joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0x104], 0
je 0x414a3f
push ebx
push str.PRF:_Applying_Profile___s_
call fcn.004133e0
mov edx, dword [ebx + 0xe98]
add esp, 8
mov dword [ebp - 4], 0
cmp dword [edx], 0
jle 0x414a07
push esi
push edi
mov dword [ebp + 8], 0
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [edx + 4]
mov ecx, edx
test byte [eax + edi + 0x108], 1
jne 0x4149e7
xor esi, esi
cmp dword [eax + edi + 0x104], esi
jle 0x4149e7
nop word [eax + eax]
mov eax, dword [edx + 4]
add eax, edi
push dword [eax + esi*4 + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4149d2
mov eax, dword [ebx + 0xe98]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
add eax, esi
push dword [ecx + eax*4 + 4]
lea eax, [edi + ecx]
push eax
call fcn.00413c60
add esp, 8
dec esi
mov ecx, dword [ebx + 0xe98]
inc esi
mov edx, ecx
mov eax, dword [ecx + 4]
cmp esi, dword [eax + edi + 0x104]
jl 0x4149a0
mov eax, dword [ebp - 4]
add edi, 0x2740
add dword [ebp + 8], 0x9d0
inc eax
mov edx, ecx
mov dword [ebp - 4], eax
cmp eax, dword [ecx]
jl 0x414980
pop edi
pop esi
push dword [ebp + 0xc]
push 1
push ebx
call fcn.00410590
add esp, 0xc
cmp byte [ebx + 0x106], 0
je 0x414a3f
lea eax, [ebp + 8]
push eax
push 0
push ebx
push fcn.00422840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x414a3f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414a50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
push str.UPD:_Check_DPI_Change_Update___d_
call fcn.004133e0
xor esi, esi
add esp, 8
mov dword [ebp - 4], esi
cmp dword [0x5664cc], esi
jle 0x414c54
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
nop
mov eax, dword [0x5664d0]
add eax, ebx
cmp byte [eax + 0x271], 0
je 0x414c39
cmp byte [eax + 0x289], 0
je 0x414aa9
cmp esi, dword [0x57c900]
jne 0x414c39
push eax
push str.UPD:_DPI_Change_Update__Profile___s__
call fcn.004133e0
mov eax, dword [0x5664d0]
push dword [ebp + 8]
add eax, ebx
push eax
call fcn.00415940
add esp, 0x10
test al, al
je 0x414c39
mov edi, dword [0x5664d0]
add edi, ebx
cmp byte [edi + 0x104], 0
je 0x414c39
cmp byte [edi + 0xeb4], 0
je 0x414bb7
push edi
push str.PRF:_Updating_Profile___s_
call fcn.004133e0
mov eax, dword [edi + 0x268]
add esp, 8
mov byte [edi + 0xeb4], 0
sub eax, 0
je 0x414ba8
sub eax, 1
je 0x414ba2
sub eax, 1
jne 0x414bb7
mov ecx, dword [edi + 0xe98]
xor esi, esi
cmp dword [ecx], esi
jle 0x414b91
xor ebx, ebx
nop word [eax + eax]
mov edx, dword [ecx + 4]
add edx, ebx
test byte [edx + 0x108], 1
jne 0x414b7d
test esi, esi
js 0x414b76
mov eax, dword [ecx]
dec eax
cmp esi, eax
jg 0x414b76
mov dword [ecx], eax
je 0x414b76
sub eax, esi
imul eax, eax, 0x2740
push eax
lea eax, [edx + 0x2740]
push eax
push edx
call fcn.00482d10
add esp, 0xc
dec esi
sub ebx, 0x2740
mov ecx, dword [edi + 0xe98]
inc esi
add ebx, 0x2740
cmp esi, dword [ecx]
jl 0x414b40
mov ebx, dword [ebp - 8]
push 1
push 0
push 0xffffffffffffffff
push edi
call fcn.00411240
mov esi, dword [ebp - 4]
jmp 0x414bb4
push 1
push 0
jmp 0x414bac
push 1
push 1
push 0xffffffffffffffff
push edi
call fcn.00411240
add esp, 0x10
cmp byte [edi + 0x26c], 0
je 0x414be1
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x414be1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x57c7d8]
test edx, edx
je 0x414c39
imul eax, dword [0x57c900], 0xeb8
add eax, dword [0x5664d0]
nop dword [eax + eax]
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x414c20
test cl, cl
je 0x414c1c
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x414c20
add edi, 2
add eax, 2
test cl, cl
jne 0x414c00
xor eax, eax
jmp 0x414c25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x414c39
push 0xffffffffffffffff
push 1
push 0x405
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
inc esi
add ebx, 0xeb8
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
cmp esi, dword [0x5664cc]
jl 0x414a80
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0xc]
push dword [edi + 8]
push str.UPD:_Check_Screen_Change_Update___d_x__d_
call fcn.004133e0
xor esi, esi
add esp, 0xc
mov dword [ebp - 4], esi
cmp dword [0x5664cc], esi
jle 0x415936
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
nop word [eax + eax]
mov eax, dword [0x5664d0]
add eax, ebx
cmp byte [eax + 0x270], 0
je 0x41591c
cmp byte [eax + 0x289], 0
je 0x415799
cmp esi, dword [0x57c900]
jne 0x41591c
push edi
push eax
call fcn.00415940
add esp, 8
test al, al
je 0x41591c
mov eax, dword [0x5664d0]
add eax, ebx
push eax
push str.UPD:_Screen_Change_Update__Profile___s__
call fcn.004133e0
mov edi, dword [0x5664d0]
add esp, 8
add edi, ebx
cmp byte [edi + 0x104], 0
je 0x415919
cmp byte [edi + 0xeb4], 0
je 0x415899
push edi
push str.PRF:_Updating_Profile___s_
call fcn.004133e0
mov eax, dword [edi + 0x268]
add esp, 8
mov byte [edi + 0xeb4], 0
sub eax, 0
je 0x41588a
sub eax, 1
je 0x415884
sub eax, 1
jne 0x415899
mov ecx, dword [edi + 0xe98]
xor esi, esi
cmp dword [ecx], esi
jle 0x415873
xor ebx, ebx
mov edx, dword [ecx + 4]
add edx, ebx
test byte [edx + 0x108], 1
jne 0x41585f
test esi, esi
js 0x415858
mov eax, dword [ecx]
dec eax
cmp esi, eax
jg 0x415858
mov dword [ecx], eax
je 0x415858
sub eax, esi
imul eax, eax, 0x2740
push eax
lea eax, [edx + 0x2740]
push eax
push edx
call fcn.00482d10
add esp, 0xc
dec esi
sub ebx, 0x2740
mov ecx, dword [edi + 0xe98]
inc esi
add ebx, 0x2740
cmp esi, dword [ecx]
jl 0x415822
mov ebx, dword [ebp - 8]
push 1
push 0
push 0xffffffffffffffff
push edi
call fcn.00411240
mov esi, dword [ebp - 4]
jmp 0x415896
push 1
push 0
jmp 0x41588e
push 1
push 1
push 0xffffffffffffffff
push edi
call fcn.00411240
add esp, 0x10
cmp byte [edi + 0x26c], 0
je 0x4158c3
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4158c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x57c7d8]
test edx, edx
je 0x415919
imul eax, dword [0x57c900], 0xeb8
add eax, dword [0x5664d0]
nop dword [eax]
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x415900
test cl, cl
je 0x4158fc
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x415900
add edi, 2
add eax, 2
test cl, cl
jne 0x4158e0
xor eax, eax
jmp 0x415905
sbb eax, eax
or eax, 1
test eax, eax
jne 0x415919
push 0xffffffffffffffff
push 1
push 0x405
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, dword [ebp + 8]
inc esi
add ebx, 0xeb8
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
cmp esi, dword [0x5664cc]
jl 0x415770
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421d80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x104
push eax
push esi
call fcn.00413ba0
add esp, 0xc
test eax, eax
je 0x421e2a
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 0x108], 0
je 0x421e2a
xor esi, esi
cmp dword [0x5664f4], esi
jle 0x421e2a
xor edi, edi
nop dword [eax]
mov eax, dword [0x5664f8]
add eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00482680
add esp, 8
test eax, eax
je 0x421e1b
mov eax, dword [0x5664f8]
add eax, 0x104
add eax, edi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00482680
add esp, 8
test eax, eax
jne 0x421e3d
inc esi
add edi, 0x30c
cmp esi, dword [0x5664f4]
jl 0x421de0
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00481761
mov esp, ebp
pop ebp
ret

Function at 0x422260
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 1
mov dword [ebp - 8], 0x100
mov word [ebp - 0xc], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0xa], ax
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push 1
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4222a0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 1
mov dword [ebp - 8], 1
mov word [ebp - 0xc], ax
mov ax, word [ebp + 8]
push 0xc
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov esp, ebp
pop ebp
ret
Function at 0x422650
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x57c7f0]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x422674
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x57c7f0], 0
test esi, esi
je 0x42273c
push 0x10
lea eax, [ebp - 0x14]
push eax
push 9
push esi
call dword [sym.imp.dwmapi.dll_DwmGetWindowAttribute]
test eax, eax
je 0x4226a4
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
xorps xmm0, xmm0
lea eax, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
push eax
movq qword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], str.WindowManagerCaptureOverlay
mov dword [ebp - 0x38], 0x4263b0
call dword [sym.imp.USER32.dll_RegisterClassA]
mov edx, dword [ebp - 0x10]
movd xmm1, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cvtdq2pd xmm1, xmm1
push 0
push dword [0xb64288]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
push 0
push 0
subsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
cvttsd2si eax, xmm1
movd xmm1, dword [ebp - 0xc]
cvtdq2pd xmm1, xmm1
push eax
subsd xmm1, xmm0
cvttsd2si eax, xmm1
push eax
push edx
push ecx
push connect
push 0x51984f
push str.WindowManagerCaptureOverlay
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 8
push eax
mov dword [0x57c7f0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00481761
mov esp, ebp
pop ebp
ret

Function at 0x422800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x422813
push dword [ebp + 8]
call fcn.00422840
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push fcn.00422840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x422836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x422c30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517ac0
mov eax, dword fs:[0]
push eax
mov eax, 0x1620
call fcn.00481770
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x770]
call fcn.0043cd30
push 0
push 0x5664cc
mov dword [ebp - 4], 0
call fcn.004222e0
push 0x5664cc
call fcn.00421f20
push 0x51b0a8
push 0xb649bc
lea eax, [ebp - 0x770]
push str._s_s.dcf
push eax
call fcn.0043ce50
add esp, 0x1c
lea ecx, [ebp - 0x770]
call fcn.0043cee0
test al, al
je 0x422e75
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xeb8
lea eax, [ebp - 0x1628]
push 0
push eax
call fcn.00483290
mov ecx, dword [ebp - 0x73d]
cmp cl, 0x2d
sete bl
xor eax, eax
cmp cl, 0x2d
mov byte [ebp - 0x162c], bl
lea ecx, [ebp - 0x73c]
sete al
dec eax
add eax, ecx
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0048dd93
lea eax, [ebp - 0x114]
push 0x2e
push eax
call fcn.004833f0
add esp, 0x20
test eax, eax
je 0x422d21
mov byte [eax], 0
push dword [ebp - 0x162c]
lea eax, [ebp - 0x1628]
push eax
lea ecx, [ebp - 0x770]
call fcn.0043cdf0
push eax
push 0
call fcn.00408ed0
add esp, 0x10
test al, al
je 0x422e50
test bl, bl
je 0x422d6d
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x1628]
push 0x104
push eax
call fcn.0048dea4
add esp, 0x10
push 9
push 0
mov ecx, 0xb657b8
call fcn.00427790
lea ecx, [ebp - 0x1628]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x422da1
test dl, dl
je 0x422d9d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x422da1
add ecx, 2
add eax, 2
test dl, dl
jne 0x422d81
xor eax, eax
jmp 0x422da6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x422e3a
mov eax, dword [ebp - 0x77c]
mov ecx, str.Ignore_Empty_Titles
mov eax, dword [eax + 4]
add eax, 0x109
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x422de1
test dl, dl
je 0x422ddd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x422de1
add eax, 2
add ecx, 2
test dl, dl
jne 0x422dc1
xor eax, eax
jmp 0x422de6
sbb eax, eax
or eax, 1
test eax, eax
je 0x422e3a
push 0x4e80
call fcn.00484f13
mov esi, eax
add esp, 4
test esi, esi
je 0x422e3a
push esi
call fcn.00408210
push str.Ignore_Empty_Titles
lea ecx, [esi + 0x109]
push 0x104
push ecx
call fcn.0048dd93
add esp, 0x10
mov byte [esi + 0x31e], 1
mov byte [esi + 0x108], 0x80
mov ecx, dword [ebp - 0x77c]
push 1
push 0
push esi
call fcn.00408720
push 0x4230c0
lea eax, [ebp - 0x1628]
mov ecx, 0x5664cc
push eax
call fcn.00414860
test bl, bl
je 0x422e62
lea ecx, [ebp - 0x770]
call fcn.0043cdf0
push eax
call edi
lea ecx, [ebp - 0x770]
call fcn.0043cee0
test al, al
jne 0x422cc1
push 1
push 0x5664cc
call fcn.004222e0
mov esi, dword [0x5664cc]
lea ecx, [ebp - 0x770]
add esp, 8
call fcn.0043cdc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret
Function at 0x4232a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x57c7d0], 0
je 0x4232bb
mov eax, dword [0xb659a8]
mov eax, dword [eax]
push dword [eax]
call sub.WTSAPI32.dll_WTSUnRegisterSessionNotification
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x423240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4232dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x423510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push edi
push eax
push 0
push dword [ebp + 8]
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x423587
cmp byte [ebp + 0xc], 0
je 0x423580
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
mov esi, 0x12c
xor ecx, ecx
mov edx, esi
mov eax, esi
dec esi
test eax, eax
setg cl
mov dword [ebp - 4], ecx
test edx, edx
jle 0x42357e
lea eax, [ebp - 4]
push eax
push edi
call ebx
cmp dword [ebp - 4], 0x103
jne 0x42357e
push 0x15a8
push 0xa
mov ecx, 0xb64288
call fcn.0042aaa0
jmp 0x423548
pop esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4286a0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x51984f
push ebx
mov ebx, dword [ebp + 0x14]
test edx, edx
push esi
mov esi, dword [ebp + 0x18]
cmovne eax, edx
push edi
push eax
push str._AUTOSTART
push str._WAITFORDATAPATH
push str._s__s__s
lea eax, [ebp - 0x414]
mov edi, ecx
push 0x208
push eax
call fcn.00407090
movzx eax, word [edi + 8]
add esp, 0x18
mov ecx, 0xb657b8
push 0
push eax
call fcn.00427790
push eax
lea eax, [edi + 0xff9]
push eax
push str._s_s.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00407090
add esp, 0x14
lea eax, [ebp - 0x628]
push eax
push 0x8007
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
je 0x428750
pop edi
pop esi
mov eax, 0xf013
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x628]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x108]
push eax
call fcn.00431640
add esp, 4
test esi, esi
jne 0x428788
movzx eax, word [edi + 8]
mov ecx, 0xb657b8
push esi
push eax
call fcn.00427790
mov esi, eax
push esi
lea eax, [ebp - 0x108]
push eax
push str._s_s.lnk
mov ecx, eax
push 0x104
push ecx
call fcn.00407090
add esp, 0x14
cmp dword [ebp + 8], 0
jne 0x4287cd
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x10], 0
je 0x4287e5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4287b8
lea eax, [ebp - 0x620]
push eax
push 0x51c400
push 1
push 0
push 0x51c460
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x428738
mov eax, dword [ebp - 0x620]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x620]
lea edx, [ebp - 0x414]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ecx, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
test ebx, ebx
push 0
cmovne eax, ebx
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp - 0x620]
lea edx, [ebp - 0x624]
push edx
push 0x52cdf0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4288b0
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x624]
lea edx, [ebp - 0x61c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x624]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
sar esi, 0x1f
and esi, 0xf013
jmp 0x4288b5
mov esi, 0xf013
mov ecx, dword [ebp - 0x620]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00481761
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42b270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareDeskSoft
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42b29d
xor eax, eax
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42b2d5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push eax
push 1
call fcn.0048deaf
mov edi, eax
add esp, 8
test edi, edi
je 0x42b307
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42b31a
push edi
call fcn.00484ef8
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, 0x52e
cmp dword [ebp - 8], esi
cmovb esi, dword [ebp - 8]
push esi
push edi
push dword [ebp + 0xc]
call fcn.00482d10
push edi
call fcn.00484ef8
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42e760
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
push edi
mov edi, dword [ebp + 0xc]
push 0x103
push 0
push eax
mov dword [ebp - 0x210], ecx
mov byte [ebp - 0x108], 0
call fcn.00483290
push str..chm
push esi
call fcn.00482680
add esp, 0x14
test eax, eax
jne 0x42e7c4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
cmp eax, 0xffffffff
jne 0x42e7f8
mov eax, dword [ebp - 0x210]
add eax, 0xff9
push eax
push 0x51d310
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407090
add esp, 0x14
jmp 0x42e80c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0048dd93
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
jne 0x42e88f
push esi
push 1
push 0x111
push 0
push 0xf007
mov ecx, 0xb657b8
call fcn.00427790
push eax
movzx eax, word [0xb64290]
mov ecx, 0xb657b8
push 0
push eax
call fcn.00427790
push eax
push 0
push 0xb64288
call fcn.0042ebc0
add esp, 0x1c
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42e8fc
lea eax, [ebp - 0x108]
mov ecx, 0xb657b8
push eax
push 1
push 0x111
push 1
push 0xf007
call fcn.00427790
push eax
movzx eax, word [0xb64290]
mov ecx, 0xb657b8
push 0
push eax
call fcn.00427790
push eax
push 0
push 0xb64288
call fcn.0042ebc0
add esp, 0x1c
mov eax, 3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 8
test edi, edi
je 0x42e930
cmp byte [edi], 0
je 0x42e930
push 0x51d318
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00484c83
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00484c83
add esp, 0x18
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42e940
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x107]
push eax
call fcn.00482d10
push 0x51d31c
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], 0x22
push 0x104
push eax
call fcn.00484c83
add esp, 0x18
lea eax, [ebp - 0x108]
push 1
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x42e9f6
push esi
push 1
push 0x111
push 0
push 0xf007
mov ecx, 0xb657b8
call fcn.00427790
push eax
movzx eax, word [0xb64290]
mov ecx, 0xb657b8
push 0
push eax
call fcn.00427790
push eax
push 0
push 0xb64288
call fcn.0042ebc0
add esp, 0x1c
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00481761
mov esp, ebp
pop ebp
ret 8