joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bfd3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, 0x81
push edi
xor edx, edx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x414]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp - 4]
call fcn.0040ac40
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
test eax, eax
jne 0x40c08c
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.0040acc7
test eax, eax
jne 0x40c08c
mov ecx, edi
call fcn.0040ad4e
test eax, eax
jne 0x40c08c
mov ecx, edi
call fcn.0040add5
test eax, eax
jne 0x40c08c
mov ecx, edi
call fcn.0040ae5c
test eax, eax
jne 0x40c08c
and word [ebp - 0x20c], ax
mov ecx, esi
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push 0x42b324
lea eax, [ebp - 0x20c]
push 0x103
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040ff68
add esp, 0x14
mov ecx, dword [ebp - 4]
call fcn.0040ac40
test eax, eax
jne 0x40c0d4
and word [ebp - 0x20c], ax
mov ecx, esi
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push 0x42b310
lea eax, [ebp - 0x20c]
push 0x103
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040ff68
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c0d9
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
push ebx
push esi
mov esi, 0x81
push edi
xor ebx, ebx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40c266
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
mov edi, 0x104
push eax
push 0x42b3d8
lea eax, [ebp - 0x410]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c189
lea eax, [ebp - 0x208]
push eax
push 0x42b3bc
lea eax, [ebp - 0x410]
push edi
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call fcn.0040ff68
add esp, 0x14
mov ebx, 0x103
lea eax, [ebp - 0x208]
push ebx
push 0x42b3ac
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
and word [ebp - 0xa28], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa26]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x42b384
push eax
push 0x4225d8
lea eax, [ebp - 0xa28]
push ebx
push eax
call esi
and word [ebp - 0x820], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x81e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x42b360
push eax
push 0x4225d8
lea eax, [ebp - 0x820]
push ebx
push eax
call esi
and word [ebp - 0x618], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x616]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x42b33c
push eax
push 0x4225d8
lea eax, [ebp - 0x618]
push ebx
push eax
call esi
add esp, 0x48
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004100f2
add esp, 0x10
jmp 0x40c268
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c26d
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x141c
call fcn.00415c50
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x40c396
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp word [esi + eax*2 - 2], 0x5c
pop ecx
push esi
jne 0x40c2b8
push 0x42b428
jmp 0x40c2bd
push 0x42b41c
lea eax, [ebp - 0x214]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x141c]
push 0x1000
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40c396
mov eax, dword [ebp - 4]
shr eax, 2
je 0x40c396
push ebx
lea ebx, [ebp - 0x141c]
mov dword [ebp + 8], eax
mov edx, dword [ebx]
test edx, edx
je 0x40c389
and word [ebp - 0x41c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
push edx
push 0
push 0x1f0fff
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40c389
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40c382
lea eax, [ebp - 0x41c]
push 0x103
push eax
push dword [ebp - 8]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x40c382
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
dec dword [ebp + 8]
jne 0x40c305
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x40c39c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov edx, dword [ebp + 8]
test edx, edx
je 0x40c454
cmp word [edx], 0
je 0x40c454
mov ax, word [0x42eef4]
push edi
mov word [ebp - 0x244], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x242]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x42b44c
lea eax, [ebp - 0x244]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x34], 0
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x244]
add esp, 0x1c
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x30], 0x42295c
mov dword [ebp - 0x2c], 0x42b430
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x40c454
push 0x4e20
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4
Function at 0x40c458
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
push 0x42b578
lea eax, [ebp - 0xc]
lea esi, [edi + 0xa94]
xor ebx, ebx
push esi
push eax
call fcn.0040e039
push 0x42b558
lea eax, [ebp - 8]
push esi
push eax
call fcn.0040e039
push 0x42b530
lea eax, [ebp - 4]
push esi
push eax
call fcn.0040e039
push dword [ebp - 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x40c5a5
push dword [ebp - 8]
call esi
test eax, eax
je 0x40c5a5
push dword [ebp - 4]
call esi
test eax, eax
je 0x40c5a5
mov eax, dword [0x42122c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040a632
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040a632
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040a632
add esp, 0x18
lea ecx, [ebp - 0x24]
push 0x42b4ec
call fcn.0040a6e9
push 0x42b4a8
lea ecx, [ebp - 0x20]
call fcn.0040a6e9
push 0x42b464
lea ecx, [ebp - 0x1c]
call fcn.0040a6e9
push dword [ebp - 0x18]
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
push dword [ebp - 0x24]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x40c575
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x40c575
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x40c575
push 1
mov ecx, edi
pop ebx
push dword [ebp - 0xc]
call fcn.0040c39c
push dword [ebp - 8]
mov ecx, edi
call fcn.0040c39c
push dword [ebp - 4]
mov ecx, edi
call fcn.0040c39c
lea ecx, [ebp - 0x1c]
call fcn.00402479
lea ecx, [ebp - 0x20]
call fcn.00402479
lea ecx, [ebp - 0x24]
call fcn.00402479
lea ecx, [ebp - 0x10]
call fcn.00402479
lea ecx, [ebp - 0x14]
call fcn.00402479
lea ecx, [ebp - 0x18]
call fcn.00402479
lea ecx, [ebp - 4]
call fcn.00402479
lea ecx, [ebp - 8]
call fcn.00402479
lea ecx, [ebp - 0xc]
call fcn.00402479
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x40c5c4
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
mov esi, ecx
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
mov word [ebp - 0x214], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x214]
push 0x1a
push eax
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x214]
push 0x42b614
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x214]
add esi, 0xa94
test eax, eax
je 0x40c62e
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x214]
push ecx
push eax
mov ecx, esi
call fcn.00401af1
push dword [esi]
mov ecx, dword [ebp - 4]
call fcn.0040c26d
and word [ebp - 0x41c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 8]
push eax
push 0x42eef4
push 0x42b59c
push SysReAllocString
mov dword [ebp - 0xc], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40c6b3
push dword [esi]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
pop ecx
test eax, eax
pop ecx
je 0x40c6b3
mov ecx, dword [ebp - 4]
call fcn.0040c458
push dword [esi]
call fcn.0040ff68
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40cbc3
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], esi
cmp word [esi + 0x210], bx
jne 0x40cbe5
xor eax, eax
jmp 0x40cc78
mov edx, 0x81
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esi, 8
mov ebx, 0x42ab7c
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, 0x103
push ebx
lea eax, [ebp - 0x414]
push edi
push eax
call esi
mov eax, dword [ebp - 4]
add eax, 0x210
push eax
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
mov ecx, dword [ebp - 4]
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call fcn.0040b703
test eax, eax
pop edi
je 0x40cc75
lea eax, [ebp - 0x414]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop eax
pop esi
pop ebx
leave
ret

Function at 0x40cc7c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebx + 8]
push eax
push 0x42ab7c
lea eax, [ebp - 0x208]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
lea eax, [ebp - 0x208]
push 0
push eax
call esi
push 4
add ebx, 0x210
push 0
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cd54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
cmp word [ecx + 0x210], 0
push esi
lea esi, [ecx + 0x210]
push edi
je 0x40ce19
and word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x42eef4
push 0x42c79c
push SysReAllocString
mov dword [ebp - 8], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x210], 0
je 0x40ce19
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x42c770
lea eax, [ebp - 0x418]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40ce19
push 1
pop eax
jmp 0x40ce1b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40cecd
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
push edi
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
je 0x40cff9
mov edx, 0x81
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x236]
mov word [ebp - 0x238], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x43e]
mov word [ebp - 0x440], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x440]
push 0x26
push eax
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x440]
push eax
push 0x42c8f8
lea eax, [ebp - 0x238]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
jne 0x40cfa9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x42eef4
push 0x42c874
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
jne 0x40cfa9
mov word [ebp - 0x238], si
lea eax, [ebp - 0x238]
push eax
call ebx
test eax, eax
pop ecx
jbe 0x40cfdb
push 0xa
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
push 0x42295c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40d075
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x41d72c
push 0x15
push esi
push 0x41d71c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x40cffd
xor eax, eax
jmp 0x40d078
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x40d075
lea edx, [ebp - 4]
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 4], esi
je 0x40d02d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x20]
mov edi, eax
push edx
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20]
mov word [ebp - 0x20], si
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x30]
mov word [ebp - 0x30], 8
mov dword [ebp - 0x28], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d07f
Capabilities:
Check if file exists
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [ebp + 8]
push esi
test eax, eax
push edi
mov dword [ecx + 0x430], eax
je 0x40d0b7
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, SysReAllocString
push 0x42c998
push edi
call esi
push 0x42b100
push edi
call esi
jmp 0x40d17a
and word [ebp - 0x410], 0
mov esi, 0x81
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d17a
and word [ebp - 0x208], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
mov edi, 0x103
push eax
push 0x42c984
lea eax, [ebp - 0x208]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d145
lea eax, [ebp - 0x208]
push eax
call fcn.0040fee4
pop ecx
lea eax, [ebp - 0x208]
push eax
push 0x42c968
lea eax, [ebp - 0x410]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push 0x42c964
push 0x42c954
push 0x42c93c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret 4

Function at 0x40d180
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, 0x103
stosw word es:[edi], ax
lea eax, [edx + 0x210]
mov dword [ebp - 4], eax
push eax
push 0x42c9d8
lea eax, [ebp - 0x414]
push ebx
push eax
call esi
and word [ebp - 0x20c], 0
push dword [ebp - 4]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
push 0x42c9c0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40d225
push 0
push 0xbb8
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0040f65e
add esp, 0x10
leave
ret
Function at 0x40d227
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 4
pop eax
xor ebx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x42ca74
push 0x4227ec
push SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, 0x81
xor eax, eax
cmp dword [ebp - 4], ebx
lea edi, [ebp - 0x212]
mov word [ebp - 0x214], bx
lea ebx, [esi + 0x210]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
jne 0x40d28f
push 0x42ca40
jmp 0x40d294
push 0x42ca08
mov esi, 0x103
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
and word [ebp - 0x41c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push ebx
push 0x42c9c0
lea eax, [ebp - 0x41c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40d306
push 0
push 0xbb8
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0040f65e
add esp, 0x10
leave
ret
Function at 0x40dbc4
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 1
mov dword [ebp - 8], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, 0x81
mov dword [0x42f978], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa2e]
mov word [ebp - 0xa30], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa30]
push 0x103
push eax
call fcn.0040fec5
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 1
push 6
push 0x42caec
call fcn.00403457
add esp, 0x18
test eax, eax
je 0x40ddb5
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x416]
mov word [ebp - 0x418], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push esi
push eax
push esi
push esi
push esi
push 0x2710
push 1
push esi
push 1
push esi
push esi
push 0x42caec
call fcn.0040ecb6
add esp, 0x30
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ddb5
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x61e]
mov word [ebp - 0x620], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x826]
mov word [ebp - 0x828], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x620]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x620]
push 0x42cad0
push eax
lea eax, [ebp - 0x828]
push eax
call edi
lea eax, [ebp - 0x620]
push 0x42cab4
push eax
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0x210]
mov edi, dword [ebp - 8]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x418]
push eax
mov ecx, edi
call fcn.0040ddba
test eax, eax
je 0x40dd5b
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.0040d9db
mov ecx, edi
call fcn.0040d3c1
test eax, eax
je 0x40dd55
mov ecx, edi
call fcn.0040d54f
mov dword [0x42f98c], 1
jmp 0x40dd5b
mov dword [0x42f98c], esi
push dword [0x42f978]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x418]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40dd89
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x828]
push eax
call esi
test eax, eax
je 0x40dd9f
lea eax, [ebp - 0x828]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
je 0x40ddb5
lea eax, [ebp - 0x210]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ddba
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40dea2
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x40dea2
cmp dword [ebp + 0x14], edi
je 0x40dea2
push ebx
mov dword [ebp + 0x10], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410b66
pop ecx
test eax, eax
pop ecx
je 0x40de9c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40de9c
push esi
call fcn.00416056
test eax, eax
pop ecx
je 0x40de9c
push esi
call fcn.0041099b
test eax, eax
pop ecx
je 0x40de9c
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x40de9c
push 0x42cb58
push 0x42cb44
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x40de95
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
mov dword [ebp + 8], eax
je 0x40de95
test eax, eax
je 0x40de95
push 0x42cb3c
push dword [ebp + 0x14]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x40de95
push esi
push 1
push dword [ebp + 8]
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x10]
pop ebx
jmp 0x40dea4
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10