joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x4052c0
push 0
push 0
mov dword [ebp - 4], 0
call fcn.0041c0ad
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4056a8
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4056a8
cmp byte [eax], 0
je 0x4056a8
mov edx, dword [ebp - 4]
push eax
push edx
call fcn.00404090
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0041b530
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00405a00
lea ecx, [ebp - 0x210]
push ecx
mov ecx, esi
call fcn.00405990
mov eax, dword [ebp - 0x210]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405b1f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4365c8
mov ecx, esi
call fcn.004058f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret
Function at 0x406890
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ecx + 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ecx + 0x38]
mov dword [ebp - 4], 0
call eax
cmp dword [ebp - 4], 1
jne 0x4068eb
lea ecx, [ebp - 8]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40699b
mov edx, dword [ebp - 8]
push str.TkBellExe
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0x436328
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40699b
push esi
push 0x4362c0
lea ecx, [ebp - 0x14]
call fcn.00410900
push 5
call fcn.00401000
mov ecx, eax
call fcn.00412e60
push eax
lea ecx, [ebp - 0x14]
call fcn.00410d30
mov eax, dword [0x43744c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00410d30
push str.____osboot
lea ecx, [ebp - 0x14]
call fcn.00410d30
cmp byte [ebp - 0xd], 0xff
lea esi, [ebp - 0x14]
jne 0x40696a
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call fcn.00410690
mov ecx, dword [ebp - 8]
inc eax
push eax
push esi
push 1
push 0
push str.TkBellExe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.004108e0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push str.App_called_MakeSureSchedulerProcessIsRunning...
lea ecx, [ebp - 8]
call fcn.00410900
lea eax, [ebp - 8]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 8]
call fcn.004108e0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
xor ebx, ebx
call edx
test eax, eax
jne 0x406b67
push esi
push edi
push str._t...Running_Tinkerbell.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
push 0x44
lea ecx, [ebp - 0x64]
push ebx
push ecx
call fcn.0041b530
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 8]
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.00410680
mov esi, dword [0x43744c]
push 5
call fcn.00401000
mov ecx, eax
call fcn.00412e60
push esi
push eax
lea edx, [ebp - 8]
push str.__s_s___startedByApp
push edx
call fcn.00411430
add esp, 0x10
cmp byte [ebp - 1], 0xff
lea eax, [ebp - 8]
jne 0x406b23
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x64]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [ebp - 0x20]
push eax
call edi
mov ecx, dword [ebp - 0x1c]
push ecx
call edi
pop edi
test esi, esi
pop esi
jne 0x406b5f
mov ebx, 0x80004005
lea ecx, [ebp - 8]
call fcn.004108e0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407c10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 0xc]
push ebx
lea eax, [ebp - 0x88]
push edi
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], eax
call fcn.00407b40
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
cmp eax, edx
je 0x407c66
push eax
call fcn.0041bac5
add esp, 4
lea ecx, [ebp - 8]
call fcn.00410680
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x407c9c
lea ecx, [ebp - 0x10c]
push 0
mov dword [ebp - 0x110], ecx
push eax
lea ecx, [ebp - 0x110]
mov ebx, 1
call fcn.00407b40
mov esi, dword [ebp - 0x110]
jmp 0x407ca1
mov esi, 0x436328
test edi, edi
je 0x407cca
push 0
lea edx, [ebp - 0x88]
push edi
lea ecx, [ebp - 0x8c]
or ebx, 2
mov dword [ebp - 0x8c], edx
call fcn.00407b40
mov eax, dword [ebp - 0x8c]
jmp 0x407ccf
mov eax, 0x436328
mov ecx, dword [ebp + 0x10]
push esi
push ecx
push eax
lea edx, [ebp - 8]
push str._CRNQueryCancelAutoplay::AllowAutoPlay_received___Path:__s__Content:__lu__Label:__s_event_cancelled
push edx
call fcn.00411430
add esp, 0x14
test bl, 2
je 0x407d07
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x88]
and ebx, 0xfffffffd
cmp eax, ecx
je 0x407d07
push eax
call fcn.0041bac5
add esp, 4
test bl, 1
je 0x407d25
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
cmp eax, edx
je 0x407d25
push eax
call fcn.0041bac5
add esp, 4
lea eax, [ebp - 8]
push eax
push 1
call fcn.0040d770
add esp, 8
call fcn.004180f0
xor esi, esi
cmp dword [ebp + 0xc], 2
jne 0x407dda
mov edx, dword [0x443dc4]
mov eax, dword [edx + 0xc]
mov ecx, 0x443dc4
call eax
add eax, 0x10
push edi
lea ecx, [ebp + 0x14]
mov dword [ebp + 0xc], eax
call fcn.00405a00
mov edx, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push edx
call fcn.0041aeb0
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407d91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e130
add esp, 4
test al, al
je 0x407dbb
call fcn.0040d180
test al, al
jne 0x407db6
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e060
add esp, 4
mov esi, 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407dda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 8]
call fcn.004108e0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40d180
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.RPApplicationRunningMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
cmp esi, 0xffffffff
je 0x40d1b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x411f80
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x411f9f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x18], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x41202f
cmp dword [ebp + 8], 0
je 0x41202f
push edi
mov edi, dword [0x443180]
test edi, edi
jne 0x411fce
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 8]
mov dword [0x443180], edi
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
div edi
pop edi
mov dword [esi + 0x1c], edx
cmp edx, ecx
jae 0x411fe3
sub ecx, edx
jmp 0x411fe8
mov dword [esi + 0x1c], ecx
xor ecx, ecx
mov edx, dword [esi + 0x1c]
mov eax, dword [ebp + 0xc]
add edx, ebx
push edx
push ecx
mov ecx, dword [ebp + 8]
push eax
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x14], eax
test eax, eax
je 0x412013
mov dword [esi + 0x18], ebx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412034
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x412050
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test bl, 8
je 0x41206a
pop esi
mov eax, 0x80070057
pop ebx
pop ebp
ret 0xc
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push edi
call edx
test bl, 3
jne 0x412083
mov eax, 0x80000000
mov edi, 0x18000002
jmp 0x41208d
mov eax, 0xc0000000
mov edi, 0x18000004
test ebx, 0x400
je 0x4120a4
test ebx, 0x100
je 0x4120b3
mov ebx, 1
jmp 0x4120c3
test ebx, 0x100
je 0x4120b3
mov ebx, 4
jmp 0x4120c3
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
push 0
push 0
push ebx
push 0
push 3
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x412107
lea ecx, [esi + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esi + 0xc]
push 0
push 0
push 0
push edi
push 0
push edx
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 8], eax
test eax, eax
jne 0x412122
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412124
pop edi
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ebx
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x412870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
or eax, 0xffffffff
cmp dword [esi + 8], 0
jl 0x4128ad
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
mov dword [esi + 4], 0
call edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
call fcn.0042abd7
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4128ad
mov dword [esi + 4], 0x80040081
pop esi
pop ebp
ret 8
Function at 0x412ed0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x412ee9
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x412f23
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412ee3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x412f30
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x94
lea eax, [ebp - 0x98]
push 0
or edi, 0xffffffff
push eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], 0
call fcn.0041b530
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov word [ebp - 0xa8], dx
xor edx, edx
cmp dword [ebp - 0x88], 2
mov word [ebp - 0xac], ax
sete dl
mov word [ebp - 0xaa], cx
mov esi, edx
test esi, esi
je 0x412fca
mov edi, 8
jmp 0x412feb
cmp ax, 4
jae 0x412fd7
mov edi, 2
jmp 0x412feb
jne 0x412feb
cmp cx, 0xa
sbb edi, edi
and edi, 0xfffffc04
add edi, 0x400
test ebx, ebx
je 0x4130bd
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0xd0]
cmp eax, 3
ja case.default.0x413010
jmp dword [eax*4 + 0x4130d0]
test esi, esi
je 0x41305a
mov ax, word [ebp - 0xac]
cmp ax, 3
ja 0x413034
jne 0x41305a
cmp word [ebp - 0xaa], 0x32
jb 0x41305a
movzx eax, word [ebp - 0xb0]
sub eax, 4
js 0x41307f
test eax, eax
je 0x413078
cmp eax, 1
je 0x413071
sub eax, 2
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 4
mov esi, eax
jmp 0x41309e
mov eax, dword [ebp - 0xb8]
sub eax, 0x182
je 0x41307f
sub eax, 0x64
je 0x413078
sub eax, 0x64
jne case.default.0x413010
mov esi, 2
jmp 0x41309e
mov esi, 1
jmp 0x41309e
mov esi, 0xfffffffe
jmp 0x41309e
mov esi, 0x40
jmp 0x41309e
mov esi, 0x20
jmp 0x41309e
mov esi, 8
jmp 0x41309e
or esi, 0xffffffff
call fcn.00412ed0
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa8]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret
Function at 0x413870
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
test eax, eax
je 0x4138fb
add esi, 4
push 0x435970
mov ecx, esi
call fcn.00410760
cmp eax, 0xffffffff
je 0x4138fb
add eax, 2
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410f80
xor esi, esi
cmp byte [ebp - 0x11], 0xff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 0x18]
jne 0x4138c1
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4138f3
cmp dword [ebp - 4], esi
je 0x4138f3
lea ecx, [ebp - 0x18]
call fcn.004108e0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
call fcn.004108e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push str.TEMP
mov edi, ecx
call fcn.0041f29d
add esp, 4
test eax, eax
je 0x41394f
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.004109d0
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
mov ecx, edi
call edx
test eax, eax
jne 0x413a03
mov ecx, esi
call fcn.004108b0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4139c0
push 0x104
lea esi, [edi + 4]
push 0x105
mov ecx, esi
call fcn.00411230
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004112c0
push 0x5c
mov ecx, esi
call fcn.00410730
mov ecx, esi
cmp eax, 0xffffffff
jne 0x413992
call fcn.004108b0
jmp 0x4139ac
push eax
lea eax, [ebp - 8]
push eax
call fcn.00410f80
push eax
mov ecx, esi
call fcn.00410920
lea ecx, [ebp - 8]
call fcn.004108e0
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
test eax, eax
jne 0x413a03
mov ecx, esi
call fcn.004108b0
push 0x104
lea esi, [edi + 4]
push 0x105
mov ecx, esi
call fcn.00411230
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004112c0
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
test eax, eax
jne 0x413a03
mov ecx, esi
call fcn.004108b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x413a66
cmp byte [eax], 0
je 0x413a66
cmp byte [esi + 7], 0xff
mov ebx, esi
jne 0x413a74
mov ebx, dword [esi]
mov edi, ebx
mov ecx, esi
call fcn.00410690
add eax, ebx
push eax
push edi
call fcn.004159b0
add esp, 8
cmp byte [esi + 7], 0xff
mov edi, eax
mov ebx, esi
jne 0x413a3a
mov ebx, dword [esi]
mov ecx, esi
call fcn.00410690
add eax, ebx
lea ecx, [edi + 1]
cmp ecx, eax
jne 0x413a4f
cmp byte [edi], 0x5c
je 0x413a5b
push 0x436504
mov ecx, esi
call fcn.00410d30
mov edx, dword [ebp + 0xc]
push edx
mov ecx, esi
call fcn.00410d30
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
jmp 0x413a1b
Function at 0x413ab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ecx + 0xb]
push ebx
push esi
lea esi, [ecx + 4]
mov bl, 0xff
cmp al, bl
je 0x413b57
xor ecx, ecx
cmp al, 7
sete cl
test cl, cl
jne 0x413b98
mov eax, esi
cmp byte [esi + 7], bl
jne 0x413aed
mov eax, dword [esi]
cmp byte [eax], 0x2e
je 0x413b98
mov ecx, esi
call fcn.00410690
cmp eax, 3
jne 0x413b6e
mov eax, esi
cmp byte [esi + 7], bl
jne 0x413b0b
mov eax, dword [esi]
cmp byte [eax + 1], 0x3a
jne 0x413b6e
mov eax, esi
cmp byte [esi + 7], bl
jne 0x413b1a
mov eax, dword [esi]
cmp byte [eax + 2], 0x5c
jne 0x413b6e
cmp byte [esi + 7], bl
jne 0x413b27
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x413b42
cmp eax, 4
je 0x413b42
cmp eax, 2
je 0x413b42
cmp eax, 6
jne 0x413b98
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret
cmp byte [esi + 4], 0
jne 0x413ae4
cmp byte [esi + 5], 0
jne 0x413ae4
cmp byte [esi + 6], 0
je 0x413b98
jmp 0x413ae4
cmp byte [esi + 7], bl
jne 0x413b75
mov esi, dword [esi]
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x413b98
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x144], 0x10
jne 0x413b42
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret

Function at 0x414500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
lea eax, [ebp - 8]
push eax
call fcn.004134d0
cmp byte [eax + 7], 0xff
jne 0x41451a
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.004108e0
cmp ebx, 0xffffffff
je 0x414540
test bl, 0x10
je 0x414540
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414550
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
lea eax, [ebp - 8]
push eax
call fcn.004134d0
cmp byte [eax + 7], 0xff
jne 0x41456a
mov eax, dword [eax]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004108e0
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4145a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x48
push ebx
call fcn.00413630
lea ecx, [ebp - 0x18]
call fcn.00410680
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x41479c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.SHGetSpecialFolderLocation
push ebx
call esi
push str.SHGetPathFromIDListA
push ebx
mov dword [ebp - 4], eax
call esi
mov edi, eax
test edi, edi
jne 0x4145f7
push str.SHGetPathFromIDList
push ebx
call esi
mov edi, eax
push str.SHGetMalloc
push ebx
call esi
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x414793
test edi, edi
je 0x414793
test esi, esi
je 0x414793
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
lea ecx, [ebp - 8]
and edx, 0xfffffff7
push ecx
add edx, 0x23
push edx
push 0
mov dword [ebp - 8], 0
call eax
test eax, eax
jne 0x41468c
push 0x105
lea ecx, [ebp - 0x18]
call fcn.00411230
push eax
mov eax, dword [ebp - 8]
push eax
call edi
lea ecx, [ebp - 4]
xor edi, edi
push ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
jl 0x414680
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004112c0
jmp 0x4146f0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4146f0
lea ecx, [ebp - 0xc]
push ecx
push 0x105
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x104
call fcn.00411230
push eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
push 0
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004112c0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x18]
call fcn.004037f0
test al, al
jne 0x414793
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x18]
push edx
mov ecx, edi
call fcn.00413480
push edi
call fcn.00414500
add esp, 4
test eax, eax
jne 0x414724
push edi
call fcn.00414550
add esp, 4
push str.Real
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
call fcn.00413530
push eax
mov ecx, edi
call fcn.00413650
lea ecx, [ebp - 0x48]
call fcn.00413500
push edi
call fcn.00414500
add esp, 4
test eax, eax
jne 0x41475a
push edi
call fcn.00414550
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x414793
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, edi
call fcn.00413530
push eax
mov ecx, edi
call fcn.00413650
lea ecx, [ebp - 0x48]
call fcn.00413500
push edi
call fcn.00414500
add esp, 4
test eax, eax
jne 0x414793
push edi
call fcn.00414550
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
lea ecx, [ebp - 0x18]
call fcn.004108e0
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret