joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41adc0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x45c1e4]
push ebx
push esi
push edi
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SystemCurrentControlSetControlKeyboard_Layouts
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41aeeb
mov edx, dword [esp + 0x10]
mov word [esp + 0x20], si
mov ecx, 0x18
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x88], si
xor eax, eax
mov ecx, 0x18
lea edi, [esp + 0x8a]
rep stosd dword es:[edi], eax
push 0x32
lea ecx, [esp + 0x8c]
push ecx
push esi
push edx
stosw word es:[edi], ax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x41aeeb
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [esp]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x8c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41aec4
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push str.Ime_File
push edx
mov dword [esp + 0x34], 0x32
call esi
mov eax, dword [esp + 0x18]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call fcn.004293d1
mov eax, dword [ebx + 0x10]
push eax
lea edx, [esp + 0x28]
push edx
call fcn.0042928d
add esp, 0xc
test eax, eax
je 0x41af00
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x32
lea ecx, [esp + 0x8c]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x41ae60
xor eax, eax
mov ecx, dword [esp + 0xf4]
call fcn.00428a01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xf4]
mov eax, 1
mov dword [ebx + 0x34], eax
call fcn.00428a01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b1f0
Capabilities:
Check if file exists

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [0x45d16c]
mov edx, dword [ecx + 0x14]
push edi
lea eax, [esi + 4]
push eax
add edx, 0x1c
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00407ec0
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test edi, edi
je 0x41b244
mov dword [esi + 0x50], 1
pop edi
pop esi
pop ecx
ret
Function at 0x41b4b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x45c1e4]
push esi
mov dword [esp + 0x214], eax
push 0x104
lea eax, [esp + 0x10]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0xc]
push 0x449e8c
push ecx
call fcn.004294f0
mov edx, dword [esi + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004294f0
mov ecx, dword [0x45d16c]
mov ecx, dword [ecx + 0x18]
add esp, 0x10
call fcn.0040da10
test eax, eax
je 0x41b569
mov eax, dword [0x45d16c]
mov ecx, dword [eax + 0x18]
lea edx, [esp + 8]
push edx
call fcn.0040da40
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 8], esp
push edx
call fcn.004044b0
mov eax, dword [0x45d16c]
mov ecx, dword [eax + 0x28]
call fcn.00409550
test eax, eax
jne 0x41b542
mov dword [esi + 0x54], 1
mov ecx, dword [esp + 8]
mov edx, dword [0x45d16c]
push ecx
mov ecx, dword [edx + 0x18]
call fcn.0040da60
mov ecx, dword [esp + 0x214]
call fcn.00428a01
pop esi
add esp, 0x214
ret
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 8], esp
push eax
call fcn.004044b0
mov ecx, dword [0x45d16c]
mov ecx, dword [ecx + 0x28]
call fcn.00409550
test eax, eax
jne 0x41b593
mov dword [esi + 0x54], 1
mov ecx, dword [esp + 0x214]
call fcn.00428a01
pop esi
add esp, 0x214
ret

Function at 0x41b940
Capabilities:
Check if file exists
Manipulate boot configuration

Disassembly:
push 0xffffffffffffffff
push 0x447248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [0x45d16c]
mov edx, dword [ecx + 0x14]
push edi
lea eax, [esi + 0x18]
push eax
add edx, 0x1c
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00407ec0
push str.delboot.ini
push eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], 0
call fcn.00403800
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b168
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b18e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test edi, edi
je 0x41b199
mov dword [esi + 0x58], 1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 0x449de4
push eax
call fcn.0042928d
add esp, 8
test eax, eax
je 0x41b95f
mov ecx, esi
call fcn.0041b1b0
mov eax, dword [esi + 0x10]
push 0x449de4
push eax
call fcn.0042928d
add esp, 8
test eax, eax
je 0x41b97b
mov ecx, esi
call fcn.0041b4b0
mov ecx, esi
pop esi
jmp 0x41b0f0
Function at 0x41c750
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4474a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043dd21
mov ebx, eax
push edi
push ebx
call fcn.0042951a
add esp, 0xc
cmp esi, ebp
jl 0x41c87b
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x41c7c3
test ax, ax
jne 0x41c865
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.004044b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x70]
add esi, 0x6c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41c7f6
xor edx, edx
jmp 0x41c7fe
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x41c830
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x41c830
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403de0
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x41c842
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00404a50
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c865
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x41c7b1
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x41c8a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41c8c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4474a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043dd21
mov ebx, eax
push edi
push ebx
call fcn.0042951a
add esp, 0xc
cmp esi, ebp
jl 0x41c9ee
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x41c933
test ax, ax
jne 0x41c9d8
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.004044b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x80]
add esi, 0x7c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41c969
xor edx, edx
jmp 0x41c971
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x41c9a3
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x41c9a3
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403de0
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x41c9b5
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00404a50
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c9d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x41c921
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x41ca14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41ca30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4474a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043dd21
mov ebx, eax
push edi
push ebx
call fcn.0042951a
add esp, 0xc
cmp esi, ebp
jl 0x41cb61
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x41caa3
test ax, ax
jne 0x41cb4b
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.004044b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x90]
add esi, 0x8c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41cadc
xor edx, edx
jmp 0x41cae4
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x41cb16
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x41cb16
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403de0
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x41cb28
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00404a50
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cb4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x41ca91
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x41cb87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41cba0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4474a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043dd21
mov ebx, eax
push edi
push ebx
call fcn.0042951a
add esp, 0xc
cmp esi, ebp
jl 0x41ccd1
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x41cc13
test ax, ax
jne 0x41ccbb
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.004044b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xa0]
add esi, 0x9c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41cc4c
xor edx, edx
jmp 0x41cc54
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x41cc86
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x41cc86
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403de0
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x41cc98
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00404a50
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ccbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x41cc01
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x41ccf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41cd10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4474a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043dd21
mov ebx, eax
push edi
push ebx
call fcn.0042951a
add esp, 0xc
cmp esi, ebp
jl 0x41ce41
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x41cd83
test ax, ax
jne 0x41ce2b
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.004044b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xb0]
add esi, 0xac
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41cdbc
xor edx, edx
jmp 0x41cdc4
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x41cdf6
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x41cdf6
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403de0
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x41ce08
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00404a50
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ce2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x41cd71
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x41ce67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41dd20
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x850
mov eax, dword [0x45c1e4]
push edi
mov edi, dword [esp + 0x858]
test edi, edi
mov dword [esp + 0x850], eax
mov dword [esp + 8], ecx
je 0x41dfb0
mov eax, dword [esp + 0x85c]
test eax, eax
je 0x41dfb0
push ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0x41d1c0
push 0x41d1b0
push 0x41d1a0
push 0x41d190
push 0x41d180
push 0x41d170
push 0x41d160
call sub.Cabinet.dll_FDICreate
mov ebx, eax
add esp, 0x24
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x41dda9
pop ebx
pop edi
mov ecx, dword [esp + 0x84c]
call fcn.00428a01
add esp, 0x850
ret 0xc
push ebp
push esi
push edi
lea ecx, [esp + 0x144]
push 0x449cf8
push ecx
call fcn.00428eda
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [esp + 0x48]
push edx
push 0x104
lea eax, [esp + 0x154]
push eax
push 0
push 1
call ebp
push 0
lea ecx, [esp + 0x40]
push 0x8020
push ecx
call fcn.0042a6dd
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x41de27
push ebx
call sub.Cabinet.dll_FDIDestroy
add esp, 4
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x84c]
call fcn.00428a01
add esp, 0x850
ret 0xc
lea edx, [esp + 0x24]
push edx
push esi
push ebx
call sub.Cabinet.dll_FDIIsCabinet
add esp, 0xc
test eax, eax
push esi
jne 0x41de4b
call fcn.0042ad09
push ebx
call sub.Cabinet.dll_FDIDestroy
add esp, 8
jmp 0x41de0c
call fcn.0042ad09
push 0x5c
push edi
call fcn.004298d4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, eax
add esp, 0xc
test esi, esi
lea eax, [esp + 0x654]
jne 0x41de88
push edi
push eax
call ebx
push 1
lea ecx, [esp + 0x34c]
push 0x449de4
push ecx
call fcn.0042b11d
jmp 0x41deaf
lea edx, [esi + 2]
push edx
push eax
call ebx
sub esi, edi
sar esi, 1
lea ecx, [esi + 1]
push ecx
lea edx, [esp + 0x34c]
push edi
push edx
call fcn.0042b11d
mov word [esp + esi*2 + 0x356], 0
mov eax, dword [esp + 0x874]
add esp, 0xc
push eax
push 0x45d3c8
call ebx
mov eax, dword [esp + 0x86c]
test eax, eax
je 0x41ded4
push eax
push 0x45d1c0
call ebx
push 0x45d3c8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41deef
push eax
push 0x45d3c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x654]
push ecx
lea edx, [esp + 0x144]
push 0x449cf8
push edx
call fcn.00428eda
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [esp + 0x48]
push eax
push 0x104
lea ecx, [esp + 0x154]
push ecx
push 0
push 1
call ebp
lea edx, [esp + 0x348]
push edx
lea eax, [esp + 0x144]
push 0x449cf8
push eax
call fcn.00428eda
add esp, 0xc
push 0
push 0
push 0x104
lea ecx, [esp + 0x55c]
push ecx
push 0x104
lea edx, [esp + 0x154]
push edx
push 0
push 1
call ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov esi, dword [esp + 0x10]
push ecx
push 0
push 0x41d230
push 0
lea edx, [esp + 0x560]
push edx
lea eax, [esp + 0x50]
push eax
push esi
call sub.Cabinet.dll_FDICopy
add esp, 0x1c
cmp eax, 1
push esi
jne 0x41de04
call sub.Cabinet.dll_FDIDestroy
add esp, 4
jmp 0x41de0e
mov ecx, dword [esp + 0x850]
xor eax, eax
pop edi
call fcn.00428a01
add esp, 0x850
ret 0xc
Function at 0x41e2a0
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x45c1e4]
push esi
push edi
mov dword [esp + 0x21c], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
test eax, eax
push 0
je 0x41e2e4
push 0x17
lea eax, [esp + 0x18]
push eax
jmp 0x41e2eb
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41e30b
mov ecx, dword [esp + 0x21c]
call fcn.00428a01
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x10]
push 0x44d928
push edx
call fcn.004294f0
lea eax, [esp + 0x18]
push 0x44e21c
push eax
call fcn.004294f0
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.004044b0
mov ecx, esi
call fcn.0041dfd0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x21c]
mov eax, 1
call fcn.00428a01
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41e370
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x45c1e4]
push esi
push edi
mov dword [esp + 0x21c], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
test eax, eax
push 0
je 0x41e3b4
push 0x17
lea eax, [esp + 0x18]
push eax
jmp 0x41e3bb
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41e3db
mov ecx, dword [esp + 0x21c]
call fcn.00428a01
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x10]
push 0x44d928
push edx
call fcn.004294f0
lea eax, [esp + 0x18]
push 0x44e228
push eax
call fcn.004294f0
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.004044b0
mov ecx, esi
call fcn.0041dfd0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x21c]
mov eax, 1
call fcn.00428a01
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41e673
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x400
xor ebx, ebx
push ebx
mov esi, 0x45d5d8
push esi
call fcn.0042b160
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e6f3
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e6ea
cmp dword [ebp - 4], 1
je 0x41e6ea
cmp dword [ebp - 4], 2
je 0x41e6ea
cmp dword [ebp - 4], 7
je 0x41e6ea
mov byte [0x45d5d8], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret