joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c624
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a5a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f55
mov dword [ebp - 0x14], eax
cmp dword [0x4628d0], esi
jne 0x40c717
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c6a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c7f7
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c7f7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c7f7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4628d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4628d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4628d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4628e0], eax
test eax, eax
je 0x40c714
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4628dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c73c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c72f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c751
push 4
pop eax
jmp 0x40c7f9
cmp dword [ebp - 0x14], esi
je 0x40c751
push dword [0x4628d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c736
mov eax, dword [0x4628dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c7af
cmp dword [0x4628e0], edi
je 0x40c7af
push eax
call ebx
push dword [0x4628e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c7af
test eax, eax
je 0x40c7af
call ecx
test eax, eax
je 0x40c7a4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c7a4
test byte [ebp - 8], 1
jne 0x40c7af
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c7df
mov eax, dword [0x4628d4]
cmp eax, edi
je 0x40c7dc
push eax
call ebx
test eax, eax
je 0x40c7dc
call eax
mov esi, eax
test esi, esi
je 0x40c7dc
mov eax, dword [0x4628d8]
cmp eax, edi
je 0x40c7dc
push eax
call ebx
test eax, eax
je 0x40c7dc
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4628d0]
call ebx
test eax, eax
je 0x40c7f7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c7f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040393e
mov esp, ebp
pop ebp
ret
Function at 0x402bc1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402bc7
call fcn.0040dfc0
lea eax, [esp]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x402bf3
mov eax, 1
jmp 0x402bf5
xor eax, eax
add esp, 0x24
pop ebp
ret

Function at 0x403275
Capabilities:
Get common file path

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40327b
jmp loc.0041a000

Function at 0x4034d1
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
call fcn.0040dfc0
mov ebx, dword [0x418030]
cmp ebx, 1
jne 0x40357e
push dword [0x4180a8]
call fcn.0040a443
mov ebx, eax
and ebx, ebx
jle 0x403525
push dword [0x4180a8]
call fcn.0040a44d
push dword [0x4180a8]
call fcn.0040a462
or eax, eax
je 0x403525
mov ebp, dword [0x4180ac]
push dword [ebp + 8]
call fcn.0040a7e7
jmp 0x403506
push dword [0x4180a0]
call fcn.0040a443
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
jle 0x40357e
push 5
push 0
push 1
push dword [0x4180a0]
call fcn.00406fb0
push dword [0x4180a0]
call fcn.0040a44d
push dword [0x4180a0]
call fcn.0040a462
or eax, eax
je 0x40357e
mov ebp, dword [0x4180a4]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x40355f
mov eax, 1
jmp 0x403587
add esp, 4
pop ebx
pop ebp
ret

Function at 0x405436
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.004053ea
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x4186a8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4180c4]
jmp 0x405467
cmp dword [esi + 0xc], edi
je 0x40546d
mov esi, dword [esi]
test esi, esi
jne 0x405460
jmp 0x405485
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x4180c4
call fcn.0040db32
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4

Function at 0x405492
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x40552a
push edi
push 0x4186a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4180c4]
test edi, edi
je 0x4054fe
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4054f7
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x4180c4
call fcn.0040db32
pop ecx
pop ecx
jmp 0x4054f9
mov edi, dword [edi]
test edi, edi
jne 0x4054ce
pop ebx
mov eax, dword [0x417114]
mov esi, eax
inc eax
push 0x10
push 0x4180c4
mov dword [0x417114], eax
call fcn.0040db72
pop ecx
pop ecx
push 0x4186a8
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x401390
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x42fda0], 0
je 0x4013b1
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x42fda8], 0
je 0x4013c3
mov dword [ebp - 4], 1
jmp 0x4013f4
cmp dword [0x42fda0], 0
jne 0x4013d7
call fcn.00401480
test eax, eax
jne 0x4013d7
jmp 0x4013f4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x42f054]
push ecx
call fcn.00401430
test eax, eax
jne 0x4013ed
jmp 0x4013f4
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x401420
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7f
je 0x40140f
cmp dword [ebp - 8], 0x78
jne 0x401420
mov dword [0x42fda8], 1
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x401800
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x430208], 0
jne 0x401848
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
je 0x40183e
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x430204], eax
mov dword [0x430208], 1
cmp dword [0x430204], 0
je 0x40186d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [0x430204]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40186d
jmp 0x4018d0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4018bf
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
je 0x401899
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
call dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x4018a9
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
call dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x4018b7
jmp 0x4018d0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401fb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
push 0x42951c
mov eax, dword [ebp + 8]
push eax
call fcn.0041e701
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402008
xor eax, eax
jmp 0x4021df
push 0x429520
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041e701
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 4], 0
jne 0x402036
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x4021df
mov eax, dword [ebp - 0x114]
push eax
call fcn.004287cc
add esp, 4
push eax
call fcn.004286f8
add esp, 4
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x64000
jle 0x4020b1
push 0
push 0x64000
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0041e65c
add esp, 0xc
test eax, eax
je 0x402097
mov edx, dword [ebp - 4]
push edx
call fcn.0041e57c
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x4021df
mov ecx, dword [ebp - 0x114]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x124]
push edx
call fcn.0041e4e4
add esp, 0x10
push 0
push 0
mov eax, dword [ebp - 0x114]
push eax
call fcn.0041e65c
add esp, 0xc
mov ecx, dword [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x128]
call fcn.00401e60
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0041e57c
add esp, 4
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.0041e1b0
add esp, 8
push 0x429524
lea ecx, [ebp - 0x110]
push ecx
call fcn.0041e1c0
add esp, 8
push 0x42952c
lea edx, [ebp - 0x110]
push edx
call fcn.0041e701
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402151
mov eax, dword [ebp - 4]
push eax
call fcn.0041e57c
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x4021df
mov edx, dword [ebp - 8]
push edx
call fcn.004287cc
add esp, 4
push eax
call fcn.004286f8
add esp, 4
mov dword [ebp - 0x120], eax
mov eax, 0x64000
sub eax, dword [ebp - 0x124]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x128]
call fcn.00401f70
mov edx, dword [ebp - 4]
push edx
push 0x10
push 1
lea eax, [ebp - 0x124]
push eax
call fcn.0041e3af
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x128]
call fcn.00401e60
mov eax, dword [ebp - 8]
push eax
call fcn.0041e57c
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041e57c
add esp, 4
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402ad0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0x31c], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0041ea1b
add esp, 8
cmp eax, 0xffffffff
jne 0x402b17
mov ecx, dword [ebp - 0x31c]
cmp dword [ecx + 0x104], 0
jne 0x402b10
push str.Source_folder_is_not_found
push 0
call fcn.0040f3e0
add esp, 8
xor eax, eax
jmp 0x402c5c
push 0
push 0x438
mov ecx, 0x42fdb8
call fcn.0041c500
push eax
call fcn.00404720
add esp, 4
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x429590
lea eax, [ebp - 0x108]
push eax
call fcn.0041e1c0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00403e60
add esp, 8
test eax, eax
jne 0x402b98
mov eax, dword [ebp - 0x31c]
cmp dword [eax + 0x104], 0
jne 0x402b8c
push str.CompressFolder_error
push 0
call fcn.0040f3e0
add esp, 8
call fcn.00404890
xor eax, eax
jmp 0x402c5c
lea ecx, [ebp - 0x318]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.__xxxx.tmp
lea edx, [ebp - 0x318]
push edx
call fcn.0041e1c0
add esp, 8
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [0x42fdb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x318]
push ecx
mov ecx, dword [ebp - 0x31c]
call fcn.00401fb0
cmp dword [ebp + 0x10], 0
jle 0x402c19
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x31c]
call fcn.00402660
jmp 0x402c38
mov edx, dword [ebp + 0xc]
push edx
call fcn.00404030
add esp, 4
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00404890
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402c70
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov dword [ebp - 0x434], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x21c], ax
movzx eax, word [ebp - 0x21c]
cmp eax, 0x412
jne 0x402ca3
mov dword [ebp - 4], 0x43b
jmp 0x402cbc
mov ecx, 0x411
test ecx, ecx
je 0x402cb5
mov dword [ebp - 4], 0x442
jmp 0x402cbc
mov dword [ebp - 4], 0x43a
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, 0x42fdb8
call fcn.0041c500
push eax
call fcn.00404720
add esp, 4
mov eax, dword [ebp - 0x434]
mov dword [eax + 0x100], 1
lea ecx, [ebp - 0x328]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4295bc
lea edx, [ebp - 0x328]
push edx
call fcn.0041ead7
add esp, 8
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.0041e1b0
add esp, 8
lea ecx, [ebp - 0x328]
push ecx
call fcn.0041ea61
add esp, 4
push 0x104
lea edx, [ebp - 0x430]
push edx
mov eax, dword [0x42fdb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4295c0
mov ecx, dword [ebp + 8]
push ecx
push 0x4295d0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1b0
add esp, 8
push 0x4295d8
lea edx, [ebp - 0x218]
push edx
call fcn.0041e1c0
add esp, 8
push 0x4295dc
lea eax, [ebp - 0x218]
push eax
call fcn.0041e1c0
add esp, 8
push 0x4295e4
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1c0
add esp, 8
lea edx, [ebp - 0x110]
push edx
call fcn.00404030
add esp, 4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x430]
push edx
mov ecx, dword [ebp - 0x434]
call fcn.004021f0
test eax, eax
jne 0x402e0c
mov eax, dword [ebp - 0x434]
cmp dword [eax + 0x104], 0
jne 0x402e03
push 0x4295ec
push 0
call fcn.0040f3e0
add esp, 8
call fcn.00404890
xor eax, eax
jmp 0x402e83
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.004043b0
add esp, 8
test eax, eax
jne 0x402e4a
mov eax, dword [ebp - 0x434]
cmp dword [eax + 0x104], 0
jne 0x402e41
push 0x4295fc
push 0
call fcn.0040f3e0
add esp, 8
call fcn.00404890
xor eax, eax
jmp 0x402e83
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x328]
push edx
mov ecx, dword [ebp - 0x434]
call fcn.00402e90
mov eax, dword [ebp - 0x434]
mov dword [eax + 0x100], 0
call fcn.00404890
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x402e90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov dword [ebp - 0x12c], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0041ea1b
add esp, 8
cmp eax, 0xffffffff
jne 0x402ebc
mov eax, 1
jmp 0x402f55
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.0041ecb0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0041e1b0
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 3
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 0
mov word [ebp - 0x118], 0x14
mov dword [ebp - 0x116], 0
mov dword [ebp - 0x112], 0
mov dword [ebp - 0x10e], 0
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp dword [ebp - 0x116], 0
je 0x402f50
xor eax, eax
jmp 0x402f55
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x402f60
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov dword [ebp - 0x53c], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x21c], ax
movzx eax, word [ebp - 0x21c]
cmp eax, 0x412
jne 0x402f93
mov dword [ebp - 4], 0x437
jmp 0x402fac
mov ecx, 0x411
test ecx, ecx
je 0x402fa5
mov dword [ebp - 4], 0x443
jmp 0x402fac
mov dword [ebp - 4], 0x436
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, 0x42fdb8
call fcn.0041c500
push eax
call fcn.00404720
add esp, 4
mov eax, dword [ebp - 0x53c]
mov dword [eax + 0x100], 1
lea ecx, [ebp - 0x430]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x429614
lea edx, [ebp - 0x430]
push edx
call fcn.0041ead7
add esp, 8
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.0041e1b0
add esp, 8
lea ecx, [ebp - 0x430]
push ecx
call fcn.0041ea61
add esp, 4
push 0x104
lea edx, [ebp - 0x538]
push edx
mov eax, dword [0x42fdb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x429618
lea ecx, [ebp - 0x430]
push ecx
push 0x429628
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1b0
add esp, 8
push 0x429630
lea edx, [ebp - 0x218]
push edx
call fcn.0041e1c0
add esp, 8
push 0x429634
lea eax, [ebp - 0x218]
push eax
call fcn.0041e1c0
add esp, 8
push str..cab
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1c0
add esp, 8
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x538]
push ecx
mov ecx, dword [ebp - 0x53c]
call fcn.004021f0
test eax, eax
jne 0x4030f3
mov edx, dword [ebp - 0x53c]
cmp dword [edx + 0x104], 0
jne 0x4030e7
push str.FileSplit_error
push 0
call fcn.0040f3e0
add esp, 8
call fcn.00404890
xor eax, eax
jmp 0x4031e2
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.004043b0
add esp, 8
test eax, eax
jne 0x403137
mov edx, dword [ebp - 0x53c]
cmp dword [edx + 0x104], 0
jne 0x40312b
push str.DecompressFolder_error
push 0
call fcn.0040f3e0
add esp, 8
call fcn.00404890
xor eax, eax
jmp 0x4031e2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00404890
cmp dword [ebp + 8], 0
je 0x403186
push 0x42966c
push str._s__express
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x53c]
call fcn.004031f0
jmp 0x4031bb
push 0x429688
push str._s__install
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x53c]
call fcn.004031f0
lea ecx, [ebp - 0x430]
push ecx
mov ecx, dword [ebp - 0x53c]
call fcn.00402e90
mov edx, dword [ebp - 0x53c]
mov dword [edx + 0x100], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4031f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov dword [ebp - 0x368], ecx
push 0x44
push 0
lea eax, [ebp - 0x360]
push eax
call fcn.0041ecb0
add esp, 0xc
mov dword [ebp - 0x360], 0x44
mov dword [ebp - 0x334], 1
mov word [ebp - 0x330], 1
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041ecb0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x118]
push edx
call fcn.0041ef75
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x4032a1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.0041e1b0
add esp, 8
push 0x4296a4
lea edx, [ebp - 0x318]
push edx
call fcn.0041e1c0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.0041e1c0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041ed10
add esp, 4
jmp 0x4032b4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.0041e1b0
add esp, 8
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x360]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40334d
cmp dword [ebp + 0x10], 0
je 0x40334d
mov dword [ebp - 0x364], 0
push 0x1f4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40330b
call fcn.0040f750
jmp 0x4032ee
lea eax, [ebp - 0x364]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x403339
cmp dword [ebp - 0x364], 0xffffffff
jne 0x403339
mov edx, dword [ebp - 0x368]
mov dword [edx + 0x108], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
je 0x403362
lea edx, [ebp - 0x118]
push edx
call fcn.0041ed10
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404720
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x430520], 0
je 0x40472f
jmp 0x404790
mov eax, dword [ebp + 8]
push eax
push 0x430420
call fcn.0041e1b0
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x4047a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x430520], eax
cmp dword [0x430520], 0
je 0x404772
mov edx, dword [0x430520]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x430520], 0
je 0x404790
cmp dword [0x430524], 0
je 0x404786
jmp 0x404790
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404772
mov esp, ebp
pop ebp
ret