joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a03
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x69c
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp + 0x618], eax
mov eax, dword [ebp + 0x624]
push ebx
push esi
xor esi, esi
push esi
push 2
mov dword [ebp - 0x64], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x3d4]
push esi
push eax
call fcn.0043d840
add esp, 0xc
lea eax, [ebp + 0x3d0]
push eax
push dword [ebp - 0x60]
mov dword [ebp + 0x3d0], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403b77
push edi
push 0x424
lea eax, [ebp - 0x54]
push esi
push eax
mov dword [ebp - 0x58], esi
call fcn.0043d840
add esp, 0xc
push dword [ebp + 0x3d8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x58]
push eax
push edi
mov dword [ebp - 0x58], 0x428
call sub.KERNEL32.dll_Module32FirstW
push edi
call ebx
lea eax, [ebp + 0x1c8]
push eax
lea ecx, [ebp + 0x5fc]
call fcn.004033f2
push 0xffffffffffffffff
push 0x460520
lea ecx, [ebp + 0x5fc]
call fcn.00401ff0
cmp eax, 0xffffffff
je 0x403b07
lea ecx, [ebp - 0x59]
push ecx
inc eax
push eax
push esi
lea eax, [ebp + 0x5fc]
push eax
lea ecx, [ebp - 0x80]
call fcn.00403280
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp + 0x5fc]
call fcn.00402de2
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00402515
lea eax, [ebp + 0x5fc]
push eax
push dword [ebp - 0x64]
call fcn.0040a425
pop ecx
pop ecx
test eax, eax
jne 0x403b4f
push dword [ebp + 0x3d8]
push esi
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x403b4f
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403b4f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp + 0x3d0]
push eax
push dword [ebp - 0x60]
call sub.KERNEL32.dll_Process32NextW
push esi
push 1
lea ecx, [ebp + 0x5fc]
mov edi, eax
call fcn.00402515
cmp edi, esi
jne 0x403a73
pop edi
push dword [ebp - 0x60]
call ebx
mov ecx, dword [ebp + 0x618]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
add ebp, 0x61c
leave
ret 4
Function at 0x403b95
Capabilities:
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x1cc]
sub esp, 0x24c
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp + 0x1c8], eax
push esi
xor eax, eax
push 0x208
mov word [ebp - 0x44], ax
xor esi, esi
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.0043d840
add esp, 0xc
push 0x104
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
call fcn.004033f2
push 0xffffffffffffffff
push 0x460520
lea ecx, [ebp - 0x60]
call fcn.00401ff0
cmp eax, 0xffffffff
je 0x403c27
lea ecx, [ebp - 0x61]
push ecx
push eax
push esi
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x80]
call fcn.00403280
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x60]
call fcn.00402de2
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00402515
cmp dword [ebp - 0x48], 8
mov eax, dword [ebp - 0x5c]
jae 0x403c33
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
lea ecx, [ebp - 0x60]
call fcn.00402515
mov ecx, dword [ebp + 0x1c8]
xor ecx, ebp
pop esi
call fcn.0043dae6
add ebp, 0x1cc
leave
ret
Function at 0x408831
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x228
xor esi, esi
lea eax, [ebp - 0x280]
push esi
push eax
mov dword [ebp - 0x6b8], ecx
call fcn.0043d840
add esp, 0xc
push esi
push 2
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x284]
push ecx
push eax
mov dword [ebp - 0x6b4], eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4088d8
mov edi, str.YYMixer.exe
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004033f2
push edi
lea ecx, [ebp - 0x3c]
call fcn.004017ef
test eax, eax
je 0x4088f4
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x6b4]
call sub.KERNEL32.dll_Process32NextW
push esi
push 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x6b0], eax
call fcn.00402515
cmp dword [ebp - 0x6b0], esi
jne 0x408891
push dword [ebp - 0x6b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043dae6
leave
ret
push 0x424
lea eax, [ebp - 0x6a8]
push esi
push eax
call fcn.0043d840
add esp, 0xc
push dword [ebp - 0x27c]
mov dword [ebp - 0x6ac], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x6ac]
push ecx
push eax
mov dword [ebp - 0x6b0], eax
call sub.KERNEL32.dll_Module32FirstW
push dword [ebp - 0x6b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x20]
call fcn.004033f2
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x40895a
lea eax, [ebp - 0x1c]
push eax
push str.MixerUninstallChecker::_isYYMixerRunning__exePath_is_:__s
call fcn.0043b312
mov eax, dword [ebp - 0x6b8]
add eax, 0x24
push edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403514
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.00402515
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.00402515
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402515
mov al, 1
jmp 0x4088e6

Function at 0x408cb1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x46038d
lea ecx, [ebp - 8]
call fcn.0040daa7
push str._path
lea ecx, [ebp - 4]
call fcn.0040da75
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00426ebc
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
push dword [eax + 0xc]
mov ecx, esi
call fcn.004032aa
lea ecx, [ebp - 4]
call fcn.0040de2d
lea ecx, [ebp - 8]
call fcn.0040de2d
cmp dword [esi + 0x18], 8
jb 0x408d0b
mov esi, dword [esi + 4]
jmp 0x408d0e
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
pop esi
leave
ret 8
Function at 0x408e05
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x28], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040da75
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00426ef8
lea ecx, [ebp - 0x28]
call fcn.0040de2d
push str._silence
lea ecx, [ebp - 0x28]
call fcn.0040da75
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00426ea6
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x21], al
call fcn.0040de2d
cmp byte [ebp - 0x21], bl
je 0x408e73
inc edi
jmp 0x408f35
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], 7
call fcn.00401795
push 0x460f38
lea ecx, [ebp - 0x28]
call fcn.0040da75
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00426ea6
test al, al
je 0x408eb7
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00408cb1
mov byte [ebp - 0x21], 1
test al, al
jne 0x408eba
mov byte [ebp - 0x21], bl
lea ecx, [ebp - 0x28]
call fcn.0040de2d
cmp byte [ebp - 0x21], bl
je 0x408ed7
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.00409169
push 2
jmp 0x408f29
push str._silencedelete
lea ecx, [ebp - 0x28]
call fcn.0040da75
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00426ea6
test al, al
je 0x408f0b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00408cb1
mov byte [ebp - 0x21], 1
test al, al
jne 0x408f0e
mov byte [ebp - 0x21], bl
lea ecx, [ebp - 0x28]
call fcn.0040de2d
cmp byte [ebp - 0x21], bl
je 0x408f2a
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.00409169
push 3
pop edi
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00402515
lea ecx, [ebp - 0x2c]
call fcn.00437a25
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
leave
ret
Function at 0x40926f
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, str.YYMixer
test eax, eax
jne 0x4092b1
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Softwareduowancom.yy.yymixer
push esi
call edi
test eax, eax
jge 0x4092ce
push str.MixerUninstallCore::deleteRegeditInfo__Failed_to_delete_STR_YYMIXER_COM_REG_LOCATION
call fcn.0043b312
pop ecx
push str.Softwareduowanyymixer
push esi
call edi
push ebx
push 0x460520
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x5c]
call fcn.004033f2
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403514
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403514
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00402515
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.00402515
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x409327
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00402515
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
leave
ret
Function at 0x409686
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x461384
mov esi, ecx
push str.2.2.0.3
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00403514
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403514
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402515
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4096da
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040da75
push eax
call fcn.0040f013
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x3d], al
call fcn.0040de2d
cmp byte [ebp - 0x3d], bl
je 0x4097a6
push 0x461380
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x7c]
push str.regsvr32__s__u__
push eax
call fcn.00409130
add esp, 0xc
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00403514
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x20]
call fcn.00402de2
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.00402515
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.00402515
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x409753
lea eax, [ebp - 0x1c]
push eax
push str.YYUninstallCore::unRegsvrAxComM__order_is__s
call fcn.0043b312
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
jae 0x40976c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004091c0
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x409784
lea eax, [ebp - 0x38]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push eax
push str.YYUninstallCore::unRegsvrAxComM__ret_is__d
call fcn.0043b312
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040280e
jmp 0x4097bf
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4097b2
lea eax, [ebp - 0x1c]
push eax
push str.YYUninstallCore::unRegsvrAxComM__file__s_not_exist.
call fcn.0043b312
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00402515
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
leave
ret
Function at 0x40a46f
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fd8]
mov eax, 0x2058
call fcn.0043e8a0
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp + 0x1fd4], eax
push ebx
mov ebx, dword [ebp + 0x1fe0]
push esi
mov esi, dword [ebp + 0x1fe4]
push edi
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2c], ax
xor edi, edi
lea eax, [ebp - 0x2a]
push edi
push eax
call fcn.0043d840
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40a4c2
mov esi, dword [esi + 4]
jmp 0x40a4c5
add esi, 4
push esi
lea eax, [ebp - 0x2c]
push 0x1000
push eax
call fcn.0043e828
push 0x40
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.0043d840
mov dword [ebp - 0x3c], edi
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
cmp dword [ebx + 0x18], 8
mov dword [ebp - 0x80], 0x44
stosd dword es:[edi], eax
jb 0x40a500
mov ebx, dword [ebx + 4]
jmp 0x40a503
add ebx, 4
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a537
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.runExeFile__CreateProcess_return_false__last_error_is__d.
call fcn.0043b312
pop ecx
pop ecx
jmp 0x40a570
cmp byte [ebp + 0x1fe8], 0
je 0x40a560
push 0x2710
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40a560
push str.runExeFile__WaitForSingleObject_timeout.
call fcn.0043b312
pop ecx
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1fd4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
add ebp, 0x1fd8
leave
ret

Function at 0x40a588
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x40a597
mov eax, dword [eax + 4]
jmp 0x40a59a
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
ret

Function at 0x40ad0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor edi, edi
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0043d840
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.duowanyymixer
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.004033f2
push eax
push esi
call fcn.00403514
add esp, 0xc
push edi
push 1
lea ecx, [ebp - 0x228]
call fcn.00402515
cmp dword [esi + 0x18], 8
jb 0x40ad8f
mov eax, dword [esi + 4]
jmp 0x40ad92
lea eax, [esi + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043dae6
leave
ret
Function at 0x40adaa
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c8], esi
call fcn.0040a588
pop ecx
test al, al
je 0x40af4c
push 0x460524
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00403514
mov eax, dword [ebp - 0x70]
add esp, 0xc
cmp dword [ebp - 0x5c], 8
jae 0x40adf4
lea eax, [ebp - 0x70]
push ebx
push edi
lea ecx, [ebp - 0x2c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 0x2cc], eax
cmp eax, 0xffffffff
je 0x40af2b
mov esi, 0x460520
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x20]
call fcn.004033f2
push 0x46051c
lea ecx, [ebp - 0x20]
call fcn.004017ef
test eax, eax
je 0x40aef4
push 0x460514
lea ecx, [ebp - 0x20]
call fcn.004017ef
test eax, eax
je 0x40aef4
test byte [ebp - 0x2c4], 0x10
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x2c8]
lea eax, [ebp - 0x2e8]
push eax
je 0x40aeb5
call fcn.00403514
add esp, 0xc
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00403549
add esp, 0xc
push ebx
push edi
lea ecx, [ebp - 0x2e8]
call fcn.00402515
lea eax, [ebp - 0x3c]
push eax
call fcn.0040adaa
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
pop ecx
jae 0x40aea9
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x3c]
jmp 0x40aeed
call fcn.00403514
add esp, 0xc
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403549
add esp, 0xc
push ebx
push edi
lea ecx, [ebp - 0x2e8]
call fcn.00402515
cmp dword [ebp - 0x40], 8
mov eax, dword [ebp - 0x54]
jae 0x40aee3
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
push ebx
push edi
call fcn.00402515
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00402515
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40ae1d
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x2c8]
cmp dword [esi + 0x18], 8
jb 0x40af36
mov eax, dword [esi + 4]
jmp 0x40af39
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
push edi
lea ecx, [ebp - 0x74]
call fcn.00402515
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043dae6
leave
ret
Function at 0x40af59
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1f8]
sub esp, 0x278
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp + 0x1f4], eax
mov ecx, dword [ebp + 0x200]
push ebx
mov dword [ebp - 0x44], ecx
call fcn.00402ca6
lea eax, [ebp - 0x48]
push eax
push 0x1a
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
xor eax, eax
push 0x206
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push ebx
push eax
call fcn.0043d840
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40b14f
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x68]
call fcn.004033f2
mov eax, dword [eax + 0x14]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040ab8e
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00402515
push str.duowanyymixer_setup.ini
lea ecx, [ebp - 0x68]
call fcn.0040371f
or esi, 0xffffffff
push esi
push ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.00403096
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.0040280e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40b01e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040daa7
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x80]
call fcn.0040ef41
lea ecx, [ebp - 0x34]
call fcn.0040de2d
push 1
lea ecx, [ebp - 0x80]
call fcn.0040ef9c
test al, al
je 0x40b13b
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040f2b9
push ebx
push ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040f563
jmp 0x40b0b5
push str.macId
lea ecx, [ebp - 0x3c]
call fcn.0040daa7
push ebx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040dc75
cmp eax, esi
lea ecx, [ebp - 0x3c]
setne byte [ebp - 0x35]
call fcn.0040de2d
cmp byte [ebp - 0x35], bl
jne 0x40b0bf
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040f563
push eax
lea ecx, [ebp - 0x34]
call fcn.0040de3b
lea ecx, [ebp - 0x40]
call fcn.0040de2d
mov eax, dword [ebp - 0x34]
cmp dword [eax + 8], ebx
jne 0x40b069
jmp 0x40b12b
push 0x461854
lea ecx, [ebp - 0x40]
call fcn.0040daa7
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040dcf6
inc eax
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040e018
mov ecx, eax
call fcn.0040d9ab
mov esi, eax
mov ecx, esi
call fcn.0040a0cb
mov eax, dword [esi]
push dword [eax + 0xc]
mov ecx, dword [ebp - 0x44]
call fcn.004033d5
mov eax, dword [ebp - 0x3c]
dec dword [eax]
cmp dword [eax], ebx
jne 0x40b11b
push dword [ebp - 0x3c]
call fcn.0040d8a5
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.0040de2d
lea ecx, [ebp - 0x40]
call fcn.0040de2d
lea ecx, [ebp - 0x34]
call fcn.0040de2d
lea ecx, [ebp - 0x58]
call fcn.0040de2d
lea ecx, [ebp - 0x80]
call fcn.0040f078
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0040280e
pop esi
push dword [ebp - 0x48]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x1f4]
mov eax, dword [ebp - 0x44]
xor ecx, ebp
pop ebx
call fcn.0043dae6
add ebp, 0x1f8
leave
ret
Function at 0x40b816
Capabilities:
Check http status code
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x478a78]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push esi
mov esi, dword [ebp + 0xa8]
push edi
mov ebx, 0xff
push ebx
lea eax, [ebp - 0x63]
push 0
push eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x6c], esi
mov byte [ebp - 0x64], 0
call fcn.0043d840
add esp, 0xc
push 4
pop edi
push 0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x20000013
push esi
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x68], edi
call esi
test eax, eax
jne 0x40b896
xor al, al
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dae6
add ebp, 0xa0
leave
ret 4
push dword [ebp - 0x74]
push str.CWinInetHttpBase::RecvResponse__nStatus__d.
call fcn.0043b312
cmp dword [ebp - 0x74], 0xc8
pop ecx
pop ecx
je 0x40b8b7
cmp dword [ebp - 0x74], 0xce
jne 0x40b87a
mov dword [ebp - 0x68], edi
xor edi, edi
push edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x20000005
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x40b8d6
mov dword [ebp - 0x70], edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
mov ebx, dword [ebp - 0x80]
cmp byte [ebx + 0x1c], 0
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x7c], edi
push eax
jne 0x40b8f5
push 0x1d
jmp 0x40b8f7
push 0x16
push dword [ebp - 0x6c]
call esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x74]
mov ecx, ebx
push dword [ebp - 0x70]
call fcn.0040b790
test al, al
je 0x40b87a
mov eax, 0x2000
mov dword [ebp - 0x78], edi
cmp dword [ebp - 0x70], eax
ja 0x40b929
mov esi, 0x400
jmp 0x40b937
mov ecx, 0x10000
cmp ecx, dword [ebp - 0x70]
sbb esi, esi
and esi, eax
add esi, eax
push esi
call fcn.0043c385
mov edi, eax
pop ecx
test edi, edi
jne 0x40b950
push eax
call fcn.0043d704
pop ecx
jmp 0x40b87a
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x40b96e
cmp dword [ebp - 0x78], 0
je 0x40b981
push dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
push edi
call fcn.0040b7b7
test al, al
je 0x40b97d
lea eax, [ebp - 0x78]
push eax
push esi
push edi
push dword [ebp - 0x6c]
call ebx
test eax, eax
jne 0x40b958
xor bl, bl
jmp 0x40b983
mov bl, 1
push edi
call fcn.0043d704
pop ecx
mov al, bl
jmp 0x40b87c

Function at 0x40ba2c
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret