joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e560
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edi + 0x38]
test byte [eax], 8
jne 0x41e577
mov dword [0x4cb538], 0x6f
xor eax, eax
pop ecx
ret
push edi
mov edx, edi
call fcn.0041ec50
add esp, 4
test eax, eax
je 0x41e573
lea ecx, [edi + 4]
push ecx
mov edx, edi
call fcn.0041ec50
add esp, 4
test eax, eax
je 0x41e573
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41e5b1
push 3
lea edx, [esp + 4]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x41e5c6
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 8]
push 1
push ecx
call fcn.0048adde
add esp, 0x10
cmp eax, 3
je 0x41e5d9
mov dword [0x4cb538], 0x66
xor eax, eax
pop ecx
ret
mov dl, byte [esp]
movzx eax, dl
mov ecx, eax
shr ecx, 4
and ecx, 7
inc ecx
mov dword [edi + 8], ecx
movzx ecx, byte [esp + 1]
and eax, 7
push ebx
inc eax
push esi
mov dword [edi + 0xc], ecx
test dl, dl
jns 0x41e6c7
mov ecx, eax
mov esi, 1
shl esi, cl
push 0
call fcn.0041f240
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x41e629
pop esi
mov dword [0x4cb538], 0x6d
pop ebx
pop ecx
ret
xor ebx, ebx
cmp dword [eax], ebx
jle 0x41e6ce
xor esi, esi
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41e64e
push 3
lea edx, [esp + 0xc]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x41e663
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.0048adde
add esp, 0x10
cmp eax, 3
jne 0x41e6a8
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 8]
mov byte [esi + eax], cl
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 9]
mov byte [eax + esi + 1], cl
mov edx, dword [edi + 0x10]
movzx ecx, byte [esp + 0xa]
mov eax, dword [edx + 8]
mov byte [eax + esi + 2], cl
mov edx, dword [edi + 0x10]
inc ebx
add esi, 3
cmp ebx, dword [edx]
jl 0x41e635
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [edi + 0x10]
call fcn.0041f2c0
pop esi
mov dword [edi + 0x10], 0
mov dword [0x4cb538], 0x66
xor eax, eax
pop ebx
pop ecx
ret
mov dword [edi + 0x10], 0
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x41e6e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
test byte [eax], 8
jne 0x41e6f7
mov dword [0x4cb538], 0x6f
xor eax, eax
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41e70d
push 1
lea eax, [esp + 7]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x41e722
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xb]
push 1
push edx
call fcn.0048adde
add esp, 0x10
cmp eax, 1
je 0x41e735
mov dword [0x4cb538], 0x66
xor eax, eax
pop ecx
ret
mov al, byte [esp + 3]
cmp al, 0x21
je 0x41e773
cmp al, 0x2c
je 0x41e766
cmp al, 0x3b
je 0x41e759
mov dword [esi], 0
mov dword [0x4cb538], 0x6b
xor eax, eax
pop ecx
ret
mov dword [esi], 4
mov eax, 1
pop ecx
ret
mov dword [esi], 2
mov eax, 1
pop ecx
ret
mov dword [esi], 3
mov eax, 1
pop ecx
ret
Function at 0x41ea80
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x41ea9b
mov dword [0x4cb538], 0x6f
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41eab1
push 1
lea eax, [esp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x41eac6
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.0048adde
add esp, 0x10
cmp eax, 1
je 0x41eada
mov dword [0x4cb538], 0x66
xor eax, eax
pop esi
pop ecx
ret
movzx eax, byte [esp + 7]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
call fcn.0041eaf0
pop esi
pop ecx
ret

Function at 0x41eaf0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x41eb0f
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xb]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x41eb24
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.0048adde
add esp, 0x10
cmp eax, 1
jne 0x41eb70
mov cl, byte [esp + 7]
test cl, cl
jbe 0x41eb7f
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x41eb52
movzx ecx, byte [esp + 7]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x41eb67
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 7]
push edx
push ecx
push 1
push eax
call fcn.0048adde
add esp, 0x10
movzx edx, byte [esp + 7]
cmp eax, edx
je 0x41eb85
mov dword [0x4cb538], 0x66
xor eax, eax
pop edi
pop ecx
ret
mov dword [ebx], 0
mov eax, 1
pop edi
pop ecx
ret

Function at 0x41ec50
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41ec6a
push 2
lea eax, [esp + 4]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x41ec7f
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [esp + 8]
push 1
push edx
call fcn.0048adde
add esp, 0x10
cmp eax, 2
je 0x41ec92
mov dword [0x4cb538], 0x66
xor eax, eax
pop ecx
ret
mov ax, word [esp]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 8]
shl ecx, 8
add ecx, edx
mov dword [eax], ecx
mov eax, 1
pop ecx
ret
Function at 0x41ecb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x41ecd4
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xf]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x41ece9
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0x13]
push 1
push edx
call fcn.0048adde
add esp, 0x10
cmp eax, 1
jne 0x41ed36
mov cl, byte [esp + 0xb]
test cl, cl
jbe 0x41ed46
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebp], eax
inc eax
test edx, edx
je 0x41ed18
movzx ecx, byte [esp + 0xb]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x41ed2d
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xb]
push edx
push ecx
push 1
push eax
call fcn.0048adde
add esp, 0x10
movzx edx, byte [esp + 0xb]
cmp eax, edx
je 0x41ed58
pop edi
mov dword [0x4cb538], 0x66
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x41ed70
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [eax + 0x38]
xor ebx, ebx
push edi
mov ecx, esi
cmp dword [esi + 0x3c], ebx
je 0x41ed92
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
add esp, 0xc
jmp 0x41eda7
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.0048adde
add esp, 0x10
movzx ecx, byte [esp + 0xf]
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x41f150
Capabilities:
Read file on windows

Disassembly:
mov cl, byte [esi]
push ebp
mov ebp, dword [esp + 8]
push edi
test cl, cl
jne 0x41f1f9
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41f175
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x41f186
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.0048adde
add esp, 0x10
cmp eax, 1
je 0x41f19a
pop edi
mov dword [0x4cb538], 0x66
xor eax, eax
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x41f1af
pop edi
mov dword [0x4cb538], 0x70
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x41f1c9
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x41f1dc
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.0048adde
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x41f18b
mov al, byte [edi]
mov byte [edi], 2
mov byte [ebp], al
dec cl
pop edi
mov byte [esi], cl
mov eax, 1
pop ebp
ret
mov al, byte [esi + 1]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
pop edi
mov byte [ebp], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop ebp
ret
Function at 0x420ca0
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x38
push esi
mov esi, eax
add esi, 4
cmp byte [esi + 0x26], 0
mov eax, esi
jne 0x420cb4
mov eax, dword [esi + 0x20]
lea ecx, [esp + 8]
push ecx
add eax, 4
push eax
call fcn.00489a11
add esp, 8
test eax, eax
jne 0x420cd3
test dword [esp + 0xe], 0x4000
je 0x420cda
mov al, 1
pop esi
add esp, 0x38
ret
cmp byte [esi + 0x26], 0
mov eax, esi
jne 0x420ce5
mov eax, dword [esi + 0x20]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x26], 0
jne 0x420cfd
mov esi, dword [esi + 0x20]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
add esp, 0x38
ret

Function at 0x420d20
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4a9558
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
push edi
mov eax, dword [0x4c8630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x2a], 0
lea esi, [edi + 4]
mov eax, esi
jne 0x420d61
mov eax, dword [esi + 0x20]
push 2
add eax, 4
push 0x4b9504
push eax
call fcn.0048eabc
add esp, 0xc
test eax, eax
je 0x420dc5
mov ecx, edi
call fcn.00420b00
test al, al
jne 0x420e1d
lea eax, [esp + 0x14]
push eax
call fcn.0041ff40
lea ebx, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x50], 0
call fcn.00420e40
test al, al
je 0x420dc9
mov eax, ebx
call fcn.00420950
test al, al
jne 0x420dc9
mov ecx, ebx
call fcn.00420d20
test al, al
jne 0x420dc9
mov eax, ebx
call fcn.00402420
xor al, al
jmp 0x420e1f
cmp byte [esi + 0x26], 0
jne 0x420dd2
mov esi, dword [esi + 0x20]
push 0
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x420e01
cmp byte [esp + 0x3e], al
jne 0x420dfd
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x420dfd
push eax
call fcn.0048a268
add esp, 4
xor al, al
jmp 0x420e1f
cmp byte [esp + 0x3e], 0
jne 0x420e1d
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x420e1d
push eax
call fcn.0048a268
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00488f53
add esp, 0x44
ret

Function at 0x421940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x4cb53c]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00488f53
add esp, 0x808
ret
Function at 0x4219b0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x474
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x46c], eax
push esi
push edi
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.0048aa40
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push 0x4b9c68
lea edx, [esp + 0x64]
push edx
call esi
push 0x4cbb58
lea eax, [esp + 0x64]
push eax
call esi
push 0x4cbb58
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jbe 0x421b78
cmp word [eax*2 + 0x4cbb56], 0x5c
je 0x421a28
push 0x4b94f8
lea ecx, [esp + 0x64]
push ecx
call esi
push str.crashrpt.exe
lea edx, [esp + 0x64]
push edx
call esi
push 0x4b9c6c
lea eax, [esp + 0x64]
push eax
call esi
push 0x4cb950
lea ecx, [esp + 0x64]
push ecx
call esi
push 0x4b9c6c
lea edx, [esp + 0x64]
push edx
call esi
push str.sogouwp
lea eax, [esp + 0x64]
push eax
call esi
push 0x4b9c6c
lea ecx, [esp + 0x64]
push ecx
call esi
cmp byte [0x4c9a08], 0
mov eax, 0x4b2f9c
jne 0x421a83
mov eax, 0x4b2fa0
push eax
lea edx, [esp + 0x64]
push edx
call esi
push 0x4b9c68
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x4cb748
call fcn.0048ea90
mov edi, eax
add esp, 8
test edi, edi
je 0x421acf
push 0x4b9c74
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x4b9c68
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x4cb540
call fcn.0048ea90
mov edi, eax
add esp, 8
test edi, edi
je 0x421b07
push 0x4b9c74
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x4b9c68
lea eax, [esp + 0x64]
push eax
call esi
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x44
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.0048aa40
add esp, 0xc
cmp byte [0x4c9a08], 0
mov dword [esp + 0x18], 0x44
je 0x421b46
mov eax, 5
mov dword [esp + 0x44], 1
mov word [esp + 0x48], ax
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
xor ecx, esp
call fcn.00488f53
add esp, 0x474
ret
Function at 0x421cb0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
cmp byte [0x4cf1e0], 0
jne 0x421d34
xor eax, eax
push str.GetNativeSystemInfo
push 0x4b95a0
mov byte [0x4cf1e0], 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421d10
lea ecx, [esp]
push ecx
call eax
jmp 0x421d1a
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x421d29
cmp ax, 6
jne 0x421d34
mov al, 1
mov byte [0x4cf1e1], al
add esp, 0x24
ret
mov al, byte [0x4cf1e1]
add esp, 0x24
ret

Function at 0x421e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x218]
mov dword [esp], eax
mov al, byte [0x4cf308]
push ebp
mov ebp, dword [esp + 0x218]
test al, al
jne 0x421efd
xor ecx, ecx
push 0x206
xor eax, eax
push ecx
lea edx, [esp + 0x12]
push edx
mov dword [0x4cf30c], eax
mov dword [0x4cf310], eax
mov word [esp + 0x14], cx
call fcn.0048aa40
add esp, 0xc
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x421e95
xor al, al
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00488f53
add esp, 0x210
ret
push edi
push str.kernel32.dll
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0048a4ff
push 0x4cf30c
lea edi, [esp + 0x1c]
call fcn.00421f40
add esp, 0x10
pop edi
test al, al
je 0x421e7d
push str.GetProductInfo
push 0x4b95a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421ef6
movzx edx, word [0x4cf30e]
movzx ecx, word [0x4cf30c]
push 0x4cf314
push 0
push 0
push edx
push ecx
call eax
mov al, 1
mov byte [0x4cf308], al
movzx edx, word [0x4cf30c]
mov dword [ebx], edx
movzx ecx, word [0x4cf30e]
mov dword [ebp], ecx
movzx edx, word [0x4cf310]
mov ecx, dword [esp + 4]
mov dword [ecx], edx
test esi, esi
je 0x421f29
mov edx, dword [0x4cf314]
mov dword [esi], edx
mov ecx, dword [esp + 0x210]
pop ebp
xor ecx, esp
call fcn.00488f53
add esp, 0x210
ret
Function at 0x421f40
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 4], eax
test eax, eax
jne 0x421f62
xor al, al
pop ebp
add esp, 0xc
ret
push ebx
push esi
push eax
xor bl, bl
call fcn.0048a836
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x421fcc
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x4b94f8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x421fcc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov word [ebp], cx
movzx edx, word [eax + 8]
mov word [ebp + 2], dx
movzx ecx, word [eax + 0xe]
mov word [ebp + 4], cx
movzx edx, word [eax + 0xc]
mov word [ebp + 6], dx
mov bl, 1
test esi, esi
je 0x421fd9
push esi
call fcn.0048a268
add esp, 4
pop esi
mov al, bl
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x4223f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp eax, ebx
jne 0x42240b
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push ebp
push eax
mov dword [esp + 0x30], ebx
call edi
test eax, eax
jne 0x4224a1
mov eax, dword [esp + 0x18]
cmp eax, ebx
jbe 0x4224a1
lea eax, [eax + eax + 8]
push esi
push eax
mov dword [esp + 0x20], eax
call fcn.0048a836
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x422450
pop esi
pop edi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
push edx
push ebx
push esi
call fcn.0048aa40
mov edx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edx]
push esi
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebp
push eax
mov dword [esp + 0x28], 1
call edi
test eax, eax
jne 0x42248e
mov edx, dword [esp + 0x20]
mov eax, esi
call fcn.00420150
mov bl, 1
push esi
call fcn.0048a268
add esp, 4
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 0xc
pop edi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc

Function at 0x4224b0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [eax]
test edx, edx
jne 0x4224bb
xor al, al
ret 4
mov eax, edi
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4224c1
sub eax, esi
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 8]
push ecx
push edi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 4
Function at 0x425130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8f48
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4c8630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.0041ffd0
add edi, 0x30
push edi
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x1c], 0
call fcn.0041ffd0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x425300
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4a9420
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
push edi
mov eax, dword [0x4c8630]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov eax, dword [esp + 0x94]
xor ebx, ebx
mov esi, ecx
cmp eax, ebx
jne 0x42534a
xor al, al
jmp 0x425495
push eax
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x1f], bl
call fcn.004200b0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x90], ebx
call fcn.0041ff40
push ebx
push ebx
push ebx
push ebx
push esi
mov byte [esp + 0xa0], 1
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
cmp edi, ebx
je 0x42545b
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea edx, [esp + 0x1c]
push edx
push 2
push edi
mov dword [esp + 0x28], 0xbb8
call esi
push 4
lea eax, [esp + 0x1c]
push eax
push 5
push edi
call esi
push 4
lea ecx, [esp + 0x1c]
push ecx
push 6
push edi
call esi
push 4
lea edx, [esp + 0x1c]
push edx
push 8
push edi
call esi
mov ecx, dword [esp + 0x4c]
mov eax, 0x800
cmp ecx, ebx
jbe 0x4253f7
cmp ecx, eax
jae 0x4253d8
mov eax, ecx
lea ecx, [esp + 0x50]
cmp byte [esp + 0x76], bl
jne 0x4253e6
mov ecx, dword [esp + 0x70]
add ecx, 4
push ecx
lea ebx, [esp + 0x20]
call fcn.004201f0
xor ebx, ebx
jmp 0x425425
cmp dword [esp + 0x48], ebx
je 0x425401
mov dword [esp + 0x48], ebx
mov eax, 1
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
call fcn.004208d0
mov eax, esi
cmp byte [esp + 0x46], bl
jne 0x42541f
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [esp + 0x20]
cmp byte [esp + 0x46], bl
jne 0x425433
mov eax, dword [esp + 0x40]
push ebx
push 0x84200000
push ebx
push ebx
add eax, 4
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, ebx
je 0x425458
push eax
mov byte [esp + 0x1b], 1
call esi
push edi
call esi
cmp byte [esp + 0x46], bl
jne 0x425476
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x425476
push eax
call fcn.0048a268
add esp, 4
cmp byte [esp + 0x76], bl
jne 0x425491
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x50]
cmp eax, ecx
je 0x425491
push eax
call fcn.0048a268
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.00488f53
add esp, 0x80
ret
Function at 0x4256c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 4], eax
test eax, eax
jne 0x4256e2
xor al, al
pop ebp
add esp, 0xc
ret
push ebx
push esi
push eax
xor bl, bl
call fcn.0048a836
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42574c
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x4b94f8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42574c
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [ebp], cx
movzx ecx, word [eax + 0xe]
mov word [ebp + 2], dx
movzx edx, word [eax + 0xc]
mov word [ebp + 4], cx
mov word [ebp + 6], dx
mov bl, 1
test esi, esi
je 0x425759
push esi
call fcn.0048a268
add esp, 4
pop esi
mov al, bl
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x425770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0048aa40
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4257c9
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00488f53
add esp, 0x214
ret
push edi
push str.kernel32.dll
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0048a4ff
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
call fcn.004256c0
add esp, 0x10
pop edi
test al, al
je 0x4257b2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.00488f53
add esp, 0x214
ret