joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e5e4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x45c01f
call fcn.0044b154
sub esp, 0x5c
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], esi
call fcn.0041a15f
push str..html
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.00419fe3
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push str..mht
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x14], ebx
call fcn.00419fe3
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x14], 3
call fcn.00446d10
add esp, 0xc
test eax, eax
je 0x41e669
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41e65b
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov byte [ebp - 0xd], bl
jne 0x41e66d
mov byte [ebp - 0xd], 0
push esi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004192fd
push esi
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.004192fd
cmp byte [ebp - 0xd], 0
mov ecx, edi
je 0x41e692
lea eax, [ebp - 0x30]
push eax
jmp 0x41e695
push dword [ebp + 8]
call fcn.0041a15f
push esi
lea ecx, [ebp - 0x30]
push ebx
call fcn.004192fd
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41e77d
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x45c4f3
call fcn.0044b154
sub esp, 0x8ac
push ebx
push esi
push edi
push str.APPCOMPANY
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
push dword [0x4844e4]
call fcn.0041b183
push str._Agent___
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.0041691c
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.004192fd
xor eax, eax
mov byte [ebp - 0x8b8], bl
mov ecx, 0x1ff
lea edi, [ebp - 0x8b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8b8]
push eax
push ebx
mov dword [ebp - 0x10], 0x800
call sub.urlmon.dll_ObtainUserAgentString
cmp eax, ebx
jl 0x41e812
lea eax, [ebp - 0x8b8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00419a13
mov edi, 0x469b70
push edi
lea ecx, [ebp - 0x48]
call fcn.00419fe3
lea eax, [ebp - 0x9c]
push 0x7e4
push eax
mov byte [ebp - 4], 3
call fcn.00446e00
push eax
lea eax, [ebp - 0x80]
push str.__OI_build
push eax
mov byte [ebp - 4], 4
call fcn.00419572
push edi
push eax
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 5
call fcn.0041691c
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.00446d10
add esp, 0x2c
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.004192fd
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.004192fd
push ebx
push esi
lea ecx, [ebp - 0x9c]
call fcn.004192fd
push ebx
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004192fd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041a15f
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004192fd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41e8c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push str.fs::LoadResourceToString_534
push str._s__id_d_type_s_
push edi
call fcn.0043a6e3
movzx eax, word [ebp + 0xc]
add esp, 0x14
push dword [ebp + 0x10]
push eax
push dword [0x483fac]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
cmp esi, edi
je 0x41e981
cmp esi, 0xffffffff
je 0x41e981
push esi
push dword [0x483fac]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
cmp ebx, edi
jne 0x41e92a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x46eb20
jmp 0x41e963
push esi
push dword [0x483fac]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
push esi
push str.__size:__d
push edi
call fcn.0043a6e3
add esp, 0xc
cmp esi, edi
jbe 0x41e98e
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
cmp eax, edi
jne 0x41e973
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x46eaf4
push str.___s_failed:__d
push edi
call fcn.0043a6e3
add esp, 0x10
jmp 0x41e98e
mov ecx, dword [ebp + 8]
push esi
push eax
call fcn.00419a30
mov al, 1
jmp 0x41e990
push str.__not_found
push edi
call fcn.0043a6e3
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41e995
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x45ce0d
call fcn.0044b154
sub esp, 0x460
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0x10
push edi
mov dword [ebp - 0x10], esp
lea edi, [esi + 4]
jb 0x41e9ba
mov eax, dword [edi]
jmp 0x41e9bc
mov eax, edi
push eax
push str.fs::LoadFileToString_569
push str._s__fn_s_
xor ebx, ebx
push ebx
call fcn.0043a6e3
add esp, 0x10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x41e9dd
mov edi, dword [edi]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x41eaa8
cmp esi, 0xffffffff
je 0x41eaa8
push ebx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x46c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x41ea56
cmp dword [ebp - 0x14], ebx
jbe 0x41ea56
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x46c]
push eax
call fcn.0041462b
add edi, dword [ebp - 0x14]
jmp 0x41ea1e
cmp edi, dword [ebp - 0x18]
jae 0x41ea8e
push 0x468d4a
lea ecx, [ebp - 0x58]
call fcn.00419fe3
lea eax, [ebp - 0x58]
push eax
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.0041a005
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_load_file__err_d_
jmp 0x41ead9
cmp esi, ebx
je 0x41ea99
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x468d4a
lea ecx, [ebp - 0x58]
call fcn.00419fe3
lea eax, [ebp - 0x58]
push eax
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0041a005
mov esi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_open_file__err_d_
push esi
call fcn.00419950
add esp, 0xc
mov ecx, eax
jmp fcn.0041a041
Function at 0x41eb4d
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x45cdd3
call fcn.0044b154
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0x10
push edi
mov dword [ebp - 0x10], esp
lea edi, [esi + 4]
jb 0x41eb6f
mov eax, dword [edi]
jmp 0x41eb71
mov eax, edi
push eax
push str.fs::SaveFileFromBuffer_600
push str._s__fn_s_
xor ebx, ebx
push ebx
call fcn.0043a6e3
add esp, 0x10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x41eb92
mov edi, dword [edi]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x41ec1c
cmp esi, 0xffffffff
je 0x41ec1c
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x41ec06
push 0x468d4a
lea ecx, [ebp - 0x68]
call fcn.00419fe3
lea eax, [ebp - 0x68]
push eax
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.0041a005
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_save_file__err_d_
jmp 0x41ec4d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x468d4a
lea ecx, [ebp - 0x68]
call fcn.00419fe3
lea eax, [ebp - 0x68]
push eax
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0041a005
mov esi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_create_file__err_d_
push esi
call fcn.00419950
add esp, 0xc
mov ecx, eax
jmp fcn.0041a041
Function at 0x41eca2
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x45bfdb
call fcn.0044b154
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esi
call fcn.0041a15f
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
je 0x41ed51
mov edi, 0x46ea00
push edi
call fcn.00449290
pop ecx
push eax
push edi
or ecx, 0xffffffff
lea edi, [ebp - 0x2c]
call fcn.00429ec6
cmp eax, 0xffffffff
push 2
pop ebx
je 0x41ed0a
push eax
push esi
mov eax, edi
push eax
lea eax, [ebp - 0x64]
call fcn.0041cd6b
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
jmp 0x41ed1d
push 0x468d4a
lea ecx, [ebp - 0x48]
call fcn.00419fe3
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00418bb2
test byte [ebp - 0x10], bl
je 0x41ed3d
and dword [ebp - 0x10], 0xfffffffd
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.004192fd
mov dword [ebp - 4], esi
test byte [ebp - 0x10], 1
je 0x41ed51
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.004192fd
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x41ee34
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x41ed68
lea eax, [ebp - 0x28]
cmp byte [eax + ecx - 1], 0x5c
je 0x41ed7c
push 0x46ec90
lea ecx, [ebp - 0x2c]
call fcn.00413613
xor edi, edi
cmp dword [ebp - 0x18], esi
jbe 0x41ee34
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x41ed93
lea eax, [ebp - 0x28]
cmp byte [eax + edi], 0x5c
jne 0x41edd6
lea eax, [edi + 1]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
call fcn.0041cd6b
cmp dword [eax + 0x18], 0x10
jb 0x41edb5
mov eax, dword [eax + 4]
jmp 0x41edb8
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x64]
inc bl
call fcn.004192fd
test bl, bl
jne 0x41ee2f
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x41ed87
jmp 0x41ee2f
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x41edea
lea eax, [ebp - 0x28]
cmp byte [eax + edi], 0x5c
jne 0x41ee2e
lea eax, [edi + 1]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
call fcn.0041cd6b
cmp dword [eax + 0x18], 0x10
jb 0x41ee0c
mov eax, dword [eax + 4]
jmp 0x41ee0f
add eax, 4
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x64]
inc bl
call fcn.004192fd
test bl, bl
jne 0x41ee52
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x41edde
mov bl, 1
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004192fd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
xor bl, bl
jmp 0x41ee36
Function at 0x41f2bd
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x45c4b3
call fcn.0044b154
sub esp, 0x40
and dword [ebp - 0x14], 0
cmp dword [esi + 0x18], 0x10
jb 0x41f2d9
mov eax, dword [esi + 4]
jmp 0x41f2dc
lea eax, [esi + 4]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
xor ebx, ebx
inc ebx
test eax, eax
je 0x41f334
push 0x46ec90
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0041691c
push dword [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], ebx
call fcn.00416a8f
add esp, 0x18
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0x14], 3
jb 0x41f323
mov eax, dword [eax + 4]
jmp 0x41f326
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov byte [ebp - 0xd], bl
je 0x41f338
mov byte [ebp - 0xd], 0
test byte [ebp - 0x14], 2
je 0x41f34d
and dword [ebp - 0x14], 0xfffffffd
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.004192fd
test byte [ebp - 0x14], bl
je 0x41f35d
push 0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004192fd
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41f36d
Capabilities:
Get file size

Disassembly:
cmp dword [eax + 0x18], 0x10
jb 0x41f378
mov eax, dword [eax + 4]
jmp 0x41f37b
add eax, 4
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x41f3ae
cmp esi, 0xffffffff
je 0x41f3ae
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
jmp 0x41f3b0
xor ebx, ebx
test esi, esi
je 0x41f3bb
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41f40f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x41f42e
mov eax, dword [edi]
jmp 0x41f430
mov eax, edi
lea ecx, [ebp - 4]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x41f453
mov ecx, dword [ebp + 8]
push 0x468d4a
call fcn.00419fe3
jmp 0x41f4ed
push ebx
push eax
call fcn.004475e8
cmp dword [esi + 0x18], 0x10
pop ecx
mov ebx, eax
jb 0x41f465
mov edi, dword [edi]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x46ec90
push ebx
call sub.VERSION.dll_VerQueryValueA
push 0x3f
pop ecx
mov byte [ebp - 0x10c], 0
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov ecx, 0xffff
and edx, ecx
push edx
movzx edx, word [eax + 0xe]
push edx
mov edx, dword [eax + 8]
movzx eax, word [eax + 0xa]
and edx, ecx
push edx
push eax
push str._d._d._d._d
lea eax, [ebp - 0x10c]
push 0xff
push eax
call fcn.0044a2f5
push ebx
call fcn.0044876d
mov ecx, dword [ebp + 8]
add esp, 0x20
lea eax, [ebp - 0x10c]
push eax
call fcn.00419fe3
pop ebx
mov eax, dword [ebp + 8]
pop edi
leave
ret
Function at 0x42140a
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [esi], edi
mov dword [esi + 8], eax
call fcn.0041a15f
mov eax, dword [edi + 0xc]
xor ebx, ebx
mov dword [esi + 0x28], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0x2c], eax
cmp dword [edi], ebx
je 0x42146e
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 0x38], eax
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x4214bd
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, esi
pop ebx
pop ebp
ret 8
Function at 0x421eb7
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov eax, 0x45cd99
call fcn.0044b154
sub esp, 0x5c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x14], ebx
je 0x421edf
cmp dword [ebp + 0xc], edi
jae 0x421f2d
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp eax, ebx
jne 0x421f28
push 0x468d4a
lea ecx, [ebp - 0x68]
call fcn.00419fe3
lea eax, [ebp - 0x68]
push eax
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0041a005
mov esi, eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.InternetQueryDataAvailable_failed__err_d
jmp 0x421fb1
cmp dword [ebp - 0x14], ebx
jne 0x421f3e
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov eax, 0x1000
cmp dword [ebp - 0x14], eax
jae 0x421f4b
mov dword [ebp - 0x14], eax
cmp edi, ebx
jbe 0x421f5c
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp dword [ebp - 0x14], eax
jbe 0x421f5c
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 0x14]
call fcn.00421e8c
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, ebx
jne 0x421fc1
push 0x468d4a
lea ecx, [ebp - 0x68]
call fcn.00419fe3
push 0xc353
push 1
lea eax, [ebp - 0x68]
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0042b98e
mov esi, eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.InternetReadFile_failed__err_d
push esi
call fcn.00419950
add esp, 0xc
mov ecx, eax
jmp fcn.0041a041
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
je 0x421fd1
cmp eax, dword [esi + 4]
jae 0x421fd1
mov dword [esi + 4], eax
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x421f2f

Function at 0x42245f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push str.fs::ShowCriticalErrorBox
xor ebx, ebx
push ebx
call fcn.0043a6e3
cmp byte [0x4844e9], bl
pop ecx
pop ecx
jne 0x4224bf
cmp byte [ebp + 8], bl
push esi
je 0x422493
mov esi, dword [0x4844e0]
cmp esi, ebx
je 0x422493
push ebx
call fcn.00408d38
jmp 0x422495
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x4224c2
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x4224be
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebx
leave
ret
Function at 0x424f94
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x460325
call fcn.0044b154
sub esp, 0x78
push ebx
push esi
push edi
mov esi, str.fs::FF_SetDefaultSearch_2292
push esi
mov ebx, ecx
call fcn.00449520
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0x10
jb 0x424fce
mov eax, dword [eax + 4]
jmp 0x424fd1
add eax, 4
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0x10
jb 0x424fdf
mov edx, dword [edx + 4]
jmp 0x424fe2
add edx, 4
push ecx
push eax
push edx
push esi
push str.___s__name_s_fn_s_len_xml__d_
push edi
call fcn.0043a6e3
add esp, 0x18
cmp dword [ebx + 0x14], edi
jbe 0x425016
push ebx
call fcn.00424adc
test al, al
pop ecx
je 0x425016
push str.__skip_FF_search_setting
push edi
call fcn.0043a6e3
pop ecx
pop ecx
jmp 0x42515b
push str._FFProfile_
lea ecx, [ebp - 0x68]
call fcn.00419fe3
lea eax, [ebp - 0x68]
push eax
xor ebx, ebx
lea eax, [ebp - 0x30]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.0041f693
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004192fd
cmp dword [ebp - 0x1c], edi
je 0x425151
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0041a15f
mov ecx, dword [ebp + 8]
push ebx
call fcn.00427a0c
push str._searchplugins_
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0041691c
push dword [ebp + 0x10]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00416a8f
add esp, 0x18
push edi
push ebx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.004192fd
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x4250af
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4250c8
push str.__search_xml_exists_already
push edi
call fcn.0043a6e3
pop ecx
jmp 0x425109
push str._searchplugins
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0041691c
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x4250e8
mov eax, dword [eax + 4]
jmp 0x4250eb
add eax, 4
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push edi
push ebx
lea ecx, [ebp - 0x68]
call fcn.004192fd
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp + 0x14]
call fcn.0041eb2e
pop ecx
push str.user_pref__browser.search.selectedEngine_____1___
lea ecx, [ebp - 0x68]
call fcn.00419fe3
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 7
call fcn.004265a1
add esp, 0x10
push edi
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.004192fd
push dword [ebp + 8]
mov eax, ebx
call fcn.00427dbd
push edi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004192fd
push edi
lea ecx, [ebp - 0x30]
push ebx
call fcn.004192fd
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x10]
call fcn.00419c15
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
Function at 0x425b7d
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x45db48
call fcn.0044b154
sub esp, 0x254
push ebx
push esi
push edi
mov esi, str.fs::FF_getExePath_2520
push esi
call fcn.00449520
mov dword [ebp - 0x24], eax
push esi
xor edi, edi
push 0x46b230
push edi
mov dword [ebp - 4], edi
call fcn.0043a6e3
add esp, 0x10
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov ebx, 0x20019
push ebx
push str.SOFTWAREMozillaMozilla_Firefox
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0041cfb0
test eax, eax
jne 0x425d7f
push 0x3f
pop ecx
mov byte [ebp - 0x260], al
lea edi, [ebp - 0x25f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.CurrentVersion
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x260]
mov dword [ebp - 0x10], 0xff
call fcn.0041cf59
test eax, eax
jne 0x425d7f
mov eax, edi
push eax
push str.__ff_ver:__s
xor esi, esi
push esi
call fcn.0043a6e3
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, esi
je 0x425c37
mov eax, edi
push eax
call fcn.00419a13
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00419fe3
push str.Main
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 3
call fcn.0041691c
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x425c71
mov eax, dword [eax + 4]
jmp 0x425c74
add eax, 4
push ebx
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.0041cfb0
mov ebx, eax
neg ebx
sbb bl, bl
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x5c]
inc bl
call fcn.004192fd
push esi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004192fd
test bl, bl
je 0x425d77
push 0x40
xor eax, eax
cmp dword [ebp + 8], esi
mov byte [ebp - 0x160], 0
pop ecx
lea edi, [ebp - 0x15f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x104
stosb byte es:[edi], al
mov dword [ebp - 0x10], ebx
je 0x425d16
push str.PathToExe
lea eax, [ebp - 0x18]
push eax
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x160]
call fcn.0041cf59
test eax, eax
jne 0x425d16
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x425d16
mov eax, edi
push eax
push str.__ff_exe:__s
push 0
call fcn.0043a6e3
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, edi
push eax
call fcn.00419a13
cmp dword [ebp + 0xc], 0
mov byte [ebp - 0x160], 0
mov dword [ebp - 0x10], ebx
je 0x425d6b
push str.Install_Directory
lea eax, [ebp - 0x18]
push eax
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x160]
call fcn.0041cf59
test eax, eax
jne 0x425d6b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x425d6b
mov eax, edi
push eax
push str.__ff_dir:__s
push 0
call fcn.0043a6e3
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov eax, edi
push eax
call fcn.00419a13
lea esi, [ebp - 0x18]
call fcn.0041943d
mov bl, 1
jmp 0x425d81
lea esi, [ebp - 0x18]
call fcn.0041943d
xor bl, bl
lea esi, [ebp - 0x20]
call fcn.0041943d
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x24]
call fcn.00419c15
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret