joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6360e02b
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x6363a530]
push esi
mov esi, dword [ebp + 0x3a0]
push edi
mov edi, dword [ebp + 0x3a4]
xor eax, ebp
mov dword [ebp + 0x394], eax
lea eax, [ebp - 0x70]
push eax
push 0x20019
push 0
push str.ppfilm_shellopencommand_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6360e116
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0x63630238
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x3fc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6360e116
lea eax, [ebp - 0x6c]
push eax
call fcn.6361dc80
cmp eax, 5
pop ecx
jb 0x6360e116
lea eax, [ebp - 0x6c]
push eax
call fcn.6361dc80
mov dword [ebp - 0x74], eax
lea eax, [ebp + eax - 0x6c]
cmp byte [eax - 2], 0x25
pop ecx
jne 0x6360e0ce
cmp byte [eax - 3], 0x20
jne 0x6360e0ce
mov byte [eax - 3], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6360e116
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.6360c36e
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x18], 0x10
jb 0x6360e0fc
mov esi, dword [esi + 4]
jmp 0x6360e0ff
add esi, 4
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.6360da40
xor eax, eax
add esp, 0x10
inc eax
jmp 0x6360e121
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.6361d41e
add ebp, 0x398
leave
ret

Function at 0x636104ad
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6363a530]
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
cmp byte [ebp + 0xc], 0
push edi
mov dword [ebp - 4], eax
mov edi, ecx
push esi
je 0x63610545
lea ecx, [ebp - 0x20]
call fcn.6360c38b
push 0x636308d4
lea ecx, [ebp - 0x20]
call fcn.6360bd11
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x636104ec
lea eax, [ebp - 0x1c]
push ebx
push eax
mov ecx, edi
call fcn.63610241
test al, al
je 0x63610539
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x63610505
lea eax, [ebp - 0x1c]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x63610526
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x6361051f
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.636044f0
mov al, bl
pop ebx
jmp 0x6361054c
push esi
mov ecx, edi
call fcn.63610241
mov bl, al
jmp 0x63610528
mov ecx, edi
call fcn.63610241
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6361d41e
leave
ret 8
Function at 0x636114a1
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x6363a530]
push ebx
xor eax, ebp
mov dword [ebp + 0x38c], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareTencentQQToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x636114e4
xor eax, eax
jmp 0x63611540
push 0x400
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.6361d770
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Install
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x63611535
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x63611535
xor ebx, ebx
inc ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0x390
leave
ret
Function at 0x6361163a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3c4]
sub esp, 0x444
mov eax, dword [0x6363a530]
xor eax, ebp
push ebx
mov dword [ebp + 0x3c0], eax
mov eax, dword [ebp + 0x3d0]
push esi
push edi
mov edi, dword [ebp + 0x3cc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x3d4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.ppfilm_shellopencommand
push SysReAllocString
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611780
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x63630238
push dword [ebp - 0x48]
xor esi, esi
inc esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x58], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x5c], ebx
jne 0x63611787
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.6361f660
cmp eax, ebx
pop ecx
pop ecx
je 0x63611787
mov byte [eax + 1], bl
lea eax, [ebp - 0x40]
push str.configconfig.ini
push eax
mov dword [ebp - 0x44], esi
call fcn.6361dd80
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop ecx
pop ecx
lea eax, [ebp - 0x40]
push eax
push ebx
push str.OPERCHAP
push str.SYSTEM
call esi
mov dword [edi], eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x63611742
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
call fcn.63610f84
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
jmp 0x63611747
mov eax, dword [ebp - 0x4c]
mov dword [eax], ebx
mov edi, dword [ebp - 0x54]
lea eax, [ebp - 0x40]
push 0x5c
push eax
mov dword [edi], ebx
call fcn.6361f660
cmp eax, ebx
pop ecx
pop ecx
je 0x63611787
inc eax
push str.partner.ini
push eax
call fcn.6361dd70
pop ecx
pop ecx
lea eax, [ebp - 0x40]
push eax
push ebx
push str.ally
push str.partner
call esi
mov dword [edi], eax
jmp 0x63611787
mov dword [ebp - 0x44], 1
mov ecx, dword [ebp + 0x3c0]
mov eax, dword [ebp - 0x44]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0x3c4
leave
ret
Function at 0x636117a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwarePIPIjfcheck
push SysReAllocString
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611840
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.finishtm
push dword [ebp - 4]
call edi
test eax, eax
jne 0x63611836
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.checktm
push dword [ebp - 4]
call edi
test eax, eax
jne 0x63611836
mov esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0xc]
je 0x63611836
push ebx
call fcn.6361f226
sub eax, dword [ebp - 0xc]
pop ecx
push 0x78
pop ecx
cmp ecx, eax
sbb esi, esi
not esi
and esi, dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x63611846
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor esi, esi
push esi
mov ebx, str.SoftwarePIPIjfcheck
push ebx
mov edi, SysReAllocString
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x63611891
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x636118db
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
pop ebx
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push str.checktm
push dword [ebp - 4]
call edi
cmp dword [ebp + 0xc], esi
je 0x636118c7
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push str.finishtm
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x636118d2
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x636118e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwarePIPIjfcheck
push SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611946
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.updatetm
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6361193d
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x6361194b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor ebx, ebx
push ebx
mov edi, str.SoftwarePIPIjfcheck
push edi
mov esi, SysReAllocString
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x63611996
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x636119c7
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push str.updatetm
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x636119be
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x636119d1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x63611a29
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x63611a29
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x636119fd
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
jmp 0x63611a2b
push edi
call fcn.6361f68d
mov esi, eax
push 0x5c
push esi
call fcn.6361f660
add esp, 0xc
test eax, eax
je 0x63611a41
push esi
mov byte [eax], 0
call fcn.636119d1
test eax, eax
pop ecx
push esi
jne 0x63611a2e
call fcn.6361d0f8
pop ecx
xor eax, eax
pop edi
pop esi
ret
call fcn.6361d0f8
pop ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x63611a29
xor eax, eax
inc eax
jmp 0x63611a2b
Function at 0x63611ebe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMain
xor edi, edi
push SysReAllocString
inc edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611f2b
or dword [ebp - 4], 0xffffffff
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.TabProcGrowth
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x63611f22
cmp dword [ebp - 4], esi
jne 0x63611f22
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x63612030
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x6363a530]
xor eax, ebp
push esi
mov esi, dword [ebp + 0x1a4]
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a8]
push edi
mov edi, dword [ebp + 0x1a0]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 0x63631d68
push 1
push 0
push 0x63631d78
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x63612082
xor eax, eax
jmp 0x636120fc
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x50]
test esi, esi
je 0x6361209a
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
lea edx, [ebp - 0x7c]
push edx
push 0x63631da8
push eax
call dword [ecx]
test eax, eax
jge 0x636120ba
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x6361207e
push 0x104
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x80]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push 2
lea edx, [ebp - 0x74]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
test esi, esi
setge al
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.6361d41e
add ebp, 0x198
leave
ret

Function at 0x63612113
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6363a530]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6363cef0
lea eax, [ebp - 0x404]
push str._sconfigconfig.ini
push eax
call fcn.6361dd0b
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
push str.AutoRun
push str.SYSTEM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.6361d41e
leave
ret
Function at 0x6361216a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6363a530]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6363cef0
lea eax, [ebp - 0x404]
push str._sconfigconfig.ini
push eax
call fcn.6361dd0b
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
push str.CanRunWithStandardRight
push str.SYSTEM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.6361d41e
leave
ret

Function at 0x636121c1
Capabilities:
Check if file exists
Create directory
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x6363a530]
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
xor eax, ebp
push ebx
mov edi, 0x6363cef0
push edi
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x78], ebx
call fcn.6361d770
add esp, 0xc
push esi
lea eax, [ebp - 0x74]
push eax
push dword [0x6363f390]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x6361222b
push esi
push edi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0x5c
push edi
call fcn.6361f660
cmp eax, ebx
pop ecx
pop ecx
je 0x6361222b
mov byte [eax + 1], bl
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x636122ba
lea eax, [ebp - 0x7c]
push eax
mov esi, 0x6363cff8
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
push str.AppData
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x636122a8
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call ebx
cmp eax, 0xffffffff
je 0x636122a8
push str.PIPI_
push esi
call fcn.6361dd80
pop ecx
pop ecx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x636122b1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x636122b1
push edi
push esi
call fcn.6361dd70
pop ecx
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x90]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.6361d41e
add ebp, 0x94
leave
ret
Function at 0x636122d5
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x6363a530]
xor eax, ebp
push ebx
xor ebx, ebx
mov dword [ebp + 0x38c], eax
mov eax, dword [ebp + 0x398]
cmp eax, ebx
push esi
mov esi, dword [ebp + 0x39c]
push edi
mov edi, dword [ebp + 0x3a0]
mov byte [esi + 3], bl
mov byte [esi + 2], bl
mov byte [esi + 1], bl
mov byte [esi], bl
jne 0x6361232d
push 0x400
lea eax, [ebp - 0x74]
push eax
push dword [0x6363f390]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x63612339
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.6361dd70
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 0x78], eax
je 0x636123c6
push eax
call fcn.6361d9eb
pop ecx
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x6361239c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x63630080
push dword [ebp - 0x7c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6361239c
mov eax, dword [ebp - 0x80]
mov cl, byte [eax + 0xa]
mov byte [esi], cl
mov cl, byte [eax + 8]
mov byte [esi + 1], cl
mov cl, byte [eax + 0xe]
mov byte [esi + 2], cl
mov al, byte [eax + 0xc]
mov byte [esi + 3], al
push dword [ebp - 0x7c]
call fcn.6361d7d5
xor eax, eax
mov ah, byte [esi]
pop ecx
xor ecx, ecx
mov ch, byte [esi + 2]
mov al, byte [esi + 1]
movzx ecx, cx
shl eax, 0x10
or eax, ecx
movzx ecx, byte [esi + 3]
or eax, ecx
mov dword [edi], eax
xor eax, eax
inc eax
jmp 0x636123c8
xor eax, eax
mov ecx, dword [ebp + 0x38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0x390
leave
ret
Function at 0x636123e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xba4]
sub esp, 0xc24
mov eax, dword [0x6363a530]
xor eax, ebp
mov dword [ebp + 0xba0], eax
mov eax, dword [ebp + 0xbac]
push ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xbb0]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x64]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
push SysReAllocString
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x64], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x6361243b
xor eax, eax
jmp 0x63612507
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x3a0]
push eax
mov dword [ebp - 0x70], ebx
mov esi, 0x400
push ebx
jmp 0x636124e0
inc dword [ebp - 0x70]
lea eax, [ebp + 0x3a0]
push eax
call fcn.6361dc80
cmp eax, 0x26
pop ecx
jne 0x636124c5
lea eax, [ebp + 0x3a0]
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push eax
call fcn.6361d9f0
test eax, eax
pop ecx
pop ecx
je 0x636124c5
lea eax, [ebp + 0x3a0]
push str.1E315374_71A5_471A_B683_4C4ADB5C588B
push eax
call fcn.6361d9f0
test eax, eax
pop ecx
pop ecx
je 0x636124f3
push dword [ebp - 0x78]
lea eax, [ebp + 0x3a0]
push dword [ebp - 0x80]
push eax
call fcn.636112e0
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x74], eax
jne 0x636124f3
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x3a0]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x64]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], esi
call edi
test eax, eax
je 0x63612466
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
mov ecx, dword [ebp + 0xba0]
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0xba4
leave
ret
Function at 0x63612b88
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6363a530]
push ebx
push esi
push edi
xor edi, edi
xor eax, ebp
mov ebx, ecx
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 8], 0xf
call fcn.63603692
push 0x636303d4
mov esi, str.loadmethod
push esi
push str.system
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebx + 0x508]
call fcn.6360d76c
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.6360b8e3
push edi
push 1
lea ecx, [ebp - 0x50]
call fcn.636044f0
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x63612bfa
lea eax, [ebp - 0x1c]
push eax
call fcn.6361da59
pop ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push edi
push str.SoftwarePIPIjfcheck
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63612c6a
push 4
pop ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
je 0x63612c61
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.636044f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6361d41e
leave
ret
Function at 0x63613198
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov eax, 0x20ac
lea ebp, [esp - 0x202c]
call fcn.6361d3b0
mov eax, dword [0x6363a530]
push ebx
mov ebx, dword [ebp + 0x2038]
push esi
push edi
mov edi, dword [ebp + 0x2034]
xor eax, ebp
xor esi, esi
push esi
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x2028], eax
mov dword [ebp + 0x24], 0xf
call fcn.63603692
lea ecx, [ebp - 0x60]
call fcn.6361adf0
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6361329c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x63613216
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6361329c
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x64]
push eax
push 0x2000
lea eax, [ebp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6361323c
mov dword [ebp - 0x64], esi
cmp dword [ebp - 0x64], esi
jbe 0x63613250
push dword [ebp - 0x64]
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x60]
call fcn.6361ad50
cmp dword [ebp - 0x64], 0x2000
jae 0x63613220
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x60]
call fcn.6361ad70
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x60]
call fcn.6361add0
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.6361ae40
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0xc]
call fcn.6360b8e3
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.636044f0
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.6360c348
lea ecx, [ebp - 0x60]
call fcn.6361ad40
push esi
lea ecx, [ebp + 0xc]
push 1
call fcn.636044f0
mov ecx, dword [ebp + 0x2028]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0x202c
leave
ret