joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e82a
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x646414], eax
je 0x51e843
mov eax, 0x10dd
leave
ret
push ebx
push esi
push edi
mov edi, dword [0x646488]
xor ebx, ebx
test edi, edi
je 0x51e890
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x51e87e
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x51e87e
call fcn.0051e74b
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push 0x18
push edi
call fcn.0056c61e
mov edi, esi
pop ecx
pop ecx
test esi, esi
jne 0x51e852
mov dword [0x646488], ebx
call fcn.0051e53b
mov edi, dword [0x646480]
test edi, edi
je 0x51e8c0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push 8
push edi
call fcn.0056c61e
mov edi, esi
pop ecx
pop ecx
test esi, esi
jne 0x51e8a5
pop edi
pop esi
mov dword [0x646480], ebx
xor eax, eax
mov dword [0x646414], ebx
pop ebx
leave
ret
Function at 0x51eb9d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x646414], eax
je 0x51ebbe
mov eax, 0x10dd
jmp 0x51ed8c
mov eax, dword [0x6462e4]
test eax, eax
jne 0x51ed8c
mov ecx, dword [0x645ef0]
test ecx, ecx
jne 0x51ebec
push 6
pop eax
mov dword [0x6462e4], eax
mov dword [0x646478], 0x645ef0
jmp 0x51ed8c
push ebx
push edi
mov ebx, esi
mov edi, esi
call fcn.0051e481
mov ecx, 0x4cfd80
mov dword [ebp - 4], eax
call fcn.0051e481
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 4]
jne 0x51ec1d
cmp dword [0x646484], ebx
jne 0x51ed7e
jmp 0x51ed5f
push 0x18
call fcn.00415d9b
mov edi, eax
pop ecx
test edi, edi
jne 0x51ec33
push 8
pop esi
jmp 0x51ed5f
mov ecx, dword [ebp - 4]
call fcn.0051e564
mov ebx, eax
test ebx, ebx
je 0x51ec2b
mov eax, dword [ebp - 4]
mov edx, esi
jmp 0x51ec4b
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x18], eax
push ecx
lea ecx, [edx + ebx]
mov dword [ebp - 0xc], esi
push esi
mov edx, eax
call fcn.00521e27
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], esi
jne 0x51ed53
mov ecx, dword [ebp - 0x18]
mov edx, eax
sub edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
call fcn.0051e4c7
test eax, eax
jne 0x51ec85
cmp edx, 5
jl 0x51ec48
cmp edx, 5
jl 0x51ed53
cmp edx, 0x12
jbe 0x51ec97
push 6
jmp 0x51ec2d
mov eax, dword [ebp - 8]
lea edx, [ebx + 0x17]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov byte [edx], al
lea ecx, [eax + ebx]
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 1], eax
add ecx, 5
call fcn.0051e458
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push 0x40
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x51ece8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x51ed5f
mov ecx, dword [ebp - 4]
call fcn.0051e76c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x51ed29
mov ecx, 0x6544
cmp word [eax + 0x1c], cx
je 0x51ed29
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push ecx
push 0x40
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x51ecde
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x1c], 0x6f746544
mov dword [eax + 0x20], 0x21737275
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov dword [edi + 4], esi
mov dword [edi + 8], 0x645ef0
mov dword [edi + 0x10], ebx
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [0x646488]
mov dword [edi], eax
xor eax, eax
mov dword [0x646488], edi
jmp 0x51ed8a
cmp dword [0x646484], 0
push 9
pop esi
jne 0x51ed69
mov dword [0x6462e4], esi
test ebx, ebx
je 0x51ed70
mov ecx, ebx
call fcn.0051e74b
test edi, edi
je 0x51ed7e
push 0x18
push edi
call fcn.0056c61e
pop ecx
pop ecx
mov dword [0x646478], 0x645ef0
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x51ed91
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x646414], eax
je 0x51edb4
mov eax, 0x10dd
jmp 0x51ee94
mov eax, dword [0x6462e4]
test eax, eax
jne 0x51ee94
test ebx, ebx
jne 0x51edcd
push 6
pop eax
jmp 0x51ee94
cmp dword [ebx], 0
jne 0x51ede5
push 6
pop eax
mov dword [0x6462e4], eax
mov dword [0x646478], ebx
jmp 0x51ee94
push esi
push edi
push 0x18
call fcn.00415d9b
mov esi, eax
pop ecx
test esi, esi
jne 0x51edfa
push 8
pop edi
jmp 0x51ee76
mov ecx, dword [ebp - 8]
mov edi, dword [ebx]
call fcn.0051e481
movzx ecx, byte [edi + 0x17]
mov edx, eax
mov eax, dword [edi + 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x51ee6a
cmp ecx, 0x17
ja 0x51ee6a
cmp dword [edi + 0x1c], edx
jne 0x51ee6a
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x51ee40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x51ee76
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x646488]
mov dword [esi], eax
xor eax, eax
mov dword [0x646488], esi
jmp 0x51ee92
cmp dword [0x646484], 0
push 9
pop edi
jne 0x51ee80
mov dword [0x6462e4], edi
test esi, esi
je 0x51ee8a
push 0x18
push esi
call fcn.0056c61e
pop ecx
pop ecx
mov dword [0x646478], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51f56f
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0x38
mov eax, 0x5dee74
call fcn.0056d43d
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x40]
xor ebx, ebx
call fcn.0051f797
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ebx
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
push 3
push ebx
inc ecx
push ecx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x51f63e
xor eax, eax
lea ecx, [ebp - 0x28]
lea edx, [eax + 1]
call fcn.0051f797
lea ecx, [ebp - 0x40]
call fcn.0051ff6d
test al, al
jne 0x51f611
lea ecx, [ebp - 0x28]
call fcn.0051ff6d
test al, al
je 0x51f611
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push ebx
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x51f611
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403d40
cmp esi, 0xffffffff
je 0x51f675
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10
jb 0x51f66e
push ebx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x51f66e
cmp dword [ebp - 0x44], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00403d40
mov al, bl
call fcn.0056d3ec
ret

Function at 0x51f685
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x5deea8
call fcn.0056d43d
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x40]
xor ebx, ebx
call fcn.0051f797
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ebx
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
push 2
push ebx
inc ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x51f703
xor eax, eax
lea ecx, [ebp - 0x28]
lea edx, [eax + 1]
call fcn.0051f797
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403d40
cmp esi, 0xffffffff
je 0x51f72a
push ebx
lea eax, [ebp - 0x44]
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x51f723
cmp dword [ebp - 0x44], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00403d40
mov al, bl
call fcn.0056d3ec
ret
Function at 0x51f797
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x234
mov eax, 0x5def01
call fcn.0056d43d
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x240], esi
xor ecx, ecx
mov dword [ebp - 0x23c], ecx
xor eax, eax
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
xor edi, edi
mov dword [ebp - 4], ecx
push ecx
lea eax, [ebp - 0x218]
inc edi
push eax
mov dword [ebp - 0x23c], edi
call fcn.00573610
add esp, 0xc
test bl, bl
push edi
push 0x23
pop eax
push 0x1a
pop ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x51f8e6
and dword [ebp - 0x230], 0
lea ecx, [ebp - 0x230]
and dword [ebp - 0x220], 0
xor eax, eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 7
call fcn.00408fe7
lea eax, [ebp - 0x230]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00446e00
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x51f8b1
mov ecx, dword [ebp - 0x230]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], ecx
cmp eax, 0x1000
jb 0x51f8a8
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00403daf
mov eax, dword [ebp - 0x238]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x234]
push eax
push ecx
call fcn.0056c61e
pop ecx
pop ecx
mov ecx, esi
test bl, bl
je 0x51f8be
push str.TencentDeskUpdate
jmp 0x51f8c3
push str.TencentDesktop
call fcn.00409914
mov ecx, esi
call fcn.0051f8ee
test al, al
jne 0x51f8da
mov ecx, esi
call fcn.0051f9da
push str.Global.db
mov ecx, esi
call fcn.00409914
mov eax, esi
call fcn.0056d3ec
ret
Function at 0x5222ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x63d284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 3
pop esi
inc eax
mov dword [ebp - 0x10c], 0x104
mov dword [ebp - 0x110], eax
mov ebx, ecx
lea eax, [ebp - 0x11c]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
call edi
test eax, eax
jne 0x52245b
push ebx
push str._sConnection
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.005228ca
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x522453
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x52244b
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x10c], 0x103
call fcn.00573610
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x52244b
mov eax, dword [ebp - 0x114]
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x522445
push esi
lea eax, [ebp - 0x108]
push 0x61d2b8
push eax
call fcn.00597d00
add esp, 0xc
test eax, eax
jne 0x522417
xor esi, esi
jmp 0x52244b
mov eax, dword [ebp - 0x114]
cmp eax, ebx
jne 0x522445
push esi
lea eax, [ebp - 0x108]
push 0x61d2b8
push eax
call fcn.00597d00
add esp, 0xc
test eax, eax
je 0x52243f
push 2
pop esi
jmp 0x52244b
mov eax, dword [ebp - 0x114]
cmp eax, 2
cmove esi, ebx
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056cd75
leave
ret
Function at 0x5226b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2aa0
call fcn.0056ca90
mov eax, dword [0x63d284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.00573610
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x522702
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x522743
push 0x5c
pop eax
cmp ax, word [ebp + ecx*2 - 0x20e]
je 0x522743
mov word [ebp + ecx*2 - 0x20c], ax
lea ecx, [ecx*2 + 2]
cmp ecx, esi
jae 0x52289c
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x52274c
sub ecx, edx
mov edx, 0x104
sar ecx, 1
mov eax, edx
sub eax, ecx
push eax
push str.iphlpapi.dll
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.005ac365
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2aa0], eax
test eax, eax
jne 0x522798
xor al, al
jmp 0x52288d
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x522864
lea ecx, [ebp - 0x2a9c]
mov dword [ebp - 0x2a9c], 0x2880
push ecx
lea ecx, [ebp - 0x2a8c]
push ecx
call eax
test eax, eax
jne 0x522864
push 3
lea esi, [ebp - 0x2a8c]
pop ebx
lea ecx, [esi + 8]
call fcn.005222ad
mov dword [ebp - 0x2a98], eax
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x2a94], eax
mov word [ebp - 0x2a90], ax
lea eax, [ebp - 0x2a94]
push eax
call fcn.00522278
test al, al
jne 0x52281b
cmp dword [esi + 0x1a0], 6
jne 0x522858
mov ecx, dword [ebp - 0x2a98]
cmp ebx, ecx
jle 0x522858
jmp 0x522821
mov ecx, dword [ebp - 0x2a98]
mov al, byte [esi + 0x194]
mov ebx, ecx
mov byte [edi], al
mov al, byte [esi + 0x195]
mov byte [edi + 1], al
mov al, byte [esi + 0x196]
mov byte [edi + 2], al
mov al, byte [esi + 0x197]
mov byte [edi + 3], al
mov al, byte [esi + 0x198]
mov byte [edi + 4], al
mov al, byte [esi + 0x199]
mov byte [edi + 5], al
mov esi, dword [esi]
test esi, esi
jne 0x5227d7
xor ebx, ebx
push dword [ebp - 0x2aa0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2a94]
mov dword [ebp - 0x2a94], ebx
push eax
mov ecx, edi
mov word [ebp - 0x2a90], bx
call fcn.00522278
xor al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056cd75
leave
ret
call fcn.0056d067
int3
Function at 0x52375e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x63d284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
call fcn.00462e8e
cmp eax, 5
jle 0x5237fb
push 0x1d
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
push 4
pop eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x80]
movsw word es:[edi], word [esi]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5237fb
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
push ebx
push str.EnableLUA
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x90], 1
push dword [ebp - 0x84]
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056cd75
leave
ret
Function at 0x524cb3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push ebx
push edx
call dword [eax + 0x10]
cmp dword [ebp - 8], 0
je 0x524ce3
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x524ce3
mov bl, 1
jmp 0x524ce5
xor bl, bl
lea ecx, [ebp - 0x18]
call fcn.00403d40
mov al, bl
pop ebx
leave
ret

Function at 0x524cf7
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push ebx
push esi
push edi
push edx
call dword [eax + 0x10]
cmp dword [ebp - 0x28], 0
je 0x524e4b
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x524e4b
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x524d67
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x611da8
call fcn.00440ee4
jmp 0x524e38
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x524d8a
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x611da8
call fcn.00440ee4
jmp 0x524e34
push ebx
lea eax, [edi + 1]
mov dword [ebp - 0x20], ebx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0xf
call fcn.004448b1
cmp dword [ebp - 0xc], 0x10
lea ecx, [ebp - 4]
push ebx
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0x20]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x524de1
cmp edi, dword [ebp - 4]
jne 0x524de1
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.00440e58
jmp 0x524df0
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x611da8
call fcn.00440ee4
mov eax, dword [ebp - 0xc]
cmp eax, 0x10
jb 0x524e27
mov ecx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
cmp eax, 0x1000
jb 0x524e1e
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00403daf
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push ecx
call fcn.0056c61e
pop ecx
pop ecx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x524e3f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x38]
call fcn.00403d40
mov eax, edi
jmp 0x524e63
mov ecx, dword [ebp + 8]
push 0x611da8
call fcn.00440ee4
lea ecx, [ebp - 0x38]
call fcn.00403d40
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x525485
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x52549e
mov eax, dword [esi]
push 0x5e4174
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x52561d
mov ebx, dword [ebp + 0x14]
xor edi, edi
cmp dword [ebx], edi
je 0x52561d
push 0x800
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.00573610
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x5254de
mov eax, dword [esi]
push eax
push 0x400
lea eax, [ebp - 0x830]
push eax
push edi
push 0x6122b0
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x830], di
je 0x52561d
push 0x14
call fcn.00415d9b
pop ecx
test eax, eax
je 0x52551e
mov ecx, eax
call fcn.0043ca6c
mov edi, eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x18]
call fcn.00408fc4
push 0x5e3f94
lea ecx, [ebp - 0x30]
call fcn.00408fc4
lea eax, [ebp - 0x18]
push eax
call fcn.0043ce02
pop ecx
push eax
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.0043d487
lea ecx, [ebp - 0x30]
call fcn.00403d40
lea ecx, [ebp - 0x18]
call fcn.00403d40
push str.title
lea ecx, [ebp - 0x18]
call fcn.00408fc4
sub esp, 0x18
xor eax, eax
mov ecx, esp
push esi
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040850d
lea eax, [ebp - 0x30]
push eax
call fcn.004c6ee0
push eax
call fcn.0043ce02
add esp, 0x20
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043d487
lea ecx, [ebp - 0x30]
call fcn.00403d40
lea ecx, [ebp - 0x18]
call fcn.00403d40
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x5255e1
push str.path
lea ecx, [ebp - 0x18]
call fcn.00408fc4
push esi
call fcn.0043ce02
pop ecx
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043d487
lea ecx, [ebp - 0x18]
call fcn.00403d40
push 0x5e3fa8
lea ecx, [ebp - 0x18]
call fcn.00408fc4
push dword [ebp + 0x10]
call fcn.0043ce02
pop ecx
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043d487
lea ecx, [ebp - 0x18]
call fcn.00403d40
mov ecx, dword [ebx]
push edi
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
push eax
call fcn.0043de68
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x525cec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x28], ebx
je 0x525d13
lea eax, [edi + 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406392
mov al, 1
jmp 0x525dfc
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x525d1d
mov eax, dword [edi]
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x525d42
test eax, eax
je 0x525d42
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
jmp 0x525d04
push 0x250
lea eax, [ebp - 0x268]
push ebx
push eax
call fcn.00573610
add esp, 0xc
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x525d61
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x268]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov esi, ebx
push eax
cmovne esi, dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x1400000
ja 0x525de9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x5e41a4
push esi
push eax
add edi, 0x18
call fcn.00452ffd
add esp, 0xc
mov ecx, edi
push eax
call fcn.00446d47
lea ecx, [ebp - 0x18]
call fcn.00403d40
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x525dbd
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x525dc7
mov eax, dword [esi]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x525ded
mov esi, 0x60c5e0
push esi
call fcn.0057e469
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407cc7
xor al, al
jmp 0x525dfb
push edi
mov ecx, esi
call fcn.00406392
cmp dword [esi + 0x10], ebx
setne al
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x527439
Capabilities:
Check if file exists
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.CBrowser360.virtual_12
Function at 0x52858d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x214]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x52861a
and dword [ebp - 8], 0
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x52861a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x52861a
push edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x60db0c
push edi
call sub.VERSION.dll_VerQueryValueW
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
jmp 0x52861c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret