joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
lea eax, [ebp - 0x208]
mov esi, ecx
push 0
push eax
call fcn.004069c0
add esp, 0xc
test esi, esi
je 0x401de6
cmp word [esi], 0
je 0x401de6
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x401e10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x401e10
push 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x401e79
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push str.guid
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.kernel32
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ebe
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401eb8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x401f2a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x220], 0
je 0x401f2a
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401f2a
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push str.guid
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404aff
mov esp, ebp
pop ebp
ret

Function at 0x402160
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4021c7
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 1
xorps xmm0, xmm0
push str.D:_A_OICI_GWGRSDDTDC___BU__A_OICI_GWGRSDDTDC___AU__A_OICI_GA___BA__A_OICI_GA___SY_
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x4021af
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], eax
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4021c7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4021e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40223e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 8
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.AutoSendDate
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x402246
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4022a8
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push esi
push str.AutoSendDate
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x4022c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40231b
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40231b
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40236e
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4023e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32
mov esi, ecx
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov edi, 0x20006
mov dword [ebp - 0x94], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402450
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x402450
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40245f
cmp dword [ebp - 0x94], 0
mov eax, 0x20206
cmovne edi, eax
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.004069c0
add esp, 0xc
lea eax, [ebp - 0x90]
push 0
push eax
push 0
push edi
push 0
push 0
push 0
push str.SoftwareCanonIJPLMInstalledDevice
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402536
sub esi, 1
je 0x4024d8
sub esi, 1
je 0x4024c1
sub esi, 2
jne 0x4024e2
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], esi
call fcn.00402380
jmp 0x4024e2
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], 1
call fcn.00402380
jmp 0x4024e2
mov dword [ebp - 0x8c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
lea eax, [ebp - 0x88]
push eax
push 1
push 0
push str.NEW_DATE
push dword [ebp - 0x90]
call esi
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push 0
push str.NEW_SEND_INFO_AGREE
push dword [ebp - 0x90]
call esi
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404aff
mov esp, ebp
pop ebp
ret
Function at 0x402ef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402f48
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.AutoSend
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402f90
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push 0
push str.AutoSendDate
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402fa0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
mov dword [ebp - 0x14], ecx
xor esi, esi
mov dword [ebp - 0x10], str.GlobalCANON_IJPLMUI
mov dword [ebp - 0xc], str.GlobalAPP_78D84DC5_5F4F_4B57_8540_D4D89617ADA8
mov dword [ebp - 8], str.GlobalCANON_IJPLMAGR
push dword [ebp + esi*4 - 0x10]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x403010
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403010
push edi
call ebx
inc esi
cmp esi, 3
jb 0x402fd3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404aff
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x402ffd
mov esi, dword [ebp + esi*4 - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x400
jge 0x402ffd
push 0x400
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404aff
mov esp, ebp
pop ebp
ret
Function at 0x4058dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.004055ec
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x405915
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405627
aas
add byte [ecx - 0x73], cl
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0xb16b40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xb16b63
mov eax, 1
jmp 0xb16c6e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0xb16b79
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0xb16b83
mov eax, 2
jmp 0xb16c6e
mov edx, dword [ebp + 0x10]
push edx
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xb16bae
mov eax, 1
jmp 0xb16c6e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0xb16bd4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0xb16bd4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0xb16bde
mov eax, 2
jmp 0xb16c6e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call 0xb27520
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0xb16c1f
mov eax, 3
jmp 0xb16c6e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xb16c6c
mov eax, 1
jmp 0xb16c6e
xor eax, eax
pop ebp
ret

Function at 0xb17600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0xb17616
xor eax, eax
jmp 0xb17656
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0xb1763b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0xb1763f
xor eax, eax
jmp 0xb17656
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00b17660
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0xd529d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xd52a00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0xd52a13
xor eax, eax
jmp 0xd52ad1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0xd52a2e
xor eax, eax
jmp 0xd52ad1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0xd52a4c
xor eax, eax
jmp 0xd52ad1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0xd52a8e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0xd52acf
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00d51d40
add esp, 8
test eax, eax
jne 0xd52acd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0xd52ad1
jmp 0xd52a85
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4016a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x43012c
mov esi, eax
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x401759
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push str._sminidownload.exe
mov edi, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0041163b
add esp, 0x10
push 0
push 0x20
push 2
push 0
push 7
push 0xc0000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401759
mov eax, dword [ebp - 0x214]
push 0
lea edx, [ebp - 0x218]
push edx
push eax
push edi
push esi
mov dword [ebp - 0x218], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x40176b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114b6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
call fcn.004033c0
test eax, eax
je 0x401759
push 3
call fcn.004017a0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
pop esi
call fcn.004114b6
mov esp, ebp
pop ebp
ret
Function at 0x401d70
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00411a80
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x230]
push ecx
push str.DownLoadDlgPath
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x22c], 0x208
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401e82
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x234]
push ecx
push str.InstallPath
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x228], 0x208
call esi
test eax, eax
je 0x401e59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea edx, [ebp - 0x210]
push edx
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouDownLoad
lea eax, [ebp - 0x210]
push eax
push str._s_s
mov ecx, eax
push 0x208
push ecx
call fcn.0041163b
add esp, 0x14
lea edx, [ebp - 0x210]
push edx
push str._sDownLoadDlg.exe
mov eax, edx
push 0x104
push eax
call fcn.0041163b
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call ebx
test eax, eax
je 0x401ef0
lea edx, [ebp - 0x210]
push edx
call ebx
test eax, eax
je 0x401ef0
push 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xd1871d0a
mov dword [ebp - 0x21c], 0x4a3c4929
mov dword [ebp - 0x218], 0x4268e5aa
mov dword [ebp - 0x214], 0x4422e635
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [ebp - 0x224]
push edx
push 0x42d34c
push 0
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ole32.dll_CoGetClassObject]
test eax, eax
jns 0x401f02
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114b6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004114b6
mov esp, ebp
pop ebp
ret
Function at 0x402ec0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x630
mov eax, dword [0x435080]
xor eax, esp
mov dword [esp + 0x62c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x428]
push eax
push 0x104
call esi
call fcn.00401d70
test eax, eax
je 0x402f72
push 2
call fcn.004017a0
add esp, 4
lea ecx, [esp + 0x210]
xor eax, eax
push ecx
push 0x104
mov dword [esp + 0x420], 0x431074
mov dword [esp + 0x424], eax
mov dword [esp + 0x428], eax
call esi
push 0x104
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x430dac
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea esi, [esp + 8]
call fcn.0040fc30
test eax, eax
je 0x402f7e
mov ebx, esi
call fcn.0040fcc0
jmp 0x402f7e
lea ebx, [esp + 0x428]
call fcn.004016a0
mov ecx, dword [esp + 0x634]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004114b6
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402fa0
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1288
call fcn.00418640
mov eax, dword [0x435080]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x1280]
push ecx
push esi
lea edx, [ebp - 0x1284]
push edx
push str.Version
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x1280], eax
call edi
test eax, eax
je 0x4030ec
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x212]
push ecx
mov word [ebp - 0x214], ax
call fcn.00411a80
add esp, 0xc
lea edx, [ebp - 0x1280]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x1284]
push ecx
push str.InstallPath
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x1280], 0x104
call edi
test eax, eax
je 0x40307f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea edx, [ebp - 0x214]
push edx
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouDownLoad
lea eax, [ebp - 0x214]
push eax
push str._s_s
mov ecx, eax
push 0x104
push ecx
call fcn.0041163b
add esp, 0x14
push str.DlgHandler.dll
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403100
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x127c]
push edx
call fcn.004065f0
test esi, esi
je 0x403100
movzx eax, word [ebp - 0x1266]
movzx ecx, word [ebp - 0x1268]
movzx edx, word [ebp - 0x126a]
push eax
movzx eax, word [ebp - 0x126c]
push ecx
push edx
push eax
push str._d._d._d._d
push 0x104
push esi
call fcn.0041163b
add esp, 0x1c
mov eax, 1
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004114b6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004114b6
mov esp, ebp
pop ebp
ret