joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d1ac
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x48d1c2
add esp, 0xfffffff0
call fcn.00405444
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call fcn.00406c24
mov eax, dword [ebp + 0xc]
call fcn.00406c24
xor eax, eax
push ebp
push 0x48d2fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi + 4], esi
lea eax, [edi + 0x10]
mov edx, dword [ebp + 0x10]
call fcn.00406f20
lea eax, [edi + 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00406f20
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
xor eax, eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
xor eax, eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
push 0x48d328
call sub.user32.dll_RegisterWindowMessageW
mov dword [edi + 0x50], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push 0
mov eax, dword [edi + 0x10]
call fcn.00407984
push eax
call sub.user32.dll_FindWindowW
mov esi, eax
mov dword [edi + 0xc], esi
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x48d2c2
mov eax, dword [edi + 4]
test eax, eax
je 0x48d2b1
push eax
push 6
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_PostMessageW
mov eax, dword [edi + 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 0xa
call fcn.0041c504
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x48d35c
call fcn.00407be0
mov eax, dword [ebp - 4]
mov edx, 7
call fcn.0045d778
jmp 0x48d2d6
mov edx, 7
mov eax, 0x48d3c4
call fcn.0045d778
jmp 0x48d2d6
mov edx, 7
mov eax, 0x48d438
call fcn.0045d778
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d305
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x4995e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.00408afc
test eax, eax
jl 0x49969f
cmp word [esi], 0xd
jne 0x499686
mov edi, dword [ebx + 0x18]
cmp byte [edi + 0x4a7], 0
je 0x49966e
mov eax, edi
call fcn.004722c8
push eax
mov eax, dword [ebx + 0x18]
call fcn.0047205c
dec eax
pop edx
cmp edx, eax
jne 0x49963f
mov eax, ebx
call fcn.004a3e80
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.004724f0
jmp 0x4996af
mov eax, dword [ebx + 0x18]
call fcn.004722c8
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.0047205c
sub eax, 2
cmp edi, eax
jne 0x499664
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.004724f0
jmp 0x4996af
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.004724f0
push 0
push 0xd
push 0x464
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_SendMessageW
cmp word [esi], 0x1b
jne 0x49969f
mov eax, dword [ebx + 0x18]
cmp byte [eax + 0x4a7], 0
je 0x49969f
xor edx, edx
call fcn.004724f0
cmp word [esi], 0x21
jae 0x4996af
mov eax, dword [ebx + 0x18]
mov dword [eax + 0x2e], 3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49f550
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49f525
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.004af070
call fcn.004b08a0
call fcn.004ab314
push 0x49f560
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c82e4], eax
mov dl, 1
mov eax, dword [0x435a94]
call fcn.00440d60
mov esi, eax
mov dword [ebx + 0x1a8], esi
mov byte [esi + 0x50], 1
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [ebx + 0x18], 0
jne 0x49f490
cmp dword [0x4c22f0], 0xffffffff
je 0x49f490
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
push ebp
push 0x49f511
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 1
mov cl, 1
call fcn.0042da0c
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x49f588
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
lea eax, [ebp - 0x20]
mov edx, dword [ebx + 0x1c]
mov edx, dword [edx + 0x423]
mov cl, 4
call fcn.0042da0c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x49f59c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f51b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f52f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f557
lea eax, [ebp - 0x20]
mov edx, dword [0x4012a0]
mov ecx, 2
call fcn.004081e4
ret

Function at 0x4a0c58
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0ce7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x24], 0
je 0x4a0cd1
cmp dword [ebx + 0x18], 0
je 0x4a0cd1
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x18]
call fcn.004706d8
cmp dword [ebp - 4], 0
jne 0x4a0cc0
mov eax, dword [ebx + 0x18]
call fcn.00470b08
test al, al
je 0x4a0cc0
mov edx, dword [ebx + 0xf8]
mov eax, dword [ebx + 0x24]
call fcn.00470748
push 4
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x24]
call fcn.00475ad8
jmp 0x4a0cd1
push 0
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0cee
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x4a37c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a3845
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0x30], 0
je 0x4a382f
xor eax, eax
push ebp
push 0x4a3825
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00406b88
push eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x78]
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a382f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a384c
lea eax, [ebp - 4]
call fcn.00406b88
ret

Function at 0x4a3854
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a392e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0x30], 0
je 0x4a3908
xor edx, edx
push ebp
push 0x4a38fe
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
call fcn.0040a1a4
push eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
test eax, 0x80000000
sete al
test al, al
je 0x4a38f4
lea eax, [ebp - 0xc]
call fcn.0040a1a4
push eax
mov eax, dword [0x4c27d0]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, 0x80000000
sete al
test al, al
je 0x4a38f4
lea eax, [ebp - 4]
call fcn.00406b88
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3935
lea eax, [ebp - 0xc]
call fcn.0040a1a4
lea eax, [ebp - 8]
call fcn.0040a1a4
lea eax, [ebp - 4]
call fcn.00406b88
ret
Function at 0x4a3c58
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a3d5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0x30], 0
je 0x4a3d2d
xor edx, edx
push ebp
push 0x4a3d23
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
call fcn.0040a1a4
push eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
test eax, 0x80000000
sete al
test al, al
je 0x4a3d19
lea eax, [ebp - 0xc]
call fcn.0040a1a4
push eax
mov eax, dword [0x4c27d0]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, 0x80000000
sete al
test al, al
je 0x4a3d19
lea eax, [ebp - 0x10]
call fcn.0040a1a4
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
test eax, 0x80000000
sete al
test al, al
je 0x4a3d19
lea eax, [ebp - 4]
call fcn.00406b88
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xf0]
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3d2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3d62
lea eax, [ebp - 0x10]
call fcn.0040a1a4
lea eax, [ebp - 0xc]
call fcn.0040a1a4
lea eax, [ebp - 8]
call fcn.0040a1a4
lea eax, [ebp - 4]
call fcn.00406b88
ret

Function at 0x4a3d6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a3e6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0x30], 0
je 0x4a3e41
xor edx, edx
push ebp
push 0x4a3e37
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
call fcn.0040a1a4
push eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
test eax, 0x80000000
sete al
test al, al
je 0x4a3e2d
lea eax, [ebp - 0xc]
call fcn.0040a1a4
push eax
mov eax, dword [0x4c27d0]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, 0x80000000
sete al
test al, al
je 0x4a3e2d
lea eax, [ebp - 0x10]
call fcn.0040a1a4
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
test eax, 0x80000000
sete al
test al, al
je 0x4a3e2d
lea eax, [ebp - 4]
call fcn.00406b88
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xe8]
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3e41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3e76
lea eax, [ebp - 0x10]
call fcn.0040a1a4
lea eax, [ebp - 0xc]
call fcn.0040a1a4
lea eax, [ebp - 8]
call fcn.0040a1a4
lea eax, [ebp - 4]
call fcn.00406b88
ret
Function at 0x4acee8
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c24
xor eax, eax
push ebp
push 0x4acfa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
push ebp
call fcn.004ace20
pop ecx
xor eax, eax
push ebp
push 0x4acf8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004079dc
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004079dc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004079dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acf92
push ebp
call fcn.004acea8
pop ecx
ret

Function at 0x4ae9c4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404a64
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5f195114
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x528f2375
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403e71
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
lea eax, [ebp - 0x404]
mov esi, ecx
push 0
push eax
call fcn.00441690
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x404]
push eax
call fcn.0040283a
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
lea ecx, [esi + 0x80]
call fcn.004027c1
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00427425
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ce9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor ebx, ebx
test ecx, ecx
je 0x40cec2
cmp word [ecx], bx
je 0x40cec2
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cec2
push 1
test al, 0x10
movzx ebx, bl
pop ecx
cmove ebx, ecx
mov al, bl
pop ebx
ret

Function at 0x40cfa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
push 0xa
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov esi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x4be958
push eax
call fcn.00407598
add esp, 0xc
lea eax, [ebp - 0x2c]
push esi
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40d053
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d053
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40d053
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40d053
lea eax, [edi + 1]
cmp eax, dword [ebx + 0x10]
ja 0x40d02f
mov dword [ebx + 0x10], eax
cmp dword [ebx + 0x14], 0x10
jb 0x40d027
mov ecx, dword [ebx]
jmp 0x40d029
mov ecx, ebx
mov byte [ecx + eax], 0
jmp 0x40d03c
sub eax, dword [ebx + 0x10]
mov ecx, ebx
push 0
push eax
call fcn.0040d59d
push 0
mov ecx, ebx
call fcn.0040715b
push edi
push dword [ebp - 0x30]
mov ecx, ebx
call fcn.00407412
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427425
mov esp, ebp
pop ebp
ret
Function at 0x40d066
Capabilities:
Get file version info

Disassembly:
push 0x1c
mov eax, 0x49e89a
call fcn.00427fde
mov edi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push eax
mov dword [ebp - 0x1c], eax
call fcn.00427707
pop ecx
mov esi, eax
xor eax, eax
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push eax
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40d0ea
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4be748
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40d0ea
mov ax, word [ecx + 0xa]
mov word [edi], ax
mov ax, word [ecx + 8]
mov word [edi + 2], ax
mov ax, word [ecx + 0xe]
mov word [edi + 4], ax
mov ax, word [ecx + 0xc]
mov word [edi + 6], ax
xor edi, edi
inc edi
jmp 0x40d0fa
test esi, esi
je 0x40d105
push esi
call fcn.00427702
pop ecx
mov eax, edi
call fcn.00427f3c
ret

Function at 0x40d10d
Capabilities:
Get common file path

Disassembly:
push 0x84c
mov eax, 0x49e8cb
call fcn.00427fa7
mov esi, ecx
push 0x800
xor edi, edi
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00441690
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402861
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], edi
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 1
push edi
lea ecx, [ebp - 0x828]
call fcn.00402495
push 0xa
lea edx, [ebp - 0x828]
pop ecx
call fcn.0040b14f
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.00408887
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40d1b4
mov eax, dword [eax]
push edi
push eax
call fcn.0044d4ad
pop ecx
pop ecx
mov ebx, eax
lea ecx, [ebp - 0x858]
push edi
neg ebx
push 1
sbb bl, bl
call fcn.00401656
add bl, 1
jne 0x40d179
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.00408887
pop ecx
push eax
mov ecx, esi
call fcn.0040197a
push edi
push 1
lea ecx, [ebp - 0x858]
call fcn.00401656
cmp dword [esi + 0x14], 8
jb 0x40d20d
mov esi, dword [esi]
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.00401656
push edi
push 1
lea ecx, [ebp - 0x840]
call fcn.00401656
mov eax, esi
call fcn.00427f51
ret
Function at 0x40d231
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x49e92b
call fcn.00427fa7
mov edi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x844], ebx
call fcn.00402495
mov edx, str.JaqKKLKJSDKTn9NPjHsGku6Tny6RJL6TSDpRjHcSkm6NJLrSoarRj1IJXuMOcLbSSL_RrabSkuMRau6T
lea ecx, [ebp - 0x840]
call fcn.0040df43
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x828]
call fcn.0040b020
cmp dword [eax + 0x14], 8
jb 0x40d278
mov eax, dword [eax]
lea ecx, [ebp - 0x844]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00401656
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
push ebx
push 1
call fcn.00405e63
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00441690
add esp, 0xc
mov dword [ebp - 0x848], 0x400
cmp dword [ebp - 0x844], 0
je 0x40d390
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x84c]
push eax
push ebx
push str.TEMP
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d384
lea eax, [ebp - 0x810]
push eax
call fcn.0040283a
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
call fcn.004027c1
mov esi, dword [0x4ff2ac]
push esi
call fcn.0040283a
pop ecx
push eax
push ebx
push esi
mov ecx, edi
call fcn.00408211
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40d384
push 0x400
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40d384
push dword [0x4ff2ac]
call fcn.0044f78d
mov esi, eax
lea eax, [ebp - 0x810]
push eax
call fcn.0040283a
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
push esi
push ebx
call fcn.00401bc1
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00427f51
ret
Function at 0x40d3fe
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x86c
mov eax, 0x49e9b2
call fcn.00427fa7
mov esi, ecx
mov dword [ebp - 0x874], esi
xor ebx, ebx
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
mov dword [ebp - 0x878], ebx
call fcn.00441690
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402861
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x840]
cmp dword [ebp - 0x82c], 8
mov eax, dword [ebp - 0x830]
cmovae ecx, dword [ebp - 0x840]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x40d494
mov edi, 0x4be748
push edi
call fcn.0040283a
pop ecx
push eax
push edi
lea ecx, [ebp - 0x840]
call fcn.00402291
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x844], 7
mov dword [ebp - 0x848], ebx
mov word [ebp - 0x858], ax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], ebx
mov word [ebp - 0x828], ax
push 8
lea edx, [ebp - 0x858]
mov byte [ebp - 4], 2
pop ecx
call fcn.0040b14f
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x870]
call fcn.00408887
pop ecx
push eax
lea ecx, [ebp - 0x828]
call fcn.0040197a
push ebx
push edi
lea ecx, [ebp - 0x870]
call fcn.00401656
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ebx
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0044d4ad
pop ecx
pop ecx
test eax, eax
jne 0x40d545
push ebx
push edi
lea ecx, [ebp - 0x828]
call fcn.00401656
push ebx
push edi
lea ecx, [ebp - 0x858]
call fcn.00401656
jmp 0x40d497
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0044fab0
pop ecx
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.0040226c
push ebx
push edi
lea ecx, [ebp - 0x828]
call fcn.00401656
push ebx
push edi
lea ecx, [ebp - 0x858]
call fcn.00401656
push ebx
push edi
lea ecx, [ebp - 0x840]
call fcn.00401656
mov eax, esi
call fcn.00427f51
ret