joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431101
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x43118a
push edi
push ebx
call fcn.004bb10a
pop ecx
mov edi, eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x43117e
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push 0x50c8fc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x43117e
cmp dword [ebp - 8], esi
je 0x43117e
mov ecx, dword [ebp - 0xc]
inc esi
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test edi, edi
je 0x431189
push edi
call fcn.004bbf48
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4318cc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4318de
push 0xd
pop eax
jmp 0x431910
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4318e7
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x432aea
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x432b0a
mov eax, dword [esi]
jmp 0x432b0c
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x432b1f
xor eax, eax
jmp 0x432ba7
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004bf4f0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x432b45
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x20c]
push 0x510a50
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x22c], 0
lea edi, [ebp - 0x228]
add esp, 0xc
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x224], eax
mov eax, 0x414
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x228], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004bc45f
mov esp, ebp
pop ebp
ret
Function at 0x432bb6
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x14], 8
jb 0x432bd9
mov eax, dword [esi]
jmp 0x432bdb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x432bee
xor eax, eax
jmp 0x432cb7
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004bf4f0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x432c14
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push 0x510a50
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004bf4f0
add esp, 0x18
cmp dword [edi + 0x14], 8
jb 0x432c4f
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x414]
push 0x510a50
push eax
call esi
and dword [ebp - 0x434], 0
lea edi, [ebp - 0x430]
add esp, 0xc
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x428], eax
mov eax, 0x414
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x430], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004bc45f
mov esp, ebp
pop ebp
ret
Function at 0x433328
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0x13c
mov eax, 0x4f1002
call fcn.004bd27f
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x138]
mov edi, dword [ebp + 0xc]
call fcn.004955be
and dword [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.00495763
mov ebx, 0x50c86c
lea ecx, [ebp - 0x70]
push ebx
call fcn.004045f0
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004045f0
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004045f0
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 8
jb 0x43338b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x58]
call fcn.004045f0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00433955
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00402120
cmp dword [edi + 0x14], 8
jb 0x4333c3
mov eax, dword [edi]
jmp 0x4333c5
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Mozilla_4.0__compatible___
lea ecx, [ebp - 0x138]
call fcn.00495b4b
mov ebx, eax
mov dword [ebp - 0x144], ebx
test ebx, ebx
je 0x433578
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push 0x50
cmovae ecx, dword [ebp - 0x40]
push ecx
push ebx
lea ecx, [ebp - 0x138]
call fcn.004956e0
mov dword [ebp - 0x140], eax
test eax, eax
je 0x433570
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
push ecx
push 0x510504
push eax
lea ecx, [ebp - 0x138]
call fcn.00495a5f
mov esi, eax
test esi, esi
je 0x4334fe
push 0
push 0
push esi
lea ecx, [ebp - 0x138]
call fcn.00495c4e
test eax, eax
je 0x4334fe
push esi
lea ecx, [ebp - 0x138]
call fcn.00495744
test eax, eax
je 0x4334fe
push 0x4000
call fcn.004bc592
and dword [ebp - 0x13c], 0
mov ebx, eax
pop ecx
jmp 0x4334cf
cmp dword [edi + 0x14], 8
jb 0x433489
mov eax, dword [edi]
jmp 0x43348b
mov eax, edi
push 0x510b68
push eax
call fcn.004c2e15
mov dword [ebp - 0x148], eax
pop ecx
pop ecx
test eax, eax
je 0x4334bf
push eax
push 1
push dword [ebp - 0x13c]
push ebx
call fcn.004c2ccc
push dword [ebp - 0x148]
call fcn.004c0ffe
add esp, 0x14
push 0x4000
push 0
push ebx
call fcn.004bf4f0
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
push 0x4000
push ebx
push esi
lea ecx, [ebp - 0x138]
call fcn.00495c31
cmp dword [ebp - 0x13c], 0
jne 0x43347f
push ebx
call fcn.004bbf10
mov ebx, dword [ebp - 0x144]
pop ecx
mov edi, dword [ebp - 0x140]
push ebx
lea ecx, [ebp - 0x138]
call fcn.004956bd
push edi
lea ecx, [ebp - 0x138]
call fcn.004956bd
push esi
lea ecx, [ebp - 0x138]
call fcn.004956bd
lea ecx, [ebp - 0x138]
call fcn.00495cdc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00402120
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00402120
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00402120
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00495656
xor eax, eax
call fcn.004bd22e
ret 8
mov esi, dword [ebp - 0x144]
jmp 0x4334fe
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x144]
jmp 0x433504
Function at 0x433802
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x2a0
mov eax, 0x4f10be
call fcn.004bd27f
mov dword [ebp - 0x2ac], ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
cmp dword [esi + 0x10], eax
je 0x43394d
push 0x24c
push eax
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.004bf4f0
add esp, 0xc
lea eax, [ebp - 0x40]
push str..
push esi
push eax
call fcn.0042444e
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.004045c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a8]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp word [ebp - 0x27c], 0x2e
je 0x433915
test byte [ebp - 0x2a8], 0x10
je 0x4338ca
push 0x50c8fc
lea ecx, [ebp - 0x28]
call fcn.00404750
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404750
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x28]
push ebx
push edi
push eax
call fcn.00433802
jmp 0x433915
cmp word [ebp - 0x27c], 0
je 0x433915
test edi, edi
je 0x433915
push 0x50c8fc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0042444e
add esp, 0xc
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.00404750
lea eax, [ebp - 0x58]
push ebx
push eax
call edi
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402120
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x433884
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00402120
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402120
xor eax, eax
inc eax
call fcn.004bd22e
ret 0xc
Function at 0x433a42
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x450
mov eax, 0x4f1129
call fcn.004bd27f
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x458], eax
cmp dword [eax + 0x10], ebx
jne 0x433a68
xor eax, eax
jmp 0x433bc3
push eax
lea ecx, [ebp - 0x43c]
call fcn.004045c0
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x45c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x45c], 0x2e
call fcn.004056c0
mov ecx, dword [ebp - 0x42c]
dec ecx
push ecx
push eax
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00409540
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.004046c0
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], bl
call fcn.00402120
push str..ocx
lea ecx, [ebp - 0x43c]
call fcn.00409570
test eax, eax
je 0x433afc
push str..dll
lea ecx, [ebp - 0x43c]
call fcn.00409570
test eax, eax
jne 0x433bb2
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004bf4f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x25
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x21c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x433b35
push 5
pop ecx
xor eax, eax
mov esi, str._regsvr32
push 0x206
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004bf4f0
mov eax, dword [ebp - 0x458]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x433b77
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x424]
push str._s___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x424]
push 5
push ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x50f004
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x433bb2
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.00402120
mov eax, ebx
call fcn.004bd22e
ret 4
Function at 0x433c13
Capabilities:
Print debug messages

Disassembly:
push 0xe4
mov eax, 0x4f1174
call fcn.004bd27f
call fcn.00433bcb
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.004045f0
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x41]
cmp dword [ebp - 0x14], 8
mov edi, 0xf003f
push 1
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push esi
call fcn.004328c9
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push edi
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
lea ecx, [ebp - 0x50]
call fcn.00425f7b
mov ebx, eax
or edi, 0xffffffff
test ebx, ebx
jne 0x433cb3
push 1
mov eax, 0x50c86c
lea ecx, [ebp - 0x50]
push eax
push eax
call fcn.004318cc
mov edi, eax
push ecx
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00434297
mov byte [ebp - 4], 2
lea eax, [ebp - 0xf0]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00436fd9
pop ecx
push edi
push ecx
push dword [ebp - 0x54]
mov edx, str.CrashRepair::BeginRegisterAcessable
push ecx
push ebx
push ecx
mov ecx, eax
call fcn.0043700b
mov edx, str.__reg.Open:
mov ecx, eax
call fcn.00437258
pop ecx
mov ecx, eax
call fcn.004344c2
mov edx, str.__helper.AddRegAccess:
mov ecx, eax
call fcn.00437258
pop ecx
mov ecx, eax
call fcn.004343ca
mov edx, str.__reg.SetStringValue
mov ecx, eax
call fcn.00437258
pop ecx
mov ecx, eax
call fcn.004344c2
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437258
mov edx, esi
mov ecx, eax
call fcn.00437258
push eax
call fcn.00436fd9
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00434392
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x433d63
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402120
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.0043434f
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push eax
mov dword [ebp - 0xa0], vtable.std::ios_base.0
call fcn.004bba15
pop ecx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00425f61
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402120
call fcn.004bd22e
ret
Function at 0x433dc4
Capabilities:
Print debug messages

Disassembly:
push 0xdc
mov eax, 0x4f11c7
call fcn.004bd27f
call fcn.00433bcb
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.004045f0
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x49]
cmp dword [ebp - 0x14], 8
mov edi, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
call fcn.00432a46
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x50]
cmp dword [esi - 0xc], ebx
je 0x433e5f
lea ecx, [ebp - 0x48]
call fcn.00431cd5
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00431e0c
push ebx
lea eax, [ebp - 0x48]
push eax
push 4
push esi
call fcn.00432648
add esp, 0x10
movzx edi, al
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00431d18
lea ecx, [esi - 0x10]
mov byte [ebp - 4], bl
call fcn.0042095b
push ecx
push ecx
lea ecx, [ebp - 0xe8]
call fcn.00434297
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe8]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00436fd9
pop ecx
push edi
push ecx
mov edx, str.CrashRepair::EndRegisterAcessable
mov ecx, eax
call fcn.0043700b
mov edx, str.__RestoreRegAccess:
mov ecx, eax
call fcn.00437258
pop ecx
mov ecx, eax
call fcn.004343ca
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437258
mov edx, esi
mov ecx, eax
call fcn.00437258
push eax
call fcn.00436fd9
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00434392
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x433eec
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402120
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.0043434f
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push eax
mov dword [ebp - 0x98], vtable.std::ios_base.0
call fcn.004bba15
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00402120
call fcn.004bd22e
ret
Function at 0x4366f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], edx
push esi
mov esi, eax
mov dword [ebp - 8], eax
push edi
or edi, 0xffffffff
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x436710
sub esi, ecx
lea ebx, [esi + 1]
push ebx
call fcn.004bb10a
mov esi, eax
pop ecx
test esi, esi
je 0x4367e4
push ebx
call fcn.004bb10a
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
test ebx, ebx
jne 0x436748
push esi
call fcn.004bbf48
jmp 0x4367e3
mov ecx, dword [ebp - 4]
mov edx, esi
inc ecx
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x436750
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub eax, ecx
push eax
push ecx
push ebx
call fcn.004c5e80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
sub eax, dword [ebp - 8]
push 0
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4367d6
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4367d6
push 0xc
call fcn.00481491
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4367d3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x10]
and dword [ebx + 4], 0
push dword [ebp - 8]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx + 8], eax
mov edi, ebx
mov ebx, dword [ebp - 0xc]
push esi
call fcn.004bbf48
push ebx
call fcn.004bbf48
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436829
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov edi, ecx
mov ebx, edx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43688f
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x436888
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x436888
lea eax, [ebp - 8]
push eax
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
and eax, 0x27
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437f55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004bf4f0
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
mov ebx, str.SOFTWAREMicrosoftInternet_Explorer
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.svcVersion
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x437fe0
cmp dword [ebp - 0x214], 1
jne 0x437fe0
cmp dword [ebp - 0x210], eax
je 0x437fe0
lea eax, [ebp - 0x20c]
push eax
call fcn.004bffb1
pop ecx
jmp 0x438027
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Version
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x438025
cmp dword [ebp - 0x214], 1
jne 0x438025
cmp dword [ebp - 0x210], eax
jne 0x437fd1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004bc45f
mov esp, ebp
pop ebp
ret

Function at 0x438036
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push str.winhttp.dll
mov edi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x438104
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.WinHttpOpenRequest
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.WinHttpSendRequest
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.WinHttpWriteData
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpCloseHandle
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.WinHttpReadData
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.WinHttpQueryDataAvailable
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
pop esi
cmp dword [edi + 4], ebx
je 0x438104
cmp dword [edi + 8], ebx
je 0x438104
cmp dword [edi + 0xc], ebx
je 0x438104
cmp dword [edi + 0x10], ebx
je 0x438104
cmp dword [edi + 0x14], ebx
je 0x438104
cmp dword [edi + 0x18], ebx
je 0x438104
cmp dword [edi + 0x1c], ebx
je 0x438104
cmp dword [edi + 0x20], ebx
je 0x438104
cmp dword [edi + 0x24], ebx
je 0x438104
test eax, eax
je 0x438104
inc ebx
jmp 0x43810b
mov ecx, edi
call fcn.00438110
pop edi
mov eax, ebx
pop ebx
ret