joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421430
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push edi
xor edi, edi
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x4214ce
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x1c]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call ebx
cmp dword [esp + 0x10], 1
jne 0x4214d7
call fcn.004074f0
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
sub eax, 0x10
shr ecx, 1
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
inc ecx
sub eax, ecx
or edx, eax
jge 0x421495
mov eax, esi
call fcn.00407610
mov edi, dword [esi]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax]
push edi
lea edx, [esp + 0x18]
push edx
push 0
push ebp
push ecx
call ebx
test eax, eax
jne 0x4214e1
mov edx, dword [esp + 0x1c]
shr edx, 1
mov word [edi + edx*2], ax
call fcn.00418a60
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret 8
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret 8
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 8

Function at 0x4215e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4c
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
mov ebp, dword [esp + 0x54]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421600
sub eax, edx
mov edi, eax
mov ecx, edi
xor eax, eax
and ecx, 0x800000ff
mov dword [esp + 0xc], edi
jns 0x421623
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax + 0x542900]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x40
jl 0x421623
xor esi, esi
test edi, edi
jle 0x421686
jmp 0x421640
mov al, byte [esi + ebp]
mov ecx, esi
and ecx, 0x3f
movzx edi, byte [esp + ecx + 0x14]
and edi, 0x80000007
not al
jns 0x42165c
dec edi
or edi, 0xfffffff8
inc edi
mov ecx, edi
mov dl, 1
shl dl, cl
mov ecx, 8
sub ecx, edi
mov dword [esp + 0x10], edi
dec dl
and dl, al
shl dl, cl
mov cl, byte [esp + 0x10]
shr al, cl
inc esi
or dl, al
cmp esi, dword [esp + 0xc]
mov byte [esi + ebp - 1], dl
jl 0x421640
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004ea10a
add esp, 0x4c
ret
Function at 0x4216a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x44
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4216b3
sub eax, edx
push ebp
mov ebp, eax
mov ecx, ebp
xor eax, eax
and ecx, 0x800000ff
push esi
jns 0x4216d4
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax + 0x542900]
xor dl, cl
mov byte [esp + eax + 8], dl
inc eax
cmp eax, 0x40
jl 0x4216d4
xor esi, esi
test ebp, ebp
jle 0x421736
push ebx
lea ecx, [ecx]
mov eax, esi
and eax, 0x3f
movzx ecx, byte [esp + eax + 0xc]
and ecx, 0x80000007
jns 0x421707
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dl, byte [edi + esi]
mov eax, 8
sub eax, ecx
mov ecx, eax
mov bl, 1
shl bl, cl
mov ecx, 8
sub ecx, eax
inc esi
dec bl
and bl, dl
shl bl, cl
mov cl, al
shr dl, cl
or bl, dl
cmp esi, ebp
not bl
mov byte [edi + esi - 1], bl
jl 0x4216f0
pop ebx
mov ecx, dword [esp + 0x48]
pop esi
pop ebp
xor ecx, esp
call fcn.004ea10a
add esp, 0x44
ret
Function at 0x425b30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, eax
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x574], ebx
je 0x425b57
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi + 0x574], ebx
mov eax, dword [esi + 0x57c]
cmp eax, ebx
je 0x425c05
mov edi, eax
call fcn.00402870
mov edi, eax
cmp edi, ebx
je 0x425bff
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
push 2
push ebx
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x30]
mov ecx, edi
call edx
test eax, eax
je 0x425b99
lea ebx, [esi + 0x18]
call fcn.00403600
xor ebx, ebx
mov eax, dword [esi + 0x57c]
cmp eax, dword [esi + 0x578]
jne 0x425bff
cmp edi, esi
je 0x425bcc
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x38]
mov eax, dword [esp + 0x34]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push 0x202
mov ecx, edi
call fcn.00404d80
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x425bee
cmp word [eax], bx
je 0x425bee
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x425bff
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x425bff
mov dword [esp + 0x14], 1
mov ebp, eax
mov dword [esi + 0x57c], ebx
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esi + 0x128]
call fcn.004a5620
cmp dword [esp + 0x14], ebx
je 0x425c61
mov eax, dword [esi + 0x10]
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
mov dword [esp + 0x24], ebp
call edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ecx
push 0x4e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4274f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x50fad1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x18], ebp
mov esi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], 2
mov byte [esi], al
xor ecx, ecx
mov dword [ebp + 0x14], eax
push 0xffffffffffffffff
mov dword [ebp + 0x18], 7
lea ebx, [ebp + 4]
mov word [ebx], cx
push eax
lea eax, [esp + 0x74]
mov ecx, ebp
call fcn.0040e810
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], 1
test edi, edi
jbe 0x42757a
cmp dword [ebp + 0x18], 8
jb 0x427568
mov ebx, dword [ebx]
mov eax, dword [esp + 0x64]
push ebx
lea ecx, [esp + 0x54]
call fcn.00427660
test eax, eax
jne 0x4275bc
lea edx, [esp + 0x50]
mov byte [esi], 1
push edx
mov ebx, str._tmp
lea esi, [esp + 0x24]
call fcn.004276d0
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, ebp
mov byte [esp + 0x4c], 3
call fcn.0040e810
mov byte [esp + 0x44], 2
cmp dword [esp + 0x38], 8
jb 0x4275bc
mov eax, dword [esp + 0x24]
push eax
call fcn.004ea0ff
add esp, 4
mov ebx, 8
cmp dword [ebp + 0x18], ebx
jb 0x4275cb
mov eax, dword [ebp + 4]
jmp 0x4275ce
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
xor esi, esi
push 0xffffffffffffffff
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], esi
push esi
mov eax, ebp
mov word [ecx + 4], dx
call fcn.0040e810
call fcn.0040f9d0
add esp, 0x1c
cmp dword [esp + 0x68], ebx
jb 0x427616
mov eax, dword [esp + 0x54]
push eax
call fcn.004ea0ff
add esp, 4
xor ecx, ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], esi
mov word [esp + 0x54], cx
cmp dword [esp + 0x84], ebx
jb 0x42763b
mov edx, dword [esp + 0x70]
push edx
call fcn.004ea0ff
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret

Function at 0x4276d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50be88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.0040e810
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x427726
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x14]
call fcn.00417d90
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.0040e810
cmp dword [esp + 0x24], 8
jb 0x42776e
mov edx, dword [esp + 0x10]
push edx
call fcn.004ea0ff
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x42bdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bb89
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
mov eax, dword [0x544fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x544fac
call edx
add eax, 0x10
mov dword [edi], eax
cmp ebp, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 1
mov edx, ebp
jge 0x42be1e
neg edx
cmp ebx, esi
mov esi, ebx
jge 0x42be26
neg esi
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jge 0x42be30
neg ecx
mov eax, dword [esp + 0x28]
test eax, eax
jge 0x42be3a
neg eax
push edx
xor edx, edx
test ebp, ebp
setl dl
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
xor edx, edx
test ebx, ebx
setl dl
push esi
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push ecx
xor ecx, ecx
cmp dword [esp + 0x40], ecx
setl cl
xor edx, edx
dec ecx
and ecx, 0xffffffd1
add ecx, 0x5f
cmp dword [esp + 0x3c], edx
push ecx
setl dl
push eax
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push str._c_d__c_d__c_d__c_d
call fcn.00402020
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x42f0c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x50eaa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
cmp dword [0x546360], 0
je 0x42f222
mov eax, dword [0x54683c]
add eax, 0xfffffff0
call fcn.00404eb0
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.00417a00
push eax
mov ecx, 0x51c370
call fcn.00417bc0
mov bl, al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f151
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42f166
push 1
push 0x51c374
lea ecx, [esp + 0x14]
push ecx
call fcn.00418990
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x51c378
call fcn.00417ae0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f1a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x42f1fa
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.qq_browser.exe
call fcn.00417ae0
mov byte [esp + 0x24], 1
mov eax, dword [eax]
push eax
mov ecx, 0x51c398
call fcn.00415470
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f1fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f222
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x42f350
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x511bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.StartInstall
mov ecx, 0x546980
call fcn.004df340
mov eax, dword [0x5467e8]
xor ebx, ebx
add esp, 4
mov dword [0x5467cc], esi
cmp dword [eax - 0xc], ebx
jne 0x42f3d1
cmp byte [0x546838], bl
je 0x42f3b3
push str.no_install_path
mov ecx, 0x546980
call fcn.004df340
add esp, 4
mov dword [0x542984], 0x3f2
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
cmp esi, ebx
je 0x42f51b
add eax, 0xfffffff0
call fcn.00404eb0
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], ebx
cmp dword [eax - 0xc], ebx
jg 0x42f433
add eax, 0xfffffff0
mov dword [0x542984], 0x3f2
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f41f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
mov eax, 3
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
call fcn.00417a70
lea edi, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.00404f20
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f477
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0xc]
call fcn.004342b0
push ebx
push 0x100000
push edx
push eax
call fcn.004fe8a0
cmp eax, 0x3c
jge 0x42f50a
mov edx, 1
lea ecx, [edx + 0x63]
mov dword [0x542984], 0x3f3
call fcn.00421510
push 0x516216
lea ecx, [esp + 0x18]
call fcn.00401910
push ebx
push ebx
push 1
push 0x5467c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 2
call fcn.00430ad0
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call fcn.00401e70
push 0x51c428
mov ecx, 0x546980
call fcn.004df340
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00406cf0
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00406cf0
call fcn.004d88c0
mov edx, dword [0x546884]
mov ecx, dword [0x5467e8]
push eax
call fcn.004d7ec0
cmp dword [0x5467cc], ebx
je 0x42f546
mov ecx, 0x5467c0
call fcn.00432950
jmp 0x42f563
push ebx
push ebx
push 0x5467c0
push 0x431a80
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5467e4], eax
cmp eax, ebx
je 0x42f568
mov ebx, 1
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
Function at 0x431600
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x50ea5b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x23
lea eax, [esp + 0x34]
push eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], cx
lea edx, [eax + 2]
jmp 0x431670
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x431670
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
lea esi, [esp + 0x14]
call fcn.004133e0
mov dword [esp + 0x240], edi
mov eax, dword [esp + 0x24]
cmp eax, edi
jne 0x4316b5
push ebx
mov ecx, 0x51c9c4
call fcn.00406c40
cmp dword [esp + 0x28], 8
jb 0x43172b
mov edx, dword [esp + 0x14]
push edx
jmp 0x431723
lea esi, [eax - 1]
cmp eax, esi
ja 0x4316c1
call fcn.004e8d73
mov eax, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x4316d4
lea eax, [esp + 0x14]
movzx eax, word [eax + esi*2]
cmp ax, 0x5c
je 0x4316f4
cmp ax, 0x2f
je 0x4316f4
push 1
push 0x51c9c8
lea eax, [esp + 0x18]
call fcn.00417d90
push 0x1b
push 0x51c9cc
lea eax, [esp + 0x18]
call fcn.00417d90
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x431712
lea ecx, [esp + 0x14]
push ebx
call fcn.00406c40
cmp dword [esp + 0x28], edi
jb 0x43172b
mov eax, dword [esp + 0x14]
push eax
call fcn.004ea0ff
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004ea10a
add esp, 0x238
ret
Function at 0x431760
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50f616
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor esi, esi
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push esi
push ecx
mov dword [esp + 0x24], esi
mov word [esp + 0x30], ax
call fcn.004f0190
mov edx, dword [0x544fac]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x544fac
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x24]
push ecx
push 0x104
mov dword [esp + 0x240], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x4318fd
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x431803
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
mov eax, 0x5467ec
call fcn.00407680
push 7
push 0x51ca04
push 0x5467ec
call fcn.00418990
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x51ca14
lea edi, [esp + 0x24]
call fcn.00418bf0
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp - 0xc]
add esp, 8
push eax
push ebp
push 0x5467ec
call fcn.00418990
mov edx, dword [0x5467ec]
push edx
call fcn.00415370
add esp, 4
test eax, eax
jne 0x4318c8
lea ebx, [esp + 0x20]
call fcn.00431600
mov edi, 0x5467ec
mov byte [esp + 0x238], 1
call fcn.00404f20
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4318b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x5467ec]
push ecx
call fcn.00415370
add esp, 4
test eax, eax
je 0x4318fd
mov edx, dword [0x5467ec]
push edx
push str.temp_:__ws
mov ecx, 0x546980
call fcn.004df340
add esp, 8
call fcn.004d88c0
mov edx, dword [0x5467ec]
mov ecx, eax
call fcn.004d8500
mov dword [esp + 0x18], 1
jmp 0x431907
mov esi, 0x5467ec
call fcn.004074f0
add ebp, 0xfffffff0
mov dword [esp + 0x238], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43192f
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004ea10a
add esp, 0x228
ret
Function at 0x431a90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x510bf0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov eax, dword [0x544fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x544fac
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
jge 0x431aff
mov ecx, 0x105
lea eax, [esp + 0x2c]
call fcn.00407610
mov esi, dword [esp + 0x2c]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004ec08d
add esp, 8
test eax, eax
jl 0x431c32
cmp eax, dword [esi - 8]
jg 0x431c32
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea edx, [esp + 0x2c]
lea eax, [ecx + 1]
push edx
lea ecx, [esp + 0x1c]
call fcn.00417a00
push eax
mov ecx, 0x51ca2c
call fcn.00417bc0
mov bl, al
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431b73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x431b8c
push 1
push 0x51ca30
lea ecx, [esp + 0x34]
push ecx
call fcn.00418990
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov ebx, 0x51ca34
call fcn.00417ae0
add esp, 8
lea edi, [ebp + 0x7c]
mov byte [esp + 0x24], 1
call fcn.00404f20
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431bd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push 0
push eax
call fcn.00416e10
mov edi, dword [edi]
add esp, 8
push edi
add ebp, 0x34
push ebp
mov ecx, 2
call fcn.00418fe0
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431c17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push 0x80070057
call fcn.004029f0
int3
Function at 0x433c40
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x50e972
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov dword [esp + 0x228], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x544fac]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, 0x544fac
mov dword [esp + 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
mov dword [esp + 0x230], 0
push ecx
mov dword [esp + 0x18], 1
mov word [esp + 0x20], ax
call fcn.004f0190
add esp, 0xc
push 0
push 0x26
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x433d68
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x433d09
jge 0x433d01
push 0x80070057
call fcn.004029f0
mov ax, word [ecx]
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433d10
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x14]
mov ebx, eax
push ecx
mov eax, edi
call fcn.00407680
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x433d5b
lea edx, [eax - 1]
test edx, edx
jl 0x433cf7
cmp edx, eax
jg 0x433cf7
movzx eax, word [ecx + edx*2]
cmp ax, 0x5c
je 0x433d5b
cmp ax, 0x2f
je 0x433d5b
mov edx, 0x51eac0
call fcn.004179a0
push 7
push 0x51d62c
push edi
call fcn.00418990
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004ea10a
add esp, 0x220
ret
Function at 0x4342b0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [eax]
sub esp, 0x1c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4342d5
xor edx, edx
add esp, 0x1c
ret
mov ecx, dword [esp + 4]
mov eax, dword [esp]
mov edx, ecx
test ecx, ecx
jg 0x4342f0
jl 0x4342e8
test eax, eax
jae 0x4342f0
or eax, 0xffffffff
mov edx, SysReAllocString
add esp, 0x1c
ret

Function at 0x4348a0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x546848]
test eax, eax
je 0x4348d4
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4348d4
mov eax, dword [0x546848]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x546848], 0
ret