joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412010
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x490858
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x14c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
push 1
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x49851c
mov ecx, esi
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x1c], esi
mov byte [esi + 4], bl
call fcn.00402910
push 0x497a4e
lea ecx, [esp + 0x10]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14], 1
call fcn.0040f1b0
push 0x103
lea eax, [esp + 0x39]
push ebx
push eax
mov dword [esp + 0x150], 1
mov byte [esp + 0x40], bl
call fcn.0044c250
add esp, 0xc
push ebx
push 0x26
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4120e8
push 0x40
lea edx, [esp + 0x38]
push str.Internet_Exploreriexplore.exe
push edx
call fcn.0044fa50
add esp, 0xc
lea eax, [esp + 0x34]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4120f0
sub eax, edx
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x14]
call fcn.0040ee80
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412150
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x150], 2
call fcn.00402830
cmp dword [esp + 0x30], 0x10
jb 0x412150
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00418a35
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x144], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412177
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0044c23d
add esp, 0x13c
ret
Function at 0x4121a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4908d3
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov esi, dword [esp + 0x458]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edi, 1
push edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x49851c
mov ecx, esi
mov dword [esp + 0x458], ebx
mov dword [esp + 0x2c], esi
mov byte [esi + 4], bl
call fcn.00402910
push 0x497a4e
lea ecx, [esp + 0x18]
mov dword [esp + 0x454], ebx
mov dword [esp + 0x24], edi
call fcn.0040f1b0
mov dword [esp + 0x450], edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
push 0x3ff
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x45c], 2
mov byte [esp + 0x50], bl
call fcn.0044c250
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4122f4
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push str.DisplayIcon
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x400
call fcn.0040e900
test eax, eax
jne 0x4122df
push str...QQBrowser.exe
lea ecx, [esp + 0x48]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4122c7
sub eax, edx
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040ee80
cmp edi, ebx
je 0x4122f0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41233c
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x45c], 3
call fcn.00402830
cmp dword [esp + 0x40], 0x10
jb 0x41233c
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00418a35
add esp, 4
cmp edi, ebx
je 0x412347
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x450], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41236e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.0044c23d
add esp, 0x444
ret
Function at 0x4123a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x490953
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov esi, dword [esp + 0x458]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edi, 1
push edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x49851c
mov ecx, esi
mov dword [esp + 0x458], ebx
mov dword [esp + 0x2c], esi
mov byte [esi + 4], bl
call fcn.00402910
push 0x497a4e
lea ecx, [esp + 0x18]
mov dword [esp + 0x454], ebx
mov dword [esp + 0x24], edi
call fcn.0040f1b0
mov dword [esp + 0x450], edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
push 0x3ff
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x45c], 2
mov byte [esp + 0x50], bl
call fcn.0044c250
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push ebx
push str.CLSID802F530B_A8F6_4631_AE49_6BACAAC6373EInprocServer32
push SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4124e1
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push 0x497a4e
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x400
call fcn.0040e900
test eax, eax
jne 0x4124cc
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4124b4
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040ee80
cmp edi, ebx
je 0x4124dd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412529
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x45c], 3
call fcn.00402830
cmp dword [esp + 0x40], 0x10
jb 0x412529
mov edx, dword [esp + 0x2c]
push edx
call fcn.00418a35
add esp, 4
cmp edi, ebx
je 0x412534
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x450], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41255b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.0044c23d
add esp, 0x444
ret
Function at 0x412590
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4909d3
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov esi, dword [esp + 0x458]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edi, 1
push edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x49851c
mov ecx, esi
mov dword [esp + 0x458], ebx
mov dword [esp + 0x2c], esi
mov byte [esi + 4], bl
call fcn.00402910
push 0x497a4e
lea ecx, [esp + 0x18]
mov dword [esp + 0x454], ebx
mov dword [esp + 0x24], edi
call fcn.0040f1b0
mov dword [esp + 0x450], edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
push 0x3ff
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x45c], 2
mov byte [esp + 0x50], bl
call fcn.0044c250
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push ebx
push str.CLSID0C27ADC4_E826_4620_A3A7_990D7E05545FInprocServer32
push SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4126d1
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push 0x497a4e
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x400
call fcn.0040e900
test eax, eax
jne 0x4126bc
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4126a4
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040ee80
cmp edi, ebx
je 0x4126cd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412719
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x45c], 3
call fcn.00402830
cmp dword [esp + 0x40], 0x10
jb 0x412719
mov edx, dword [esp + 0x2c]
push edx
call fcn.00418a35
add esp, 4
cmp edi, ebx
je 0x412724
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x450], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41274b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.0044c23d
add esp, 0x444
ret
Function at 0x412780
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x490a53
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov esi, dword [esp + 0x458]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edi, 1
push edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x49851c
mov ecx, esi
mov dword [esp + 0x458], ebx
mov dword [esp + 0x2c], esi
mov byte [esi + 4], bl
call fcn.00402910
push 0x497a4e
lea ecx, [esp + 0x18]
mov dword [esp + 0x454], ebx
mov dword [esp + 0x24], edi
call fcn.0040f1b0
mov dword [esp + 0x450], edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
push 0x3ff
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x45c], 2
mov byte [esp + 0x50], bl
call fcn.0044c250
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push ebx
push str.CLSID00000ADA_7E0D_47C1_986C_F017D09C4304InprocServer32
push SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4128c1
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push 0x497a4e
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x400
call fcn.0040e900
test eax, eax
jne 0x4128ac
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412894
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040ee80
cmp edi, ebx
je 0x4128bd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412909
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x45c], 3
call fcn.00402830
cmp dword [esp + 0x40], 0x10
jb 0x412909
mov edx, dword [esp + 0x2c]
push edx
call fcn.00418a35
add esp, 4
cmp edi, ebx
je 0x412914
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x450], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41293b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.0044c23d
add esp, 0x444
ret
Function at 0x414440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414455
xor eax, eax
ret 8
test al, 0x10
je 0x414465
xor eax, eax
cmp dword [esp + 8], eax
setne al
ret 8
xor eax, eax
cmp dword [esp + 8], eax
sete al
ret 8

Function at 0x414790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x13c
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push edi
xor edi, edi
mov ebx, ecx
cmp dword [ebx + 0xc0], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
jle 0x414954
push ebp
push esi
lea ebp, [ebx + 0xd0]
lea ebx, [ebx]
mov esi, 0x10
cmp dword [ebp + 0x14], esi
jb 0x4147df
mov eax, dword [ebp]
jmp 0x4147e1
mov eax, ebp
mov edx, dword [ebp - 8]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x414803
mov dword [ebp + 0x50], edi
jmp 0x414918
mov dword [esp + 0x20], 0x104
cmp dword [ebp + 0x30], esi
jb 0x414815
mov eax, dword [ebp + 0x1c]
jmp 0x414818
lea eax, [ebp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push ecx
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414840
mov dword [ebp + 0x50], edi
jmp 0x414918
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414852
sub eax, edx
cmp byte [esp + eax + 0x43], 0x5c
jne 0x414881
lea eax, [esp + 0x44]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414870
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
jmp 0x4148af
lea edi, [esp + 0x44]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x414886
mov dx, word [0x497a4c]
lea eax, [esp + 0x44]
mov word [edi], dx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4148a0
sub eax, edx
push eax
lea eax, [esp + 0x48]
push eax
lea esi, [ebp + 0x34]
mov ecx, esi
call fcn.00402910
push str.opera.exe
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.004103a0
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x4148d7
mov eax, dword [eax + 4]
jmp 0x4148da
add eax, 4
push 0
push eax
mov ecx, ebx
call fcn.00414440
test eax, eax
sete bl
cmp dword [esp + 0x40], 0x10
jb 0x4148fd
mov edx, dword [esp + 0x2c]
push edx
call fcn.00418a35
add esp, 4
xor edi, edi
test bl, bl
mov ebx, dword [esp + 0x18]
je 0x41490c
mov dword [ebp + 0x50], edi
jmp 0x414918
mov eax, 1
mov dword [ebp + 0x50], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
inc eax
add ebp, 0xb0
cmp eax, dword [ebx + 0xc0]
mov dword [esp + 0x14], eax
jl 0x4147d0
pop esi
pop ebp
cmp dword [esp + 8], edi
je 0x414954
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0044c23d
add esp, 0x13c
ret
mov ecx, dword [esp + 0x140]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044c23d
add esp, 0x13c
ret
Function at 0x416120
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x490e59
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x6c]
xor ebx, ebx
mov dword [esp + 0x18], ebx
push 1
mov ebp, ecx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push 0x49851c
mov ecx, edi
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x24], edi
mov byte [edi + 4], bl
call fcn.00402910
mov ecx, ebp
mov dword [esp + 0x64], ebx
mov dword [esp + 0x18], 1
call fcn.00414790
test eax, eax
jne 0x416289
cmp dword [ebp + 0xc0], ebx
mov dword [esp + 0x14], ebx
jle 0x416289
lea esi, [ebp + 0x104]
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.00402830
push 9
push str.Opera.exe
lea ecx, [esp + 0x44]
mov dword [esp + 0x6c], 1
call fcn.00409600
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x4161f6
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x416232
cmp dword [esp + 0x54], 0x10
mov byte [esp + 0x64], bl
jb 0x416219
mov eax, dword [esp + 0x40]
push eax
call fcn.00418a35
add esp, 4
mov eax, dword [esp + 0x14]
inc eax
add esi, 0xb0
cmp eax, dword [ebp + 0xc0]
mov dword [esp + 0x14], eax
jl 0x4161b2
jmp 0x416289
mov eax, dword [esp + 0x40]
mov esi, 0x10
cmp dword [esp + 0x54], esi
jae 0x416245
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00403100
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x70], 2
call fcn.00402830
cmp dword [esp + 0x38], esi
jb 0x416276
mov edx, dword [esp + 0x24]
push edx
call fcn.00418a35
add esp, 4
cmp dword [esp + 0x54], esi
jb 0x416289
mov eax, dword [esp + 0x40]
push eax
call fcn.00418a35
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0044c23d
add esp, 0x54
ret 4
Function at 0x4174c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x4b99e4]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0
push 0x497a4e
mov ecx, esi
call fcn.0040ee80
push 0x1ff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.0044c250
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
push str.DisplayIcon
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSogouExplorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x417585
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417542
sub eax, edx
je 0x417585
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417554
sub eax, edx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0040ee80
mov eax, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044c23d
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0044c23d
add esp, 0x210
ret

Function at 0x4175d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4910d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
push 0x497a4e
lea ecx, [esp + 8]
call fcn.0040f1b0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0
call fcn.004174c0
add esp, 4
test eax, eax
je 0x417664
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x417664
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41764f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41768c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x4176a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x491108
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4b99e4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
call fcn.004175d0
test eax, eax
je 0x4177e9
push 0x497a4e
lea ecx, [esp + 0x10]
call fcn.0040f1b0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x24], 0
call fcn.004174c0
mov ecx, dword [esp + 0x10]
add esp, 4
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jg 0x417746
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41772f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
lea ecx, [edi + 4]
push ecx
call fcn.00418a40
mov edx, dword [esp + 0x10]
add esp, 4
mov esi, eax
push esi
push edi
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x417784
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x417723
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x497a4c
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4177bb
lea ecx, [esp + 0xc]
call fcn.0040ed40
jmp 0x41772f
mov eax, dword [esp + 0x10]
movzx edi, word [eax + 0xa]
push esi
call fcn.00418a4b
add esp, 4
lea ecx, [esp + 0xc]
call fcn.0040ed40
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret