joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4302f7
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6334c
call fcn.0050d9b0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x418], ax
mov edi, edx
lea eax, [ebp - 0x416]
mov esi, ecx
push ebx
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x418]
push str.DownLoad.cab
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
push 0x206
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push ebx
push eax
call fcn.005091d0
add esp, 0xc
lea ecx, [ebp - 0x638]
mov edx, edi
call fcn.00430500
cmp dword [eax + 0x14], 8
jb 0x4303b1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 1
lea ecx, [ebp - 0x638]
call fcn.0040536f
lea ecx, [ebp - 0x63348]
call fcn.0040ca0e
lea ecx, [ebp - 0x63348]
call fcn.0040cf50
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x60ee0], 1
jb 0x4303fc
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x63348]
call fcn.00409b00
lea eax, [ebp - 0x210]
mov dword [ebp - 0x60ca0], 0x493e0
push eax
lea ecx, [ebp - 0x63348]
call fcn.00409b32
lea ecx, [ebp - 0x63348]
call fcn.0040cea1
lea ecx, [ebp - 0x63348]
call fcn.0040d1b0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4304e2
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x638]
call fcn.004058f0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x650]
call fcn.004058f0
lea edx, [ebp - 0x638]
lea ecx, [ebp - 0x650]
call fcn.0043054f
push ebx
push 1
lea ecx, [ebp - 0x650]
mov esi, eax
call fcn.0040536f
push ebx
push 1
lea ecx, [ebp - 0x638]
call fcn.0040536f
test esi, esi
je 0x4304d5
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4304d5
cmp dword [edi + 0x14], 8
jb 0x4304bf
mov edi, dword [edi]
push 3
push edi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4304d5
mov bl, 1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x63348]
call fcn.0040ccd9
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4305a3
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.0050d9b0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x53fc30
mov esi, edx
mov ebx, ecx
call fcn.004058f0
push dword [esi]
xor edi, edi
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4307a7
push 0xffc
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x1418], edi
push edi
push eax
call fcn.005091d0
add esp, 0xc
mov dword [ebp - 0x1464], edi
lea eax, [ebp - 0x1464]
push eax
push 0x400
lea eax, [ebp - 0x1418]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4307a7
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x104
push eax
push dword [ebp - 0x1418]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x1448]
call fcn.004058f0
lea edx, [ebp - 0x1448]
lea ecx, [ebp - 0x1430]
call fcn.00430be4
push eax
lea ecx, [ebp - 0x1448]
call fcn.004075c9
push 0
push 1
lea ecx, [ebp - 0x1430]
call fcn.0040536f
xor eax, eax
push edi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005091d0
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0x1464], edi
jbe 0x43076f
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [ebp + edi*4 - 0x1418]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x1430]
call fcn.004058f0
lea edx, [ebp - 0x1430]
lea ecx, [ebp - 0x1460]
call fcn.00430be4
push eax
lea ecx, [ebp - 0x1430]
call fcn.004075c9
push 0
push 1
lea ecx, [ebp - 0x1460]
call fcn.0040536f
cmp dword [ebp - 0x1434], 8
mov eax, dword [ebp - 0x1448]
jae 0x430733
lea eax, [ebp - 0x1448]
push dword [ebp - 0x1438]
lea ecx, [ebp - 0x1430]
push 0
push eax
call fcn.00407878
lea ecx, [ebp - 0x1430]
push 0
push 1
cmp eax, 0xffffffff
jne 0x43076a
call fcn.0040536f
inc edi
cmp edi, dword [ebp - 0x1464]
jb 0x4306c6
jmp 0x43076f
call fcn.0040536f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call fcn.004049e1
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.00405941
push 0
push 1
lea ecx, [ebp - 0x1448]
call fcn.0040536f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4309fc
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.0050d9b0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x1224], edx
push 0xffc
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x1220], ecx
push ebx
push eax
mov dword [ebp - 0x120c], ebx
call fcn.005091d0
add esp, 0xc
mov dword [ebp - 0x1214], ebx
lea eax, [ebp - 0x1214]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x430b53
mov eax, dword [ebp - 0x1214]
push esi
shr eax, 2
mov esi, 0x400
cmp eax, esi
ja 0x430a81
mov esi, eax
test esi, esi
jle 0x430b52
push edi
lea edi, [ebp - 0x120c]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005091d0
add esp, 0xc
mov dword [ebp - 0x1210], ebx
push dword [edi]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x430b07
and dword [ebp - 0x1218], 0
lea eax, [ebp - 0x121c]
and dword [ebp - 0x121c], 0
push eax
push 4
lea eax, [ebp - 0x1218]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x430b07
push 0x103
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1218]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x430b07
mov dword [ebp - 0x1210], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1210], 0
je 0x430b44
mov eax, dword [ebp - 0x1220]
cmp dword [eax + 0x14], 8
jb 0x430b25
mov eax, dword [eax]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.005036e8
pop ecx
pop ecx
test eax, eax
jne 0x430b44
mov ecx, dword [ebp - 0x1224]
push edi
call fcn.0040bea5
add edi, 4
push 0
pop ebx
dec esi
jne 0x430a88
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x430b62
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
mov esi, ecx
call fcn.005091d0
xor eax, eax
mov dword [ebp - 0x10], ebx
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea edi, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x8000000
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x430bc3
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x430bd6
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x430bdd
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431243
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x431261
mov eax, dword [esi]
jmp 0x431263
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431275
mov al, 1
jmp 0x4312f7
lea ecx, [ebp - 0x1c]
mov bl, 1
call fcn.00431307
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x43128b
lea eax, [ebp - 0x1c]
cmp dword [esi + 0x14], 8
jb 0x431293
mov esi, dword [esi]
push 3
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call esi
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4312ab
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4312e7
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4312c2
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4312e9
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4312d9
lea eax, [ebp - 0x1c]
push 4
push 0
push eax
call esi
test eax, eax
setne bl
jmp 0x4312e9
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040536f
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x431307
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 0x20a]
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push edi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x54bc40
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.004058f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x431411
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x58]
mov ebx, edx
push 0
push eax
mov edi, ecx
call fcn.005091d0
add esp, 0xc
mov dword [ebp - 0x58], esi
xor esi, esi
mov dword [ebp - 0x2c], 1
push 5
pop eax
mov word [ebp - 0x28], ax
test ebx, ebx
je 0x43144a
push 4
pop esi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [ebp - 4], 0
je 0x43146d
or esi, 0x1000000
cmp dword [edi + 0x14], 8
jb 0x431475
mov edi, dword [edi]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push esi
push eax
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431495
xor al, al
jmp 0x4314ce
test ebx, ebx
je 0x4314bc
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x4314b3
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x431491
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431599
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push ecx
mov eax, ecx
mov dword [ebp - 0x6c], edx
mov ecx, esp
push eax
call fcn.004050d6
lea ecx, [ebp - 0x40]
call fcn.00458fb0
xor eax, eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x64], eax
mov bl, al
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x64]
push eax
call fcn.00459140
mov esi, dword [ebp - 0x64]
cmp esi, dword [ebp - 0x60]
jne 0x4315eb
xor bl, bl
jmp 0x431688
push 0x54c478
lea ecx, [ebp - 0x58]
call fcn.004058f0
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00415344
push eax
lea ecx, [ebp - 0x28]
call fcn.004075a4
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.0040536f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x431625
lea eax, [ebp - 0x28]
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x431641
xor bl, bl
jmp 0x43167c
xor ecx, ecx
lea eax, [ebp - 0x68]
push ecx
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x68], ecx
push eax
push ecx
push ecx
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x43167c
cmp dword [ebp - 0x10], 7
jne 0x43167c
mov ecx, dword [ebp - 0x6c]
mov bl, 1
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040536f
lea ecx, [ebp - 0x64]
call fcn.00407966
lea ecx, [ebp - 0x40]
call fcn.00459030
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4316ab
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x874], ecx
push 0x7fe
push eax
mov word [ebp - 0x808], ax
xor ebx, ebx
lea eax, [ebp - 0x806]
mov dword [ebp - 0x858], ebx
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
and dword [ebp - 0x810], ebx
xor ecx, ecx
push eax
lea eax, [ebp - 0x808]
mov word [ebp - 0x820], cx
push eax
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x80c], 7
call fcn.00405941
xor eax, eax
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x870], eax
xor edx, edx
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x868], eax
lea eax, [ebp - 0x870]
push eax
call fcn.004670f0
mov eax, dword [ebp - 0x86c]
mov esi, dword [ebp - 0x870]
sub eax, esi
pop ecx
push 0x18
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x878], ecx
mov dword [ebp - 0x858], eax
test eax, eax
je 0x431871
mov edi, eax
test eax, eax
je 0x431830
push ecx
push ecx
mov ecx, esp
or ebx, 1
push esi
call fcn.004050d6
lea ecx, [ebp - 0x850]
call fcn.00458fb0
push eax
lea ecx, [ebp - 0x838]
call fcn.00458f80
xor eax, eax
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], eax
mov byte [ebp - 0x851], al
lea eax, [ebp - 0x864]
push eax
call fcn.00459140
mov eax, dword [ebp - 0x860]
mov ecx, dword [ebp - 0x864]
sub eax, ecx
cdq
idiv dword [ebp - 0x878]
test eax, eax
je 0x43180a
cmp dword [ecx + 0x14], 8
jb 0x4317f7
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x43180a
mov byte [ebp - 0x851], 1
lea ecx, [ebp - 0x864]
call fcn.00407966
lea ecx, [ebp - 0x838]
call fcn.00459030
cmp byte [ebp - 0x851], 0
mov byte [ebp - 0x851], 1
jne 0x431837
mov byte [ebp - 0x851], 0
test bl, 1
je 0x43184a
lea ecx, [ebp - 0x850]
and ebx, 0xfffffffe
call fcn.00459030
cmp byte [ebp - 0x851], 0
je 0x43185f
mov ecx, dword [ebp - 0x874]
push esi
call fcn.0040770a
push 0x18
pop eax
add esi, eax
mov eax, dword [ebp - 0x858]
dec edi
jne 0x43177e
lea ecx, [ebp - 0x870]
call fcn.00407966
push 0
push 1
lea ecx, [ebp - 0x820]
call fcn.0040536f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x43189c
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.0050d9b0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, edx
push 0x3ffe
push eax
mov word [ebp - 0x420c], ax
mov esi, ecx
lea eax, [ebp - 0x420a]
push eax
call fcn.005091d0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4318e1
mov eax, dword [esi]
jmp 0x4318e3
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4319d2
cmp dword [esi + 0x14], 8
jb 0x4318fc
mov eax, dword [esi]
jmp 0x4318fe
mov eax, esi
lea ecx, [ebp - 0x4218]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x4319d2
cmp eax, 0x3fff
ja 0x4319d2
cmp dword [esi + 0x14], 8
jb 0x431927
mov esi, dword [esi]
lea ecx, [ebp - 0x420c]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4319d2
lea eax, [ebp - 0x4214]
push eax
lea eax, [ebp - 0x4210]
push eax
push 0x53fe1c
lea eax, [ebp - 0x420c]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4319d2
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.005091d0
mov ecx, dword [ebp - 0x4210]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.005028f6
lea eax, [ebp - 0x20c]
push eax
call fcn.004049e1
add esp, 0x2c
mov ecx, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00405941
xor eax, eax
inc eax
jmp 0x4319d4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x431aed
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x218], 0x104
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x53fc30
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x431b90
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431b90
lea ecx, [ebp - 0x210]
call fcn.00468040
test al, al
setne cl
test cl, cl
je 0x431b90
mov al, 1
jmp 0x431b92
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x431ba0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x218], 0x104
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x53fc30
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x431c43
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431c43
lea ecx, [ebp - 0x210]
call fcn.00468040
test al, al
setne cl
test cl, cl
je 0x431c43
mov al, 1
jmp 0x431c45
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x431c53
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x218], 0x104
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x53fc30
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x431cf6
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431cf6
lea ecx, [ebp - 0x210]
call fcn.00468040
test al, al
setne cl
test cl, cl
je 0x431cf6
mov al, 1
jmp 0x431cf8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4327fd
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
mov esi, ecx
push ebx
push eax
call fcn.005091d0
xor eax, eax
mov dword [ebp - 0x418], 1
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
mov dword [ebp - 0x41c], 0x208
call fcn.005091d0
add esp, 0x18
lea eax, [ebp - 0x414]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x414]
push eax
push str._sInternet_Exploreriexplore.exe
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.005028f6
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
add esp, 0x10
push eax
call edi
test eax, eax
jne 0x4328e3
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x53fc30
push 0x54cc70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x4328e3
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004058f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x432904
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea ecx, [ebp - 0x1c]
call fcn.004327fd
cmp dword [ebp - 0xc], 0
je 0x4329d0
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x432935
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4329d0
push ecx
lea ecx, [ebp - 0x6c]
call fcn.0045e910
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.004050d6
lea ecx, [ebp - 0x4c]
call fcn.00458fb0
push dword [ebp - 0x6c]
mov ecx, eax
call fcn.0045a5b0
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.00459030
push esi
lea ecx, [ebp - 0x4c]
call fcn.004058f0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040770a
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040536f
push ecx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0045f720
cmp dword [ebp - 0x20], 8
mov ecx, dword [ebp - 0x34]
jae 0x4329af
lea ecx, [ebp - 0x34]
push ecx
push ecx
call fcn.00430950
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.0040536f
lea ecx, [ebp - 0x6c]
call fcn.0045eb50
jmp 0x4329d2
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040536f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret