [eax], 0
call fcn.100aeac0
mov dword [eax], 0x16
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._waccess_s
push str.__amode___6____0_
call fcn.100a2a90
add esp, 0x14
mov eax, 0x16
jmp 0x100b6b41
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100b6b02
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100ae990
add esp, 4
call fcn.100aeac0
mov eax, dword [eax]
jmp 0x100b6b41
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x100b6b0e
xor eax, eax
jmp 0x100b6b41
mov eax, dword [ebp - 4]
and eax, 1
je 0x100b6b3f
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x100b6b3f
call fcn.100aeaf0
mov dword [eax], 5
call fcn.100aeac0
mov dword [eax], 0xd
call fcn.100aeac0
mov eax, dword [eax]
jmp 0x100b6b41
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401df0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401e3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e34
test esi, esi
je 0x401e34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e10
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402020
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402148
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020ae
cmp eax, 4
jne 0x4020d0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020be
cmp edx, 4
je 0x4020be
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402020
Function at 0x4ace10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4ace2a
add esp, 0xfffffff0
call fcn.00404550
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040547c
mov eax, dword [ebp + 0x18]
call fcn.0040547c
mov eax, dword [ebp + 0x14]
call fcn.0040547c
mov eax, dword [ebp + 0x10]
call fcn.0040547c
mov eax, dword [ebp + 0xc]
call fcn.0040547c
mov eax, dword [ebp + 8]
call fcn.0040547c
xor eax, eax
push ebp
push 0x4acf62
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bba50], 0
je 0x4ace8e
mov ecx, 0x4acf94
mov dl, 1
mov eax, dword [0x4ac5f0]
call 0x4641a0
call 0x4049b8
xor edx, edx
mov eax, edi
call fcn.004041bc
mov dl, 1
mov eax, dword [0x41a9dc]
call fcn.004041bc
mov esi, eax
mov dword [edi + 4], esi
mov eax, esi
mov dl, 1
call 0x41f134
mov eax, dword [edi + 4]
mov byte [eax + 0x1d], 1
lea eax, [edi + 0x18]
mov edx, dword [ebp + 0xc]
call fcn.00405030
lea eax, [edi + 0x14]
mov edx, dword [ebp + 0x18]
call fcn.00405030
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call 0x46662c
mov edx, dword [ebp - 8]
mov eax, dword [0x4bbd78]
call fcn.00405030
mov eax, dword [0x4bbb50]
mov edx, dword [ebp + 0x10]
call fcn.00405030
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov eax, edi
call fcn.004ad04c
push edi
push 0x4ad6fc
mov cl, 1
mov dl, 1
mov eax, dword [0x45b05c]
call 0x461ee8
lea eax, [edi + 0x30]
push eax
call 0x469b50
push edi
push 0x4ad2e0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45b05c]
call 0x461ee8
mov dword [edi + 0xc], eax
mov dword [0x4bba50], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acf69
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405000
lea eax, [ebp + 8]
mov edx, 5
call fcn.00405000
ret
Function at 0x4fe560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9f000]
mov dword [edi + 0xbb710], 0x4d1c0b7e
push edi
or ebp, 0xffffffff
jmp 0x4fe58a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fe591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe580
mov eax, 1
add ebx, ebx
jne 0x4fe5a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fe5b4
jne 0x4fe5d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe5d3
dec eax
add ebx, ebx
jne 0x4fe5c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fe598
add ebx, ebx
jne 0x4fe5cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fe625
xor ecx, ecx
sub eax, 3
jb 0x4fe5eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fe65a
sar eax, 1
mov ebp, eax
jmp 0x4fe5f6
add ebx, ebx
jne 0x4fe5f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe5c4
inc ecx
add ebx, ebx
jne 0x4fe604
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe5c4
add ebx, ebx
jne 0x4fe611
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fe606
jne 0x4fe622
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fe606
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fe644
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fe636
jmp 0x4fe586
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fe644
add edi, ecx
jmp 0x4fe586
pop esi
mov edi, esi
mov ecx, 0x6433
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fe662
cmp byte [edi], 0x1b
jne 0x4fe662
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fe667
lea edi, [esi + 0xfa000]
mov eax, dword [edi]
or eax, eax
je 0x4fe6d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10bd08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10be0c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fe694
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10be10]
or eax, eax
je 0x4fe6d0
mov dword [ebx], eax
add ebx, 4
jmp 0x4fe6b1
call dword [esi + 0x10be20]
mov ebp, dword [esi + 0x10be14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fe70a
sub esp, 0xffffff80
jmp fcn.004b6614
Function at 0x401f50
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esp + 0x120], ebx
je 0x401f95
mov ecx, esi
call fcn.004020b0
test eax, eax
je 0x401f95
lea eax, [esp + 0x18]
push str.Global_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push str._is_running
push edx
call edi
mov eax, dword [esi + 0x108]
cmp eax, ebx
je 0x401fc8
push eax
call fcn.00419540
add esp, 4
mov dword [esi + 0x108], ebx
push 0x14
call fcn.00419406
add esp, 4
cmp eax, ebx
mov dword [esi + 0x108], eax
jne 0x401fea
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov eax, dword [esi + 0x108]
push ebx
push ebx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ecx, dword [esi + 0x108]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push ebx
push eax
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x104], eax
je 0x402055
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402055
mov ecx, dword [esi + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x104], ebx
mov ecx, dword [esi + 0x104]
xor eax, eax
cmp ecx, ebx
pop edi
pop esi
pop ebx
sete al
add esp, 0x110
ret 4

Function at 0x402610
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.004196c0
push ebx
mov ebx, dword [esp + 0x1010]
push ebp
push esi
xor eax, eax
xor esi, esi
test ebx, ebx
push edi
jle 0x402688
mov eax, dword [esp + 0x1018]
mov ecx, dword [esp + 0x1014]
push eax
push ecx
call fcn.004196ac
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x402686
mov ecx, 0x3ff
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x14]
push 0x42f0a8
push edx
call fcn.00419629
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
inc esi
cmp esi, ebx
jl 0x40262d
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret

Function at 0x402920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
add eax, 0x1c
mov edx, 8
mov esi, dword [eax]
sub eax, 4
xor esi, ecx
dec edx
mov dword [eax + 4], esi
mov ecx, esi
jne 0x402931
pop esi
ret

Function at 0x402950
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push esi
push edi
add eax, 0x1c
mov esi, 8
mov ecx, dword [eax]
sub eax, 4
mov edi, ecx
xor edi, edx
dec esi
mov dword [eax + 4], edi
mov edx, ecx
jne 0x402962
pop edi
pop esi
ret
Function at 0x403000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x300c
call fcn.004196c0
push ebx
push ebp
mov ebp, dword [esp + 0x301c]
push esi
push edi
push 3
push 0x42f21c
push ebp
call fcn.00402610
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x40307f
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x101d]
mov byte [esp + 0x101c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
lea eax, [esp + 0x1024]
push str._MassUp__Fail:_Open_File.__s__errorno_d
push eax
call fcn.00419629
add esp, 0x10
lea ecx, [esp + 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x300c
ret
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x201d]
mov byte [esp + 0x201c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x42f12c
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str._AhnLab_UpdateLog_
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 4
lea eax, [esp + 0x20]
push 1
push eax
mov byte [esp + 0x24], bl
lea ebp, [edx + ecx + 0x20]
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], ebx
call fcn.00419b89
add esp, 0x10
cmp eax, 4
jne 0x403116
push esi
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.00419b89
add esp, 0x10
cmp eax, 1
jne 0x403116
push esi
push ebp
lea edx, [esp + 0x2024]
push eax
push edx
call fcn.00419b89
add esp, 0x10
cmp eax, ebp
jne 0x403116
mov dword [esp + 0x10], ebx
jmp 0x403121
push str._MassUp__Fail:_Read_File.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004199d3
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
jne 0x403175
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x201c]
push eax
push 0x80b
push ebp
push ecx
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.00402370
lea eax, [esp + 0x34]
push eax
call fcn.00402bb0
add esp, 0x1c
test eax, eax
jne 0x403190
mov ecx, dword [esp + 0x3024]
push ecx
call fcn.00402db0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x300c
ret
mov edi, str._AhnLab_UpdateLog_
or ecx, 0xffffffff
xor eax, eax
push 0x20
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x3024]
not ecx
dec ecx
lea edx, [esp + ecx + 0x20]
push edx
push eax
call fcn.004196f0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x300c
ret
Function at 0x4031d0
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
sub esp, 8
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x40331c
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
push esi
call fcn.004196f0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x403315
push 0x103
push esi
push 0x437280
call fcn.004196f0
mov edi, 0x437280
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x43727f], 0x5c
jne 0x40325b
mov byte [ecx + 0x43727f], bl
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x1c]
xor esi, esi
push eax
push 0x20019
push ebx
push str.SoftwareAhnLabDynaUpdate
push 0x80000002
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4032f3
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
lea ecx, [esp + 0x18]
push edx
push ecx
push ebx
push str.SULogSize
push eax
mov esi, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x4032c9
mov dword [0x42f090], eax
jmp 0x4032f3
cmp eax, 3
jae 0x4032da
mov dword [0x42f090], 0x300000
jmp 0x4032f3
cmp eax, 0x1e
jbe 0x4032eb
mov dword [0x42f090], 0x1e00000
jmp 0x4032f3
shl eax, 0x14
mov dword [0x42f090], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004199a4
add esp, 4
cmp esi, ebx
je 0x40331c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x403b80
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x429ab5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebp
call fcn.00401000
mov ebx, 1
mov dword [esp + 0x244], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x403bed
mov esi, dword [esp + 0x24c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00401040
mov dword [esp + 0x14], ebx
jmp 0x403c97
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x128
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403c0d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403c80
cmp edi, dword [esp + 0x20]
je 0x403c28
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403c2c
cmp edi, dword [esp + 0x20]
jne 0x403c13
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push ebp
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x403c4b
lea ecx, [esp + 0x10]
push ecx
jmp 0x403c85
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x224
push edx
push esi
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x403c6c
push esi
call edi
lea eax, [esp + 0x10]
push eax
jmp 0x403c85
lea ecx, [esp + 0x138]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401690
push esi
call edi
lea edx, [esp + 0x10]
push edx
mov esi, dword [esp + 0x250]
mov ecx, esi
call fcn.00401040
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x244], 0
call fcn.00401090
mov ecx, dword [esp + 0x23c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x238
ret

Function at 0x403de0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x403e46
cmp dword [esp + 8], 1
jne 0x403e46
mov ax, word [esp + 0x94]
test ax, ax
je 0x403e2b
cmp ax, 1
jne 0x403e46
push str._MUpdate2__NeedDownloadWinhttp___is_TRUE
push 1
call fcn.004036f0
add esp, 8
mov eax, 1
add esp, 0x9c
ret
xor eax, eax
add esp, 0x9c
ret
Function at 0x404290
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x429b5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 4]
stosb byte es:[edi], al
call fcn.00401000
mov dword [esp + 0x114], 0
call fcn.00404280
test eax, eax
je 0x404306
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x104
sub eax, ecx
push eax
lea eax, [esp + 0xc]
push str.Global_
push eax
call fcn.0041a487
add esp, 0xc
mov eax, dword [0x4383b8]
mov ecx, dword [eax - 4]
test ecx, ecx
jle 0x404327
push eax
lea ecx, [esp + 8]
push str.MAutoup_is_running_with__s
push ecx
call fcn.004012b0
add esp, 0xc
jmp 0x404335
push str.MAutoup
lea ecx, [esp + 8]
call fcn.00401690
lea ecx, [esp + 4]
call fcn.00401650
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404379
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
mov esi, 0x104
sub esi, ecx
lea ecx, [esp + 8]
call fcn.00401650
push esi
lea edx, [esp + 0x10]
push eax
push edx
call fcn.0041a487
add esp, 0xc
pop esi
lea eax, [esp + 8]
push eax
push str._CreateMautoupMutex__MAutoup_Mutex_Name___s_
push 1
call fcn.004036f0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x4383c8], eax
pop edi
je 0x40440d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4043df
lea edx, [esp + 4]
push edx
push str._CreateMautoupMutex__MAutoup_already_runnning...__s_
push 1
call fcn.004036f0
mov eax, dword [0x4383c8]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4383c8], 0
jmp 0x404421
lea ecx, [esp]
mov dword [esp + 0x110], 0xffffffff
call fcn.00401090
mov eax, 1
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
lea ecx, [esp + 4]
push ecx
push str._CreateMautoupMutex__MAutoup_CreateMutex_Fail___s_
push 1
call fcn.004036f0
add esp, 0xc
lea ecx, [esp]
mov dword [esp + 0x110], 0xffffffff
call fcn.00401090
mov ecx, dword [esp + 0x108]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x4045a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call ebx
test eax, eax
je 0x4045ef
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4045ef
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4045f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CUpdateStatus__Fail_to_open_ahn.ui__d_.
push 1
call fcn.004036f0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 2
push 0
push 0xfffffffffffffff7
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40462a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CUpdateStatus__Fail_to_set_file_pointer__d_.
push 1
call fcn.004036f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x10]
push 0
push eax
push 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
test eax, eax
jne 0x404665
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CUpdateStatus__Fail_to_read_CRC_of_Ahn.ui___d_.
push 1
call fcn.004036f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret