joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f900
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4db324]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44f989
mov ecx, dword [ebp + 8]
test cl, 0xf
jne 0x44f922
sub dword [ebp + 0x14], 0x10
mov eax, dword [ebp + 0x14]
mov dl, byte [eax]
inc eax
mov byte [0x4db32c], dl
mov dword [ebp + 0x14], eax
mov eax, dword [0x4db628]
mov edx, fcn.00435020
add edx, eax
add eax, ecx
mov cl, byte [edx + ecx]
mov edx, dword [ebp + 0xc]
mov byte [eax + edx], cl
pushal
mov esi, dword [ebp + 0xc]
add esi, dword [ebp + 8]
mov ch, 7
and ah, cl
mov eax, dword [0x4db628]
add esi, eax
xor ax, ax
mov ah, byte [0x4db32c]
or bl, 0x18
and bl, cl
xor byte [esi], ah
popal
mov eax, dword [ebp + 8]
inc eax
cmp eax, 0x744
mov dword [ebp + 8], eax
jg 0x44f98e
mov eax, dword [0x4db324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x44f916
call fcn.0046a500
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x469dc0
Capabilities:
Compare security identifiers
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Query or enumerate registry value
Set current directory
Terminate thread
Write clipboard data

Disassembly:
push ecx
push 0
push 0
push 0
push 0
Function at 0x46a340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x804
push ebx
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x814]
mov ecx, dword [esp + 0xc]
cmp ecx, eax
mov dword [esp + 0x88], 0x44f9b0
jne 0x46a381
push 0
call fcn.0044f800
add esp, 4
call fcn.00469dc0
jmp 0x46a386
call fcn.0044f820
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x4d8358
mov dword [esp + 0x2c], fcn.0046a500
mov dword [esp + 0x20], 0x41b010
mov dword [esp + 0x28], fcn.0044fdb0
mov dword [esp + 0x34], 0x484510
call ebx
mov dword [esp + 0x84], eax
mov edi, 0x4d8348
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x60]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x38], 0x4b8690
shr ecx, 2
mov dword [esp + 0x44], 0x2e706c65
mov word [esp + 0x48], 0x6c64
mov byte [esp + 0x4a], 0x6c
push 0x4d8334
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x4db340], 0
and ecx, 3
mov dword [0x4db344], 0
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x24], fcn.004357f0
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], 0x4b86b0
mov dword [esp + 0x1c], 0x401000
mov dword [esp + 0x38], 0x49e520
mov dword [esp + 0x40], 0x4d8250
mov dword [esp + 0x44], 0x68707061
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov dword [0x50b750], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x46a489
mov eax, 0x13
mov dword [esp + 0x2c], 0x401000
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], 0x49e520
jmp 0x46a4d7
mov ecx, dword [esp + 0x814]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x50b7d4
push 0x4db6e8
mov dword [0x4db344], eax
call ebx
push eax
call esi
mov edx, dword [esp + 0x84]
push 0x4db734
push edx
mov dword [0x4db334], eax
call esi
mov dword [esp + 0x80], eax
lea eax, [esp + 0x90]
push edi
push eax
call fcn.0044fd70
lea ecx, [esp + 0x10]
lea edx, [esp + 0x90]
push ecx
call edx
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x804
ret
Function at 0x493f07
Capabilities:
Encode data using xor

Disassembly:
int 0x45
sbb al, 0x7e
lodsd eax, dword [esi]
jle 0x493f5d
push ebx
dec edx
inc ebx
pop esp
imul ecx, dword [ebp - 0x73b061e7], 0xffffff9f
pushfd
daa
jecxz 0x493ef9
lahf
stc
pop edi
fdiv qword [ebx]
push 0x3e
not dword [ebx]
dec eax
ficom dword [edi + ebp*2 + 0x71]
jle 0x493f98
cmp al, 0x98
inc ebx
inc esi
scasb al, byte es:[edi]
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
jge 0x493f78
dec esp
lahf
pushfd
mov edi, 0xd33be3ec
int 0xde
lea ebp, [esi]
sub al, 0xe2
sbb dword [edi], esp
cwde
push ebx
mov ebp, 0xb660716e
or dword [esi + 0x44], 0xffffff9c
xchg esp, eax
scasb al, byte es:[edi]
mov esi, 0x54944d7d
xor ebx, 0xd33fe322
or dword [edx], ebx
sar dword [edx], 0xe4
insb byte es:[edi], dx
invalid
je 0x493fd8
push ebx
push eax
pop ds
pop esp
out dx, eax
mov ah, 5
xor al, 0x4c
ror dword [edi + eax*2 - 0x771e101d], 1
inc edi
jecxz 0x493f5a
loope 0x493ef5
test byte [ebx + 0x3c8c0193], dh
or eax, 0xd1b0e74
cld
jno 0x493ff6
inc ebp
mov ss, word [esi - 0x2a9bb2c1]
mov esi, 0x475d547c
invalid
cmpsd dword [esi], dword es:[edi]
lea ebx, [edi + 0x1e4eae6c]
mov bh, 0x6e
and edi, ebp
mov byte [0x8e2ccf], al
mul dword [ebx + 0x5ff932da]
mov esp, ebx
sbb byte [eax + ebp + 0x2e], ch
sbb byte [ebx], dl
xor ebx, ecx
das
mov al, byte [0x888e3d05]
or bl, byte [ecx - 0x43]
pop edi
sar byte [edi + 0x70], 1
insb byte es:[edi], dx
mov word [esi - 0x28e63c01], ds
sub al, 0x9e
out dx, al
xchg esp, eax
inc ebx
inc ebx
loop 0x493f68
rol dword [ebx], cl
mov eax, 0x6a62968b
jae 0x493ffc
mov edx, dword [esi + 0x1e736a62]
xchg ecx, eax
test eax, 0x525e1002
into
add edi, dword [edi + 3]
into
insb byte es:[edi], dx
xor dword [edi], ebx
into
mov eax, dword [0x654b11de]
pop esi
cmp eax, 0x121f0d0f
jg 0x49406b
pop ds
adc bh, byte [edi + 0x71]
mov cl, 0xa
cmp al, 0x5c
pop esp
push ebp
pop ebp
loop 0x494012
mov esi, 0x59020cbc
inc ebx
cmp dword [edx], esi
jmp 0xcf841af9
xor esp, dword [eax + 0x1f]
sbb cl, byte [eax]
fmul qword [esi + ebp*2 - 0x1e]
push eax
dec esi
mov al, 0x4e
xchg edx, eax
rcl dword [eax], cl
xor dword [eax - 0x4a718d69], 0xffffffa2
nop
and dword [eax - 0x29], edx
push eax
int 0x60
wait
test byte [ebx - 0x223ae60], 0x41
mov byte [0x6328a2bc], al
popal
mov dword [esi - 0x57156e34], ecx
mov ebp, 0xffc98220
into
les edi, [edx]
adc dl, byte [ebp + 0xc]
invalid
mov word [eax + 0x27194dba], cs
js 0x493ffd
adc ebx, ebx
call 0x4c930cfc
sbb dword [ecx - 0xa], edx
add byte [edx + 0xa], cl
retf 0x6af1
Function at 0x4aeba5
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x80165829
stosd dword es:[edi], eax
sub al, 0x23
push 0xfb191cef
push ss
sub byte [ebx - 0x1097dcd4], 0x1c
sbb ebx, edi
out 0x21, eax
mov bh, byte [edx - 0x1a]
rcr dword [esi + 0x46], 1
push esi
jecxz 0x4aeadb
aas
out dx, al
loopne 0x4aeadc
push es
push edi
in eax, dx
sub al, 0x27
pop ebx
sbb dword [ecx - 0x23], edx
ja 0x4aeac1
pushfd
in al, dx
sbb al, 6
and ch, ch
insd dword es:[edi], dx
out 0x26, eax
mov word [esi + 0x18], ds
push esi
mul byte [edi + 0x4ac5e338]
jecxz 0x4aea76
dec edx
invalid
pop ebp
loopne 0x4aea79
and eax, 0x3720700d
mov dl, byte [edx - 0x45]
sub dword [edi + 0x377c9b39], esp
or al, 0x57
xor byte [edi + 0x1290459d], bl
mov cl, byte [ecx - 0x112337af]
mov dword [ecx - 0x38], edx
fsub st(6), st(0)
push ecx
enter 0xffffffffffffeedc, 0x40
inc eax
add al, 0xc6
mov ebx, 0x19f7bac7
mov dh, 0xc5
mov edx, 0xc5b619f7
int 0xd1
or edi, edx
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
mov eax, 0x89e65ec0
popfd
test eax, 0xde900780
jge 0x4aeaf0
invalid
sub eax, 0xcd5b3fac
pushal
pushfd
jge 0x4aeb60
mul ecx
jg 0x4aeb5a
mov edi, 0xe7a8da3e
mov eax, dword [0x1c154ce4]
inc ebx
xor ch, al
js 0x4aeaaf
adc byte [edi - 0x5a], dl
inc esp
xor byte [edi + 0x4a12b63d], 0xd0
mov esp, 0xa0225bec
sbb esi, 0x37ad1a55
invalid
xchg ecx, eax
stosb byte es:[edi], al
mov bl, 4
mov al, byte [0x59ea9e6a]
jnp 0x4aeae6
sahf
ljmp 0xeb62
adc dword [edx - 0x15], esp
push ebp
je 0x4aeb7b
wait
and dword [edx - 0x59de84cf], ebx
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
dec ebx
imul ebp, ebx, 0x1cfe986
salc
mov ch, 0x1f
loope 0x4aeb0c
push eax
retf 0x1f10
mov ecx, 0x49cb0571
loope 0x4aeb71
dec esp
dec ebx
cmp eax, 0xddb510bd
push edi
cmp al, 0x5c
sub eax, 0x80075f74
and dh, byte [edx + 0x405a415b]
iretd
Function at 0x4b8530
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4db4c0]
push ebx
push esi
push edi
test eax, eax
jne 0x4b8680
xor edi, edi
xor ebx, ebx
push edi
push 0x4d8380
push 0x4db4a0
add ebx, 0x1000
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp edi, 0x64
jae 0x4b85a9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4d8368
mov dword [0x50b768], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4b85a9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 2
push ebx
mov dword [0x4db4c0], ebx
call esi
test eax, eax
jne 0x4b8666
mov ecx, dword [0x4db4c0]
cmp word [ecx], 0x5a4d
jne 0x4b8666
mov eax, dword [ecx + 0x3c]
push 0x100
add eax, ecx
push eax
mov dword [0x4db5b4], eax
call esi
test eax, eax
jne 0x4b8666
mov eax, dword [0x4db5b4]
cmp word [eax], 0x4550
jne 0x4b8666
mov ecx, dword [eax + 0x28]
mov edx, dword [0x4db4c0]
dec ebp
add byte [ebx - 0x35fcf7c0], cl
cmp eax, 0x5abba00d
mov dword [ebp - 4], ecx
je 0x4b8674
cmp eax, 0x5af06e8d
je 0x4b8674
cmp eax, 0x5b79bd28
je 0x4b8674
cmp eax, 0x5bbb5a49
je 0x4b8674
cmp eax, 0x5aafbe34
je 0x4b863e
cmp eax, 0x5add9069
je 0x4b863e
cmp eax, 0x5b73d047
je 0x4b863e
cmp eax, 0x5bb345ac
jne 0x4b8666
mov eax, dword [0x4db4c0]
push eax
mov eax, 3
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 4]
call eax
mov eax, dword [0x4db4c0]
push eax
mov eax, 1
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 4]
call eax
inc edi
cmp edi, 0x70000
jae 0x4b8680
jmp 0x4b8548
call fcn.004b8530
int3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d2881
Capabilities:
Terminate process

Disassembly:
cmp dword [0x53bbd8], 1
jne 0x4d288f
call 0x334d3c10
dec esp
add byte [eax], al
add al, 0xe8
mov cl, 0x13
add byte [eax], al
pop ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4d3c57
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d8468
cmp edx, dword [eax]
je 0x4d3c6b
add eax, 8
inc ecx
cmp eax, 0x4d84f8
jb 0x4d3c5c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d8468]
jne 0x4d3d99
mov eax, dword [0x53bbd8]
cmp eax, 1
je 0x4d3d73
test eax, eax
jne 0x4d3c9c
cmp dword [0x4d83a0], 1
je 0x4d3d73
cmp edx, 0xfc
je 0x4d3d99
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4d3cd3
lea eax, [ebp - 0x1a4]
push 0x4db278
push eax
call fcn.004d5680
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004d5cb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4d3d16
lea eax, [ebp - 0x1a4]
push eax
call fcn.004d5cb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4db274
push edi
call fcn.004d69c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4db258
push eax
call fcn.004d5680
lea eax, [ebp - 0xa0]
push edi
push eax
lea eax, [ebp + 8]
lea esi, [esi + 0x4d846c]
push 0
push eax
push dword [esi]
call fcn.004d5cb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4028c0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4010
call fcn.00429820
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x400c], eax
xor eax, eax
push 0x3ffe
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0041c7f0
add esp, 0xc
mov dword [esp + 4], 0
test esi, esi
je 0x4029a9
test edi, edi
je 0x4029a9
lea edx, [esp + 4]
push edx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4029a9
cmp eax, 0x3fff
ja 0x4029a9
lea ecx, [esp + 0xc]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4029a9
lea edx, [esp + 8]
push edx
lea eax, [esp + 4]
push eax
push 0x43a634
lea ecx, [esp + 0x18]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4029a9
push 0x208
push 0
push edi
call fcn.0041c7f0
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x43a638
push 0x103
push edi
call fcn.0041acc9
add esp, 0x28
mov eax, 1
mov ecx, dword [esp + 0x400c]
xor ecx, esp
call fcn.0041a78f
add esp, 0x4010
ret
mov ecx, dword [esp + 0x400c]
xor ecx, esp
xor eax, eax
call fcn.0041a78f
add esp, 0x4010
ret

Function at 0x402f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402f8d
pop edi
pop ebp
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402fc4
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402fc0
lea ebx, [ebx]
cmp esi, eax
jae 0x402fc4
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x402fb0
cmp esi, eax
jb 0x402fcb
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x403500
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x434640
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x2c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
push esi
mov dword [esp + 0x1c], ebx
call edi
cmp eax, ebx
je 0x40366a
push ebp
call edi
cmp eax, ebx
je 0x40355e
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x2c]
push eax
push 0x43a9b8
push 0x17
push ebx
push 0x43a9a8
mov dword [esp + 0x38], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x403652
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40366a
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x28], 1
mov ecx, dword [eax]
push 0x43a9c8
push eax
mov eax, dword [ecx]
call eax
cmp eax, ebx
jge 0x4035cd
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x403652
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x403652
cmp dword [esp + 0x14], ebx
je 0x403652
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
cmp eax, ebx
jl 0x4035b0
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
je 0x4035f9
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x2c]
call eax
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x403616
push esi
call edi
test eax, eax
je 0x403616
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push ebx
push esi
push eax
call edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
xor ecx, ecx
cmp eax, ebx
setge cl
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp eax, ebx
je 0x403652
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40366a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x403690
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x441618
push 0x41c8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4451b0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x43a8c4
push 0xc01
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x403766
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x403766
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x403766
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x20], 0
push 0
push 0x80
push 2
push 0
push 1
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x403766
push 0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov edx, dword [ebp - 0x2c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x403766
xor eax, eax
cmp edi, dword [ebp - 0x20]
sete al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0040378c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x403d20
Capabilities:
Delete file

Disassembly:
push ecx
push esi
lea esi, [esp + 4]
call fcn.00404990
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 3
push 0xa01
push 0
call esi
push eax
lea eax, [edi + 0x28]
call fcn.00410320
push 3
push 0xa02
push 0
call esi
push eax
lea eax, [edi + 0x9c]
call fcn.00410320
mov ecx, dword [edi + 0x200]
inc ecx
push ecx
push 0xb01
push 0
call esi
push eax
lea eax, [edi + 0x110]
call fcn.00410320
mov edx, dword [edi + 0x200]
inc edx
push edx
push 0xb02
push 0
call esi
push eax
lea eax, [edi + 0x184]
call fcn.00410320
mov eax, dword [edi + 4]
push 0
push 0x7d0
push 0x681
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4044a0
Capabilities:
Delete file

Disassembly:
push esi
push edi
call fcn.004050c0
mov ecx, str.del_icon
call fcn.0040b7d0
mov esi, dword [esp + 0xc]
lea edi, [esp + 0xc]
call fcn.004046d0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4044e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
test esi, esi
pop esi
je 0x40450b
call fcn.004050c0
mov ecx, str.del_icon_succ
call fcn.0040b7d0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
ret 4
call fcn.004050c0
mov ecx, str.del_icon_fail
call fcn.0040b7d0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
ret 4

Function at 0x4046d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0x208
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call fcn.0041c7f0
add esp, 0xc
push 1
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp]
mov eax, esi
call fcn.00404690
mov edx, dword [eax]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [esp]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404748
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str..lnk
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
push edi
lea ecx, [esp + 8]
call fcn.004029c0
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, edi
call fcn.0041a78f
add esp, 0x210
ret
Function at 0x4047f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4353db
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x234]
push 0x208
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.0041c7f0
add esp, 0xc
push 0
push 0x1a
lea ecx, [esp + 0x20]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.LDSGameMasterPkgInfo
lea edx, [esp + 0x1c]
push edx
call ebx
cmp dword [esi + 0x2e8], 8
jb 0x404881
mov ecx, dword [esi + 0x2d4]
jmp 0x404887
lea ecx, [esi + 0x2d4]
lea edi, [esp + 0x10]
call fcn.004032f0
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
mov dword [esp + 0x230], 0
call fcn.00404fe0
mov eax, dword [eax]
add esp, 4
push eax
lea edx, [esp + 0x1c]
push edx
call ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4048d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x22c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4048ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.PkgIcon.ico
lea edx, [esp + 0x1c]
push edx
call ebx
push ebp
lea ecx, [esp + 0x1c]
call fcn.004029c0
mov eax, ebp
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0041a78f
add esp, 0x220
ret 4