joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4c00
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.0040b150
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
or edi, 0xffffffff
test eax, eax
je 0x40b697
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40b697
xor esi, esi
push 0x639e58
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.004062d0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [esi + 0x636098]
mov edx, eax
call fcn.004062d0
mov byte [ebp - 4], 0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b5c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x14]
call ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
test eax, eax
mov eax, edi
je 0x40b685
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b5ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, 0x30
jb 0x40b580
push str.ceflibcef.dll
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.004062d0
add esp, 4
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004823a0
mov byte [ebp - 4], 3
mov ecx, dword [0x685568]
test ecx, ecx
jne 0x40b631
push 0x80004005
call fcn.004024f0
push ecx
push dword [eax]
call fcn.005af8a8
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
test eax, eax
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b65f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x18]
movzx esi, bl
add edx, 0xfffffff0
xor esi, 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b699
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40b699
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b697
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x40b6b8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cfe0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4f70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x20], eax
push dword [eax + 0x44]
lea ebx, [eax + 0x44]
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d1a5
lea ecx, [ebp - 0x10]
call fcn.0040b150
mov dword [ebp - 4], edi
mov edx, dword [eax]
mov ecx, dword [ebx]
call fcn.0049e140
neg eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
sbb edi, edi
add edx, 0xfffffff0
inc edi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d05e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402c20
mov ecx, eax
test ecx, ecx
jne 0x40d073
push 0x80004005
call fcn.004024f0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
test edi, edi
jne 0x40d150
xorps xmm0, xmm0
lea ecx, [ebp - 0x14]
movlpd qword [ebp - 0x28], xmm0
call fcn.0040b150
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.0046e550
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d0d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.004823a0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebx]
cmp dword [ecx - 4], 1
jle 0x40d0f6
push dword [ecx - 0xc]
mov ecx, ebx
call fcn.00406b80
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.0058f290
mulsd xmm0, qword [0x647f30]
sub esp, 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebx]
movsd qword [esp], xmm0
push dword [eax]
call fcn.0040a690
push eax
lea eax, [ebp - 0x10]
push str.CEFUnzip_fileSize:_d_md5:_s_DiskFreeSpace:_.2f
push eax
call fcn.004083c0
mov byte [ebp - 4], 1
add esp, 0x18
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d14d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x40d161
call fcn.0040b6d0
mov ecx, ebx
call fcn.004066a0
mov ecx, 0x636100
test edi, edi
mov eax, 0x6360f8
push esi
cmove eax, ecx
push eax
push str.cef_unzip
call fcn.0046dbd0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d1a5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
push 0
push edi
push 0xdadb
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x41085e
mov eax, 0x8000ffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x410888
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x410882
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x410995
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4108be
cmp byte [edi + 0x18], al
je 0x4108b2
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00410560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4108f3
call fcn.00410560
push ecx
mov ecx, esi
mov edi, eax
call fcn.004106a0
test eax, eax
jns 0x410993
test edi, edi
cmovns edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.00410770
mov dword [esp + 0xc], eax
test eax, eax
jns 0x410921
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.004106a0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x4108ce
push 0
push 0
push ebx
mov ecx, esi
call fcn.00410770
mov edi, eax
test edi, edi
jns 0x41095b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.004106a0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x410a30
push 0
push 0
call fcn.005b74d2
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4108ce
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x410993
call fcn.00410560
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5254
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [esi + 0x24], vtable.CSingletonBase_class_CCCMgr_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push esi
mov dword [esi], vtable.CCCMgr.0
mov dword [esi + 0x24], vtable.CCCMgr.1.0
call fcn.00411890
mov byte [ebp - 4], 2
call fcn.00402c20
mov ecx, eax
test ecx, ecx
jne 0x411043
push 0x80004005
call fcn.004024f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
mov dword [esi + 0x40], 0
push edi
push 0x66b4f0
call fcn.0040e9f0
add esp, 0xc
movzx eax, ax
mov ecx, esi
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e940
mov eax, dword [esi + 0x2c]
mov ecx, esi
mov dword [eax + 0x38], 0x4112e0
mov dword [eax + 0x3c], 0
call fcn.00411360
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5644
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [esi + 0x24], vtable.CCCCallback.0
mov dword [esi + 0x28], vtable.CSingletonBase_class_CKPMgr_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x2c]
push esi
mov dword [esi], vtable.CKPMgr.1.0
mov dword [esi + 0x24], vtable.CKPMgr.2.0
mov dword [esi + 0x28], vtable.CKPMgr.0
call fcn.00414a10
mov byte [ebp - 4], 2
call fcn.00402c20
mov ecx, eax
test ecx, ecx
jne 0x413931
push 0x80004005
call fcn.004024f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov byte [ebp - 4], 3
call fcn.00402c20
mov ecx, eax
test ecx, ecx
jne 0x413955
push 0x80004005
call fcn.004024f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
push edi
push 0x66b610
call fcn.0040e9f0
add esp, 0xc
movzx eax, ax
mov ecx, esi
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e940
mov eax, dword [esi + 0x30]
mov dword [eax + 0x30], 0x413c30
mov dword [eax + 0x34], 0
mov eax, dword [esi + 0x30]
mov dword [eax + 0x38], 0x40d2b0
mov dword [eax + 0x3c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4143d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5788
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x1c], 0
mov ecx, dword [eax]
mov eax, dword [0x6860e8]
cmp eax, dword [ecx + 4]
jle 0x414461
push 0x6860e8
call fcn.0058e4ed
add esp, 4
cmp dword [0x6860e8], 0xffffffff
jne 0x414461
call fcn.00402c20
mov ecx, eax
test ecx, ecx
jne 0x41443d
push 0x80004005
call fcn.004024f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x5df440
mov dword [0x6860ec], eax
call fcn.0058e9cd
push 0x6860e8
call fcn.0058e4ae
add esp, 8
mov eax, dword [0x6860ec]
cmp dword [eax - 0xc], 0
jne 0x41452e
push 0x639e58
lea ecx, [ebp - 0x18]
call fcn.00406540
push str.kittip
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004062d0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov edx, dword [eax]
call fcn.0047e210
push eax
mov ecx, 0x6860ec
mov byte [ebp - 4], 2
call fcn.00406c90
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4144d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4144f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x414511
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x6860ec]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41452e
push eax
push dword [0x6860ec]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [0x6860ec]
lea ecx, [ecx - 0x10]
call fcn.004073a0
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x414560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d57c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004143d0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or ebx, 0xffffffff
test eax, eax
je 0x41464d
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x41464d
xor edi, edi
nop
push 0x639e58
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.004062d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push dword [edi + 0x63613c]
mov edx, eax
call fcn.004062d0
mov byte [ebp - 4], 0
add esp, 8
mov edx, dword [ebp - 0x18]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414605
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
test eax, eax
mov eax, ebx
je 0x41463b
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41462c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 4
cmp edi, 4
jb 0x4145c0
mov edi, 1
jmp 0x41464f
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41464d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41466b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414680
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0x34]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414699
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
call fcn.004143d0
mov ecx, dword [esi + 0x34]
mov eax, dword [eax]
test ecx, ecx
je 0x4146c3
test eax, eax
je 0x4146c3
push eax
push 0x410e90
push 0
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov edi, eax
jmp 0x4146c5
xor edi, edi
mov edx, dword [ebp - 4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4146e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414700
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d57f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x66a9c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004143d0
push 0x639e58
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004062d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push dword [0x685584]
mov edx, eax
call fcn.004062d0
add esp, 8
mov byte [ebp - 4], 3
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41477e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41479c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4147d5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4147d5
push str.RunTip
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4147d5
push 0
push 0
push 0x911c9b
call eax
mov esi, eax
jmp 0x4147d7
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4147f6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x415315
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415320
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x415350
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x66a9c4]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00415290
mov esi, eax
test esi, esi
jne 0x415447
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x415419
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00415350
mov esi, eax
test esi, esi
jne 0x415447
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x4153e0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415430
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.00415200
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415456
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0058e39a
mov esp, ebp
pop ebp
ret 4
Function at 0x4158b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5936
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x66a9c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x41595c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x41595c
call fcn.00410560
mov esi, eax
jmp 0x415a4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41597f
call fcn.00410560
jmp 0x415a3f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41599d
call fcn.00410560
jmp 0x415a3f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4159be
mov esi, 0x8007000e
jmp 0x415a41
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00418c30
jmp 0x4159e8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x4159ff
mov esi, 0x8007000e
jmp 0x415a41
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x415a1f
call fcn.00410560
jmp 0x415a3f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00416710
mov esi, eax
test edi, edi
je 0x415a4c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x415a70
lea ecx, [ebp - 0x418]
call fcn.00418e70
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0058e39a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5abb
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x66a9c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x685c20]
test al, al
jne 0x417d6d
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.005a7400
add esp, 0xc
lea eax, [ebp - 0x118]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x417d68
push str.config_systemprofile
lea ecx, [ebp - 0x148]
call fcn.00406800
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x130]
call fcn.00406800
push dword [ebp - 0x138]
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
push ecx
cmovae eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x130]
push eax
call fcn.00418dd0
movzx ecx, byte [0x685c20]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x11c]
mov edx, 1
cmovne ecx, edx
mov byte [0x685c20], cl
cmp eax, 0x10
jb 0x417d2f
inc eax
lea ecx, [ebp - 0x130]
push eax
push dword [ebp - 0x130]
call fcn.00407520
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
cmp eax, 0x10
jb 0x417d68
inc eax
lea ecx, [ebp - 0x148]
push eax
push dword [ebp - 0x148]
call fcn.00407520
mov al, byte [0x685c20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058e39a
mov esp, ebp
pop ebp
ret