joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427ae0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
push ecx
lea edi, [ebp - 0x218]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50a8b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], str.LOBBY_SERVER
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x3a9b
push str.LobbyUserPort
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00453050
mov edx, dword [ebp - 8]
mov dword [edx + 0x10b0], eax
mov dword [ebp - 0x10], 0
jmp 0x427b4f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x14
jae 0x427b91
mov ecx, dword [ebp - 0x10]
add ecx, 1
push ecx
push str.Lobby_Server__u
push 0x200
lea edx, [ebp - 0x214]
push edx
call fcn.00401e15
add esp, 0x10
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 8]
call fcn.00401a5a
jmp 0x427b46
mov eax, dword [ebp - 8]
mov dword [eax + 0x10b4], 0
mov dword [ebp - 0x10], 0
jmp 0x427bb0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x14
jae 0x427be6
mov edx, dword [ebp - 0x10]
add edx, 4
imul edx, edx, 0x44
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xe44]
cmp dword [ecx + edx + 0x3c], 1
jne 0x427be4
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10b4]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10b4], eax
jmp 0x427ba7
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x427c1c]
call fcn.00453080
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004538d0
add esp, 0x218
cmp ebp, esp
call fcn.00453050
mov esp, ebp
pop ebp
ret 4
Function at 0x427ca0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push esi
push edi
push ecx
lea edi, [ebp - 0x224]
mov ecx, 0x89
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50a8b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x218], 0
jmp 0x427ce7
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xa
jge 0x427d06
mov ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x10b8], 0xffffffff
jmp 0x427cd8
mov dword [ebp - 0xc], str.LOBBY_REGION
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push str.RegionCount
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00453050
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xa
jl 0x427d46
mov dword [ebp - 0x224], 9
jmp 0x427d52
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
jmp 0x427d79
mov ecx, dword [ebp - 0x220]
add ecx, 1
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp - 0x21c]
jge 0x427e36
mov eax, dword [ebp - 0x220]
push eax
push str.RegionID__u
push 0x200
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00453050
mov edx, dword [ebp - 0x220]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x10b8], eax
mov edx, dword [ebp - 0x220]
push edx
push str.RegionName__u
push 0x200
lea eax, [ebp - 0x210]
push eax
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov ecx, dword [ebp + 8]
push ecx
push 0x20
mov edx, dword [ebp - 0x220]
imul edx, edx, 0x42
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x10e0]
push ecx
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00453050
jmp 0x427d6a
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x427e6c]
call fcn.00453080
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004538d0
add esp, 0x224
cmp ebp, esp
call fcn.00453050
mov esp, ebp
pop ebp
ret 4
Function at 0x4282d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
push esi
push edi
push ecx
lea edi, [ebp - 0x9d8]
mov ecx, 0x276
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50a8b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
push 0x80
push 0
lea eax, [ebp - 0x8c]
push eax
call fcn.00452fd0
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x194]
push ecx
call fcn.00452fd0
add esp, 0xc
mov ecx, 0xa
mov esi, str.Nation_IP_WhiteList
lea edi, [ebp - 0x1c4]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x9d8], 0
jmp 0x42835f
mov edx, dword [ebp - 0x9d8]
add edx, 1
mov dword [ebp - 0x9d8], edx
cmp dword [ebp - 0x9d8], 0x100
jge 0x428489
mov eax, dword [ebp - 0x9d8]
push eax
push str.IP__d
push 0x80
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov edx, dword [ebp + 8]
push edx
push 0x80
lea eax, [ebp - 0x194]
push eax
push 0x4e3c7c
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x1c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00453050
test eax, eax
jne 0x4283c7
jmp 0x428350
xor eax, eax
mov word [ebp - 0x96], ax
lea ecx, [ebp - 0x194]
push ecx
call fcn.00401fdc
add esp, 4
movzx edx, word [ebp - 0x194]
test edx, edx
jne 0x4283ef
jmp 0x428350
mov eax, dword [ebp - 0x1cc]
lea ecx, [ebp + eax*8 - 0x9d0]
push ecx
lea edx, [ebp - 0x194]
push edx
call fcn.004012ee
add esp, 8
movzx eax, al
test eax, eax
je 0x428454
mov ecx, dword [ebp - 0x1cc]
add ecx, 1
mov dword [ebp - 0x1cc], ecx
cmp dword [0x50c350], 0
je 0x428452
lea edx, [ebp - 0x194]
push edx
mov eax, dword [ebp - 0x9d8]
push eax
push str.___Nation_IP_whitelist_entry__d______s___n
push 0xff00
mov ecx, dword [0x50c350]
push ecx
call fcn.0040256d
add esp, 0x14
jmp 0x428484
cmp dword [0x50c350], 0
je 0x428484
lea edx, [ebp - 0x194]
push edx
mov eax, dword [ebp - 0x9d8]
push eax
push str.___Nation_IP_whitelist_entry__d_is_invalid______s___n
push 0xff
mov ecx, dword [0x50c350]
push ecx
call fcn.0040256d
add esp, 0x14
jmp 0x428350
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1cc]
mov dword [edx + 0x1b68], eax
push 0x800
lea ecx, [ebp - 0x9d0]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x1b6c
push edx
call fcn.00454600
add esp, 0xc
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4284ec]
call fcn.00453080
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004538d0
add esp, 0x9d8
cmp ebp, esp
call fcn.00453050
mov esp, ebp
pop ebp
ret 4
Function at 0x4298d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push ecx
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov esi, esp
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp esi, esp
call fcn.00453050
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x429952
cmp dword [ebp - 8], 0xffffffff
jne 0x42992a
mov esi, esp
push str.___GetMessage_return__1___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00453050
jmp 0x429950
mov esi, esp
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp esi, esp
call fcn.00453050
mov esi, esp
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, esp
call fcn.00453050
jmp 0x4298ec
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x429978]
call fcn.00453080
pop eax
pop edx
pop edi
pop esi
add esp, 0x2c
cmp ebp, esp
call fcn.00453050
mov esp, ebp
pop ebp
ret
Function at 0x4538d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50a8b4]
jne 0x4538da
repz ret
jmp fcn.00469590
Function at 0x401140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push edi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.softwarehewlett_packardhp_software_update
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40120a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.ndays
push eax
call esi
test eax, eax
jne 0x4011b4
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.notify
push ecx
call esi
test eax, eax
jne 0x4011d9
mov edx, dword [esp + 0x14]
mov dword [edi + 4], edx
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.never
push edx
call esi
test eax, eax
pop esi
jne 0x4011ff
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x14
ret

Function at 0x4014b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4014c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4014dd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4014fe
cmp esi, eax
jae 0x4014d7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014f0
cmp esi, eax
jae 0x4014d7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403de0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ccc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
push 0x17
push edi
push str.HPRulesEngine.ContentCollection
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
call fcn.00402c90
cmp eax, edi
jge 0x403e49
cmp eax, 0x80004002
je 0x403e49
push eax
call fcn.0043c1c0
cmp dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
je 0x403ece
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401810
push 1
push ecx
mov ecx, dword [ebp - 0x18]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov dword [ebp - 0x20], esp
je 0x403e7c
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 0x14], edi
mov byte [ebp - 4], 3
jne 0x403e8f
push 0x80004003
call fcn.0043c1c0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004028c0
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
push 1
push edx
mov ecx, esi
call fcn.00420f80
mov ecx, esi
mov dword [ebp - 0x1c], eax
call fcn.00420af0
mov ecx, dword [ebp - 0x18]
cmp ecx, edi
je 0x403ece
call fcn.00401c50
mov dword [ebp - 0x18], edi
jmp 0x403ece
mov eax, dword [ebp - 0x14]
cmp eax, edi
mov dword [ebp - 4], 0xffffffff
je 0x403ee2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4042c0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404321
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x404303
cmp eax, 2
jne 0x404313
test esi, esi
mov eax, dword [esp + 0x14]
je 0x40431d
mov cl, byte [eax + esi - 1]
test cl, cl
je 0x40431d
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x406cf0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x44d0cb
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.0042dca0
mov eax, dword [0x4655d4]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1014], eax
call fcn.00441da2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x1028]
push 0x1000
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
push edi
mov dword [esp + 0x102c], ebx
mov byte [esp + 0x20], bl
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x406d96
lea ecx, [esp + 0x14]
push ecx
call fcn.00406c40
add esp, 4
cmp eax, ebx
je 0x406d96
xor edx, edx
mov dx, word [0x46411c]
lea ecx, [esp + 0x10]
push edx
push eax
mov eax, dword [0x46669c]
push eax
call fcn.00405020
test eax, eax
je 0x406d96
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, dword [sym.imp.USER32.dll_FindWindowExA]
push ebx
push ebx
push ebx
push edi
call ebp
mov esi, eax
cmp esi, ebx
je 0x406e11
jmp 0x406db0
push 0x1000
lea edx, [esp + 0x18]
push edx
push esi
mov byte [esp + 0x20], bl
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x406e05
lea eax, [esp + 0x14]
push eax
call fcn.00406c40
add esp, 4
cmp eax, ebx
je 0x406e05
mov edx, dword [0x46669c]
xor ecx, ecx
mov cx, word [0x46411c]
push ecx
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00405020
test eax, eax
je 0x406e05
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push ebx
push esi
push edi
call ebp
mov esi, eax
cmp esi, ebx
jne 0x406db0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1020], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x406e3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1008]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1004]
call fcn.0042d2b8
add esp, 0x1014
ret
Function at 0x407d10
Capabilities:
Connect to http server
Create http request

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1ab0]
test eax, eax
jne 0x407dc4
mov edx, dword [esi + 0x1258]
mov eax, dword [edx - 0xc]
mov ecx, eax
neg ecx
sbb ecx, ecx
push 0
and ecx, edx
neg eax
push 0
sbb eax, eax
push ecx
and eax, 3
push eax
push str.VCSoapClient
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x1aac], eax
je 0x407dc8
mov ecx, dword [esi + 0x125c]
test ecx, ecx
push edi
lea edi, [esi + 0x125c]
je 0x407d91
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
push edi
push 2
push eax
call ebx
mov eax, dword [esi + 0x1aac]
push 4
push edi
push 6
push eax
call ebx
mov ecx, dword [esi + 0x1aac]
push 4
push edi
push 5
push ecx
call ebx
pop ebx
push 0
push 0x200
xor eax, eax
mov ax, word [esi + 0x122a]
push 3
push 0
push 0
lea edx, [esi + 0x25]
push eax
mov eax, dword [esi + 0x1aac]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 0x1ab0], eax
pop edi
je 0x407dc8
xor eax, eax
pop esi
ret
mov ecx, esi
call fcn.00407680
mov eax, 0x80004005
pop esi
ret
Function at 0x4091f0
Capabilities:
Send data
Send http request

Disassembly:
push 0xffffffffffffffff
push 0x44d1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
call fcn.00407d10
test eax, eax
je 0x409233
mov dword [esi + 0x1aa8], 4
mov eax, 0x80004005
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push ebx
lea eax, [esi + 0x1260]
xor ebx, ebx
test eax, eax
je 0x409248
lea ecx, [esi + 0x126c]
jmp 0x40924a
xor ecx, ecx
mov ax, word [esi + 0x122a]
mov ecx, dword [ecx]
xor edx, edx
cmp ax, 0x1bb
mov eax, dword [esi + 0x1ab0]
setne dl
push edi
push ebx
dec edx
and edx, 0x800000
or edx, 0x200
push edx
push 0x464160
push ebx
push str.HTTP_1.0
push ecx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp eax, ebx
mov dword [esi + 0x1ab4], eax
je 0x409392
push 0xa0000000
push 0xffffffffffffffff
push str.Content_Type:_text_xml
push eax
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov edi, dword [esp + 0x20]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4092b4
mov ecx, dword [esi + 0x124c]
sub eax, edx
mov edx, dword [ecx - 0xc]
push edx
push ecx
mov ecx, dword [esi + 0x1ab4]
push eax
push edi
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x40939c
mov eax, dword [esi + 0x1ab4]
mov ecx, esi
mov dword [esi + 0x1254], eax
call fcn.00407700
cmp eax, 0x1f4
je 0x40930f
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov dword [esi + 0x1aa8], 7
mov dword [esp + 0x20], ebx
mov edx, dword [esi]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x1c], ebx
call dword [edx]
test eax, eax
jl 0x40937a
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.004076e0
test eax, eax
mov edi, dword [esp + 0xc]
jl 0x40936c
mov edx, dword [esp + 0x20]
push edx
push edi
lea ecx, [esi + 0x1ab8]
call fcn.00408da0
test eax, eax
jge 0x40936c
mov dword [esi + 0x1aa8], 8
cmp edi, ebx
mov byte [esp + 0x18], bl
je 0x40937a
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x18], 0xffffffff
je 0x40939c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40939c
mov dword [esi + 0x1aa8], 5
mov ecx, dword [esp + 0x10]
pop edi
pop ebx
mov eax, 0x80004005
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40af70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x44d31b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov eax, dword [0x4655d4]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x10]
push str.SoftwareHewlett_Packardediags
push eax
call fcn.0042e7f6
add esp, 8
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x1c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esp + 0xc], 4
jne 0x40aff3
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push str.OpMode
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40affb
mov dword [esp + 4], 0xffffffff
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], 0
mov eax, dword [esp + 4]
sub eax, 0
mov dword [esp + 0x120], 0
lea ecx, [esp]
je 0x40b035
dec eax
je 0x40b02e
push str.embed_hp_web_update_3
jmp 0x40b03a
push str.embed_hp_web_update_3_staging
jmp 0x40b03a
push str.embed_hp_web_update_3_test
call fcn.00402770
mov ecx, dword [esp]
test ecx, ecx
je 0x40b059
push esi
mov esi, dword [ecx]
mov dword [ecx], 0
call fcn.00401c50
mov eax, esi
pop esi
jmp 0x40b065
push 0x80004003
call fcn.0043c1c0
xor eax, eax
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x114]
call fcn.0042d2b8
add esp, 0x124
ret

Function at 0x40b090
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44d340
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
call fcn.004222d0
push eax
lea ecx, [esp + 8]
call fcn.004018a0
push 0x452e14
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call fcn.00401810
lea eax, [esp]
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call fcn.00402820
mov ecx, dword [esp]
test ecx, ecx
mov byte [esp + 0x10], 0
je 0x40b0f0
call fcn.00401c50
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b110
mov eax, dword [esi + 4]
test eax, eax
jne 0x40b10b
mov ecx, dword [esi]
push ecx
call fcn.0043c3a0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x40b112
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40b15d
test esi, esi
je 0x40b138
mov eax, dword [esi + 4]
test eax, eax
jne 0x40b133
mov edx, dword [esi]
push edx
call fcn.0043c3a0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x40b13a
xor eax, eax
push 0x450a18
push eax
push str.SessionFile_was_deleted
mov ecx, 0x4666c8
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
test esi, esi
je 0x40b168
mov ecx, esi
call fcn.00401c50
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4134f0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov al, byte [ecx + 0x105]
test al, al
push esi
je 0x413566
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x413559
push edi
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x10]
push 0
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
push esi
jne 0x413560
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x4157d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4655d4]
mov edx, dword [esp + 0x120]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x12c], eax
mov eax, dword [edi]
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
jne 0x41583a
test ecx, ecx
je 0x41582c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], ecx
je 0x415848
test ecx, ecx
je 0x4158eb
push ecx
jmp 0x4158e5
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x4158b2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.004157d0
mov edi, eax
test edi, edi
jne 0x415904
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x415874
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x4158c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x128]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x4158eb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x118]
call fcn.0042d2b8
add esp, 0x11c
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x415913
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
call fcn.0042d2b8
add esp, 0x11c
ret 4
Function at 0x415e10
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x415e22
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8