joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dee0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x3ac
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x3a8], eax
push esi
push edi
mov edi, dword [esp + 0x3c0]
lea eax, [esp + 0x14]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
neg esi
sbb esi, esi
push 0
inc esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [esp + 0x3b8]
push 0
push edx
push 0
mov ecx, 0x4538a4
call fcn.0040b2d0
mov ecx, 0x453828
call fcn.0040a520
call fcn.0040c4d0
test eax, eax
je 0x40e0a3
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x1ae]
push ecx
mov word [esp + 0x1b0], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x1a4]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
lea eax, [esp + 0x1a8]
push 0x6400000
push eax
call fcn.0040ed20
add esp, 0xc
mov ecx, 0x453828
test eax, eax
jne 0x40e0a7
push 0x28
call fcn.00409220
lea ecx, [esp + 0x1a4]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.0040ed70
add esp, 8
push 1
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.0040ddd0
push eax
lea ecx, [esp + 0xc]
call fcn.00409500
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4444f0]
je 0x40e02e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40e02e
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov ecx, 0x453828
call fcn.00408210
test eax, eax
jne 0x40e07a
mov ecx, dword [esp + 8]
mov eax, dword [0x4444f4]
push 0x64
push ecx
lea edx, [esp + 0x14]
push 0xca
push edx
mov dword [esp + 0x1c], eax
call fcn.0040de50
mov eax, dword [esp + 0x1c]
push 0x40
push 0x83
push eax
push 0
call fcn.0040d520
add esp, 0x20
lea ecx, [esp + 0xc]
call fcn.00410b70
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4444f0]
je 0x40e0a3
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40e0a3
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
jmp 0x40e104
call fcn.0040ac10
mov ecx, 0x453828
test eax, eax
jne 0x40e0c4
call fcn.00408970
call fcn.0040afe0
or eax, 0xffffffff
jmp 0x40e104
mov eax, dword [esp + 0x3c4]
push eax
push edi
call fcn.0040aa60
mov edi, eax
call fcn.0040afe0
mov ecx, 0x453828
call fcn.00408970
mov ecx, 0x4538a4
call fcn.0040d4c0
test esi, esi
je 0x40e0f7
call dword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.0041e4a0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov ecx, dword [esp + 0x3b0]
pop edi
pop esi
xor ecx, esp
call fcn.00434fc4
add esp, 0x3ac
ret 0x10
Function at 0x40e160
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push esi
push edi
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x40e193
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40e18c
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ead0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x140], eax
xor eax, eax
push esi
push 0x11c
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x40eb4a
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x40eb97
push str.GetNativeSystemInfo
push 0x439f68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40eb97
lea ecx, [esp + 4]
push ecx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x40eb7c
cmp ax, 6
jne 0x40eb97
mov eax, 1
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00434fc4
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00434fc4
add esp, 0x144
ret

Function at 0x40ebb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x114]
xor eax, eax
cmp dword [esp + 4], 5
sete al
xor ecx, esp
call fcn.00434fc4
add esp, 0x118
ret
Function at 0x40ec50
Capabilities:
Get disk size

Disassembly:
sub esp, 0x228
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, dword [esp + 0x234]
push esi
mov esi, dword [esp + 0x234]
push edi
xor edi, edi
xor eax, eax
cmp esi, edi
je 0x40ed08
push 0x208
lea ecx, [esp + 0x2a]
push edi
push ecx
mov word [esp + 0x30], ax
call sub.MSVCR90.dll_memset
push edi
push edi
push edi
lea edx, [esp + 0x3c]
push edx
push esi
call dword [sym.imp.MSVCR90.dll__wsplitpath]
add esp, 0x20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40ed06
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [edi + 1]
pop edi
pop esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00434fc4
add esp, 0x228
ret
xor eax, eax
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x228
ret

Function at 0x40f4f0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebp]
xor ebx, ebx
mov dword [esp + 8], ecx
cmp eax, ebx
je 0x40f511
mov dword [ebp], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x40f523
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
je 0x40f555
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x14], ebx
jle 0x40f560
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40f5a8
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x28]
push edx
push eax
push esi
push edi
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push ebp
push ecx
mov ecx, dword [esp + 0x18]
push esi
call fcn.0040f420
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 8

Function at 0x410820
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esi + 0xc]
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
ret 4
Function at 0x410860
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push str.PageState
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esi + 0xc]
cmp word [esi], 0
je 0x41088e
test esi, esi
jne 0x410892
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.MSVCR90.dll__wcsnicmp]
push 0x20
push str.Hide
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4108b2
pop edi
mov eax, 1
pop esi
ret
push 0x20
push str.Minimized
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4108cb
pop edi
mov eax, 2
pop esi
ret
push 0x20
push str.Smart
push esi
call edi
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
pop edi
add eax, 3
pop esi
ret

Function at 0x4108f0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x2010
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
push esi
mov esi, dword [esp + 0x201c]
push edi
mov edi, dword [esp + 0x2024]
test esi, esi
je 0x4109ed
test edi, edi
je 0x4109ed
mov ebx, dword [esp + 0x2028]
cmp ebx, 0x80
jl 0x4109ed
push 0x2000
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x1c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4109ed
cmp eax, 0x1fff
ja 0x4109ed
lea edx, [esp + 0x18]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4109ed
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x43a138
lea edx, [esp + 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4109ed
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push 0x43a120
push edi
call fcn.00407f00
add esp, 0x24
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.00434fc4
add esp, 0x2010
ret
mov ecx, dword [esp + 0x2018]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00434fc4
add esp, 0x2010
ret
Function at 0x410d50
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x201c
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebp
push esi
push edi
push 0x2000
lea eax, [esp + 0x28]
push 0
push eax
mov ebp, ecx
call sub.MSVCR90.dll_memset
mov esi, dword [ebp]
mov edi, dword [esp + 0x2038]
add esp, 0xc
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x18], 0
test esi, esi
je 0x410db3
test edi, edi
jne 0x410dba
xor eax, eax
jmp 0x410f32
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x1000
lea edx, [esp + 0x30]
push edx
push 0
push str.FixedProductText
add eax, 0xc8
push edi
mov dword [esp + 0x28], eax
call ebx
cmp word [esp + 0x28], 0
je 0x410df8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
call fcn.004300d0
push esi
push 0x1000
lea ecx, [esp + 0x30]
push ecx
push 0
push str.OptionalProductText
push edi
call ebx
cmp word [esp + 0x28], 0
je 0x410e26
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
add ecx, 0x10
call fcn.004300d0
push esi
push 0x1000
lea eax, [esp + 0x30]
push eax
push 0
push str.InstalledProductText
push edi
call ebx
cmp word [esp + 0x28], 0
je 0x410e54
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
add ecx, 0x20
call fcn.004300d0
lea ecx, [esp + 0x14]
call fcn.00410860
mov edx, dword [ebp + 0x1c]
push esi
push 0
push str.ShowCancelButton
push edi
mov dword [edx + 0x184], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp + 0x1c]
push esi
xor ecx, ecx
push 0x1000
cmp eax, 1
lea eax, [esp + 0x30]
push eax
sete cl
push 0
push str.SubTitle
push edi
mov dword [edx + 0x188], ecx
call ebx
cmp word [esp + 0x28], 0
mov ebp, dword [esp + 0x10]
je 0x410eb4
lea ecx, [esp + 0x28]
push ecx
lea ecx, [ebp + 0x30]
call fcn.004300d0
push esi
push 0x1000
lea edx, [esp + 0x30]
push edx
push 0
push str.SubText
push edi
call ebx
cmp word [esp + 0x28], 0
je 0x410ede
lea eax, [esp + 0x28]
push eax
lea ecx, [ebp + 0x40]
call fcn.004300d0
push esi
push 0
push str.SubTextHeight
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0
push str.SubTextMargin
push edi
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x1000
lea ecx, [esp + 0x30]
push ecx
push 0
push str.AllProductInstalledPrompt
push edi
mov dword [ebp + 0x64], eax
call ebx
cmp word [esp + 0x28], 0
pop ebx
je 0x410f2d
lea edx, [esp + 0x24]
push edx
lea ecx, [ebp + 0x50]
call fcn.004300d0
mov eax, 1
mov ecx, dword [esp + 0x2024]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00434fc4
add esp, 0x201c
ret 4
Function at 0x410f50
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2018
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2014], eax
push ebx
push esi
push edi
push 0x2000
lea eax, [esp + 0x24]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
mov edi, dword [esi]
mov ebx, dword [esp + 0x2034]
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x14], 0
test edi, edi
je 0x410fb2
test ebx, ebx
jne 0x410fb6
xor eax, eax
jmp 0x410fed
lea ecx, [esp + 0xc]
call fcn.00410860
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 1
mov dword [edx + 0x190], ecx
mov ecx, dword [esp + 0x2020]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x2018
ret 4

Function at 0x411010
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2018
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2014], eax
push ebx
push esi
push edi
push 0x2000
lea eax, [esp + 0x24]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
mov edi, dword [esi]
mov ebx, dword [esp + 0x2034]
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x14], 0
test edi, edi
je 0x411072
test ebx, ebx
jne 0x411076
xor eax, eax
jmp 0x4110ad
lea ecx, [esp + 0xc]
call fcn.00410860
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x194], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 1
mov dword [edx + 0x198], ecx
mov ecx, dword [esp + 0x2020]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x2018
ret 4

Function at 0x4110d0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2018
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2014], eax
push ebx
push esi
push edi
push 0x2000
lea eax, [esp + 0x24]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
mov edi, dword [esi]
mov ebx, dword [esp + 0x2034]
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x14], 0
test edi, edi
je 0x411132
test ebx, ebx
jne 0x411136
xor eax, eax
jmp 0x411185
lea ecx, [esp + 0xc]
call fcn.00410860
mov edx, dword [esi + 0x1c]
push edi
push 1
push str.ShowCancelButton
push ebx
mov dword [edx + 0x19c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [edx + 0x1a0], ecx
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x19c], 1
jne 0x411180
mov ecx, eax
mov dword [ecx + 0x19c], 2
mov eax, 1
mov ecx, dword [esp + 0x2020]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x2018
ret 4
Function at 0x4111a0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2018
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2014], eax
push ebx
push esi
push edi
push 0x2000
lea eax, [esp + 0x24]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
mov edi, dword [esi]
mov ebx, dword [esp + 0x2034]
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x14], 0
test edi, edi
je 0x411202
test ebx, ebx
jne 0x411206
xor eax, eax
jmp 0x41123d
lea ecx, [esp + 0xc]
call fcn.00410860
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x1a4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 1
mov dword [edx + 0x1a8], ecx
mov ecx, dword [esp + 0x2020]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x2018
ret 4
Function at 0x4123c0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x436635
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x453358]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [0x4444f4]
mov dword [esi], eax
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
call fcn.0042fe60
mov ecx, dword [0x4444f4]
mov dword [esi + 0x14], ecx
mov edx, dword [0x4444f4]
mov dword [esi + 0x18], edx
mov eax, dword [0x4444f4]
mov dword [esi + 0x1c], eax
mov ecx, dword [0x4444f4]
mov dword [esi + 0x20], ecx
mov edx, dword [0x4444f4]
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], reloc.OLEAUT32.dll_SysReAllocString
mov eax, dword [0x4444f4]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x4444f4]
mov dword [esi + 0x30], ecx
mov edx, dword [0x4444f4]
mov dword [esi + 0x34], edx
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 9
call fcn.004117b0
mov eax, dword [0x4444f4]
mov dword [esi + 0x50], eax
mov ecx, dword [0x4444f4]
mov dword [esi + 0x54], ecx
mov edx, dword [0x4444f4]
mov dword [esi + 0x58], edx
mov eax, dword [0x4444f4]
mov dword [esi + 0x5c], eax
mov ecx, dword [0x4444f4]
mov dword [esi + 0x60], ecx
mov edx, dword [0x4444f4]
mov dword [esi + 0x64], edx
mov eax, dword [0x4444f4]
mov dword [esi + 0x68], eax
mov ecx, dword [0x4444f4]
mov dword [esi + 0x6c], ecx
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 0x12
call fcn.004117b0
mov eax, 0x14
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], 0x3e8
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], 1
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov edx, dword [0x4444f4]
mov dword [esi + 0xb8], edx
or eax, 0xffffffff
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], 0xb4
mov eax, dword [0x4444f4]
mov dword [esi + 0xc8], eax
mov eax, 0x6400000
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 0x15
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], edi
call fcn.004117b0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x416060
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2004
call fcn.004350b0
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
push edi
push 0x2000
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
call sub.MSVCR90.dll_memset
mov ebx, dword [edi]
add esp, 0xc
test ebx, ebx
je 0x4160a2
mov ebp, dword [esp + 0x2014]
test ebp, ebp
jne 0x4160a9
xor eax, eax
jmp 0x416244
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ebx
push 0x1000
lea ecx, [esp + 0x18]
push ecx
push 0
push str.BDProduct
push ebp
call esi
cmp word [esp + 0x10], 0
je 0x41610d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4160d4
sub eax, edx
movzx edx, word [0x45394c]
sar eax, 1
push edx
mov esi, eax
lea eax, [esp + 0x14]
push 0x2c
push eax
call fcn.0042ec50
add esp, 0xc
push 1
push 0
push 1
push esi
lea ecx, [esp + 0x20]
push ecx
jmp 0x4161c8
push ebx
push 0x1000
lea edx, [esp + 0x18]
push edx
push 0
push str.FixedProduct
push ebp
call esi
cmp word [esp + 0x10], 0
je 0x41616c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416131
sub eax, edx
sar eax, 1
mov esi, eax
movzx eax, word [0x45394c]
push eax
lea ecx, [esp + 0x14]
push 0x2c
push ecx
call fcn.0042ec50
add esp, 0xc
push 0
push 1
push 1
push esi
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.00415f50
push ebx
push 0x1000
lea eax, [esp + 0x18]
push eax
push 0
push str.OptionalProduct
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x4161cf
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416194
movzx ecx, word [0x45394c]
push ecx
sub eax, edx
lea edx, [esp + 0x14]
sar eax, 1
push 0x2c
push edx
mov esi, eax
call fcn.0042ec50
add esp, 0xc
push 0
push 1
push 0
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.00415f50
push ebx
push 0x1000
lea ecx, [esp + 0x18]
push ecx
push 0
push str.OptionalProductEx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x416234
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4161f7
sub eax, edx
movzx edx, word [0x45394c]
sar eax, 1
push edx
mov esi, eax
lea eax, [esp + 0x14]
push 0x2c
push eax
call fcn.0042ec50
add esp, 0xc
push 0
push 1
push 2
push esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.00415f50
jmp 0x41623e
mov ecx, dword [edi + 0x1c]
push 0
call fcn.004309f0
mov eax, 1
pop esi
mov ecx, dword [esp + 0x200c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434fc4
add esp, 0x2004
ret 4
Function at 0x416260
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416272
pop esi
ret
mov ecx, esi
call fcn.00413970
call fcn.0040ead0
mov ecx, esi
test eax, eax
je 0x41628b
push str.Product64
jmp 0x416290
push str.Product32
call fcn.00416060
mov ecx, dword [esi + 0x1c]
call fcn.00430bf0
test eax, eax
jg 0x4162ad
push str.360Installer
mov ecx, esi
call fcn.00416060
mov ecx, esi
call fcn.00415800
mov eax, dword [esi + 8]
cmp dword [eax - 8], 0
je 0x4162c5
push eax
mov ecx, esi
call fcn.00410d50
mov eax, dword [esi + 0xc]
cmp dword [eax - 8], 0
je 0x4162d6
push eax
mov ecx, esi
call fcn.00410f50
mov eax, dword [esi + 0x10]
cmp dword [eax - 8], 0
je 0x4162e7
push eax
mov ecx, esi
call fcn.00411010
mov eax, dword [esi + 0x14]
cmp dword [eax - 8], 0
je 0x4162f8
push eax
mov ecx, esi
call fcn.004110d0
mov eax, dword [esi + 0x18]
cmp dword [eax - 8], 0
je 0x416309
push eax
mov ecx, esi
call fcn.004111a0
mov eax, 1
pop esi
ret