joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4272b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 4]
xor ebx, ebx
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.00426bd0
add esp, 8
cmp eax, ebx
mov dword [0x5a810c], eax
je 0x427487
mov dx, word [0x53ada0]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], dx
mov word [ebp - 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
lea edx, [ebp - 0x20c]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x20c]
push 0x50b79c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, 0x5439f8
call fcn.0041f5c0
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push str.http:__doctor.se.360.cn_index.php_doadderrorlog
mov ecx, 0x412
xor eax, eax
mov edi, 0x5a0ed8
push 0x50c180
push 0x824
push 0x5a0ed8
rep stosd dword es:[edi], eax
call esi
add esp, 0x10
lea edx, [ebp - 0x414]
mov ecx, 0x82
xor eax, eax
push edx
mov edi, 0x5a0ac8
push 0x50c180
push 0x104
rep stosd dword es:[edi], eax
push 0x5a0ac8
call esi
mov ax, word [0x53ada0]
mov ecx, 0x81
mov word [ebp - 0x61c], ax
xor eax, eax
lea edi, [ebp - 0x61a]
add esp, 0x10
rep stosd dword es:[edi], eax
mov ecx, str.___________________________7d9114302a0cb6
mov dword [0x54609c], 0x2710
test ecx, ecx
mov dword [0x546094], 0x4274a0
mov dword [0x546090], ebx
stosw word es:[edi], ax
je 0x427419
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004f3f00
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push str.___________________________7d9114302a0cb6
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push str.multipart_form_data__boundary_s
lea edx, [ebp - 0x61c]
push 0x103
push edx
call esi
mov eax, dword [0x5a810c]
mov ecx, dword [ebp - 4]
add esp, 0x10
lea edx, [ebp - 0x61c]
mov dword [0x545e74], eax
mov dword [0x545e78], ecx
push edx
mov ecx, 0x82
xor eax, eax
mov edi, 0x545e7c
push 0x50c180
push 0x104
rep stosd dword es:[edi], eax
push 0x545e7c
call esi
add esp, 0x10
mov ecx, 0x5439f8
call fcn.0041f4f0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x427487
mov ecx, 0x5439f8
call fcn.0041f8f0
lea esp, [ebp - 0x628]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429ac0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x820
push ebx
push esi
push edi
mov esi, dword [esp + 0x830]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
stosw word es:[edi], ax
push 0x50c180
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebx
lea ecx, [esp + 0x224]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 0x18
test eax, eax
je 0x429b33
add eax, 2
lea edx, [esp + 0x214]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x626]
mov word [esp + 0x624], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x624]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x214]
lea edx, [esp + 0x624]
push ecx
push edx
push 0x50c6a4
lea eax, [esp + 0x18]
push 0x103
push eax
call ebx
mov cx, word [0x53ada0]
xor eax, eax
mov word [esp + 0x430], cx
mov ecx, 0x81
lea edi, [esp + 0x432]
add esp, 0x14
rep stosd dword es:[edi], eax
push str.Skin
push 0x53b02c
push str._s_s_
lea edx, [esp + 0x428]
push 0x103
push edx
stosw word es:[edi], ax
call ebx
lea eax, [esp + 0x430]
push eax
call fcn.00439330
lea ecx, [esp + 0x434]
push 1
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00439b90
add esp, 0x24
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0xc]
push ecx
call edi
push 0
push esi
call fcn.00439a10
add esp, 8
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x820
ret 4
Function at 0x432ee0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x432fad
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x432fad
push 0
push str.cachesnap
mov ecx, 0x53adc0
call fcn.00408460
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
je 0x432fad
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x432f30
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call fcn.00432d60
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x432f43
xor edi, edi
jmp 0x432f73
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004f3f00
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push edi
push esi
mov esi, dword [ebp + 0xc]
dec eax
push str._s_s.png
push eax
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432fad
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x432fad
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x432fc0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x214]
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push ecx
call fcn.00432ee0
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
add esp, 0x208
ret
Function at 0x438a20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov esi, ecx
mov dword [esp + 0x10], ebp
je 0x438b28
lea edi, [esi + 0x22c]
push 0x103
push eax
push edi
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
push ebp
push 0x80
push 4
push ebp
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x438b28
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x6400000
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], eax
mov dword [esp + 0x18], ebp
jbe 0x438a9a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esi + 0x21c], edi
jne 0x438aba
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 0x220]
xor eax, eax
inc ecx
push ebp
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 0x220]
mov edx, dword [esi + 0x21c]
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438b08
mov eax, dword [esi + 0x220]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jne 0x438b08
mov dword [esp + 0x10], 1
jmp 0x438b21
mov eax, dword [esi + 0x21c]
cmp eax, ebp
je 0x438b21
push eax
call fcn.004f3eca
add esp, 4
mov dword [esi + 0x21c], ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x228], ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x438d50
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
je 0x438db6
mov esi, dword [esp + 0x18]
test esi, esi
je 0x438db6
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80000080
push 2
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x438db6
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x438dbe
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, edi
pop edi
pop esi
pop ebx
sete al
ret 0xc
Function at 0x438e60
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
push edi
je 0x438eae
mov edi, dword [esp + 0x10]
test edi, edi
je 0x438eae
mov ebx, dword [esp + 0x14]
test ebx, ebx
jbe 0x438eae
push esi
xor esi, esi
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x438ea8
mov ecx, ebx
mov esi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret

Function at 0x438ec0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebp
test eax, eax
push edi
je 0x438f15
mov edi, dword [esp + 0x10]
test edi, edi
je 0x438f15
mov ebp, dword [esp + 0x14]
test ebp, ebp
jbe 0x438f15
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x24]
lea esi, [eax + ecx]
test esi, esi
je 0x438f0e
mov ecx, ebp
push eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor eax, eax
pop ebp
ret

Function at 0x439300
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x439326
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x439328
mov eax, esi
pop esi
ret
Function at 0x43b5a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f4f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004e2500
xor edi, edi
lea ecx, [esi + 0xeec]
mov dword [esp + 0x18], edi
call fcn.0043d0f0
push edi
lea ecx, [esi + 0x2494]
mov byte [esp + 0x1c], 1
call fcn.004c8630
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24e0], al
mov dword [esi + 0x24e4], edi
mov dword [esi + 0x24e8], edi
mov dword [esi + 0x24ec], edi
mov dword [esi + 0x2490], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24dc], edi
mov dword [esi], 0x4fa55c
mov dword [esi + 4], 0x4fa548
mov dword [esi + 0x28], 0x4fa544
mov dword [esi + 0x30], 0x4fa534
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43b5b8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f4f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004e2500
xor edi, edi
lea ecx, [esi + 0xeec]
mov dword [esp + 0x18], edi
call fcn.0043d0f0
push edi
lea ecx, [esi + 0x2494]
mov byte [esp + 0x1c], 1
call fcn.004c8630
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24e0], al
mov dword [esi + 0x24e4], edi
mov dword [esi + 0x24e8], edi
mov dword [esi + 0x24ec], edi
mov dword [esi + 0x2490], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24dc], edi
mov dword [esi], 0x4fa55c
mov dword [esi + 4], 0x4fa548
mov dword [esi + 0x28], 0x4fa544
mov dword [esi + 0x30], 0x4fa534
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43b670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f4fa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x4fa55c
mov dword [edi + 4], 0x4fa548
mov dword [edi + 0x28], 0x4fa544
mov dword [edi + 0x30], 0x4fa534
mov ebx, dword [edi + 0x24e8]
mov esi, dword [edi + 0x24e4]
cmp esi, ebx
mov dword [esp + 0x18], 1
je 0x43b6f8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi]
mov edx, dword [0x50b100]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x43b6f0
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x43b6f0
mov eax, dword [esi]
sub eax, 0xc
push eax
call fcn.004f3eca
add esp, 4
add esi, 4
cmp esi, ebx
jne 0x43b6c9
pop ebp
mov eax, dword [edi + 0x24e4]
push eax
call fcn.004f3eca
xor ebx, ebx
add esp, 4
lea ecx, [edi + 0x2494]
mov dword [edi + 0x24e4], ebx
mov dword [edi + 0x24e8], ebx
mov dword [edi + 0x24ec], ebx
call fcn.004c8680
lea ecx, [edi + 0xeec]
mov byte [esp + 0x18], bl
call fcn.0043d1a0
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.004e2830
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43db6e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4f505b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x30]
xor ebx, ebx
push 0x1c
mov dword [esp + 0x18], esi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], cl
mov byte [esi + 0x1c], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x18], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x5a9ebc], ebx
jne 0x43dbc2
mov dword [0x5a9ebc], edi
mov dword [edi], ebx
mov edx, dword [0x5a9ebc]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x5a9eb8]
inc ecx
mov dword [0x5a9eb8], ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x43dbe6
push ebp
call fcn.004f3eca
add esp, 4
mov edi, dword [0x5a9ebc]
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
mov dword [eax + 8], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
push edi
mov dword [esi], 0x4fa5f0
call fcn.00497390
mov ecx, eax
call fcn.00497740
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x43ed20
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push 0
push str.user.dat
mov ecx, 0x53adc0
stosw word es:[edi], ax
call fcn.00408460
mov esi, eax
push str.user.dat
lea eax, [esp + 0xc]
push 0x103
push eax
call fcn.00439010
push 0
push esi
call fcn.00438f20
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esp, 0x14
test eax, eax
jne 0x43ed82
lea ecx, [esp + 8]
push esi
push ecx
call edi
push str.history.dat
lea edx, [esp + 0xc]
push 0x103
push edx
call fcn.00439010
add esp, 0xc
mov ecx, 0x53adc0
push 0
push str.history.dat
call fcn.00408460
mov esi, eax
push 0
push esi
call fcn.00438f20
add esp, 8
test eax, eax
jne 0x43edc3
lea eax, [esp + 8]
push esi
push eax
call edi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x445050
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push 0
push str.secache.ini
mov ecx, 0x53adc0
lea esi, [edi + 0x2c]
call fcn.00408460
push eax
push 0x50c180
push 0x103
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
add edi, 0x28
push esi
push edi
call fcn.00486f80
add esp, 0x1c
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
ret
Function at 0x445820
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
push edi
call ebx
lea eax, [esi + 0x28]
push 0
push eax
call fcn.00487170
add esp, 8
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call ebx
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x44586c
push 1
push str.HasLastPage
push str.Main
call fcn.0040a920
add esp, 0xc
ret

Function at 0x4476c0
Capabilities:
Parse url

Disassembly:
mov eax, 0x1494
call fcn.004f3f00
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14a4]
test esi, esi
push edi
je 0x447829
cmp word [esi], 0
je 0x447829
mov eax, dword [esp + 0x14ac]
test eax, eax
je 0x447829
mov dx, word [0x53ada0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x254]
push edx
mov dword [esp + 0x18], eax
mov eax, 0x104
lea ecx, [esp + 0x50]
push 0
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call ebx
mov ebp, dword [sym.imp.WININET.dll_InternetCrackUrlW]
add esp, 4
push eax
push esi
call ebp
test eax, eax
jne 0x4477d8
mov ecx, 0x411
lea edi, [esp + 0x45e]
mov word [esp + 0x45c], ax
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.http:___s_
lea eax, [esp + 0x464]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x45c]
push ecx
push 0
push edx
call ebx
add esp, 4
push eax
lea eax, [esp + 0x468]
push eax
call ebp
test eax, eax
je 0x447829
mov edx, dword [esp + 0x14b0]
mov esi, dword [esp + 0x14ac]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx]
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x254]
push ecx
push eax
push str._s:___s_favicon.ico
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1494
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1494
ret
Function at 0x447cc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push esi
push SysReAllocStringLen
mov dword [esp + 0x30], 0
call edi
mov ebp, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x447d3c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push str.iexplore.exe
push esi
push SysReAllocStringLen
mov dword [esp + 0x3c], 0
call edi
test eax, eax
jne 0x447d3c
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test ebp, ebp
jne 0x447d4c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x447d6a
lea edx, [esp + 0x28]
push 4
push edx
push 4
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x447df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x447f7d
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x447f7d
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x447f73
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x447f73
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x447f69
mov eax, dword [esp + 8]
cmp eax, esi
je 0x447f69
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x5aaf48
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x447f5f
mov eax, dword [esp + 4]
cmp eax, esi
je 0x447f5f
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret