joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x42c732
cmp edi, 0x20
jb 0x42c732
push 0x400
lea eax, [ebp - 0x508]
push 0
push eax
mov dword [ebp - 0x510], 1
mov dword [ebp - 0x50c], 0x400
call fcn.0049d850
add esp, 0xc
lea ecx, [ebp - 0x50c]
push ecx
lea edx, [ebp - 0x508]
push edx
lea eax, [ebp - 0x510]
push eax
push 0x5988c0
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x42c732
lea eax, [ebp - 0x508]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42c680
sub eax, edx
cmp eax, 0x40
jne 0x42c732
push 0x20
lea ecx, [ebp - 0x508]
push ecx
mov eax, 0x80
lea ecx, [ebp - 0x88]
call fcn.0042b770
push 0x7ffffffe
lea edx, [ebp - 0x4e8]
push edx
mov eax, 0x80
lea ecx, [ebp - 0x108]
call fcn.0042b770
push 0x400
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.0049d850
add esp, 0xc
lea ecx, [ebp - 0x508]
push 0x400
push ecx
lea ecx, [ebp - 0x88]
call fcn.0042b7d0
add esp, 8
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42c732
lea ecx, [ebp - 0x88]
push ecx
mov edx, edi
mov ecx, esi
call fcn.0042b5a0
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d4b1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0049d4b1
mov esp, ebp
pop ebp
ret

Function at 0x42cf40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret

Function at 0x42d2e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov ecx, dword [eax]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], ecx
push eax
lea ecx, [ebp - 0x5c]
push ecx
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x60], edx
call fcn.0042cf70
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x6c]
push eax
call fcn.0042d070
lea ecx, [ebp - 0x6c]
push ecx
push esi
call fcn.0042d180
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049d4b1
mov esp, ebp
pop ebp
ret
Function at 0x42e148
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x42e1ad
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x42e1a4
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret

Function at 0x42e1bd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
je 0x42e226
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x42e226
cmp dword [ebp - 0x11c], 6
jae 0x42e226
xor eax, eax
inc eax
jmp 0x42e23b
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42e221
call fcn.0042e148
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049d4b1
leave
ret

Function at 0x42e55b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x24], eax
call fcn.00433248
movzx eax, al
pop ecx
neg eax
sbb eax, eax
push 1
add eax, 0x80000002
push edi
push eax
lea ecx, [ebp - 0x2c]
xor bl, bl
call fcn.0040b5a0
cmp dword [ebp - 0x2c], 0
je 0x42e60a
push esi
lea ecx, [ebp - 0x20]
call fcn.004059e0
push str.new_360chrome.exe
lea ecx, [ebp - 0x20]
call fcn.00407d50
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x42e5c3
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e5e6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push 0x4c99f0
call fcn.0040b860
test eax, eax
jne 0x42e5e6
mov bl, 1
jmp 0x42e5fe
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push 0x4c9abc
call fcn.0040b860
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00405df0
lea ecx, [ebp - 0x2c]
call fcn.0040b750
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
Function at 0x42ec04
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0049d850
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], ebx
call fcn.00405a60
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0042e89c
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.00405ad0
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.00405df0
push str.User_Data_v3updateconfig_v3update.ini
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0042e728
mov eax, dword [ebp - 0x228]
add esp, 0xc
cmp dword [ebp - 0x214], 8
jae 0x42ece4
lea eax, [ebp - 0x228]
push eax
push ebx
mov edi, str.flag
push edi
mov esi, 0x4c86c0
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
je 0x42ed31
cmp eax, 2
je 0x42ed31
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x228]
call fcn.00405df0
push ebx
push 1
lea ecx, [ebp - 0x244]
call fcn.00405df0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x42ed46
lea eax, [ebp - 0x228]
push eax
push 0x4c86bc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor esi, esi
inc esi
jmp 0x42ed04
Function at 0x42ff5b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x42ff4d
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x4302e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x430262
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x4303be
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042fdb3
pop ecx
test al, al
jne 0x43048c
push esi
call fcn.00412170
mov esi, eax
mov eax, dword [esi]
push str.CHROME_RESTART
mov ecx, esi
call dword [eax + 8]
test al, al
je 0x430483
push ebx
push 1
xor ebx, ebx
push 0x4c8520
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x20], bl
call fcn.00402920
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push str.CHROME_CRASHED
mov ecx, esi
call dword [eax + 0xc]
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00402720
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x74], 0x44
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebx
test eax, eax
je 0x430483
push edi
push dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2c]
call edi
pop edi
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.0049d4b1
leave
ret
Function at 0x431719
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov edx, ecx
mov edi, eax
shrd edi, edx, 0x14
shr edx, 0x14
sub eax, dword [ebp - 0x50]
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
sbb ecx, dword [ebp - 0x4c]
mov ebx, eax
shrd ebx, ecx, 0x14
xor esi, esi
shr ecx, 0x14
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], esi
mov word [ebp - 0x20], ax
call fcn.00405a60
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x431794
lea eax, [ebp - 0x20]
push 0x20019
push eax
push 0x80000002
lea ecx, [ebp - 0x7c]
call fcn.0040b5a0
lea eax, [ebp - 0x74]
push eax
push str.PagingFiles
lea ecx, [ebp - 0x7c]
call fcn.0040b990
test eax, eax
jne 0x4317d3
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x74]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x4317d3
mov dword [ebp - 0x64], 1
push dword [ebp - 0x64]
push esi
push edi
push ebx
push esi
call fcn.0043b5d8
mov ecx, eax
call fcn.0042fefe
lea ecx, [ebp - 0x7c]
call fcn.0040b750
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.00405df0
lea ecx, [ebp - 0x74]
call fcn.00409240
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
Function at 0x432763
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x10]
add ecx, ecx
cmp dword [eax + 0x14], 8
jb 0x432776
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
jb 0x432781
mov edx, dword [edx]
push ecx
push eax
push 1
push 0
push edx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x4398fb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 4], 0
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x24], 0
pop edi
jne 0x439928
mov dword [ebp - 0x24], 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx - 1]
jmp 0x439939
mov dl, byte [eax]
add eax, dword [ebp - 0x24]
cmp eax, ecx
jb 0x439934
mov al, byte [ecx]
leave
ret

Function at 0x439941
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], edi
call fcn.004160c0
cmp eax, 1
jle 0x439a2a
push edi
push 0x8000000
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.0040af40
cmp dword [ebp - 4], edi
je 0x43998d
cmp dword [ebp - 4], 0xffffffff
jne 0x43999c
lea ecx, [ebp - 4]
call fcn.0040adc0
xor al, al
jmp 0x439a97
mov ecx, dword [ebp + 0x10]
mov eax, 0x100000
mov dword [ebp - 0x14], eax
cmp ecx, eax
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x14]
jb 0x4399b4
lea eax, [ebp - 8]
mov ebx, dword [eax]
push 4
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x43998d
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea ecx, [ebp - 0xc]
push ecx
push ebx
mov dword [ebp - 8], edi
push eax
jmp 0x439a08
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
jbe 0x439a11
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4399f5
cmp dword [ebp - 8], eax
sbb eax, eax
neg eax
jmp 0x4399f8
xor eax, eax
inc eax
cmp eax, edi
je 0x439a11
add dword [ebp - 8], ecx
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4399de
push 0x8000
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 4]
call fcn.0040adc0
jmp 0x439a95
push 9
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, edi
je 0x439995
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x5985d8
mov dword [ebp - 0xc], esi
call fcn.004263b0
test al, al
jne 0x439a5b
call fcn.00415ae0
lea ecx, [ebp - 0x10]
call fcn.00426090
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
cmp ecx, edi
je 0x439a75
mov dword [ebp - 8], ecx
jmp 0x439a79
or dword [ebp - 8], 0xffffffff
cmp eax, dword [ebp - 8]
lea eax, [ebp - 0x14]
jb 0x439a84
lea eax, [ebp - 8]
push dword [eax]
push esi
call fcn.004398fb
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b0b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43b11a
cmp dword [ebp + 0x10], 1
je 0x43b0f2
cmp dword [ebp + 0x10], 2
je 0x43b0f2
push 0xd
pop eax
jmp 0x43b11a
mov eax, dword [ebp - 4]
test edi, edi
je 0x43b114
test eax, eax
je 0x43b10f
test al, 1
jne 0x43b0ed
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x43b114
jmp 0x43b0ed
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x43b174
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
mov edi, 0x823
push edi
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x827]
push 0
push eax
mov byte [ebp - 0x828], 0
call fcn.0049d850
add esp, 0xc
cmp dword [ebp + 0x18], 0
push ebx
je 0x43b2b0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push edi
push eax
call fcn.004a2910
lea eax, [ebp - 0x828]
add esp, 0x18
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b1fb
sub eax, edi
push 0x598320
push ebx
mov edi, eax
call fcn.0049fc3e
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 0x82c], ebx
test ebx, ebx
je 0x43b302
push 2
push 0
push ebx
call fcn.004a2894
push ebx
call fcn.004a15b6
push 0
push 0
push ebx
mov dword [ebp - 0x834], eax
call fcn.004a2894
mov eax, dword [ebp - 0x834]
lea ebx, [eax + edi + 2]
add esp, 0x1c
cmp ebx, dword [esi]
jae 0x43b29f
push edi
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x830]
call fcn.0049d0d0
push dword [ebp - 0x82c]
mov eax, dword [ebp - 0x830]
push 1
push dword [ebp - 0x834]
add eax, edi
push eax
call fcn.004a1199
mov eax, dword [ebp - 0x830]
add esp, 0x1c
add eax, dword [ebp - 0x834]
mov ecx, 0xa0d
mov word [eax + edi], cx
mov dword [esi], ebx
jmp 0x43b2a2
and dword [esi], 0
push dword [ebp - 0x82c]
call fcn.004a1688
pop ecx
jmp 0x43b305
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push edi
push eax
call fcn.004a2910
lea eax, [ebp - 0x828]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43b2d9
sub eax, ecx
mov edi, eax
cmp edi, dword [esi]
jae 0x43b302
push edi
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x830]
call fcn.0049d0d0
add esp, 0xc
mov dword [esi], edi
jmp 0x43b305
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
Function at 0x43b314
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004a2a90
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x43b3d7
cmp eax, 0x3fff
ja 0x43b3d7
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43b3d7
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x597548
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43b3d7
mov eax, dword [ebp - 0x4008]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push edi
push esi
call fcn.004a29bc
xor eax, eax
add esp, 0x1c
mov word [esi + edi*2 - 2], ax
inc eax
jmp 0x43b3d9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret

Function at 0x43b3e8
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
push ebx
mov ebx, 0x607cf0
cmp ax, word [0x607cf0]
jne 0x43b421
push esi
push edi
push eax
push 0x26
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x43b409
push 0x10
pop ecx
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x43b425
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call fcn.0043b3e8
push eax
call fcn.0043b314
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x43b475
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43b475
cmp ax, word [esi]
je 0x43b475
inc edi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x43b9f5
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.004a2a90
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x5a1f04], bl
jne 0x43bb8b
xor eax, eax
push 0x1046
mov word [ebp - 0x145c], ax
lea eax, [ebp - 0x145a]
push ebx
push eax
call fcn.0049d850
add esp, 0xc
call fcn.0043b9b8
cmp dword [eax + 0x14], 0x10
jb 0x43ba4a
mov edi, dword [eax]
jmp 0x43ba4c
mov edi, eax
cmp edi, ebx
je 0x43ba62
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x43ba66
xor eax, eax
jmp 0x43ba7a
lea eax, [esi + esi]
call fcn.004a2ac0
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.0043af80
push 0x5a3768
push eax
mov ecx, 0x5a3560
push ecx
push 0x5a3150
push 0x5a2f48
push 0x5a2d40
push 0x5a2b38
push 0x5a2930
push 0x5a2728
mov eax, 0x5a2318
push eax
push 0x5a1f08
push ebx
push ebx
push eax
push ecx
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360chromebq_dim_kpid__guid__ver_dim_v360chrome___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
lea eax, [ebp - 0x145c]
push 0x823
push eax
call fcn.004a29bc
mov esi, 0x5a4fe8
add esp, 0x48
mov ecx, esi
call fcn.004c045d
lea eax, [ebp - 0x145c]
push eax
mov ecx, esi
call fcn.0043b530
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0049d850
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0049d850
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4cc99c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0043b562
mov ecx, esi
mov dword [0x5a7450], 1
mov dword [0x5a7690], 0x1388
call fcn.004c1c3f
mov ecx, esi
call fcn.004bd5d7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [ebp - 0x1468]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d4b1
leave
ret
Function at 0x43c3dc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x620]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 0x620], ebx
call fcn.0043c200
pop ecx
mov dword [0x5a49b0], eax
cmp eax, ebx
je 0x43c547
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4ccb3c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, 0x5a4fe8
mov ecx, esi
call fcn.004c045d
push str.http:__crash.browser.360.cn_interface_dumpinfo_
mov ecx, esi
call fcn.0043b530
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0043b562
xor eax, eax
push edi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
mov dword [0x5a7690], 0x2710
call fcn.0049d850
add esp, 0xc
mov ebx, str.___________________________7d9114302a0cb6
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x43c4e4
xor eax, eax
jmp 0x43c4f8
lea eax, [edi + edi]
call fcn.004a2ac0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0043af80
push eax
push 0x4ccbc0
lea eax, [ebp - 0x61c]
push 0x103
push eax
call fcn.004a29bc
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x620]
mov ecx, esi
push dword [0x5a49b0]
call fcn.0043b594
mov ecx, esi
call fcn.004c1c3f
mov ecx, esi
call fcn.004bd5d7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [ebp - 0x62c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d4b1
leave
ret