joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0d70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x218]
mov esi, dword [esp + 0x214]
lea ecx, [esp + 8]
dec edx
push ecx
push str._s360seWebCacheImages_
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043fa40
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4e0de0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push esi
push eax
call fcn.004e06a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e0e02
pop esi
add esp, 0x208
ret
cmp word [esi], 0
je 0x4e0e5e
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1a
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x21c]
lea edx, [esp + 8]
push esi
mov esi, dword [esp + 0x21c]
push edx
dec eax
push str._s360seWebCache_s.html
push eax
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043fa40
add esp, 0x18
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0x4e16d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x4e1709
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x50], 1
test ecx, ecx
je 0x4e1709
push 2
call fcn.00416f80
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x58]
push 0
push 0
push 1
call fcn.00416cb0
pop esi
ret

Function at 0x4e8ed0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov edx, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x10], eax
push ecx
push edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
add ecx, 0x32
add eax, 0xa
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
add eax, 0x32
cmp ecx, ebx
mov dword [esp + 0x14], eax
je 0x4e8f83
call fcn.004941c0
test eax, eax
je 0x4e8f83
mov ecx, dword [esi + 0x38]
push ebp
push edi
call fcn.00494280
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
call fcn.00494280
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4e8f64
push 1
mov ebx, edi
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4e8f64
lea ebx, [edi + edi]
mov eax, dword [esp + 0x24]
push 0
mov ecx, dword [esi + 0x38]
push 0
push ebp
push edi
push 0
push ebx
lea edx, [esp + 0x28]
push 0
push edx
push eax
call fcn.004937d0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4fd500
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2f7c]
test eax, eax
jne 0x4fd65e
mov eax, dword [esi + 0x3f2c]
test eax, eax
jne 0x4fd65e
push edi
call fcn.004fda30
test eax, eax
jne 0x4fd5e0
test esi, esi
mov dword [esi + 0x2f68], 1
je 0x4fd543
lea eax, [esi + 0xef4]
jmp 0x4fd545
xor eax, eax
mov edx, dword [esi + 0x2f74]
lea edi, [esi + 0x2f74]
push eax
mov ecx, edi
call dword [edx + 0x4c]
push 5
push 0x56e1d0
push 0x56e1d0
push str.IMG_PROGRESS
push 0x56e1d0
mov ecx, edi
call fcn.004f2d00
mov eax, dword [esi + 0x12c]
mov ecx, dword [esi + 8]
push 1
push 0
push 0
push 2
push eax
push ecx
push str.ProgressBar
mov ecx, edi
call fcn.004ff4b0
push 0
push 0x64
push 0
mov ecx, edi
call fcn.004f2cb0
test edi, edi
je 0x4fd5c6
mov edx, dword [esi + 0x2f7c]
lea eax, [esi + 0x2f78]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x90]
pop edi
pop esi
ret
xor eax, eax
push eax
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x90]
pop edi
pop esi
ret
mov ecx, dword [esi + 8]
mov dword [esi + 0x2f68], 0
mov eax, dword [0x58e22c]
push 0
push eax
push 2
push ecx
push 0
push 0
push 0
push 0
push 0x44000001
push str.ProgressBar
push 0x56c844
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x640000
push 0
push 0x401
push eax
mov dword [esi + 0x3f2c], eax
call edi
mov edx, dword [esi + 0x3f2c]
push 0
push 0
push 0x409
push edx
call edi
mov eax, dword [esi + 0x3f2c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x90]
pop edi
pop esi
ret
Function at 0x50b2f0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52387b
push eax
mov eax, 0x1260
mov dword fs:[0], esp
call fcn.0051d7f0
push esi
mov esi, dword [esp + 0x1274]
push edi
push 0x56b020
mov edi, ecx
push esi
call fcn.0043fb20
add esp, 8
test eax, eax
je 0x50b452
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.0043fb60
add esp, 0x10
test eax, eax
je 0x50b3eb
lea ecx, [esp + 0x220]
push 0x5586c0
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x50b3a2
lea edx, [esp + 0x220]
push 0x824
push edx
push 1
push esi
call fcn.0043fb60
add esp, 0x10
cmp word [esp + 0x220], 0
jne 0x50b3a2
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.0043fb60
add esp, 0x10
lea ecx, [esp + 0x220]
push ecx
push 0x53a4a4
push 0x824
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [edi + 0x1046], 0
push edi
call fcn.004bf470
mov ecx, dword [esp + 0x126c]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x126c
ret 4
lea ecx, [esp + 8]
call fcn.004ada10
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1278], 0
call fcn.004adae0
mov esi, eax
test esi, esi
je 0x50b439
push esi
lea ecx, [esp + 0xc]
call fcn.004adbe0
test eax, eax
je 0x50b42f
push 0x824
push edi
push esi
lea ecx, [esp + 0x14]
call fcn.004adc20
push esi
lea ecx, [esp + 0xc]
call fcn.004adb50
lea ecx, [esp + 8]
mov dword [esp + 0x1270], 0xffffffff
call fcn.004ada60
jmp 0x50b3c7
push 0x53cc98
push esi
call fcn.0043fb20
add esp, 8
test eax, eax
push esi
je 0x50b3aa
push 0x824
push edi
push 0x56e1d0
push 0x5624bc
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x50b3c7
Function at 0x518060
Capabilities:
Check if file exists
Create thread
Get common file path
Read .ini file

Disassembly:
sub esp, 0x61c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [esp + 0x14]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x422]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov word [esp + 0x420], bx
push str.360seie6_mode
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x424]
push ecx
push edx
stosw word es:[edi], ax
call esi
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x518103
lea ecx, [esp + 0x10]
push str.360se360seie6.ini
lea edx, [esp + 0x21c]
push ecx
push edx
jmp 0x518115
lea eax, [esp + 0x10]
push str.360se360se.ini
lea ecx, [esp + 0x21c]
push eax
push ecx
call esi
lea edx, [esp + 0x218]
push edx
push ebx
push str.NotJoinPrivate
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x518188
push 0x1048
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x518188
push 0x823
xor ecx, ecx
mov eax, 0x824
push edi
call fcn.00517f80
add esp, 8
test eax, eax
je 0x518188
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
push ebx
push edi
push 0x517dc0
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
je 0x518188
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebx
add esp, 0x61c
ret

Function at 0x5182e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc8
push esi
mov esi, ecx
push edi
push esi
push 0
push str.IeBC
push str.func
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, eax
cmp edx, 9
jae 0x518305
inc edx
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x53ad34
lea eax, [esp + 0x10]
push 0x63
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 8]
push esi
push ecx
push str.IeBC
push str.func
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
add esp, 0xc8
ret

Function at 0x518390
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc8
push esi
mov esi, ecx
push edi
push esi
push 0
push str.innerpage
push str.func
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, eax
cmp edx, 5
jae 0x5183b5
inc edx
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x53ad34
lea eax, [esp + 0x10]
push 0x63
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 8]
push esi
push ecx
push str.innerpage
push str.func
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
add esp, 0xc8
ret
Function at 0x5186a0
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
sub esp, 0x20
xor eax, eax
push esi
mov esi, ecx
cmp dword [esp + 0x34], eax
je 0x51887c
cmp dword [esp + 0x38], eax
je 0x51887c
push ebx
push ebp
push edi
xor ebx, ebx
xor ebp, ebp
xor edi, edi
cmp esi, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
je 0x5187e2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5187e0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.IeBC
push str.func
call edi
push esi
push ebp
push 0x56d050
push str.func
mov ebx, eax
call edi
push esi
push ebp
push str.iknow
push str.inner
call edi
push esi
push 0
push str.innerpage
push str.func
mov ebp, eax
call edi
push esi
push 0
push str.notip
push str.inner
mov dword [esp + 0x38], eax
call edi
push esi
push 0
push str.openietipcloseie8dlg
push str.openie
mov dword [esp + 0x3c], eax
call edi
push esi
push 0
push str.OpenIeUseIE8
push str.openie
mov dword [esp + 0x34], eax
call edi
push esi
push 0
push str.OpenIeUseIE6
push str.openie
mov dword [esp + 0x2c], eax
call edi
push esi
push 0
push 0x56d118
push str.updateie
mov dword [esp + 0x30], eax
call edi
push esi
push 0
push str.UpdateNow
push str.updateie
mov dword [esp + 0x28], eax
call edi
push esi
push 0
push str.NoTip
push str.updateie
mov dword [esp + 0x24], eax
call edi
push esi
push 0
push str.Close
push str.updateie
mov dword [esp + 0x20], eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
cmp edx, eax
jne 0x5187f9
cmp esi, eax
jne 0x5187f9
mov ecx, 1
jmp 0x518808
xor ecx, ecx
cmp edx, eax
je 0x518808
cmp esi, eax
jne 0x518808
mov eax, 1
mov esi, dword [esp + 0x3c]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x28]
push edi
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push ebp
push eax
push ecx
push 0
push ebx
call fcn.00518df0
push eax
call fcn.0049bb50
push eax
call fcn.004521e0
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x8c]
dec edx
push str.http:__seapp.stat.360safe.com_q.html_namezdie8sever_sappver0mid_sc_d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d_0_0_0
push edx
push eax
call fcn.0042dfe0
add esp, 0x58
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret 0x14
xor eax, eax
pop esi
add esp, 0x20
ret 0x14
Function at 0x518920
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x2dc
mov eax, 0x590c50
push ebx
push ebp
push esi
xor esi, esi
test eax, eax
push edi
je 0x518ac0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x518ac0
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x7e]
mov word [esp + 0x7c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xe2]
mov word [esp + 0xe0], si
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x14], esi
cmp eax, esi
jle 0x518ac0
mov ebp, dword [sym.imp.MSVCRT.dll_time]
mov esi, dword [sym.imp.MSVCRT.dll_gmtime]
xor ebx, ebx
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
sub eax, ebx
push edx
mov dword [esp + 0x18], eax
call esi
add esp, 8
test eax, eax
je 0x518a09
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
inc edx
push ecx
add eax, 0x76c
push edx
push eax
push str._d_02d_02d
lea ecx, [esp + 0x8c]
push 0x31
push ecx
call fcn.0042dfe0
add esp, 0x18
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
add eax, 0x15180
push edx
mov dword [esp + 0x14], eax
call esi
add esp, 4
test eax, eax
je 0x518a4a
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
inc edx
push ecx
add eax, 0x76c
push edx
push eax
push str._d_02d_02d
lea ecx, [esp + 0x28]
push 0x31
push ecx
call fcn.0042dfe0
add esp, 0x18
lea edx, [esp + 0x18]
lea eax, [esp + 0x7c]
push edx
push eax
push 0x590c50
push str._sHistory.IE5MSHist01_s_s
lea ecx, [esp + 0xf0]
push 0x104
push ecx
call fcn.0042e050
add esp, 0x18
lea edx, [esp + 0xe0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x518ab0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2f0]
inc eax
add ebx, 0x15180
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x5189a9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2dc
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2dc
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x518e90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1054
call fcn.0051d7f0
lea eax, [esp]
push esi
push eax
xor esi, esi
push str.SoftwareIEStub
push SysReAllocStringLen
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x518f9e
push ebx
push ebp
push edi
mov ecx, 0x411
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], si
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
stosw word es:[edi], ax
mov eax, dword [esp + 0x14]
push edx
push esi
push eax
mov dword [esp + 0x24], 0x823
mov ebx, 1
call ebp
test eax, eax
jne 0x518f77
mov esi, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 6
lea ecx, [esp + 0x20]
push str.8CLSID
push ecx
call esi
add esp, 0xc
test eax, eax
je 0x518f45
push 0x12
lea edx, [esp + 0x20]
push str.8Internet_Explorer
push edx
call esi
add esp, 0xc
test eax, eax
je 0x518f45
push 0x12
lea eax, [esp + 0x20]
push str.8Internet_Settings
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x518f49
inc dword [esp + 0x18]
mov ecx, 0x412
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov eax, ebx
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x24], 0x823
inc ebx
call ebp
test eax, eax
je 0x518f06
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop edi
pop ebp
cmp eax, 3
pop ebx
jne 0x518f9e
push str.SoftwareIEStub
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop esi
add esp, 0x1054
ret
Function at 0x51a400
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x218
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
push str.ie8ver.dll
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x1c]
push eax
push 0x53c0b0
push 0x104
push ecx
mov dword [esp + 0x24], esi
call fcn.0042dfe0
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51a547
lea eax, [esp + 0x18]
push eax
call fcn.004ae180
add esp, 4
test eax, eax
je 0x51a547
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
mov dword [esp + 0xc], edi
je 0x51a547
push ebp
push 0x56dafc
push str.IE8VER.INI
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
cmp ebp, esi
je 0x51a52f
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push ebp
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test esi, esi
mov ebp, eax
je 0x51a52f
test ebp, ebp
je 0x51a52f
lea esi, [ebp + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebx], edi
je 0x51a52b
mov ecx, esi
xor eax, eax
mov edx, ecx
mov esi, dword [esp + 0x18]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x1f21bc
and ecx, 3
push ebp
rep stosb byte es:[edi], al
mov edi, dword [ebx]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
call fcn.0041e550
mov edx, dword [ebx]
lea esi, [ebx + 4]
push edx
push esi
call fcn.00495d60
mov eax, dword [esi]
add esp, 0x14
test eax, eax
je 0x51a52b
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x218
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x218
ret 4
Function at 0x51a560
Capabilities:
Get file size

Disassembly:
sub esp, 0x624
xor eax, eax
push ebx
mov ebx, ecx
push ebp
push esi
mov ecx, dword [ebx + 4]
push edi
test ecx, ecx
je 0x51a6f2
mov ebp, dword [esp + 0x63c]
mov ecx, 0x82
lea edi, [esp + 0x12]
mov word [esp + 0x10], ax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x638]
push ebp
push eax
push 0x53c0b0
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.0042dfe0
add esp, 0x14
lea edx, [esp + 0x10]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x51a6f0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x51a6f0
cmp edi, 0xffffffff
je 0x51a6f0
mov eax, dword [ebx + 4]
push 0
push 0x539b44
push ebp
push eax
call fcn.00496dd0
add esp, 0x10
cmp edi, eax
jne 0x51a6f0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x42a]
mov word [esp + 0x428], 0
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], ax
push 0x104
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x644]
test eax, eax
je 0x51a68c
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x220]
push ecx
push str.head
push ebp
push edx
call fcn.00496be0
add esp, 0x14
lea eax, [esp + 0x428]
lea ecx, [esp + 0x10]
push 0x104
push eax
push ecx
mov ecx, ebx
call fcn.0051a2a0
jmp 0x51a6bf
mov eax, dword [ebx + 4]
lea edx, [esp + 0x220]
push edx
push 0x56db1c
push ebp
push eax
call fcn.00496be0
add esp, 0x14
lea ecx, [esp + 0x428]
lea edx, [esp + 0x10]
push 0x104
push ecx
push edx
mov ecx, ebx
call fcn.0051a140
lea eax, [esp + 0x21c]
push 0x104
lea ecx, [esp + 0x42c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x51a6f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x624
ret 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x624
ret 0xc
Function at 0x404d00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0xffffffffffffffff
push 0
call fcn.005c6b24
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404d30
push 0x20019
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00404e40
add esp, 0xc
mov ebp, eax
jmp 0x404d34
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x404e2e
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 0
push edx
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404e1f
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x404d7a
cmp eax, 2
je 0x404d7a
cmp eax, 6
je 0x404d7a
cmp eax, 7
jne 0x404e1f
mov eax, dword [esp + 0x18]
add eax, 2
push eax
call fcn.005c8d38
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ebx
push 0
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404e16
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x404df4
test eax, eax
mov esi, ebx
jbe 0x404df4
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [ecx + 8]
push edx
call fcn.005c6d3a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, dword [esp + 0x18]
mov eax, esi
sub eax, ebx
cmp eax, ecx
jb 0x404dca
cmp ebp, dword [esp + 0x14]
je 0x404e03
push ebp
call fcn.00404e70
add esp, 4
push ebx
call fcn.005c8d61
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push ebx
call fcn.005c8d61
add esp, 4
cmp ebp, dword [esp + 0x14]
je 0x404e2e
push ebp
call fcn.00404e70
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret