joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x454fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
lea eax, [esp + 0x30]
push eax
call fcn.00425fb0
mov dword [esp + 0x54], 0
cmp dword [ebp + 4], 0
lea esi, [ebp + 8]
mov dword [esi], 0
jbe 0x425229
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi]
push 3
push ecx
push eax
call edx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x5c]
push eax
call fcn.00425970
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x58], 1
call fcn.0042ab40
add eax, 0x78
push eax
call fcn.0042d6b0
cmp eax, 1
jne 0x4251c0
mov edx, dword [esp + 0x3c]
test edx, edx
jne 0x425179
xor ecx, ecx
jmp 0x425182
mov ecx, dword [esp + 0x44]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x40]
mov edi, eax
sub edi, edx
sar edi, 2
cmp edi, ecx
jae 0x42519e
mov edx, dword [esi]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x40], eax
jmp 0x4251c5
mov edi, eax
cmp edx, eax
jbe 0x4251a9
call fcn.0043ec5c
mov eax, dword [esp + 0x30]
push edi
push eax
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
call fcn.00426250
jmp 0x4251c5
cmp eax, 0xffffffff
je 0x425204
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4251f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, dword [ebp + 4]
jb 0x425126
jmp 0x425229
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x425229
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
sub esi, eax
sar esi, 2
test esi, esi
je 0x42525c
mov edi, dword [ebp]
mov ebp, dword [ebp + 0xc]
ja 0x42524b
call fcn.0043ec5c
mov eax, dword [esp + 0x3c]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x1c]
push ebp
push 0
push esi
push eax
push edi
call edx
mov eax, dword [esp + 0x3c]
xor esi, esi
cmp eax, esi
je 0x42526b
push eax
call fcn.0043ea71
add esp, 4
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call fcn.0043ea71
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4
Function at 0x426910
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x454bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x467e80
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
xor ebp, ebp
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
push eax
push str.SOFTWARE_rising_s
lea edi, [esp + 0x24]
mov dword [esp + 0x34], ebx
call fcn.00404e80
mov edi, dword [esp + 0x24]
push edi
push str.strRegKey__s
push 0x80
call fcn.004025a0
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x426a4d
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x426a66
lea edx, [esp + 0x14]
push edx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x426a40
mov edx, dword [esp + 0x14]
push edx
call fcn.0043d9cc
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push ebx
push esi
call fcn.00443400
add esp, 0x10
cmp esi, ebx
je 0x426a40
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push ebx
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x426a37
lea ebp, [ebx + 1]
mov ebx, dword [esp + 0x34]
add ebx, 0x20
mov edx, esi
call fcn.00427230
mov ecx, dword [ebx]
push ecx
push str.m_strVersionOld_s
push 0x80
call fcn.004025a0
add esp, 0xc
push esi
call fcn.0043f105
add esp, 4
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426a66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenKey_Failed_ERR_d
push 0x80
call fcn.004025a0
add esp, 0xc
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426a8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x427140
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x452be8
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
jne 0x427193
xor ecx, ecx
jmp 0x4271a1
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x427198
sub ecx, esi
push eax
mov edi, ecx
lea eax, [esp + 0x24]
call fcn.00404710
lea edi, [esp + 0x20]
call fcn.00425d00
mov esi, dword [esp + 0x20]
mov eax, dword [esi - 0xc]
test eax, eax
jl 0x4271e3
push str._AFTERREBOOT
push esi
call fcn.0043e3d5
add esp, 8
test eax, eax
je 0x4271e3
sub eax, esi
cmp eax, 0xffffffff
je 0x4271e3
mov dword [ebp + 0x1c], 1
jmp 0x4271ea
mov dword [ebp + 0x1c], 0
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42720e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4

Function at 0x427490
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [esp]
push eax
push 0x28
mov dword [esp + 0xc], 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4274c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
sete al
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x4274ee
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
push 0x10
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x427552
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x427570
Capabilities:
Accept command line arguments
Check mutex on windows
Print debug messages

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, dword [esp + 0x48]
push edi
push str.Rsinstall_Start_______________________________________________________________
push 0x80
call fcn.004025a0
add esp, 8
call fcn.00427490
test al, al
jne 0x4275b2
push str.AdjustPrivileges_failed
push 0x80
call fcn.004025a0
add esp, 8
xor eax, eax
push 0xa
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov byte [esp + 0x45], al
lea eax, [esp + 0x3c]
push eax
push 0xb
push esi
mov byte [esp + 0x48], 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x38]
push ecx
push str.Current_Product___s
push 0x80
call fcn.004025a0
mov edx, dword [0x467e80]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x467e80
call eax
lea ecx, [esp + 0x38]
push ecx
add eax, 0x10
push str._sDDF51177_0BB6_475C_BBCC_F1B3F310D2BB
lea edi, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.00404e80
add esp, 8
call fcn.00425d00
mov ebx, dword [esp + 0x10]
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x427663
push str.Rsinstall_is_Runing_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x427736
push str.WinMain
push 0x45a368
push 0x80
call fcn.004025a0
add esp, 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004235c0
lea edi, [esp + 0xc]
call fcn.00425d00
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jl 0x4276b6
push str._SILENCE
push eax
call fcn.0043e3d5
add esp, 8
lea edx, [esp + 0x14]
push edx
call fcn.00427ab0
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4276c7
sub eax, edx
lea ecx, [esp + 0x38]
mov edi, eax
push ecx
lea eax, [esp + 0x18]
call fcn.00404710
lea edi, [esp + 0x14]
mov dword [esp + 0x34], 1
call fcn.00427e90
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.00427b60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427726
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427742
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043defc
add esp, 0x3c
ret 0x10
Function at 0x427e90
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.CWorkClass::DoWork
push 0x45a368
push 0x80
call fcn.004025a0
mov dword [0x568c7c], edi
call fcn.004267a0
push str.CWorkClass::First_ExtratPrePack
push 0x4585c8
push 0x80
mov esi, eax
call fcn.004025a0
mov eax, 1
add esp, 0x18
test byte [0x568f38], al
jne 0x427eee
or dword [0x568f38], eax
call fcn.004229c0
push 0x4555d0
call fcn.0043f998
add esp, 4
mov ecx, 0x568df0
call fcn.00422b30
test eax, eax
je 0x427f8d
call fcn.00429c60
call fcn.00428020
test eax, eax
jne 0x427f22
push str.Two_LoadPreInstallXml_Failed
push 0x80
call fcn.004025a0
add esp, 8
pop esi
ret
push ebx
mov ebx, dword [edi + 0x20]
call fcn.00436080
mov dword [eax + 0x28], ebx
call fcn.00435960
mov ebx, dword [eax + 4]
add eax, 4
call fcn.00435960
mov eax, dword [eax]
call fcn.00426820
cmp dword [esi + 0x10], 0
je 0x427f8f
call fcn.00435960
mov dword [eax + 0x2c], 1
call fcn.00435960
mov ebx, eax
add ebx, 0x58
mov edx, str.First
call fcn.00427230
mov esi, edi
call fcn.00428740
test eax, eax
jne 0x428012
push str.Silence_Install_OK_Exit...
push 0x80
call fcn.004025a0
add esp, 8
pop ebx
pop esi
ret
cmp dword [esi + 0x14], 0
je 0x427fe5
call fcn.00435960
mov dword [eax + 0x2c], 2
call fcn.00435960
mov ebx, eax
add ebx, 0x58
mov edx, str.Over
call fcn.00427230
push str.RSE_IsOverlayInstall
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.IsOverlayInstall
push 0x80
call fcn.004025a0
add esp, 8
push edi
call fcn.00428de0
pop ebx
mov eax, edi
pop esi
jmp 0x429990
cmp dword [esi + 0x18], 0
je 0x428012
call fcn.00435960
mov dword [eax + 0x2c], 1
call fcn.00435960
mov ebx, eax
add ebx, 0x58
mov edx, str.Span
call fcn.00427230
mov eax, edi
call fcn.004298d0
pop ebx
mov eax, edi
pop esi
jmp 0x429990
push ecx
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4299f0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x568c94]
test eax, eax
jne 0x4299db
push 0x30
call fcn.0043e9a7
add esp, 4
test eax, eax
jne 0x4299cd
push 0x45ff24
lea ecx, [esp + 7]
xor al, al
push ecx
mov byte [esp + 0xb], al
call fcn.0044143b
push esi
mov esi, eax
call fcn.00436020
mov dword [0x568c94], eax
pop esi
mov eax, dword [eax + 4]
sub eax, 0
je 0x4299e8
sub eax, 1
jne 0x4299f0
add esp, 4
jmp fcn.00429a00
pop ecx
ret
Function at 0x428100
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push str.CWorkClass::Four_ExtratAllPack
push 0x4585c8
push 0x80
call fcn.004025a0
mov eax, dword [0x568c94]
add esp, 0xc
mov dword [esp + 8], 0
test eax, eax
jne 0x42815b
push 0x30
call fcn.0043e9a7
add esp, 4
test eax, eax
jne 0x42814f
xor al, al
mov byte [esp + 7], al
push 0x45ff24
lea eax, [esp + 0xb]
push eax
call fcn.0044143b
mov esi, eax
call fcn.00436020
mov dword [0x568c94], eax
lea ecx, [esp + 8]
push ecx
push 0
push edi
push 0x427c40
push 0
push 0
mov dword [eax + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.WaitFor_ExtratAllPack_Start
push 0x80
mov dword [edi + 0xc], eax
call fcn.004025a0
mov edx, dword [edi + 0xc]
add esp, 8
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.WaitFor_ExtratAllPack_End
push 0x80
call fcn.004025a0
add esp, 8
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x428740
Capabilities:
Create thread

Disassembly:
push ecx
push edi
push str.CWorkClass::FirstInstall
push 0x4585c8
push 0x80
mov edi, 1
call fcn.004025a0
push str.CWorkClass::IsShowInstall
push 0x4585c8
push 0x80
call fcn.004025a0
add esp, 0x18
call fcn.0042ab40
cmp dword [eax + 0x14], 0
je 0x42878f
cmp dword [esi + 0x20], 0
je 0x42879b
call fcn.00435960
mov dword [eax + 0x28], 3
mov ecx, esi
call fcn.00428810
xor eax, eax
pop edi
pop ecx
ret
call fcn.00435960
push str.CWorkClass::Three_LoadUI_Show
push 0x4585c8
push 0x80
mov dword [eax + 0x28], edi
call fcn.004025a0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x427d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x428805
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUI_failed_Err_d
push 0x80
call fcn.004025a0
add esp, 0xc
push 0
push str.RsInstall
push str.LoadUiWindow_Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, edi
pop edi
pop ecx
ret

Function at 0x428de0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
call fcn.00435960
mov ebx, dword [eax]
call fcn.00435960
mov edi, eax
mov eax, dword [edi + 0x20]
mov edx, dword [eax - 8]
add edi, 0x20
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x104
or ecx, edx
jge 0x428e1b
mov ecx, 0x104
mov eax, edi
call fcn.00404d80
mov esi, dword [edi]
cmp dword [esi - 8], 0x104
jge 0x428e30
push 0x80070057
call fcn.004059f0
mov dword [esi - 0xc], 0x104
mov eax, dword [edi]
push 0x104
mov byte [eax + 0x104], 0
call fcn.0042a420
add esp, 4
call fcn.00435960
mov esi, eax
mov eax, dword [esi + 0x20]
mov ecx, dword [eax - 8]
add esi, 0x20
test eax, eax
je 0x428e6f
push ecx
push eax
call fcn.0043ecbd
add esp, 8
test eax, eax
jl 0x428e26
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x428e26
push str.CWorkClass::IsShowInstall
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
push 0x4585c8
push 0x80
mov byte [eax + ecx], 0
call fcn.004025a0
add esp, 0xc
call fcn.0042ab40
cmp dword [eax + 0x14], 0
mov esi, dword [esp + 0x10]
je 0x428eb7
cmp dword [esi + 0x20], 0
je 0x428ec9
call fcn.00435960
mov dword [eax + 0x28], 3
mov ecx, esi
call fcn.00429450
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
call fcn.00435960
push str.CWorkClass::Three_LoadUI_Show
push 0x4585c8
push 0x80
mov dword [eax + 0x28], 1
call fcn.004025a0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0x427d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x428ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUI_failed_Err_d
push 0x80
call fcn.004025a0
add esp, 0xc
push 0
push str.RsInstall
push str.LoadUiWindow_Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
Function at 0x4298d0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push str.CWorkClass::IsShowInstall
push 0x4585c8
push 0x80
mov ebx, eax
call fcn.004025a0
add esp, 0xc
call fcn.0042ab40
cmp dword [eax + 0x14], 0
je 0x429908
cmp dword [ebx + 0x20], 0
je 0x429912
call fcn.00435960
mov dword [eax + 0x28], 3
call fcn.00428af0
xor eax, eax
pop ebx
pop ecx
ret
call fcn.00435960
push str.CWorkClass::Three_LoadUI_Show
push 0x4585c8
push 0x80
mov dword [eax + 0x28], 1
call fcn.004025a0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0
push ebx
push 0x427d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x10], eax
test eax, eax
jne 0x429980
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUI_failed_Err_d
push 0x80
call fcn.004025a0
add esp, 0xc
push 0
push str.RsInstall
push str.LoadUiWindow_Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x429c60
Capabilities:
Get common file path
Read .ini file
Set current directory

Disassembly:
sub esp, 0x52c
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push ebp
push esi
push 0x104
xor ebp, ebp
lea eax, [esp + 0x11]
push ebp
push eax
mov byte [esp + 0x18], 0
call fcn.00443400
push 0x105
mov ebx, 0x4581d8
lea esi, [esp + 0x1c]
call fcn.0042a420
xor ebx, ebx
add esp, 0x10
cmp byte [esp + 0xc], bl
jne 0x429cc2
push 0x105
mov ebx, 0x45aa14
call fcn.0042a420
add esp, 4
xor ebx, ebx
jmp 0x429cc7
mov ebp, 1
push 0x104
lea ecx, [esp + 0x221]
push ebx
push ecx
mov byte [esp + 0x228], bl
call fcn.00443400
push 0x104
lea edx, [esp + 0x125]
push ebx
push edx
mov byte [esp + 0x12c], bl
call fcn.00443400
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x21c], cl
inc eax
cmp cl, bl
jne 0x429d00
lea eax, [esp + 0x21c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x429d18
mov ecx, dword [str.CompsVer.inf]
mov edx, dword [0x45aa1c]
mov dword [eax], ecx
mov ecx, dword [0x45aa20]
mov dword [eax + 4], edx
mov dx, word [0x45aa24]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x21c]
push eax
push 0x105
lea ecx, [esp + 0x11c]
push ecx
push 0x4581a0
push str.Version
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x114], bl
je 0x429e3c
push 0x104
lea edx, [esp + 0x431]
push ebx
push edx
mov byte [esp + 0x438], bl
call fcn.00443400
add esp, 0xc
lea eax, [esp + 0x42c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xc]
push ecx
call esi
push 0x104
lea edx, [esp + 0x329]
push ebx
push edx
mov byte [esp + 0x330], bl
call fcn.00443400
add esp, 0xc
xor eax, eax
jmp 0x429de0
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x324], cl
inc eax
cmp cl, bl
jne 0x429de0
push edi
lea edi, [esp + 0x328]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x429e00
lea ecx, [esp + 0x118]
push ecx
call fcn.0043fc7d
add esp, 4
cmp eax, 0x15
pop edi
jl 0x429e32
mov eax, 0x4581d8
cmp ebp, ebx
jne 0x429e2c
mov eax, 0x45aa14
push eax
call fcn.00429ab0
lea edx, [esp + 0x42c]
push edx
call esi
mov ecx, dword [esp + 0x534]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043defc
add esp, 0x52c
ret
Function at 0x429ed0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x453588
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], 1
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x28]
mov edx, dword [ecx + 4]
push eax
push edx
push str._s_s
lea edi, [esp + 0x1c]
call fcn.00404e80
mov edi, dword [esp + 0x1c]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ebp, 0xffffffff
cmp eax, ebp
jne 0x429fdc
push edi
push str._s_do_no_exist_
push 0x80
call fcn.004025a0
lea eax, [edi - 0x10]
add esp, 0xc
mov byte [esp + 0x1c], 1
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429f80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429fa4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x429fc5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x2c]
neg esi
sbb esi, esi
push esi
mov edx, edi
call fcn.0043a2b0
mov esi, eax
lea eax, [edi - 0x10]
mov byte [esp + 0x1c], 1
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a00e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a032
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x42a053
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0xc