joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4274ed
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x64c], ecx
mov ecx, dword [0x51a244]
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
jne 0x427694
push 0x208
push ecx
lea eax, [ebp - 0x414]
push eax
call fcn.0049f230
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049f230
push str.ntdll.dll
lea eax, [ebp - 0x414]
push eax
push str._s_s
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00407939
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4275b9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42762c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42762c
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x648], eax
test eax, eax
je 0x42762c
push 0x110
lea eax, [ebp - 0x524]
push 0
push eax
call fcn.0049f230
add esp, 0xc
mov dword [ebp - 0x528], 0x114
lea eax, [ebp - 0x528]
push eax
call dword [ebp - 0x648]
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x42762c
mov dword [0x51a244], eax
mov eax, dword [ebp - 0x520]
mov dword [0x51a248], eax
mov eax, dword [ebp - 0x51c]
mov dword [0x51a24c], eax
mov eax, dword [ebp - 0x518]
mov dword [0x51a250], eax
push 0x118
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.0049f230
add esp, 0xc
mov dword [ebp - 0x644], 0x11c
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [0x51a244]
test eax, eax
je 0x427694
test ecx, ecx
jne 0x427694
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x640]
mov dword [0x51a248], eax
mov eax, dword [ebp - 0x638]
mov dword [0x51a24c], eax
mov eax, dword [ebp - 0x634]
mov dword [0x51a244], ecx
mov dword [0x51a250], eax
mov eax, dword [ebp - 0x64c]
test eax, eax
je 0x4276a0
mov dword [eax], ecx
test ebx, ebx
je 0x4276ab
mov eax, dword [0x51a248]
mov dword [ebx], eax
test edi, edi
je 0x4276b6
mov eax, dword [0x51a24c]
mov dword [edi], eax
test esi, esi
je 0x4276c1
mov eax, dword [0x51a250]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret
Function at 0x4276ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4277b8
mov eax, dword [ebp - 4]
test eax, eax
je 0x4277b8
xor ecx, ecx
lea eax, [eax*2 + 1]
push 2
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049702c
mov esi, eax
pop ecx
test esi, esi
je 0x4277b8
mov eax, dword [ebp - 4]
lea eax, [eax*4 + 2]
push eax
push 0
push esi
call fcn.0049f230
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4277af
push esi
call fcn.004a338c
pop ecx
mov ecx, dword [ebp + 0x14]
push eax
push esi
call fcn.004041f3
push ebx
push esi
call fcn.00496a18
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4277ba
push ebx
push esi
call fcn.00496a18
pop ecx
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x4277be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x10]
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42785b
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x42785b
inc eax
push eax
call fcn.0049702c
mov esi, eax
pop ecx
test esi, esi
je 0x42785b
mov eax, dword [ebp + 0x14]
inc eax
push eax
push 0
push esi
call fcn.0049f230
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x427851
push esi
call fcn.004a33b0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004041aa
push 1
push esi
call fcn.00496a18
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x42785d
push 1
push esi
call fcn.00496a18
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x427861
Capabilities:
Check if file exists

Disassembly:
push 0x240
mov eax, 0x4caa36
call fcn.00496d1f
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x525914]
mov edi, 0x4d18d0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24c], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x51a2c0]
cmp eax, dword [ecx + 4]
jg 0x427a49
push edi
mov ecx, 0x51a2a8
call fcn.004143ae
test al, al
jne 0x4278c6
push 0x51a2a8
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040458e
jmp 0x427a41
push edi
lea ecx, [ebp - 0x230]
call fcn.004022ea
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
jne 0x427908
push edi
mov ecx, esi
call fcn.004022ea
jmp 0x427a36
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0049f230
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.......
lea eax, [ebp - 0x218]
push eax
call edi
push str.components_seapp_
lea eax, [ebp - 0x218]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x4279a0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....
lea eax, [ebp - 0x218]
push eax
call edi
push str.seapp_
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x427a05
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049f230
lea eax, [ebp - 0x248]
push eax
call fcn.00426a76
add esp, 0x10
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.360se6Applicationcomponents_seapp_
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x248]
call fcn.00404061
lea eax, [ebp - 0x218]
push eax
call fcn.004a338c
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ebx, 0x51a2a8
push eax
mov ecx, ebx
call fcn.004041f3
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push ebx
call fcn.0040458e
lea ecx, [ebp - 0x230]
call fcn.00404061
mov eax, esi
call fcn.00496cc9
ret
push 0x51a2c0
call fcn.004967d3
cmp dword [0x51a2c0], 0xffffffff
pop ecx
jne 0x4278a0
push edi
mov ecx, 0x51a2a8
mov dword [ebp - 4], ebx
call fcn.004022ea
push 0x4d022c
call fcn.00496c8e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x51a2c0
call fcn.00496789
pop ecx
jmp 0x4278a0
Function at 0x427afb
Capabilities:
Check if file exists

Disassembly:
push 0x240
mov eax, 0x4caab3
call fcn.00496d1f
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x525914]
mov edi, 0x4d18d0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24c], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x51a288]
cmp eax, dword [ecx + 4]
jg 0x427ce3
push edi
mov ecx, 0x51a270
call fcn.004143ae
test al, al
jne 0x427b60
push 0x51a270
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040458e
jmp 0x427cdb
push edi
lea ecx, [ebp - 0x230]
call fcn.004022ea
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
jne 0x427ba2
push edi
mov ecx, esi
call fcn.004022ea
jmp 0x427cd0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0049f230
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.......
lea eax, [ebp - 0x218]
push eax
call edi
push str.components_seapp_
lea eax, [ebp - 0x218]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x427c3a
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....
lea eax, [ebp - 0x218]
push eax
call edi
push str.seapp_
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x427c9f
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049f230
lea eax, [ebp - 0x248]
push eax
call fcn.00426a76
add esp, 0x10
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.360se6Applicationcomponents_seapp_
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x248]
call fcn.00404061
lea eax, [ebp - 0x218]
push eax
call fcn.004a338c
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ebx, 0x51a270
push eax
mov ecx, ebx
call fcn.004041f3
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push ebx
call fcn.0040458e
lea ecx, [ebp - 0x230]
call fcn.00404061
mov eax, esi
call fcn.00496cc9
ret
push 0x51a288
call fcn.004967d3
cmp dword [0x51a288], 0xffffffff
pop ecx
jne 0x427b3a
push edi
mov ecx, 0x51a270
mov dword [ebp - 4], ebx
call fcn.004022ea
push 0x4d0236
call fcn.00496c8e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x51a288
call fcn.00496789
pop ecx
jmp 0x427b3a
Function at 0x42825a
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x4ca594
call fcn.00496d1f
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.004265dc
xor edi, edi
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 4], edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042ce2c
pop ecx
pop ecx
test eax, eax
je 0x4282d2
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call fcn.0040458e
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push 1
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push edi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.00404061
lea ecx, [ebp - 0x28]
call fcn.00404061
call fcn.00496cc9
ret

Function at 0x4282e0
Capabilities:
Create process on windows

Disassembly:
push 0x4ac
mov eax, 0x4cabca
call fcn.00496d1f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x420]
push 0x208
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.004022ea
mov dword [ebp - 4], ebx
call fcn.004288e5
test eax, eax
je 0x428426
lea eax, [ebp - 0x438]
mov dword [ebp - 0x4b8], ebx
push eax
mov esi, 0x4d6e7c
lea eax, [ebp - 0x4b0]
push esi
push eax
call fcn.00401c93
push esi
push eax
lea eax, [ebp - 0x498]
mov byte [ebp - 4], 1
push eax
call fcn.00401c6d
push esi
push eax
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push eax
call fcn.00401c6d
add esp, 0x24
push edi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040412f
mov byte [ebp - 0x4b4], bl
lea ecx, [ebp - 0x450]
push dword [ebp - 0x4b4]
mov dword [ebp - 0x440], ebx
push eax
mov dword [ebp - 0x43c], ebx
call fcn.00403e90
push 0x4d6e78
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.00401c6d
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.00404061
lea ecx, [ebp - 0x480]
call fcn.00404061
lea ecx, [ebp - 0x498]
call fcn.00404061
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 9
call fcn.00404061
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x4b8]
push ecx
push ebx
lea eax, [ebp - 0x468]
cmovae eax, dword [ebp - 0x468]
push 1
push eax
call fcn.00425f9d
add esp, 0x10
lea ecx, [ebp - 0x468]
mov esi, eax
call fcn.00404061
test esi, esi
jne 0x428459
cmp dword [edi + 0x14], 8
jb 0x42842e
mov edi, dword [edi]
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push 1
cmovae eax, dword [ebp - 0x438]
push ebx
push edi
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x438]
call fcn.00404061
call fcn.00496cc9
ret
Function at 0x42846a
Capabilities:
Create process on windows

Disassembly:
push 0x9c
mov eax, 0x4cac28
call fcn.00496d1f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00427a8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042ce2c
pop ecx
pop ecx
test eax, eax
je 0x4285b6
call fcn.004288e5
test eax, eax
je 0x42858b
and dword [ebp - 0xa8], 0
lea eax, [ebp - 0x28]
push eax
mov esi, 0x4d6e7c
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00401c93
push esi
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
push eax
call fcn.00401c6d
push esi
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
call fcn.00401c6d
add esp, 0x24
push edi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040412f
xor ecx, ecx
mov byte [ebp - 0xa4], cl
push dword [ebp - 0xa4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x40]
push eax
call fcn.00403e90
push 0x4d6e78
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00401c6d
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00404061
lea ecx, [ebp - 0x70]
call fcn.00404061
lea ecx, [ebp - 0x88]
call fcn.00404061
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 9
call fcn.00404061
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0xa8]
push ecx
push 0
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push 1
push eax
call fcn.00425f9d
add esp, 0x10
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.00404061
test esi, esi
jne 0x4285b6
cmp dword [edi + 0x14], 8
jb 0x428593
mov edi, dword [edi]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push edi
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.00404061
call fcn.00496cc9
ret
Function at 0x428c61
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x428dd8
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x428c88
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
dec eax
neg eax
sbb al, al
and dword [ebp - 4], 0
inc al
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x4dd810
push 1
push 0
push 0x4dd880
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x428dd1
push edi
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 8
jb 0x428ccb
mov edx, dword [edi]
mov eax, dword [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x14], 8
jb 0x428ce0
mov edx, dword [edx]
mov eax, dword [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp + 0x18]
xor ebx, ebx
cmp dword [edx + 0x10], ebx
je 0x428d06
cmp dword [edx + 0x14], 8
jb 0x428cfc
mov edx, dword [edx]
mov eax, dword [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp + 0x14]
cmp dword [edx + 0x10], ebx
je 0x428d1a
cmp dword [edx + 0x14], 8
jb 0x428d16
mov edx, dword [edx]
push ebx
push edx
jmp 0x428d24
cmp dword [edi + 0x14], 8
jb 0x428d22
mov edi, dword [edi]
push ebx
push edi
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edi, dword [ebp + 0x1c]
cmp dword [edi + 0x10], ebx
je 0x428d51
call fcn.00428215
test eax, eax
je 0x428d51
cmp dword [edi + 0x14], 8
jb 0x428d46
mov edi, dword [edi]
push edi
push dword [ebp - 4]
call fcn.00428814
pop ecx
pop ecx
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], ebx
push 0x4dd870
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
pop edi
setns bl
test eax, eax
js 0x428d93
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x428d79
mov edx, dword [esi]
mov eax, dword [ebp - 8]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
mov eax, dword [ebp - 8]
push eax
setns bl
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x428dd1
cmp byte [ebp + 0x20], 0
je 0x428dd1
cmp byte [ebp - 0xc], 0
je 0x428db9
push 0
push 0
push 0
push 0x8000000
jmp 0x428dcb
cmp dword [esi + 0x14], 8
jb 0x428dc1
mov esi, dword [esi]
push 0
push esi
push 0x3005
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x429342
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor eax, eax
lea esi, [ecx + 0x1b80]
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4293c9
cmp eax, 0x3fff
ja 0x4293c9
push esi
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4293c9
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x4d3930
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4293c9
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push edi
push esi
call fcn.00404609
add esp, 0x1c
xor eax, eax
mov word [esi + edi*2 - 2], ax
inc eax
pop edi
jmp 0x4293cb
xor eax, eax
pop esi
leave
ret 0xc

Function at 0x42943b
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
mov edi, ecx
push eax
push 0x26
lea esi, [edi + 0x5b80]
push esi
push eax
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4d70b0
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x32
pop eax
push eax
lea ebx, [edi + 0xcbc]
mov dword [ebp - 4], eax
push ebx
push esi
mov ecx, edi
call fcn.00429342
test eax, eax
jne 0x4294a6
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push ebx
lea eax, [ebp - 8]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42957a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.360se6_new
mov esi, ecx
push 0x28
push esi
call fcn.00429e0a
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esi + 0xb4]
push 0x500
push eax
call fcn.00429e0a
add esp, 0xc
mov ecx, esi
call fcn.0042911c
mov ecx, esi
call fcn.004293d0
mov ecx, esi
call fcn.0042943b
mov ecx, esi
call fcn.00429507
mov ecx, esi
call fcn.0042915f
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 0
je 0x429635
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
lea eax, [esi + 0xab4]
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push str._d._d._d__s
push 0x103
push eax
call fcn.00404609
add esp, 0x1c
lea edi, [esi + 0x5d88]
push 0x104
push edi
mov byte [edi], 0
call fcn.0042e3fe
cmp byte [edi], 0
lea eax, [esi + 0xd84]
pop ecx
pop ecx
jne 0x429665
push str.empty_na
push 0x23
push eax
call fcn.00429e0a
jmp 0x42966e
push 0x23
push eax
push edi
call fcn.004297db
add esp, 0xc
mov ecx, esi
push ebx
call fcn.0042920d
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00429694
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret 8
Function at 0x429694
Capabilities:
Check if file exists
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
mov ebx, ecx
push eax
call fcn.004265dc
cmp dword [ebp - 0xc], 0
pop ecx
je 0x4297c4
push esi
xor eax, eax
lea esi, [ebx + 0xe7c]
cmp dword [ebp - 8], 8
mov word [esi], ax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push edi
push eax
push 0x103
push esi
call fcn.004a9840
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...User_Data
push esi
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 0x104
test eax, eax
jne 0x42971f
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_Data
push esi
call edi
push str.tcdump
push esi
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42973a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x2710
call fcn.004298b4
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push str._scrashinfo__d__d.dat
mov edi, 0x104
lea eax, [ebx + 0x128c]
push edi
push eax
call fcn.00407939
push esi
push str._sStandaloneCrashInfo
lea eax, [ebx + 0x1494]
push edi
push eax
call fcn.00407939
mov cl, byte [ebp + 8]
lea eax, [ebx + 0xe10]
push eax
test cl, cl
lea edi, [ebx + 0x1084]
mov edx, str._s_secrash__s.dmp
mov eax, str._sMinorError__s.dmp
cmovne eax, edx
push esi
push eax
or eax, 0xffffffff
test cl, cl
mov ecx, 0x104
cmove eax, ecx
push eax
push edi
call fcn.00407939
add esp, 0x3c
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4297c2
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
lea ecx, [ebp - 0x1c]
call fcn.00404061
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret 4