joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b54a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x41b55e
xor eax, eax
jmp 0x41b69c
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x41b587
dec edx
sub edx, 1
jne 0x41b589
add eax, 2
jmp 0x41b589
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x41b59c
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x41b69b
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x41b632
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x491bb0]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x491bb0]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x491bb0]
mov byte [edi + 2], al
mov al, byte [esi + 0x491bb0]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x41b5c7
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x41b635
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x41b68e
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x41b64a
movzx ecx, byte [eax + 1]
jmp 0x41b64c
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x491bb0]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x491bb0]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x41b683
and ecx, 0xf
mov al, byte [ecx*4 + 0x491bb0]
mov byte [edi + 2], al
jmp 0x41b687
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fdd8
Capabilities:
Get mac address on windows

Disassembly:
push 0x58
mov eax, 0x48c9a0
call fcn.00458cd6
mov esi, dword [ebp + 8]
and dword [ebp - 0x64], 0
push 0x288
mov dword [ebp - 0x54], 4
call fcn.0043a85f
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41fe14
push 0x48f4a0
mov ecx, esi
call fcn.0040b720
jmp 0x41ff7c
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x41fe39
push ebx
call fcn.0043a86a
push dword [ebp - 0x54]
call fcn.0043a85f
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41fe03
xor eax, eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x41ff51
mov byte [ebp - 0x20], al
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0x60], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
mov edi, ebx
test ebx, ebx
je 0x41ff2a
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x20]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.00408b40
lea eax, [edi + 0x10c]
push eax
call fcn.00487c25
push 0x4921b4
push eax
call fcn.00434cf0
add esp, 0x2c
test eax, eax
jne 0x41ff86
cmp dword [edi + 0x1a0], 0x47
je 0x41ff86
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b720
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x60]
call fcn.0041aee2
push 0
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.004188e8
mov edi, dword [edi]
test edi, edi
jne 0x41fe81
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
test eax, eax
je 0x41ff49
lea eax, [ebp - 0x38]
cmp eax, ecx
je 0x41ff49
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00405cc0
lea ecx, [ebp - 0x60]
call fcn.0041c6ad
push ebx
call fcn.0043a86a
pop ecx
xor ebx, ebx
mov dword [esi + 0x14], 0xf
lea eax, [ebp - 0x38]
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00408210
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.004188e8
mov eax, esi
call fcn.00458c91
ret 4
cmp byte [ebp - 0x20], 0
jne 0x41ff90
xor eax, eax
jmp 0x41ff9a
lea eax, [ebp - 0x20]
push eax
call fcn.004457a0
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.004088b0
jmp 0x41ff49
Function at 0x41ffc6
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x4ae1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.00432e20
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4a5548
call fcn.00445c91
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0044669c
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.00432e20
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.00432e20
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.00432e20
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4200c4
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00408b40
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.0040b720
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004134d9
mov esp, ebp
pop ebp
ret 4
Function at 0x420425
Capabilities:
Check os version

Disassembly:
push 0x34c
mov eax, 0x48ca2a
call fcn.00458cd6
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x358], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.00432e20
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4a5558
mov ecx, esi
call fcn.00401f10
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x32c]
push str.ntdll.dll
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x42051c
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420515
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x42054e
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x42061a
cmp eax, 1
jne 0x420544
mov edi, str.WindowsXP
jmp 0x42060a
mov edi, str.WindowsServer2003
jmp 0x42060a
cmp eax, 6
jne 0x42061a
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x4205f7
sub eax, 1
je 0x4205f0
mov edi, dword [ebp - 0x338]
sub eax, 1
jne 0x420620
cmp edi, 0x1ebb
jne 0x42058c
mov edi, str.Windows8
jmp 0x42060a
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x420585
cmp edi, 0x1f13
je 0x420585
cmp dword [ebp - 0x340], 0xa
jne 0x4205c4
cmp dword [ebp - 0x344], 0
jne 0x420620
push str.Windows10
call fcn.00445c91
pop ecx
push eax
push str.Windows10
jmp 0x4205e7
cmp dword [ebp - 0x340], 6
jne 0x420620
cmp dword [ebp - 0x344], 3
jne 0x420620
push str.Windows8.1
call fcn.00445c91
pop ecx
push eax
push str.Windows8.1
mov ecx, esi
call fcn.00402070
jmp 0x420620
mov edi, str.Windows7
jmp 0x42060a
cmp dword [ebp - 0x354], 1
mov edi, str.WindowsVista
je 0x42060a
mov edi, str.WindowsServer2008
push edi
call fcn.00445c91
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402070
mov edi, dword [ebp - 0x338]
push 0x4a5558
mov ecx, esi
call fcn.0041b094
test eax, eax
jne 0x42068e
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00432e20
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00409550
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x420672
mov eax, ebx
jmp 0x42067f
lea eax, [ebp - 0x218]
push eax
call fcn.00445c91
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402070
cmp dword [ebp + 0xc], 0
je 0x4206bc
cmp word [ebp - 0x320], 0
je 0x4206ad
lea eax, [ebp - 0x320]
push eax
call fcn.00445c91
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.00403cb0
mov eax, esi
call fcn.00458c91
ret
Function at 0x4214f6
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00445c91
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041350d
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.00445c6f
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x421570
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x421567
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42155d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42156e
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x42153a
jmp 0x421570
xor edi, edi
push esi
call fcn.00413516
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x1a
push eax
push esi
call fcn.00421a0b
lea eax, [ebp - 0x20c]
push eax
call fcn.00445c91
add esp, 0x14
test eax, eax
je 0x421638
lea eax, [ebp - 0x20c]
push 0x4a5544
push eax
call fcn.00445bfe
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00445bfe
lea eax, [ebp - 0x20c]
push 0x4a5544
push eax
call fcn.00445bfe
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421611
lea eax, [ebp - 0x20c]
push eax
call fcn.004214f6
pop ecx
cmp word [ebp - 0x20c], si
je 0x421629
lea eax, [ebp - 0x20c]
push eax
call fcn.00445c91
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402070
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004134d9
mov esp, ebp
pop ebp
ret

Function at 0x4216ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4b02fc]
test al, al
jne 0x421785
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00432e20
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42177c
lea eax, [ebp - 0x20c]
push eax
call fcn.00445e7a
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.00434f53
pop ecx
pop ecx
test eax, eax
jne 0x421774
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00434f53
pop ecx
pop ecx
test eax, eax
je 0x42177c
mov byte [0x4b02fc], bl
jmp 0x421782
mov bl, byte [0x4b02fc]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004134d9
mov esp, ebp
pop ebp
ret
Function at 0x421793
Capabilities:
Check if file exists

Disassembly:
push 0xc54
mov eax, 0x48cbc7
call fcn.00458cd6
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
mov esi, 0x208
and dword [ebp - 0xc60], 0
push esi
push 0
push eax
call fcn.00432e20
push esi
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00432e20
push esi
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00432e20
push esi
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00432e20
push esi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00432e20
push esi
xor esi, esi
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00432e20
xor eax, eax
mov dword [ebp - 0xc44], 7
add esp, 0x48
mov dword [ebp - 0xc48], esi
mov word [ebp - 0xc58], ax
push esi
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], esi
push eax
push esi
call fcn.00421a0b
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00445c6f
lea eax, [ebp - 0x218]
push eax
call fcn.00445c91
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00432f7a
add esp, 0x24
test eax, eax
jne 0x421897
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.00421580
pop ecx
pop ecx
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.004040c0
push esi
push 1
jmp 0x4219f8
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00445c6f
lea eax, [ebp - 0x830]
push str.Local
push eax
call fcn.00445bfe
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
cmovne esi, ecx
push eax
call fcn.00445c6f
lea eax, [ebp - 0x628]
push str.LocalLow
push eax
call fcn.00445bfe
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc5c], ecx
push eax
call fcn.00445c6f
lea eax, [ebp - 0xa38]
push str.Roaming
push eax
call fcn.00445bfe
add esp, 0x10
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x4219d5
cmp dword [ebp - 0xc5c], 0
je 0x4219d5
test ecx, ecx
je 0x4219d5
push ebx
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push str._s_s_
push eax
call fcn.00409550
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4219a5
lea eax, [ebp - 0x420]
push eax
call fcn.004214f6
pop ecx
cmp word [ebp - 0x420], 0
jne 0x4219b3
xor eax, eax
jmp 0x4219c0
lea eax, [ebp - 0x420]
push eax
call fcn.00445c91
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc58]
call fcn.00402070
jmp 0x4219e4
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.00421580
pop ecx
pop ecx
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.004040c0
xor eax, eax
push 0
inc eax
push eax
lea ecx, [ebp - 0xc58]
call fcn.00401fb0
mov eax, edi
call fcn.00458c91
ret
Function at 0x421a7e
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x48cbff
call fcn.00458cd6
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.00432e20
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.00432e20
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x421b5c
cmp word [edi], dx
jne 0x421aed
mov eax, edx
jmp 0x421af4
push edi
call fcn.00445c91
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00402070
cmp dword [ebp - 0x30], 0
je 0x421b5c
mov edi, 0x48fae4
push edi
call fcn.00445c91
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00402070
xor edi, edi
cmp word [esi], di
jne 0x421b25
mov eax, edi
jmp 0x421b2c
push esi
call fcn.00445c91
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403cb0
mov esi, 0x48fae8
push esi
call fcn.00445c91
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403cb0
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403de0
jmp 0x421b78
xor edi, edi
cmp word [esi], di
jne 0x421b67
mov eax, edi
jmp 0x421b6e
push esi
call fcn.00445c91
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.CreateRunProcess__s_
call fcn.00406530
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x421bbd
mov esi, edi
jmp 0x421be8
cmp byte [ebp + 0x10], 0
je 0x421bd5
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00401fb0
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401fb0
mov eax, esi
call fcn.00458c91
ret
Function at 0x421c2a
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x48cc37
call fcn.00458cd6
mov eax, dword [ebp + 8]
test eax, eax
je 0x421d26
push eax
lea ecx, [ebp - 0x40]
call fcn.00401f10
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041a948
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.00432e20
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x421d17
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x421d0c
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x421cb6
mov eax, ebx
jmp 0x421cc3
lea eax, [ebp - 0x248]
push eax
call fcn.00445c91
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402070
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041a948
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041adfd
test eax, eax
je 0x421d2c
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401fb0
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x421c99
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00401fb0
mov eax, esi
call fcn.00458c91
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401fb0
jmp 0x421d19
Function at 0x422795
Capabilities:
Check if file exists

Disassembly:
push 0x258
mov eax, 0x48cdd4
call fcn.00458cd6
mov esi, ecx
lea eax, [esi + 4]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x230]
call fcn.00403ad0
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ebp + 8], edi
je 0x4227dd
lea eax, [esi + 0x1c]
lea ecx, [ebp - 0x230]
cmp ecx, eax
je 0x4227dd
push 0xffffffffffffffff
push edi
push eax
call fcn.00402290
push 8
pop esi
cmp dword [ebp + 0x50], esi
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4227fd
xor esi, esi
inc esi
jmp 0x42297d
lea eax, [ebp + 0xc]
push eax
call fcn.0041a948
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041a060
add esp, 0xc
cmp dword [ebp - 0x21c], esi
lea edx, [ebp - 0x230]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp + 0x24]
cmovae edx, dword [ebp - 0x230]
lea eax, [ebp - 0x248]
cmp dword [ebp + 0x38], esi
push edx
cmovae ecx, dword [ebp + 0x24]
cmp dword [ebp - 0x234], esi
push ecx
cmovae eax, dword [ebp - 0x248]
push str.LastUpdTimeStamp
push eax
mov byte [ebp - 4], 4
call ebx
cmp dword [ebp - 0x21c], esi
lea edx, [ebp - 0x230]
lea ecx, [ebp + 0x3c]
cmovae edx, dword [ebp - 0x230]
lea eax, [ebp - 0x248]
cmp dword [ebp + 0x50], esi
push edx
cmovae ecx, dword [ebp + 0x3c]
cmp dword [ebp - 0x234], esi
push ecx
cmovae eax, dword [ebp - 0x248]
push str.File
push eax
call ebx
cmp dword [ebp + 0x50], esi
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401f10
lea eax, [ebp - 0x260]
push eax
call fcn.004279b4
add esp, 0x1c
lea edx, [ebp - 0x230]
cmp dword [ebp - 0x21c], esi
lea ecx, [ebp - 0x260]
lea eax, [ebp - 0x248]
cmovae edx, dword [ebp - 0x230]
cmp dword [ebp - 0x24c], esi
push edx
cmovae ecx, dword [ebp - 0x260]
cmp dword [ebp - 0x234], esi
push ecx
cmovae eax, dword [ebp - 0x248]
push str.LastMD5
push eax
call ebx
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00432e20
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
push edi
cmovae esi, dword [ebp - 0x230]
call fcn.0043a5e1
add esp, 0x10
lea edi, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
cmovae edi, dword [ebp - 0x248]
push esi
push 0xa
lea ecx, [ebp - 0x218]
push ecx
push edx
push eax
call fcn.0044696f
add esp, 0x10
push eax
push str.CacheTime
push edi
call ebx
xor edi, edi
lea ecx, [ebp - 0x260]
xor esi, esi
push edi
inc esi
push esi
call fcn.00401fb0
push edi
push esi
lea ecx, [ebp - 0x248]
call fcn.00401fb0
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.00401fb0
push edi
push esi
lea ecx, [ebp + 0xc]
call fcn.00401fb0
push edi
push esi
lea ecx, [ebp + 0x24]
call fcn.00401fb0
push edi
push esi
lea ecx, [ebp + 0x3c]
call fcn.00401fb0
call fcn.00458c91
ret 0x4c
Function at 0x42529b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x48d234
call fcn.00458ca2
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0042eb14
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042eb48
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4252db
mov edi, 0xf003f
push edi
push esi
push 0x492e70
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42533b
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x425316
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42533b
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0042eb27
call fcn.00458c7c
ret 0xc