joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419260
Capabilities:
Get common file path

Disassembly:
push ecx
xor eax, eax
mov dword [esp], 0
cmp ax, word [0x4c3a98]
jne 0x41929c
push 0x4c3a98
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0x5c
cmp cx, word [eax*2 + 0x4c3a96]
je 0x41929c
mov edx, ecx
mov word [eax*2 + 0x4c3a98], dx
push esi
mov esi, dword [esp + 0xc]
push 0x4c3a98
mov ecx, esi
call fcn.004190e0
mov eax, esi
pop esi
pop ecx
ret

Function at 0x419340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, dword [esp + 0x220]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0x10], 0
push ecx
mov word [esp + 0x1c], ax
call fcn.00454ce0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4193e2
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x4a233c
push eax
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004190e0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00454cc7
add esp, 0x218
ret

Function at 0x419410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov edi, dword [esp + 0x220]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0x14], 0
push ecx
mov word [esp + 0x1c], ax
call fcn.00454ce0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x208
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4194e7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x4a23c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4194c0
sub eax, edx
sar eax, 1
mov dword [esp + 8], eax
lea eax, [esp + eax*2 + 0x10]
mov edx, 0x5c
cmp dx, word [eax - 2]
je 0x4194e7
mov ecx, edx
mov word [eax], cx
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004190e0
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00454cc7
add esp, 0x218
ret
Function at 0x41b1c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49c3c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x4c1bd8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x14], ebx
cmp ax, word [0x4c3ea8]
jne 0x41b32c
mov esi, dword [esp + 0x2c]
push 0x104
push 0x4c3ea8
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x4c3ea8
call fcn.004541d4
add esp, 8
test eax, eax
je 0x41b228
xor ecx, ecx
mov word [eax + 2], cx
push str.360sd.exe
lea ecx, [esp + 0x14]
call fcn.004190e0
mov dword [esp + 0x20], 0
test esi, esi
jne 0x41b26d
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push 0x4c3ea8
push eax
call fcn.00416a30
mov eax, dword [eax]
add esp, 0xc
push eax
lea ebx, [esi + 1]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [esp + 0xf], bl
test eax, eax
je 0x41b272
mov byte [esp + 0xf], 0
test bl, 1
je 0x41b297
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b297
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0xf], 0
je 0x41b304
lea ecx, [esp + 0x14]
push ecx
call fcn.00419410
add esp, 4
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0040e240
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b2df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x41b304
cmp eax, 0x104
jge 0x41b304
push 0x103
push ecx
push 0x4c3ea8
call fcn.00455578
add esp, 0xc
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b32c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x28]
push 0x4c3ea8
mov ecx, esi
call fcn.004190e0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x421810
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor ebp, ebp
push ebp
push ebx
mov dword [esp + 0x14], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x421836
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push edi
push esi
call fcn.00455759
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x421850
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42189e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4a0e7c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42189e
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0xa]
mov ecx, dword [esp + 0x20]
mov dword [ecx], edx
movzx edx, word [eax + 8]
mov dword [ecx + 4], edx
movzx edx, word [eax + 0xe]
mov dword [ecx + 8], edx
movzx eax, word [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ebp, 1
push edi
call fcn.00455602
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4218c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, dword [esp + 0x23c]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x421930
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x421929
push 0x104
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.0045600f
add esp, 0xc
test eax, eax
je 0x421949
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x421903
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00454cc7
add esp, 0x230
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.00454cc7
add esp, 0x230
ret

Function at 0x421970
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.004218c0
add esp, 4
test eax, eax
je 0x4219a4
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4219a3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x421c80
Capabilities:
Get file version info

Disassembly:
sub esp, 0xd8
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
mov ebx, dword [esp + 0xe0]
push ebp
mov ebp, dword [esp + 0xe8]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x421ccd
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.00454cc7
add esp, 0xd8
ret
push esi
push edi
call fcn.00455759
mov esi, eax
add esp, 4
test esi, esi
je 0x421db6
push edi
push 0
push esi
call fcn.00454ce0
add esp, 0xc
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x421d89
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x421dad
mov eax, dword [esp + 0x14]
movzx edi, word [eax]
movzx ebx, word [eax + 2]
xor edx, edx
push 0xc6
push edx
lea eax, [esp + 0x26]
push eax
mov word [esp + 0x28], dx
call fcn.00454ce0
movzx ecx, bx
push ecx
movzx edx, di
push edx
lea eax, [esp + 0x30]
push str.StringFileInfo_04x_04xSpecialBuild
push eax
mov dword [esp + 0x2c], 0
call fcn.00421760
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x421dad
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00454efb
add esp, 4
mov dword [ebp], eax
push esi
call fcn.00455602
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xe4]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454cc7
add esp, 0xd8
ret
push esi
call fcn.00455602
add esp, 4
xor al, al
jmp 0x421d94

Function at 0x422080
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ce10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c1bd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1_
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0
push 0x84000000
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push 0
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
push 0x400
mov edi, eax
call fcn.00453a9c
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
push 0x400
mov esi, eax
push esi
push edi
mov dword [ebp - 0x14], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push ebx
call edi
test esi, esi
je 0x42211f
push esi
call fcn.004559f4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422560
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x490
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x48c], eax
push esi
mov esi, dword [esp + 0x498]
push edi
mov edi, dword [esp + 0x4a8]
xor eax, eax
push 0x436
push eax
lea ecx, [esp + 0x66]
push ecx
mov word [esp + 0x68], ax
call fcn.00454ce0
add esp, 0xc
test esi, esi
je 0x4226b4
cmp word [esi], 0
je 0x4226b4
push esi
push 0x4a16a0
lea edx, [esp + 0x64]
push 0x438
push edx
call fcn.0040d340
mov esi, dword [esp + 0x4b0]
add esp, 0x10
test esi, esi
je 0x4225fd
cmp word [esi], 0
je 0x4225fd
push 0x4a37b8
push 0x438
lea eax, [esp + 0x64]
push eax
call fcn.00413900
push esi
push 0x438
lea ecx, [esp + 0x64]
push ecx
call fcn.00413900
push 0x40
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00454ce0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
xor eax, eax
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
push 0
mov eax, 5
mov word [esp + 0x64], ax
push 0
lea eax, [esp + 0x7c]
push eax
push 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4226b4
cmp dword [esp + 0x4a4], 0
je 0x422674
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x422684
mov edx, dword [esp + 8]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.00454cc7
add esp, 0x490
ret
mov ecx, dword [esp + 0x494]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00454cc7
add esp, 0x490
ret
Function at 0x4226d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
mov eax, ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x422700
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
mov eax, 0xb
cmp dword [esp + 0x3c], esi
je 0x422723
mov eax, 0x10b
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x422892
push edi
push esi
push esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x28]
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp dword [esp + 0x10], esi
jbe 0x422841
mov eax, dword [esp + 0x18]
xor ecx, ecx
add eax, 0xa
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00453a9c
add esp, 4
mov ebp, eax
mov dword [esp + 0x20], esi
cmp dword [esp + 0x10], esi
jbe 0x422832
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebp
push 0
inc eax
push edx
mov dword [esp + 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x42281f
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx + 2]
xor ecx, ecx
lea eax, [edi + 0xa]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00453a9c
mov esi, eax
mov eax, dword [esp + 0x40]
push ebp
push eax
push 0x4a1680
push edi
push esi
call fcn.004139a0
mov ecx, dword [esp + 0x58]
push ecx
push esi
push ebx
call fcn.004226d0
push esi
mov edi, eax
call fcn.00453aa7
add esp, 0x28
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x10]
jb 0x4227a5
push ebp
call fcn.00453aa7
mov ebp, dword [esp + 0x40]
add esp, 4
xor esi, esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], esi
je 0x42287f
push str.RegDeleteKeyExW
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x42288f
push esi
push 0x100
push ebp
push ebx
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4229a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x620
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x630]
mov dword [esp + 0xc], ebx
lea esi, [ebx + 2]
cmp dword [esp + 0x634], ebx
je 0x4229d5
mov esi, 0x102
push 0x208
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.00454ce0
push 0x208
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.00454ce0
add esp, 0x18
push edi
push 0x208
lea edx, [esp + 0x18]
push edx
call fcn.0040d2b0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x422a36
push eax
push 0x208
lea ecx, [esp + 0x220]
push ecx
call fcn.0040d2b0
push 0x208
lea edx, [esp + 0x424]
push 0
push edx
call fcn.00454ce0
lea eax, [esp + 0x224]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push 0x4a1680
lea ecx, [esp + 0x438]
push 0x208
push ecx
call fcn.0040d340
add esp, 0x20
push 0
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x43c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [esp + 0xc]
test eax, eax
je 0x422aa0
test esi, esi
je 0x422b15
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422aa7
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x14]
push edx
push 1
push 0
push 0x4a1228
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
test eax, eax
jne 0x422ad9
lea ebx, [eax + 1]
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422ae0
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x4b6cbc
push ecx
call esi
test eax, eax
jne 0x422b0a
inc ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x628]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00454cc7
add esp, 0x620
ret
Function at 0x422b30
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x1a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x20], ax
call fcn.00454ce0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 1
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422bce
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
push 0x4b6cbc
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422bbb
lea esi, [edi + 1]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], edi
cmp esi, edi
jne 0x422c1d
push 0x206
lea eax, [esp + 0x222]
xor edx, edx
push edi
push eax
mov word [esp + 0x228], dx
call fcn.00454ce0
add esp, 0xc
lea ecx, [esp + 0x21c]
push ecx
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x422c4b
push str.iexplore.exe
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [esp + 0x42c]
push edi
push edi
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00422560
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00454cc7
add esp, 0x420
ret
mov ecx, dword [esp + 0x424]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00454cc7
add esp, 0x420
ret
Function at 0x423250
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x24
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
mov ebx, ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x38]
mov ebp, eax
lea eax, [ecx - 0x42]
cmp ax, 0x18
ja 0x423289
movzx edi, cx
sub edi, 0x41
jmp 0x42329c
lea edx, [ecx - 0x62]
cmp dx, 0x18
ja 0x4233c4
movzx edi, cx
sub edi, 0x61
lea eax, [edi + edi*2]
lea esi, [ebx + eax*8]
xor eax, eax
cmp dword [esi + 0x4e8], eax
je 0x4232c0
mov edx, ebp
sub edx, dword [esi + 0x4ec]
cmp edx, 0x1d4c0
jb 0x42338f
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, 0x3a
mov word [esp + 0x1e], ax
mov word [esp + 0x1c], cx
lea eax, [esp + 0x1c]
mov ecx, 0x5c
xor edx, edx
push eax
mov word [esp + 0x24], cx
mov word [esp + 0x26], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x423325
lea eax, [edi + edi*2 + 0x9f]
mov dword [ebx + eax*8], 0xffffffff
mov dword [ebx + eax*8 + 4], 0xffffffff
jmp 0x423375
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
lea eax, [edi + edi*2 + 0x9f]
je 0x423355
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + eax*8], ecx
mov dword [ebx + eax*8 + 4], edx
jmp 0x423375
inc dword [esi + 0x4f0]
mov ecx, dword [esi + 0x4f0]
mov dword [ebx + eax*8], 0xffffffff
mov dword [ebx + eax*8 + 4], 0xffffffff
cmp ecx, 3
jb 0x42338f
mov dword [esi + 0x4e8], 1
mov dword [esi + 0x4f0], 0
mov dword [esi + 0x4ec], ebp
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4233aa
lea edi, [edi + edi*2 + 0x9f]
mov ecx, dword [ebx + edi*8]
mov dword [eax], ecx
mov edx, dword [ebx + edi*8 + 4]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00454cc7
add esp, 0x24
ret 8
test esi, esi
je 0x4233d5
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00454cc7
add esp, 0x24
ret 8

Function at 0x423610
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423686
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x423655
cmp eax, 2
jne 0x423671
mov eax, dword [esp + 0x14]
test esi, esi
je 0x423680
test eax, eax
je 0x42367b
test al, 1
jne 0x423671
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x423680
pop edi
mov eax, 0xd
pop esi
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x426db7
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub eax, 1
push esi
mov esi, ecx
je 0x426dcc
sub eax, 1
jne 0x426e09
call fcn.00426a10
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0x3d8]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x3fa
mov ecx, esi
call fcn.00425020
push 0
push 0
push 0
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x426e09
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x10