joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437d75
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [esp + 0x90], ecx
xorps xmm0, xmm0
lea ecx, [esp + 0x4c]
movups xmmword [ecx + 0x34], xmm0
movups xmmword [ecx + 0x24], xmm0
movups xmmword [ecx + 0x14], xmm0
movups xmmword [ecx + 4], xmm0
lea esi, [esp + 0x30]
movaps xmmword [esi], xmm0
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 0x8000000
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
mov eax, dword [esi]
test eax, eax
je 0x437dff
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x34]
test eax, eax
je 0x437e13
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x437e27
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [esp + 0x90]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x437ebb
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x437edb
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437f2e
lea edi, [ebp - 0x1c]
push edi
call fcn.00437f89
add esp, 4
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x437efd
mov eax, dword [ebp - 0x1c]
cmp byte [esi + 0xb], 0
jns 0x437f05
mov esi, dword [esi]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [ebp - 0x11], 0
jns 0x437f18
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437f32
cmp byte [ebp - 0x11], 0
jns 0x437f36
mov eax, dword [ebp - 0x1c]
jmp 0x437f39
mov bl, 1
jmp 0x437f75
xor ebx, ebx
jmp 0x437f64
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x437f64
cmp byte [ebp - 0x11], 0
jns 0x437f51
mov eax, dword [ebp - 0x1c]
jmp 0x437f54
lea eax, [ebp - 0x1c]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
cmp byte [ebp - 0x11], 0
jns 0x437f75
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437f89
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x414
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0x208
xor ebx, ebx
lea esi, [ebp - 0x218]
push eax
push ebx
push esi
call fcn.006030b0
add esp, 0xc
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0x420]
mov eax, 0x208
push eax
push ebx
push edi
call fcn.006030b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push eax
push 0x64a392
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp + 8]
push edi
call fcn.00401a6c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, dword [ebp + 8]
add esp, 0x414
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43800e
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4218
call fcn.00517f10
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x4010]
push 0x4000
push 0
push edi
call fcn.006030b0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x43804b
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
test eax, eax
je 0x43810d
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x438066
mov eax, dword [ebx]
lea ecx, [ebp - 0x421c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 1]
cmp ecx, 0x3ffe
ja 0x43810d
cmp byte [ebx + 0xb], 0
jns 0x43808a
mov ebx, dword [ebx]
push edi
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43810d
lea eax, [ebp - 0x4224]
lea ecx, [ebp - 0x4220]
push eax
push ecx
push 0x6391f0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43810d
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x4218]
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
mov eax, dword [ebp - 0x4220]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, 0xffff
mov ebx, eax
and ebx, edx
shr eax, 0x10
and edx, ecx
shr ecx, 0x10
push ebx
push eax
push edx
push ecx
push str._d._d._d._d
push 0x103
push edi
call fcn.00404830
add esp, 0x1c
mov ecx, esi
push edi
call fcn.0046930c
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x4218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4381df
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push dword [ebp + 8]
call fcn.00490ea0
add esp, 4
test eax, eax
jne 0x4381fa
cmp byte [ebp + 0xc], 0
jne 0x438204
test eax, eax
setne al
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00490f00
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
test esi, esi
mov edx, 0x64a43e
mov edi, 0x64a3a4
cmove edi, edx
mov edx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
mov ebx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan._Download_the_latest_version_
cmove ebx, edx
movzx eax, ax
setne cl
cmp eax, 0x804
cmove ebx, edi
mov eax, 0x64a39a
mov edx, str.Tips
cmove edx, eax
lea eax, [ecx*4 + 0x40]
push eax
push edx
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x438272
cmp eax, 6
jne 0x438272
push str.http:__chrome.360.cn_
call fcn.00491020
add esp, 4
push 0
call fcn.0060fd98
Function at 0x438279
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [esp + 0x30], ecx
push eax
call fcn.00490ea0
add esp, 4
mov esi, eax
test eax, eax
jne 0x43846d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
movzx eax, ax
cmp eax, 0x804
jne 0x4382f6
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x10]
test eax, eax
je 0x438327
mov ecx, edi
push eax
call fcn.0046930c
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4382f0
mov eax, dword [esp + 0x10]
lea ebx, [esp + 4]
jmp 0x43832d
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x10]
test eax, eax
je 0x438355
mov ecx, edi
push eax
call fcn.0046930c
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x438321
mov eax, dword [esp + 0x10]
lea ebx, [esp + 4]
jmp 0x43835b
lea ebx, [esp + 4]
mov eax, edi
lea ecx, [esp + 4]
push eax
push 0x64a800
push ecx
call fcn.0047c510
add esp, 0xc
cmp byte [esp + 0x2b], 0
js 0x438386
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x4383b2
lea ebx, [esp + 4]
mov eax, edi
lea ecx, [esp + 4]
push eax
push str._s_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
push ecx
call fcn.0047c510
add esp, 0xc
cmp byte [esp + 0x2b], 0
js 0x4383e0
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x43840c
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x4383b2
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [ebx + 8]
mov dword [esp + 0x28], eax
movsd xmm0, qword [ebx]
movsd qword [esp + 0x20], xmm0
cmp byte [edi + 0xb], 0
jns 0x4383d5
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
lea edi, [esp + 0x20]
mov eax, 0x64a39a
jmp 0x438438
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x43840c
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [ebx + 8]
mov dword [esp + 0x28], eax
movsd xmm0, qword [ebx]
movsd qword [esp + 0x20], xmm0
cmp byte [edi + 0xb], 0
jns 0x43842f
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
lea edi, [esp + 0x20]
mov eax, str.Tips
mov bl, byte [ebp + 0x14]
cmp byte [edi + 0xb], 0
jns 0x438447
mov ecx, dword [esp + 0x20]
jmp 0x43844b
lea ecx, [esp + 0x20]
push 0x40
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test bl, bl
jne 0x438489
cmp byte [edi + 0xb], 0
jns 0x43846d
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
xor ebx, ebx
test esi, esi
setne bl
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call fcn.0060fd98
Function at 0x438a8e
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [ebp - 0x70], ecx
xor eax, eax
mov dword [ebp - 0x68], edx
test edx, edx
setne al
mov edi, eax
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 5
xor ebx, ebx
lea esi, [ebp - 0x64]
mov dword [esi], ebx
lea eax, [edi*4]
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov edx, dword [ebp - 0x70]
cmp dword [esi], ebx
lea eax, [edi*4 + 0x1000000]
cmove eax, dword [ebp - 0x6c]
cmp byte [edx + 0xb], 0
jns 0x438b0f
mov edx, dword [edx]
lea ecx, [ebp - 0x54]
lea esi, [ebp - 0x64]
push esi
push ecx
push ebx
push ebx
push eax
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x438b68
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x438b47
push dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x438b5b
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x60]
call esi
push dword [ebp - 0x64]
call esi
mov bl, 1
jmp 0x438b68
push 0
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43919e
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.00418b9c
lea edi, [ebp - 0xb8]
test al, al
je 0x4391cb
push 0x138c
jmp 0x4391d0
push 0x138a
push edi
call fcn.00498905
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x4391e5
mov edi, dword [ebp - 0xb8]
lea ecx, [ebp - 0x10]
push edi
call fcn.0042f6f4
cmp byte [ebp - 0xad], 0
jns 0x439205
push dword [ebp - 0xb8]
call fcn.00517bd6
add esp, 4
push dword [ebp - 0x10]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43929e
mov byte [esi], 1
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4392ab
mov esi, eax
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43924a
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
call fcn.00473360
add esp, 4
test al, al
je 0x4392ab
lea esi, [ebp - 0xb8]
mov ecx, esi
push 0
push 0x49b
push str..._.._chrome_installer_tdsetup_tdsetup_ee_setup_util.cc
call fcn.004733f0
lea eax, [ebp - 0xb0]
push 0x1c
push str.find_another_setup_running_r_n
push eax
call fcn.00403cc6
add esp, 0xc
mov ecx, esi
call fcn.00473790
jmp 0x4392ab
push str.Enter...install
call fcn.00401e20
add esp, 4
mov eax, dword [ebp - 0x10]
xor ecx, ecx
dec ecx
lock xadd dword [eax - 4], ecx
dec ecx
test ecx, ecx
jg 0x4392c6
add eax, 0xfffffff0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
add esp, 0xb0
pop esi
pop edi
pop ebp
ret
Function at 0x43953c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x40]
mov ecx, esi
call fcn.0046ed20
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.0046ed20
push edi
push 0x66
call fcn.00476650
add esp, 8
test al, al
je 0x4395d4
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea ecx, [ebp - 0x1c]
push edi
call fcn.0046f0c0
mov eax, dword [edi]
cmp dword [edi + 4], eax
je 0x4395cc
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x43959c
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea edi, [ebp - 0x34]
mov ecx, edi
push edx
push eax
call fcn.0046ed80
mov ecx, esi
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
cmp byte [ebp - 0x35], 0
jns 0x4395c0
mov esi, dword [ebp - 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x4395fa
lea ecx, [ebp - 0x28]
call fcn.00403fbe
lea ecx, [ebp - 0x1c]
call fcn.0046ee40
xor ebx, ebx
lea ecx, [ebp - 0x40]
call fcn.0046ee40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.00403fbe
lea ecx, [ebp - 0x1c]
call fcn.0046ee40
movzx eax, byte [ebp - 0x35]
test al, al
jns 0x43961d
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
jmp 0x439620
lea ecx, [ebp - 0x40]
movzx edx, byte [esi + 0xb]
test dl, dl
jns 0x43962d
mov edx, dword [esi + 4]
mov esi, dword [esi]
mov bl, 1
push 1
push eax
push ecx
push edx
push esi
call fcn.0047b0c0
add esp, 0x14
test al, al
je 0x4395dc
jmp 0x4395de
Function at 0x439c41
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x41c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push ebx
push esi
push eax
call fcn.006030b0
add esp, 0xc
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x428], ebx
lea edi, [ebp - 0x420]
push ebx
push esi
push edi
call fcn.006030b0
add esp, 0xc
push esi
push 0x26
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
lea edi, [ebp - 0x218]
push str._sInternet_Exploreriexplore.exe
push 0x103
push edi
call fcn.00404830
add esp, 0x10
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439cf8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x424]
push eax
push edi
push ecx
push 0x6390a0
push 0x64ab86
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439cf8
mov word [ebp - 0x218], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00401a6c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x41c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x439d1a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push esi
call fcn.00439c41
add esp, 4
mov al, byte [esi + 0xb]
test al, al
js 0x439d4b
test al, al
jne 0x439d54
xor esi, esi
jmp 0x439e0e
cmp dword [ebp - 0x18], 0
je 0x439d7e
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439d7e
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x40]
mov ecx, edi
push 0
call fcn.0046b060
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x439d82
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x439d85
xor esi, esi
jmp 0x439dfd
lea edx, [ebp - 0x1c]
lea esi, [ebp - 0x4c]
mov ecx, esi
push eax
push edx
call fcn.0046ed80
mov ecx, edi
push esi
call fcn.0046b130
mov ecx, esi
call fcn.0046ee40
mov ecx, esi
push ebx
call fcn.00401a6c
mov ecx, edi
push esi
call fcn.0046c750
cmp byte [esi + 0xb], 0
jns 0x439dc1
push dword [ebp - 0x4c]
call fcn.00517bd6
add esp, 4
lea ecx, [ebp - 0x40]
push esi
call fcn.0046cdd0
cmp byte [ebp - 0x41], 0
jns 0x439dd3
mov esi, dword [ebp - 0x4c]
xor eax, eax
push eax
push eax
push 1
push esi
call fcn.00437c6d
add esp, 0x10
mov esi, eax
cmp byte [ebp - 0x41], 0
jns 0x439df5
push dword [ebp - 0x4c]
call fcn.00517bd6
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.0046b550
cmp byte [ebp - 0x11], 0
jns 0x439e0e
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439e22
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x38], eax
lea esi, [esp + 0x2c]
push esi
call fcn.00439c41
add esp, 4
cmp byte [esi + 0xb], 0
js 0x439e53
jne 0x439e5e
jmp 0x439e7d
cmp dword [esp + 0x30], 0
je 0x439e7d
mov esi, dword [esp + 0x2c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439e7d
cmp byte [esp + 0x37], 0
jns 0x439f1e
mov esi, dword [esp + 0x2c]
jmp 0x439f22
xor esi, esi
lea eax, [esp + 0x28]
mov dword [eax], esi
push eax
push 0x689eb4
push 0x15
push esi
push 0x689ec4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x439f3d
mov eax, dword [esp + 0x28]
xor esi, esi
inc esi
test eax, eax
je 0x439f3d
lea ebx, [esp + 0x14]
mov dword [ebx], 0
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x94]
mov eax, dword [ebx]
test eax, eax
je 0x439edd
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
lea eax, [esp + 0x18]
mov word [eax], 0
mov ecx, esp
mov word [ecx], 8
mov dword [ecx + 8], edi
mov edx, dword [esp + 0x28]
mov ebx, dword [edx]
push eax
push eax
push eax
push eax
push ecx
push edx
call dword [ebx + 0xd0]
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x439f3d
lea esi, [esp + 0x2c]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xa
push 0
push edi
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor esi, esi
inc esi
cmp byte [esp + 0x37], 0
jns 0x439f50
push dword [esp + 0x2c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x439fa4
Capabilities:
Check if file exists
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439f65
Function at 0x43a459
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ecx], esi
mov dword [edx], esi
mov dword [edi], esi
mov dword [ebx], esi
lea eax, [ebp - 0x14]
mov dword [eax], 1
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x43a538
mov ebx, eax
lea edi, [eax + eax]
add edi, 4
test edi, edi
je 0x43a538
add ebx, 2
push edi
call fcn.00517c03
add esp, 4
xor esi, esi
push edi
mov edi, eax
push esi
push eax
call fcn.006030b0
add esp, 0xc
push edi
push ebx
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43a52f
xor esi, esi
lea eax, [ebp - 0x18]
mov dword [eax], esi
lea ecx, [ebp - 0x1c]
mov dword [ecx], esi
push eax
push ecx
push 0x6391f0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43a52f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43a52f
cmp dword [ebp - 0x18], ebx
jae 0x43a52f
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, ecx
shr edx, 0x10
mov esi, dword [ebp + 0x10]
mov dword [esi], edx
mov edx, 0xffff
and ecx, edx
mov esi, dword [ebp + 0x14]
mov dword [esi], ecx
mov ecx, eax
shr ecx, 0x10
mov esi, dword [ebp + 0x18]
mov dword [esi], ecx
and eax, edx
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
xor esi, esi
inc esi
push edi
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a54c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x43a570
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea esi, [ebp - 0x1c]
mov ecx, esi
push edx
push eax
call fcn.0046ed80
xor ebx, ebx
lea edi, [ebp - 0x28]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, esi
push edi
call fcn.0046f0c0
mov eax, dword [edi]
cmp dword [edi + 4], eax
je 0x43a5ad
cmp byte [eax + 0xb], 0
jns 0x43a5a0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
setne bl
lea ecx, [ebp - 0x28]
call fcn.00403fbe
lea ecx, [ebp - 0x1c]
call fcn.0046ee40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c1ce
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x43c202
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.0043c20a
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43c1fb
mov dword [esi], ebx
call fcn.00472f20
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x43c254
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x44
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x6f4e3c]
xor edx, ebp
mov dword [ebp - 0xc], edx
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
xor ebx, ebx
mov dword [ebp - 0x10], ebx
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x3c], str.runas
cmp byte [ecx + 0xb], 0
jns 0x43c29e
mov ecx, dword [ecx]
mov dword [ebp - 0x38], ecx
cmp byte [eax + 0xb], 0
jns 0x43c2a9
mov eax, dword [eax]
lea ecx, [ebp - 0x48]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x1c], ebx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x43c2f0
mov esi, dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x4c]
mov dword [eax], 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x43c2eb
test eax, eax
je 0x43c2eb
mov ecx, dword [ebp - 0x4c]
mov dword [esi], ecx
test eax, eax
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x44
pop esi
pop ebx
pop ebp
ret