joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x409939
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [0x430014]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40997c
mov eax, dword [ebp - 0xc]
jmp 0x4099d9
cmp dword [ebp - 4], 1
je 0x40998f
cmp dword [ebp - 4], 2
je 0x40998f
mov eax, 0xd
jmp 0x4099d9
cmp dword [ebp + 0xc], 0
je 0x4099cd
cmp dword [ebp - 8], 0
je 0x4099c5
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4099bc
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4099c3
mov eax, 0xd
jmp 0x4099d9
jmp 0x4099cd
mov edx, dword [ebp + 0xc]
mov word [edx], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411360
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e2bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x440030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409a10
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x14], 0
mov esi, dword [ebp - 0x10]
add esi, 0x18
call fcn.00419e00
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call dword [0x430244]
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x10]
add esi, 0x4c
call fcn.00419e00
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.0040e980
push 0x411d20
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.004135d0
push 0x411c40
mov ecx, dword [ebp - 0x10]
add ecx, 0x80
call fcn.004135d0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x90], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411450
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d691
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x440030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
call fcn.00412a10
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x80
call fcn.00413610
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.00413610
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00411430
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0x4c
call fcn.00419e10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call dword [0x430230]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
call fcn.00419e10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409a40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x418140
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.GlobalFA6FBBB1_8C8E_43b1_B8EC_35573A94C231
push 0
push 6
call dword [0x43005c]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x418167
xor eax, eax
jmp 0x4181b4
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [0x430074]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4181a3
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [0x430110]
mov eax, dword [ebp - 4]
mov dword [eax], 0
xor eax, eax
jmp 0x4181b4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx + 8], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x418360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x30], 0
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x31], 0
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [0x430010]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4183fc
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push str.EnableLogToView
mov edx, dword [ebp - 4]
push edx
call dword [0x430014]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4183f2
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x4183e3
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x30], 1
mov edx, dword [ebp - 0xc]
and edx, 2
je 0x4183f2
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x31], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [0x430018]
mov esp, ebp
pop ebp
ret

Function at 0x418430
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
mov dword [ebp - 4], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00429e0e
add esp, 0xc
push 0x103
lea edx, [ebp - 0x210]
push edx
push str._APPDATA_TencentQQPCMgr_
call dword [0x430048]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4184a1
lea eax, [ebp - 0x210]
push eax
call dword [0x4304a8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4184e7
lea ecx, [ebp - 0x210]
push ecx
push 0x103
mov edx, dword [ebp - 0x214]
add edx, 4
push edx
call dword [0x4303c8]
add esp, 0xc
push 0xffffffffffffffff
push str.ErrLogFile.log
push 0x104
mov eax, dword [ebp - 0x214]
add eax, 4
push eax
call dword [0x4303fc]
add esp, 0x10
jmp 0x418509
push 0x103
push str.C:ErrLogFile.log
push 0x103
mov ecx, dword [ebp - 0x214]
add ecx, 4
push ecx
call dword [0x430404]
add esp, 0x10
mov eax, dword [ebp - 0x214]
mov esp, ebp
pop ebp
ret

Function at 0x418520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x10]
push ecx
call dword [0x430044]
movzx edx, word [ebp - 2]
push edx
movzx eax, word [ebp - 4]
push eax
movzx ecx, word [ebp - 6]
push ecx
movzx edx, word [ebp - 8]
push edx
call dword [0x430034]
push eax
push str.__4d___02d:_02d:_02d._03d_
push 0xffffffffffffffff
push 0x20
lea eax, [ebp - 0x38]
push eax
call dword [0x430460]
add esp, 0x24
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
push edx
call dword [0x430068]
mov esp, ebp
pop ebp
ret
Function at 0x4185b0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x4185c4
jmp 0x4186c6
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0
jne 0x418601
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
mov ecx, dword [ebp - 0x4c]
add ecx, 4
push ecx
call dword [0x430058]
mov edx, dword [ebp - 0x4c]
mov dword [edx], eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp dword [eax], 0
setne cl
test ecx, ecx
jne 0x418601
jmp 0x4186c6
mov dword [ebp - 8], 0
push 0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
push eax
call dword [0x430054]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x418628
cmp dword [ebp - 8], 0x2000000
jbe 0x41862d
jmp 0x4186c6
mov dword [ebp - 0x10], 0
push 2
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
push eax
call dword [0x430064]
mov ecx, dword [ebp - 0x4c]
call fcn.00418520
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x50]
mov cl, byte [eax]
mov byte [ebp - 0x55], cl
add dword [ebp - 0x50], 1
cmp byte [ebp - 0x55], 0
jne 0x418666
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x5c], edx
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push ecx
call dword [0x430068]
mov dx, word [0x436b38]
mov word [ebp - 0xc], dx
mov al, byte [0x436b3a]
mov byte [ebp - 0xa], al
push 0
lea ecx, [ebp - 4]
push ecx
push 2
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push ecx
call dword [0x430068]
mov esp, ebp
pop ebp
ret 4

Function at 0x418790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
push edi
xor edi, edi
push 0x400
lea eax, [esp + 0x16]
push edi
push eax
mov dword [esp + 0x10], edi
mov word [esp + 0x1c], di
call fcn.00429e0e
add esp, 0xc
cmp word [0x440ff0], di
mov dword [esp + 0xc], 0x200
mov ecx, ebx
je 0x4187de
push 0x440ff0
call dword [0x4302c4]
lea eax, [edi + 1]
pop edi
add esp, 0x410
ret
push esi
call dword [0x4302c0]
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x14], edi
call dword [0x430134]
push eax
call dword [0x430138]
mov esi, eax
cmp esi, edi
je 0x418818
lea ecx, [esp + 0xc]
push ecx
call dword [0x43013c]
push eax
call esi
test eax, eax
je 0x41881c
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
lea edx, [esp + 8]
push edx
and eax, 0x200
add eax, 1
push eax
push edi
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [0x430010]
test eax, eax
pop esi
jne 0x418897
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push edi
push 0x436e30
push edx
call dword [0x430014]
test eax, eax
jne 0x41888c
lea edi, [eax + 1]
push 0x104
lea eax, [esp + 0x14]
push eax
push 0x440ff0
call dword [0x4302e8]
add esp, 0xc
push 0x440ff0
mov ecx, ebx
call dword [0x4302c4]
mov ecx, dword [esp + 4]
push ecx
call dword [0x430018]
mov eax, edi
pop edi
add esp, 0x410
ret
Function at 0x4188b0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42cff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x458
push ebx
push esi
mov ecx, edi
call dword [0x4302c0]
xor ebx, ebx
push 0x206
lea eax, [esp + 0x52]
push ebx
push eax
mov word [esp + 0x58], bx
call fcn.00429e0e
push 0x208
lea ecx, [esp + 0x266]
push ebx
push ecx
xor esi, esi
mov word [esp + 0x26c], bx
call fcn.00429e0e
lea edx, [esp + 0x64]
add esp, 0x18
test edx, edx
mov dword [esp + 0x10], 0x104
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 1
je 0x418a8a
lea eax, [esp + 8]
push eax
push 1
push ebx
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [0x430010]
test eax, eax
jne 0x4189b7
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x258]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push str.Version
push ecx
call dword [0x430014]
cmp eax, ebx
jne 0x4189a4
cmp dword [esp + 0xc], 1
jne 0x4189a4
lea eax, [esp + 0x254]
call fcn.00418f30
test eax, eax
je 0x4189a4
push 0x104
lea edx, [esp + 0x258]
push edx
lea eax, [esp + 0x54]
push eax
call dword [0x4302e8]
add esp, 0xc
lea esi, [ebx + 1]
mov ecx, dword [esp + 8]
push ecx
call dword [0x430018]
cmp esi, ebx
jne 0x418a78
lea ecx, [esp + 0x30]
call dword [0x430244]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x46c], ebx
call fcn.00418d50
add esp, 4
test eax, eax
je 0x418a5f
lea ecx, [esp + 0x14]
call dword [0x430244]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x46c], 1
call dword [0x430170]
push eax
call fcn.00418fa0
add esp, 8
test eax, eax
je 0x418a12
mov esi, 1
jmp 0x418a30
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call dword [0x430170]
push eax
call fcn.00419030
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x418a4e
lea ecx, [esp + 0x14]
call dword [0x430170]
push eax
lea edx, [esp + 0x50]
push 0x104
push edx
call dword [0x4303c8]
add esp, 0xc
lea ecx, [esp + 0x14]
mov byte [esp + 0x468], bl
call dword [0x430230]
lea ecx, [esp + 0x30]
mov dword [esp + 0x468], 0xffffffff
call dword [0x430230]
cmp esi, ebx
je 0x418a8a
lea eax, [esp + 0x4c]
call fcn.00418f30
test eax, eax
jne 0x418aab
mov word [esp + 0x4c], bx
mov ecx, edi
call dword [0x4302c0]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
add esp, 0x464
ret
cmp esi, ebx
je 0x418a8a
lea eax, [esp + 0x4c]
push eax
mov ecx, edi
call dword [0x4302c4]
mov ecx, dword [esp + 0x460]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x464
ret
Function at 0x418b70
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x13c0
call fcn.0042bf20
push esi
xor esi, esi
push 0xf9c
lea eax, [esp + 0x42c]
push esi
push eax
mov dword [esp + 0x430], esi
call fcn.00429e0e
push 0x206
lea ecx, [esp + 0x22]
push esi
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x28], si
call fcn.00429e0e
add esp, 0x18
lea edx, [esp + 4]
push edx
push 0xfa0
lea eax, [esp + 0x42c]
push eax
mov dword [esp + 0x14], esi
call fcn.0042a8e8
test eax, eax
je 0x418d3c
mov eax, dword [esp + 4]
cmp eax, esi
je 0x418d3c
push ebx
push ebp
shr eax, 2
push edi
mov dword [esp + 0x18], eax
mov edi, esi
je 0x418d2f
mov ebp, dword [0x43011c]
mov ebx, dword [0x4300e0]
mov ecx, dword [esp + edi*4 + 0x430]
push ecx
push esi
push 0x410
call ebp
mov esi, eax
test esi, esi
je 0x418c9c
push 0x208
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x20], 0
call fcn.00429e0e
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.0042a8fa
test eax, eax
je 0x418c95
mov eax, dword [esp + 0x14]
push 0x104
lea edx, [esp + 0x20]
push edx
push eax
push esi
call fcn.0042a8e2
test eax, eax
je 0x418c95
push str.QQPCMgr.exe
lea ecx, [esp + 0x20]
push ecx
call ebx
test eax, eax
je 0x418cb0
push str.QQPCTray.exe
lea edx, [esp + 0x20]
push edx
call ebx
test eax, eax
je 0x418cb0
push str.QQPCRTP.exe
lea eax, [esp + 0x20]
push eax
call ebx
test eax, eax
je 0x418cb0
push esi
call dword [0x430110]
add edi, 1
cmp edi, dword [esp + 0x18]
jae 0x418d2f
xor esi, esi
jmp 0x418c00
push 0x208
lea ecx, [esp + 0x22a]
push 0
push ecx
mov word [esp + 0x230], 0
call fcn.00429e0e
add esp, 0xc
push 0x104
lea edx, [esp + 0x228]
push edx
push 0
push esi
call fcn.0042a8ee
lea eax, [esp + 0x224]
push eax
call dword [0x4304b0]
push esi
call dword [0x430110]
mov esi, dword [esp + 0x13d4]
lea ecx, [esp + 0x224]
push ecx
mov ecx, esi
call dword [0x4302c4]
push 0x436e2c
mov ecx, esi
call dword [0x4301c8]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x13c0
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x13c0
ret
xor eax, eax
pop esi
add esp, 0x13c0
ret
Function at 0x419090
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42cfc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push ebx
push ebp
mov ebp, dword [esp + 0x268]
push esi
xor ebx, ebx
push 0x208
lea eax, [esp + 0x56]
push ebx
push eax
xor esi, esi
mov word [esp + 0x5c], bx
call fcn.00429e0e
add esp, 0xc
cmp edi, ebx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 1
je 0x41924e
cmp ebp, ebx
je 0x41924e
lea ecx, [esp + 0xc]
push ecx
push 1
push ebx
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [0x430010]
test eax, eax
jne 0x41916f
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.Version
push edx
call dword [0x430014]
cmp eax, ebx
jne 0x41915c
cmp dword [esp + 0x10], 1
jne 0x41915c
lea eax, [esp + 0x50]
call fcn.00418f30
test eax, eax
je 0x41915c
push ebp
lea eax, [esp + 0x54]
push eax
push edi
call dword [0x4302e8]
add esp, 0xc
lea esi, [ebx + 1]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x430018]
cmp esi, ebx
jne 0x419224
lea ecx, [esp + 0x18]
call dword [0x430244]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x268], ebx
call fcn.00418d50
add esp, 4
test eax, eax
je 0x41920b
lea ecx, [esp + 0x34]
call dword [0x430244]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x268], 1
call dword [0x430170]
push eax
call fcn.00418fa0
add esp, 8
test eax, eax
je 0x4191c6
mov esi, 1
jmp 0x4191e4
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call dword [0x430170]
push eax
call fcn.00419030
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4191fa
lea ecx, [esp + 0x34]
call dword [0x430170]
push eax
push ebp
push edi
call dword [0x4303c8]
add esp, 0xc
lea ecx, [esp + 0x34]
mov byte [esp + 0x264], bl
call dword [0x430230]
lea ecx, [esp + 0x18]
mov dword [esp + 0x264], 0xffffffff
call dword [0x430230]
cmp esi, ebx
je 0x419234
mov eax, edi
call fcn.00418f30
test eax, eax
jne 0x419234
mov word [edi], bx
xor esi, esi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
add esp, 0x25c
ret
mov ecx, dword [esp + 0x25c]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x25c
ret

Function at 0x419270
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
mov esi, edx
xor edx, edx
cmp ecx, edx
je 0x4192d3
cmp eax, edx
jle 0x4192d3
cmp esi, edx
je 0x4192d3
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00419540
push esi
lea esi, [esp + 0x10]
call fcn.00419600
add esp, 8
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4193a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x428
push ebp
mov ebp, dword [esp + 0x430]
push edi
xor edi, edi
push 0x208
lea eax, [esp + 0x22a]
push edi
push eax
mov word [esp + 0x230], di
call fcn.00429e0e
push 0x208
lea ecx, [esp + 0x2a]
push edi
push ecx
mov word [esp + 0x30], di
call fcn.00429e0e
add esp, 0x18
cmp ebp, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
je 0x419530
cmp word [ebp], di
je 0x419530
mov eax, dword [esp + 0x438]
cmp eax, edi
je 0x419530
push esi
push 0x208
push edi
push eax
call fcn.00429e0e
add esp, 0xc
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x419524
push ebx
push esi
call fcn.00429834
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x419523
push ebx
push esi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41951a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41951a
xor esi, esi
test dword [esp + 0x10], 0xfffffffc
jbe 0x4194fa
mov ebp, dword [0x4303b8]
lea ebx, [ebx]
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
push 0xffffffffffffffff
lea eax, [esp + 0x30]
push 0x105
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x24], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4194e2
mov ecx, dword [esp + 0x10]
add esi, 1
shr ecx, 2
cmp esi, ecx
jb 0x419490
jmp 0x4194fa
mov edx, dword [esp + 0x14]
push 0x104
push edx
lea eax, [esp + 0x234]
push eax
call dword [0x430098]
mov edx, dword [esp + 0x440]
push 0x104
lea ecx, [esp + 0x230]
push ecx
push edx
call dword [0x430098]
mov edi, 1
push ebx
call fcn.00429e14
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x428
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x428
ret
Function at 0x41a289
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x124
lea ebp, [esp - 4]
mov eax, dword [0x440030]
xor eax, ebp
mov dword [ebp + 0x124], eax
push 0x28
mov eax, 0x42c2b8
call fcn.0042a7ae
mov eax, dword [ebp + 0x130]
or dword [ebp - 0x10], 0xffffffff
mov edi, ecx
lea ecx, [ebp]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
call dword [0x43022c]
xor ebx, ebx
mov esi, 0x104
push esi
push ebx
push 0x105
push dword [ebp - 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call dword [0x430308]
push esi
lea eax, [ebp + 0x1d]
push ebx
push eax
mov byte [ebp + 0x1c], bl
call fcn.00429e0e
add esp, 0x1c
lea eax, [ebp + 0x1c]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [0x430498]
cmp eax, ebx
jge 0x41a316
mov dword [edi], 3
jmp 0x41a4a0
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call dword [0x4302a8]
mov esi, dword [0x4301ac]
push 0x436fac
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
call esi
add esp, 0xc
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 1
call dword [0x43020c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call dword [0x430214]
push ebx
lea ecx, [ebp]
call dword [0x43026c]
mov edi, dword [0x4300c4]
push eax
call edi
cmp eax, ebx
jne 0x41a392
call dword [0x430030]
cmp eax, 0xb7
je 0x41a392
call dword [0x430030]
cmp eax, 5
je 0x41a392
mov eax, dword [ebp - 0x14]
mov dword [eax], 3
jmp 0x41a4a0
push str.DeskUpdate
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
call esi
add esp, 0xc
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call dword [0x43020c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call dword [0x430214]
push ebx
lea ecx, [ebp]
call dword [0x43026c]
push eax
call edi
cmp eax, ebx
jne 0x41a3e5
mov edi, dword [0x430030]
call edi
cmp eax, 0xb7
je 0x41a3e5
call edi
cmp eax, 5
jne 0x41a384
push str.GlobalMgr.db
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
call esi
add esp, 0xc
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 3
call dword [0x43020c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call dword [0x430214]
push ebx
push 0x80
push 3
push ebx
push 3
mov edi, 0xc0000000
push edi
lea ecx, [ebp]
call dword [0x43026c]
mov esi, dword [0x4300bc]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41a447
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x50
jmp 0x41a47a
call dword [0x430030]
cmp eax, 2
jne 0x41a471
push ebx
push 0x80
push eax
push ebx
push 3
push edi
lea ecx, [ebp]
call dword [0x43026c]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41a480
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x65f
cmp dword [ebp - 0x10], 0xffffffff
je 0x41a4a0
push 0x104
lea ecx, [ebp]
call dword [0x43026c]
push eax
push 0x105
push dword [ebp - 0x18]
call dword [0x4303bc]
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call dword [0x430214]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x124]
xor ecx, ebp
call fcn.00429e1a
add ebp, 0x128
leave
ret 4