joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405aca
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.004059c4
pop ecx
push dword [esp + 4]
call dword [sym.imp.MSVCRT.dll_exit]

Function at 0x405da1
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call dword [sym.imp.MSVCRT.dll__isatty]
test eax, eax
pop ecx
je 0x405dbc
call fcn.00406347
mov ebp, eax
dec ebp
jmp 0x405dc1
mov ebp, 0x7fffffff
cmp ebp, 1
jge 0x405dc9
push 1
pop ebp
mov edi, dword [sym.imp.MSVCRT.dll_getchar]
mov ebx, 0x1f5
cmp ebx, 0x1f5
je 0x405e0a
lea eax, [ebx - 0x1f5]
cdq
idiv ebp
test edx, edx
jne 0x405e0a
push 0x139
call fcn.00405e43
push eax
push 1
call fcn.00405b55
add esp, 0xc
call edi
cmp eax, 0xa
je 0x405e0a
cmp eax, 0xffffffff
jne 0x405dfe
push ebx
call fcn.00405e43
mov esi, eax
mov dword [esp], str.___EOH___
push esi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x405e37
cmp byte [esi], 0
je 0x405e37
push esi
push 1
call fcn.00405b55
pop ecx
inc ebx
pop ecx
jmp 0x405dd4
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
pop ebx

Function at 0x40663d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409ac0
push 0x406620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40b854], 0xffffffff
or dword [0x40b858], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40b850]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x40b84c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40b85c], eax
call fcn.004063a2
cmp dword [0x40b210], 0
jne 0x4066c0
push 0x40676c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040675a
push 0x40b00c
push 0x40b008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40b848]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40b844]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x40b004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401862
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4915f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
mov eax, dword [ebp + 4]
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax]
cmp dword [ebp + 0x64], 3
mov dword [ebp + 0x1c0], eax
mov esi, eax
mov dword [eax], 0x490310
mov dword [eax + 0xc], 0x490300
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
je 0x49164b
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x30
mov dword [esp], ebp
call dword [eax]
mov eax, dword [ebp + 4]
xor edi, edi
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax]
mov dword [esi + 0x18], eax
mov ebx, eax
jmp 0x491673
mov ebx, dword [esi + 0x18]
mov eax, dword [ebp + 4]
add ebx, edi
add edi, 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax + 4]
cmp edi, 0x80
mov dword [ebx], eax
jne 0x491670
mov byte [esi + 0x1c], 1
cmp byte [ebp + 0x5a], 0
je 0x491704
mov ebx, dword [ebp + 0x54]
cmp ebx, 7
jle 0x491749
cmp ebx, 0x100
jle 0x4916d2
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x3b
mov dword [eax + 0x18], 0x100
mov eax, dword [ebp]
mov dword [esp], ebp
call dword [eax]
mov eax, dword [ebp + 4]
mov dword [esp + 0xc], 3
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax + 8]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x14], ebx
test eax, eax
jne 0x491712
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x10], 0
test eax, eax
je 0x4916fc
mov eax, dword [ebp + 0x5c]
mov edx, dword [ebp + 4]
mov dword [ebp + 0x4c], 2
mov dword [esp], ebp
mov dword [esp + 4], 1
lea eax, [eax + eax*2]
lea eax, [eax + eax + 0xc]
mov dword [esp + 8], eax
call dword [edx + 4]
mov dword [esi + 0x20], eax
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00490240
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x3a
mov dword [eax + 0x18], 8
mov eax, dword [ebp]
mov dword [esp], ebp
call dword [eax]
jmp 0x4916d2
Function at 0x4c2080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004c12c0
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4c2103
test byte [ebx + 0x20], 0x30
jne 0x4c20b7
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x61cd54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x4c20fa
cmp dword [eax + 0x14], 0
je 0x4c2147
mov esi, dword [eax + 4]
mov dword [eax + 0x68], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4c20ed
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4c210a
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.004c1450
jmp 0x4c209d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x4c2171
mov eax, dword [0x61cd54]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x4c20fa
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4c215e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x4c212d
mov eax, ebx
call fcn.004c0f70
jmp 0x4c212d
Function at 0x555780
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [ecx + 4]
mov esi, dword [ebp + 8]
test eax, eax
je 0x5557bb
cmp esi, 0xf
je 0x5557d0
cmp esi, 0x10
jne 0x5557bb
mov eax, dword [ecx + 0x68]
test eax, eax
je 0x555814
mov dword [esp + 4], 9
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [ebp + 8], esi
lea esp, [ebp - 8]
mov ecx, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00543880
mov edx, dword [ecx + 0x68]
test edx, edx
je 0x5557bb
test byte [ecx + 0x40], 2
je 0x555806
mov dword [esp + 4], 0
mov eax, dword [edx]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp + 8], esi
sub esp, 8
lea esp, [ebp - 8]
mov ecx, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00543880
mov eax, dword [eax + 4]
test byte [eax + 0x40], 2
je 0x555803
cmp byte [eax + 0x4c], 0xef
jbe 0x5557dd
jmp 0x5557bb
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
cmp eax, fcn.00554fa0
jne 0x55587d
mov eax, dword [0x621100]
test eax, eax
mov dword [ecx + 0x24], eax
je 0x555897
mov dword [ecx + 0x38], 0x50
xor eax, eax
mov byte [ebx + 0x3c], al
mov dword [esp], ebx
call dword [0x61fe08]
mov eax, dword [ebx + 0x68]
test eax, eax
je 0x55589e
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsIconic]
sub esp, 4
test eax, eax
jne 0x555884
mov eax, dword [0x633070]
test eax, eax
jne 0x5557bb
mov eax, dword [ebx + 0x68]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
sub esp, 4
jmp 0x5557bb
call eax
jmp 0x5557bb
mov eax, dword [ebx + 0x68]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_OpenIcon]
sub esp, 4
jmp 0x55585a
mov eax, 1
jmp 0x555835
mov dword [esp], ebx
call fcn.00540990
jmp 0x5557bb
Function at 0x406e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
nop
jmp 0x406dbb
xor eax, eax
nop
jmp 0x406dca
lodsb al, byte [esi]
jmp 0x406ddc
cmp al, 0x61
nop
jmp 0x406dea
jl 0x406df1
nop
nop
sub al, 0x20
nop
nop
ror edi, 0xd
nop
add edi, eax
nop
dec ecx
jne 0x406dbb
nop
push edx
nop
jmp 0x406e0a
mov edx, dword [edx + 0x10]
nop
jmp 0x406e1f
push edi
nop
jmp 0x406e2c
mov eax, dword [edx + 0x3c]
nop
add eax, edx
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x406fec
nop
jmp fcn.00406e50
nop
add eax, edx
jmp 0x406e64
push eax
jmp 0x406e76
mov ebx, dword [eax + 0x20]
nop
jmp 0x406e88
add ebx, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x406e99
jmp 0x406ea7
test ecx, ecx
jmp 0x406eb8
je 0x406fc9
nop
jmp 0x406ecd
jmp 0x406edd
dec ecx
nop
xor edi, edi
nop
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
jmp 0x406ef6
nop
xor eax, eax
nop
ror edi, 0xd
jmp 0x406f0b
lodsb al, byte [esi]
jmp 0x406f1a
add edi, eax
nop
cmp al, ah
jmp 0x406f2d
jne 0x406ef6
nop
jmp 0x406f44
add edi, dword [ebp - 8]
jmp 0x406f56
cmp edi, dword [ebp + 0x24]
nop
jne 0x406e99
nop
jmp 0x406f70
pop eax
mov ebx, dword [eax + 0x24]
jmp 0x406f86
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
jmp 0x406fa3
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
jmp 0x406fb8
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
pop ebx
pop ebx
popal
nop
pop ecx
pop edx
push ecx
jmp eax
nop
jmp 0x406fda
pop eax
jmp 0x406fec
nop
jmp 0x406ffd
pop edi
nop
pop edx
nop
jmp 0x407015
mov edx, dword [edx]
nop
jmp 0x40702b
jmp 0x406d9f

Function at 0x40b2e5
Capabilities:
Write file on windows

Disassembly:
rol dword [eax], 1
mov esp, ebp
or dword [ecx + 0x4d8bf04e], 0xa3558b14
pop ebx
pop edi
mov dword [ecx], edx
or bl, byte [ebp - 0x1b]
nop
nop
nop
nop
nop
mov eax, dword [0x51ec8bb9]
mov ecx, 0x5651ec8b
mov esi, dword [ebp + 8]
mov dl, bl
sub al, 0x84
ror byte [edi], 0x84
mov esi, 0x8b000000
dec esi
dec eax
insb byte es:[edi], dx
rcr byte [edi + 0x5701f98f], 0x89
inc ebp
cld
mov dword [ebp + 8], eax
jne 0xd24db395
add byte [0x3c7e8bd2], cl
mov edi, dword [esi + 0x3c]
cmp edx, dword [edi + ecx + 0x9184]
out dx, eax
mov ebx, dword [esi + 0x38]
cmp edi, 0xffffffff
jbe 0x40b2b5
or eax, 0xffffffff
jmp 0x40b313
sbb byte [esi - 0x5d], dl
lea ecx, [ebp + 0x50]
push 0
push ecx
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test dword [ebp + ecx + 0x70], ebp
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x50]
stc
stc
push esp
push ebx
rol byte [ebx - 0x7d4350c], 1
add ebx, eax
mov dword [esi + 0x50], edx
test edi, edi
mov dword [esi + 0x54], ecx
ja 0x40b2f6
mov eax, dword [ebp + 8]
pop edi
mov dword [esi + 0x3c], 0x2d00
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xf304
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x401048
cmp dword [ebp - 0x11c], 5
jb 0x401048
mov dword [ebp - 0x124], 0x401130
jmp 0x401052
mov dword [ebp - 0x124], 0x4010a0
mov ecx, dword [ebp - 0x124]
push ecx
push 0x57c324
call fcn.00401080
call dword [0x57c324]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret
Function at 0x4054b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4054e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4054e0
xor eax, eax
xor edx, edx
jmp 0x4054e6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x409e60
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521a33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
call fcn.00402a80
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0042c01f
add esp, 8
lea edx, [ebp - 0x21c]
push edx
call fcn.0042c43d
add esp, 4
movzx eax, word [ebp + eax*2 - 0x21e]
cmp eax, 0x5c
jne 0x409edf
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0042c43d
add esp, 4
mov word [ebp + eax*2 - 0x21e], 0
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00402b50
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0040b060
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402c10
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00402b30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.00402b10
lea ecx, [ebp - 0x10]
call fcn.00418360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x409f60
lea ecx, [ebp - 0x10]
call fcn.00418360
push eax
call fcn.00409e60
add esp, 4
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402b10
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret

Function at 0x40a070
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0042c01f
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
push 0
push 0x530d34
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x40a10a
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
jmp 0x40a10c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret

Function at 0x40a120
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
je 0x40a157
xor eax, eax
jmp 0x40a169
cmp dword [ebp - 0x11c], 6
jae 0x40a164
xor eax, eax
jmp 0x40a169
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret
Function at 0x40a800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40a82f
xor eax, eax
jmp 0x40a953
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a84d
xor eax, eax
jmp 0x40a953
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a872
xor eax, eax
jmp 0x40a953
mov ecx, dword [ebp - 4]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40a951
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a940
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0042c100
add esp, 0xc
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40a936
push 0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0040ac80
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x40a936
mov ecx, dword [ebp - 0xc]
call fcn.0040ad50
test eax, eax
jne 0x40a905
mov eax, dword [ebp - 0xc]
jmp 0x40a953
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x40a928
push 1
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x28], eax
jmp 0x40a92f
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x14], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40b4f0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c8], ecx
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push 0
push 0x531d6c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x2c4], eax
push 0x4000
push 0x2b4
lea ecx, [ebp - 0x2c0]
push ecx
push 0
push 0x531d74
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x2c4], 0
je 0x40b595
cmp dword [ebp - 4], 0
je 0x40b595
push 1
mov edx, dword [ebp - 0x2c4]
push edx
call fcn.004fad83
push eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0040eb70
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004fad83
push eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0040eb70
mov eax, 1
jmp 0x40b597
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret

Function at 0x40ba80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40bab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40bab0
xor eax, eax
xor edx, edx
jmp 0x40bab6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x40e410
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x64], 0
push 2
lea eax, [ebp - 0x4c]
push eax
push 0x12
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0042ba57
add esp, 4
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 3
push 4
lea edx, [ebp - 0x70]
push edx
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x58], eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x54], edx
push 2
lea eax, [ebp - 0x4c]
push eax
push 0x1010
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0042ba57
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._I64d
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0042ceab
add esp, 0x10
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x4c]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e780
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x57dcc0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 0x230], ecx
cmp dword [ebp + 8], 0x104
jge 0x40e7aa
xor eax, eax
jmp 0x40e967
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
shl eax, 1
push eax
call fcn.0050102e
add esp, 4
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 4], ecx
push 1
push 0x1a
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40e7e7
jmp 0x40e8f8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0x208
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x531e28
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x40e849
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], 0
je 0x40e870
push 0x531e78
lea eax, [ebp - 0x220]
push eax
call fcn.0042c01f
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042c43d
add esp, 4
mov esi, eax
push 0x531e7c
call fcn.0042c43d
add esp, 4
lea esi, [esi + eax + 1]
lea edx, [ebp - 0x220]
push edx
call fcn.0042c43d
add esp, 4
add esi, eax
push 0x531ea8
call fcn.0042c43d
add esp, 4
add esi, eax
cmp esi, dword [ebp + 8]
jg 0x40e8f0
push str.CyberLinkPower2Go_
mov eax, dword [ebp - 4]
push eax
call fcn.0042bff5
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bff5
add esp, 8
push str.Temp
mov eax, dword [ebp - 4]
push eax
call fcn.0042bff5
add esp, 8
mov dword [ebp - 8], 1
xor ecx, ecx
jne 0x40e7ce
cmp dword [ebp - 8], 0
jne 0x40e90f
push str.C:Temp
mov edx, dword [ebp - 4]
push edx
call fcn.0042c01f
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e92c
mov ecx, dword [ebp - 4]
push ecx
call fcn.00409e60
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e94c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042c01f
add esp, 8
mov edx, dword [ebp - 4]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x22c]
push eax
call fcn.00501033
add esp, 4
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0042b9ea
mov esp, ebp
pop ebp
ret 8