joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405730
Capabilities:
Get common file path
Get startup folder
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push str.CInstallCtrl::GetModeInstallPath____r_n
mov dword [ebp - 0x210], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x515274
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x515278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x4057b3
xor ecx, ecx
jmp 0x4057cf
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4057c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00401d30
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00412b06
mov esp, ebp
pop ebp
ret 4

Function at 0x405800
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5b56
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push str.CInstallCtrl::GetOldInstallPath____r_n
mov dword [ebp - 0x248], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
mov dword [ebp - 4], eax
xorps xmm0, xmm0
movq qword [ebp - 0x228], xmm0
mov esi, reloc.WS2_32.dll_bind
mov dword [ebp - 0x220], eax
mov dword [ebp - method.Registry.virtual_0], vtable.Registry.0
mov dword [ebp - 0x224], reloc.WS2_32.dll_bind
mov dword [ebp - 0x220], esi
push str.ZZDS_PC
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push str.Software_s
push eax
call fcn.00407b60
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4058fb
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x240]
push eax
push str.InstPath
call fcn.0040b270
mov esi, dword [ebp - 0x220]
cmp dword [ebp - 0x230], 0
jne 0x405924
push edi
call fcn.00405730
test esi, esi
je 0x405915
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x22c]
cmp ecx, 8
jb 0x40595b
inc ecx
push ecx
jmp 0x40594a
lea eax, [ebp - 0x240]
mov ecx, edi
push eax
call fcn.00404e50
test esi, esi
je 0x40593d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
cmp eax, 8
jb 0x40595b
inc eax
push eax
push dword [ebp - 0x240]
lea ecx, [ebp - 0x240]
call fcn.00401e90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret 4
Function at 0x406220
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5c76
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.CInstallCtrl::CreateLnk____r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ZhuanZhuan.exe
add esi, 4
lea eax, [ebp - 0x640]
push esi
push eax
call fcn.00407c20
add esp, 0xc
push str.uninst.exe
lea eax, [ebp - 0x658]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00407c20
add esp, 0xc
push 0
push 0x17
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
push 0x515274
push eax
call esi
push 0x51540c
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x218]
call fcn.0040bec0
push 0x51540c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._s_s.lnk
push eax
call fcn.00407b60
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x640]
cmovae esi, dword [ebp - 0x640]
lea ecx, [ebp - 0x640]
cmovae ecx, dword [ebp - 0x640]
push eax
push esi
call fcn.0040bc60
push 0x51540c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x515438
push eax
call fcn.00407b60
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x658]
cmovae esi, dword [ebp - 0x658]
lea ecx, [ebp - 0x658]
cmovae ecx, dword [ebp - 0x658]
push eax
push esi
call fcn.0040bc60
push 0x51540c
lea eax, [ebp - 0x628]
push str._s.lnk
push eax
call fcn.00407b60
add esp, 0x3c
lea eax, [ebp - 0x218]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._s_s
push eax
call fcn.00407b60
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x640]
cmovae esi, dword [ebp - 0x640]
lea ecx, [ebp - 0x640]
cmovae ecx, dword [ebp - 0x640]
push eax
push esi
call fcn.0040bc60
mov eax, dword [ebp - 0x644]
add esp, 0x18
cmp eax, 8
jb 0x406401
inc eax
lea ecx, [ebp - 0x658]
push eax
push dword [ebp - 0x658]
call fcn.00401e90
xor eax, eax
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x648], 0
cmp eax, 8
jb 0x40643c
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00401e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret
Function at 0x407050
Capabilities:
Create process on windows
Get system information on windows
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x844
mov eax, dword [0x526060]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push edi
push str.CInstallCtrl::InstallFinish____r_n
mov esi, ecx
call ebx
mov ecx, esi
call fcn.00406220
mov ecx, esi
call fcn.00406460
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x24]
cmp ax, 9
je 0x4070aa
cmp ax, 6
je 0x4070aa
xor eax, eax
jmp 0x4070af
mov eax, 1
test eax, eax
mov dword [esp + 0x20], 7
mov edx, str.zzdsMenu_64.dll
mov dword [esp + 0x1c], 0
mov ecx, str.zzdsMenu_32.dll
cmove edx, ecx
xor eax, eax
mov word [esp + 0xc], ax
cmp word [edx], ax
jne 0x4070de
xor ecx, ecx
jmp 0x4070f2
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4070e3
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00401d30
push str.CInstallCtrl::InstallDll____r_n
call ebx
cmp dword [esp + 0x20], 8
lea ecx, [esp + 0xc]
cmovae ecx, dword [esp + 0xc]
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x40711f
mov eax, dword [esi]
jmp 0x407121
mov eax, esi
push ecx
push eax
lea eax, [esp + 0x50]
push str._s___s_s_
push eax
call fcn.00407e60
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x58]
add esp, 0x10
push 0
push 0
push eax
push str.regsvr32.exe
push str.open
push 0
call edi
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x40716a
inc eax
lea ecx, [esp + 0xc]
push eax
push dword [esp + 0x10]
call fcn.00401e90
push 0xf
xor eax, eax
mov dword [esp + 0x24], 7
push str.ZZWordAddin.dll
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00401d30
push str.CInstallCtrl::InstallDll____r_n
call ebx
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x4071ae
mov esi, dword [esi]
push eax
push esi
lea eax, [esp + 0x50]
push str._s___s_s_
push eax
call fcn.00407e60
add esp, 0x10
lea eax, [esp + 0x48]
push 0
push 0
push eax
push str.regsvr32.exe
push str.open
push 0
call edi
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x4071f1
inc eax
lea ecx, [esp + 0xc]
push eax
push dword [esp + 0x10]
call fcn.00401e90
mov ecx, dword [esp + 0x84c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00412b06
mov esp, ebp
pop ebp
ret
Function at 0x407210
Capabilities:
Check if file exists
Create process on windows
Get common file path
Move file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5e6b
mov eax, dword fs:[0]
push eax
sub esp, 0xc84
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push str.CInstallCtrl::UnInstallOldDll____r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0xc3c]
push eax
call fcn.00407db0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc3c]
cmp dword [ebp - 0xc28], 8
cmovae eax, dword [ebp - 0xc3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4073f9
cmp dword [ebp - 0xc28], 8
lea eax, [ebp - 0xc3c]
cmovae eax, dword [ebp - 0xc3c]
push eax
lea eax, [ebp - 0xc24]
push str._u__s___s_
push eax
call fcn.00407e60
add esp, 0xc
lea eax, [ebp - 0xc74]
push 0x38
push 0
push eax
call fcn.004c4090
add esp, 0xc
mov dword [ebp - 0xc78], 0x3c
lea eax, [ebp - 0xc24]
mov dword [ebp - 0xc74], 0x40
mov dword [ebp - 0xc64], eax
lea eax, [ebp - 0xc78]
mov dword [ebp - 0xc70], 0
push eax
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0xc68], str.regsvr32.exe
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0xc5c], 5
mov dword [ebp - 0xc58], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xbb8
push dword [ebp - 0xc40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004c4090
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.004c4090
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.00404ff0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40739d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push str._s_s.dll
push eax
call fcn.00407b60
mov eax, dword [ebp - 0xc7c]
add esp, 0x10
cmp eax, 8
jb 0x4073d7
inc eax
lea ecx, [ebp - 0xc90]
push eax
push dword [ebp - 0xc90]
call fcn.00401e90
cmp dword [ebp - 0xc28], 8
lea ecx, [ebp - 0x424]
lea eax, [ebp - 0xc3c]
cmovae eax, dword [ebp - 0xc3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0xc28]
cmp eax, 8
jb 0x407417
inc eax
lea ecx, [ebp - 0xc3c]
push eax
push dword [ebp - 0xc3c]
call fcn.00401e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret 4
Function at 0x408f50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor edi, edi
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004c4090
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor esi, esi
nop
mov eax, 1
mov ecx, esi
shl eax, cl
test ebx, eax
je 0x408fb5
movzx eax, si
add eax, 0x41
push eax
lea eax, [ebp - 0x44]
push str._C:_
push eax
call fcn.00409e20
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x408fb5
inc edi
inc esi
cmp esi, 0x20
jb 0x408f80
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b06
mov esp, ebp
pop ebp
ret

Function at 0x408fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x409041
push ebx
call fcn.00404f40
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov ecx, dword [ebx]
push 0
push 0
push dword [ebx + 4]
or ecx, 2
push ecx
call fcn.004c8a65
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x409040
lea esi, [eax + 1]
push edi
push esi
call fcn.00413112
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push esi
push edi
push dword [ebx + 4]
push dword [ebx]
call fcn.004c8a89
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call fcn.0041310d
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x409110
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push str.CMainWnd::CMainWnd____r_n
mov dword [esi], vtable.CMainWnd.2.0
mov dword [esi + 0x10], vtable.CMainWnd.5.0
mov dword [esi + 0x20], vtable.CMainWnd.1.0
mov dword [esi + 0x24], vtable.CMainWnd.3.0
mov dword [esi + 0x28], vtable.CMainWnd.0
mov dword [esi + 0x2c], vtable.CMainWnd.4.0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.00408c50
test byte [ebp + 8], 1
je 0x409165
push 0x794
push esi
call fcn.00412b55
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x409170
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6018
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x526060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.CMainWnd::InitWindow____r_n
call ebx
lea edi, [esi + 0x30]
push str.closebtn
mov ecx, edi
call fcn.00450c80
push str.wizardTab
mov ecx, edi
mov dword [esi + 0x770], eax
call fcn.00450c80
push str.licenseshow
mov ecx, edi
mov dword [esi + 0x774], eax
call fcn.00450c80
push str.showPathOpt
mov ecx, edi
mov dword [esi + 0x778], eax
call fcn.00450c80
push str.moreconfiginfo
mov ecx, edi
mov dword [esi + 0x77c], eax
call fcn.00450c80
push str.editDir
mov ecx, edi
mov dword [esi + 0x780], eax
call fcn.00450c80
mov dword [esi + 0x784], eax
call fcn.00405010
lea eax, [ebp - 0x24]
push eax
call fcn.00405800
mov edx, eax
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 8
jb 0x409235
mov edx, dword [edx]
mov ecx, dword [esi + 0x784]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x40925d
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00401e90
push str.progress_tip
mov ecx, edi
call fcn.00450c80
push str.Progress
mov ecx, edi
mov dword [esi + 0x788], eax
call fcn.00450c80
mov dword [esi + 0x78c], eax
mov esi, dword [esi + 4]
call fcn.00405010
push str.CMainWnd::InitLicense____r_n
mov dword [eax + 0x1c], esi
call ebx
push str.editLicense
mov ecx, edi
call fcn.00450c80
mov ebx, eax
test ebx, ebx
je 0x4092c2
push ecx
call fcn.00409b10
mov esi, eax
test esi, esi
je 0x4092c2
mov edx, dword [ebx]
mov ecx, ebx
push esi
call dword [edx + 0x2c]
push esi
call fcn.0041310d
add esp, 4
call fcn.00408f50
mov esi, eax
push esi
push str.drives_:__d__r_n
call fcn.00408fd0
add esp, 8
cmp esi, 1
jne 0x4092f3
push str.btnInstall
mov ecx, edi
call fcn.00450c80
test eax, eax
je 0x4092f3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov dword [edi], 1
sub eax, 0x401
je 0x4095fe
sub eax, 1
je 0x4095e1
sub eax, 1
je 0x409548
mov dword [edi], 0
push edi
push dword [ebp + 0x10]
mov ecx, esi
push ebx
push dword [ebp + 8]
call fcn.0045b960
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret 0x10
push dword [esi + 0x790]
call fcn.00457960
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x770]
mov dword [esi + 0x790], 0
test ecx, ecx
je 0x409578
mov eax, dword [ecx]
push 1
call dword [eax + 0xf8]
test ebx, ebx
je 0x4095b4
push 0x64
mov ecx, esi
call fcn.00409db0
mov ecx, dword [esi + 0x774]
push 2
mov eax, dword [ecx]
call dword [eax + 0x204]
mov ecx, dword [esi + 4]
call fcn.0040c220
push ecx
call fcn.00405010
mov ecx, eax
call fcn.00405f30
test eax, eax
je 0x40963a
jmp 0x4095c7
mov ecx, dword [esi + 4]
sub esp, 0xc
mov edx, 0x515bac
call fcn.0040a480
add esp, 0xc
push str.CMainWnd::Exit____r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
push 0
push 0x10
mov ecx, esi
call fcn.00457ae0
jmp 0x40963a
push 0
push 0x320
push 1
call fcn.00457960
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x790], eax
jmp 0x40963a
cmp dword [esi + 0x788], 0
je 0x40962e
push ebx
lea eax, [ebp - 0x84]
push str.ck_W
push eax
call fcn.00409f50
mov ecx, dword [esi + 0x788]
lea edx, [ebp - 0x84]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78c]
push ebx
call fcn.0045c610
cmp dword [edi], 0
je 0x409526
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b06
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4098c0
Capabilities:
Copy file
Delete file
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.CMainWnd::onClose____r_n
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0x774]
call fcn.0045a8a0
cmp eax, 2
je 0x4099cd
push 1
push 1
mov ecx, esi
call fcn.00457d60
mov ecx, dword [esi + 4]
sub esp, 0xc
mov edx, 0x515c70
call fcn.0040a480
add esp, 0xc
cmp eax, 1
je 0x409929
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c4090
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c4090
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c8af5
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00412b06
mov esp, ebp
pop ebp
ret

Function at 0x4099e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e60bb
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.CMainWnd::OnInstall____r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.0040bbb0
test al, al
je 0x409a4f
push 0x51540c
lea eax, [ebp - 0x210]
push str._s__
push eax
call fcn.00409e40
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x210]
call fcn.0040a480
add esp, 0xc
jmp 0x409af2
push 0x84
lea eax, [ebp - 0x294]
push 0
push eax
call fcn.004c4090
mov ecx, dword [edi + 0x784]
lea edx, [ebp - 0x294]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 0x28]
lea ecx, [ebp - 0x294]
mov dword [ebp - 4], 0
call fcn.00458900
mov ecx, eax
call fcn.0040bec0
test al, al
jne 0x409aa9
mov ecx, dword [edi + 4]
sub esp, 0xc
mov edx, 0x515cd0
call fcn.0040a480
add esp, 0xc
jmp 0x409ae7
mov ecx, dword [edi + 0x77c]
test ecx, ecx
je 0x409ae0
call fcn.004597c0
test al, al
je 0x409ae0
mov ecx, dword [edi + 0x77c]
push 1
mov esi, dword [ecx]
call fcn.004597c0
mov ecx, dword [edi + 0x77c]
test al, al
sete al
movzx eax, al
push eax
call dword [esi + 0x1bc]
mov ecx, edi
call fcn.00409c60
lea ecx, [ebp - 0x294]
call fcn.004581b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret
Function at 0x409b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x515cec
push 0x82
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x409b43
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409b4c
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x409b6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
add eax, 2
push eax
mov dword [ebp - 4], eax
call fcn.00413112
mov edi, eax
add esp, 4
test edi, edi
jne 0x409b9f
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
push 0
push edi
call fcn.004c4090
push dword [ebp - 8]
push ebx
push edi
call fcn.004c3b10
mov ecx, edi
call fcn.00408a40
push edi
mov esi, eax
call fcn.0041310d
add esp, 0x1c
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409c60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e610b
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.CMainWnd::StartInstall____r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0x774]
push 1
mov eax, dword [ecx]
call dword [eax + 0x204]
mov ecx, dword [esi + 0x770]
test ecx, ecx
je 0x409cbd
mov eax, dword [ecx]
push 0
call dword [eax + 0xf8]
mov ecx, dword [esi + 0x784]
lea edx, [ebp - 0xb4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00458900
mov edx, eax
mov dword [ebp - 0x1c], 7
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
cmp word [edx], ax
jne 0x409cfc
xor ecx, ecx
jmp 0x409d10
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d01
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00401d30
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call fcn.004581b0
lea eax, [ebp - 0x30]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00409e60
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x409d4e
push 1
call fcn.0040cc76
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
push dword [ebp - 0x18]
call fcn.0040d231
add esp, 8
test eax, eax
je 0x409d67
push eax
call fcn.0040cc49
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp eax, 8
jb 0x409d8a
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00401e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret