joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ae30
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x473fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0043b3e0
mov ebx, eax
test ebx, ebx
jne 0x42ae6e
mov eax, 8
jmp 0x42b02e
mov ecx, edi
call fcn.0043b3c0
mov esi, eax
test esi, esi
je 0x42ae64
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x42ae97
mov dword [esp + 0x14], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42aeab
mov ecx, dword [0x493014]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0041c290
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call fcn.00423130
lea ecx, [esp + 0x14]
call fcn.00423190
mov ebp, dword [esp + 0x14]
cmp dword [ebp - 8], 0
jne 0x42aee2
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 1
jmp 0x42b02e
mov edx, dword [esp + 0x44]
mov eax, dword [edx]
cmp dword [eax - 8], 0x80
jle 0x42af04
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 9
jmp 0x42b02e
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x42af22
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 3
jmp 0x42b02e
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42af4b
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42af4b
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 2
jmp 0x42b02e
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004290e0
test eax, eax
je 0x42af6e
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 5
jmp 0x42b02e
movzx eax, word [ebp]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x4c]
push esi
call eax
mov ecx, dword [ebx]
mov esi, edx
mov edx, dword [ecx + 0x30]
mov edi, eax
shrd edi, esi, 0x14
push ebx
shr esi, 0x14
call edx
cdq
cmp esi, edx
ja 0x42afac
jb 0x42af99
cmp edi, eax
jae 0x42afac
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 6
jmp 0x42b02e
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b006
lea ecx, [esp + 0x18]
call fcn.0042a840
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x44], 1
call fcn.0041e0a0
lea ecx, [esp + 0x1c]
call fcn.0042aac0
lea ecx, [esp + 0x18]
test eax, eax
jne 0x42affc
call fcn.0042a9f0
lea ecx, [esp + 0x14]
call fcn.0041a500
mov eax, 7
jmp 0x42b02e
mov byte [esp + 0x3c], 0
call fcn.0042a9f0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.0041e0a0
call fcn.0042ac70
add esp, 4
lea ecx, [esp + 0x14]
test eax, eax
je 0x42aff0
call fcn.0041a500
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x42bf20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4740d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x48]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CFadeInOutAnnimationPlayer.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call fcn.00448600
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x42c3d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
push esi
push 0
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x42c438
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42c431
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.360tray.exe
lea ecx, [esp + 0x30]
push ecx
call ebp
test eax, eax
je 0x42c451
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42c412
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0045bbec
add esp, 0x230
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [edi], eax
push esi
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0045bbec
add esp, 0x230
ret
Function at 0x42c480
Capabilities:
Get session user name
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4741ab
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x244]
mov ebp, dword [esp + 0x240]
mov ebx, dword [esp + 0x23c]
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42c5a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42c5cd
lea ecx, [esp + 0x14]
call fcn.004257f0
push 0x1a
lea ecx, [esp + 0x18]
mov dword [esp + 0x238], 0
call fcn.00425b90
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, eax
test esi, esi
je 0x42c537
push 0xf003f
push esi
push 0x47d178
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00425c30
push esi
call edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], 0x105
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call fcn.00425810
mov esi, eax
test esi, esi
je 0x42c57f
push 0xf003f
push esi
push 0x47d178
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00425c30
push esi
call edi
mov ecx, dword [esp + 0x244]
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x42c5ae
lea ecx, [esp + 0x14]
mov dword [esp + 0x234], 0xffffffff
call fcn.00425800
mov eax, 1
jmp 0x42c622
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x14]
cmp eax, 5
je 0x42c5d1
mov dword [esp + 0x234], 0xffffffff
call fcn.00425800
xor eax, eax
jmp 0x42c622
push 1
call fcn.00425b90
mov esi, eax
test esi, esi
je 0x42c5fa
push 0xf003f
push esi
push 0x47d178
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00425c30
push esi
call edi
mov edx, dword [esp + 0x244]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x234], 0xffffffff
call fcn.00425800
mov eax, esi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0045bbec
add esp, 0x224
ret
Function at 0x42ca00
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1994
call fcn.0045cb30
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x1990], eax
push edi
mov edi, ecx
mov ecx, dword [0x496ca4]
test ecx, ecx
jne 0x42ca3d
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0045bbec
add esp, 0x1994
ret
push esi
call fcn.004374f0
mov esi, eax
test esi, esi
jne 0x42ca60
pop esi
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0045bbec
add esp, 0x1994
ret
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
push ebx
push esi
call ecx
push 0x800
lea edx, [esp + 0x1a0]
push 0
push edx
mov ebx, eax
call fcn.0045bc00
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x1a0]
push ecx
push esi
call edx
cmp word [esp + 0x19c], 0
jne 0x42cabc
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0045bbec
add esp, 0x1994
ret
push ebp
push 0x800
lea eax, [esp + 0x11a4]
push 0
push eax
call fcn.0045bc00
mov ecx, dword [esi]
mov eax, dword [ecx + 0x4c]
add esp, 0xc
push 0x400
lea edx, [esp + 0x11a4]
push edx
push esi
call eax
mov eax, dword [edi + 0x10]
mov ecx, dword [eax - 8]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add ecx, ecx
push ecx
push eax
push 1
lea edx, [esp + 0x11ac]
push edx
lea eax, [esp + 0x1b0]
push eax
push ebx
call ebp
push 0x190
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0045bc00
mov edx, dword [esi]
mov ecx, dword [edx + 0x3c]
add esp, 0xc
push 0xc8
lea eax, [esp + 0x14]
push eax
push esi
call ecx
push 0x800
lea edx, [esp + 0x9a4]
push 0
push edx
call fcn.0045bc00
mov ecx, dword [edi + 0x10]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x9a8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x9a0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cb70
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x9a4]
push ecx
push 1
push 0
lea edx, [esp + 0x1b0]
push edx
push ebx
call ebp
mov ecx, dword [esp + 0x19a0]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.0045bbec
add esp, 0x1994
ret
Function at 0x42d890
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x908
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x904], eax
push ebx
mov ebx, dword [esp + 0x910]
push esi
mov esi, dword [esp + 0x918]
mov dword [esp + 8], 0
test esi, esi
jne 0x42d8d1
push 0x484624
mov ecx, ebx
call fcn.0041e0e0
jmp 0x42d98d
push edi
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0045bc00
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x126]
push eax
mov word [esp + 0x128], dx
call fcn.0045bc00
push esi
lea ecx, [esp + 0x12c]
push 0x400
push ecx
call fcn.0045c24a
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x24
xor esi, esi
call fcn.00401340
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
push 0x80
lea ecx, [esp + 0x14]
push ecx
push eax
call edx
push 0x47d1fc
lea eax, [esp + 0x114]
push 0x400
push eax
call fcn.0045c24a
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x120]
push 0x400
push edx
call fcn.0045c24a
add esp, 0x18
lea eax, [esp + 0x110]
push eax
call edi
test eax, eax
je 0x42d9a8
inc esi
cmp esi, 0xa
jl 0x42d924
push 0x484624
mov ecx, ebx
call fcn.0041e0e0
pop edi
mov ecx, dword [esp + 0x90c]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0045bbec
add esp, 0x908
ret 8
lea ecx, [esp + 0x110]
push ecx
jmp 0x42d985
Function at 0x42dcb0
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x47432b
mov eax, dword fs:[0]
push eax
mov eax, 0x100c
call fcn.0045cb30
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x1008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1030]
mov esi, dword [esp + 0x1034]
mov edi, dword [esp + 0x1038]
test ebx, ebx
je 0x42ded3
test esi, esi
je 0x42ded3
push 0x800
lea eax, [esp + 0x820]
push 0
push eax
mov dword [esp + 0x24], 0
call fcn.0045bc00
push 0x800
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.0045bc00
push 0x400
lea edx, [esp + 0x838]
push esi
push edx
call fcn.0045cd4c
add esp, 0x24
lea eax, [esp + 0x81c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x81c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42de26
push esi
push str.File__s_exist
call fcn.004197f0
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
push esi
call ebp
test eax, eax
jne 0x42de26
push esi
push str.Delete_File__s_failed
call fcn.004197f0
add esp, 8
lea edx, [esp + 0x1c]
push edx
push 0
push 0x47bed0
lea eax, [esp + 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 0x1c]
push ecx
call ebp
push esi
call fcn.0042c2d0
add esp, 4
test eax, eax
jne 0x42de8b
lea edx, [esp + 0x1c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x42de8b
push esi
push str.Move_File__s_to_temp_dir
call fcn.004197f0
add esp, 8
push 4
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test edi, edi
je 0x42de1e
mov dword [edi], 4
mov dword [esp + 0x18], 1
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x42de82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x493014]
mov dword [esp + 0x14], ecx
push eax
push esi
push ebx
lea edx, [esp + 0x20]
push str.Copy_From__s_to__s_Failed_Error_Code___d
push edx
mov dword [esp + 0x103c], 0
call fcn.0041e1e0
mov eax, dword [esp + 0x28]
push eax
call fcn.004197f0
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x1028], 0xffffffff
call fcn.0041a500
cmp dword [esp + 0x18], 0
je 0x42decc
jmp 0x42debf
push esi
push str.Move_File__s_failed__replace_until_reboot
call fcn.004197f0
add esp, 8
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
push esi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test edi, edi
je 0x42debf
mov dword [edi], 5
mov ecx, dword [0x496ca4]
push 1
call fcn.0043ecb0
mov eax, 1
jmp 0x42ded5
xor eax, eax
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0045bbec
add esp, 0x1018
ret
Function at 0x42e620
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x410
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
mov ebx, dword [esp + 0x418]
mov dword [esp + 8], ecx
mov ecx, dword [0x496ca4]
push esi
push edi
mov edi, dword [esp + 0x424]
test ecx, ecx
je 0x42e65e
call fcn.0043e7e0
mov esi, eax
test esi, esi
jne 0x42e665
xor eax, eax
jmp 0x42e785
test edi, edi
je 0x42e65e
test ebx, ebx
je 0x42e65e
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
call ebp
test eax, eax
je 0x42e784
push edi
call ebp
test eax, eax
jne 0x42e690
mov eax, 1
jmp 0x42e784
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x26]
push ecx
xor ebp, ebp
mov word [esp + 0x28], ax
call fcn.0045bc00
mov edx, dword [esi]
mov ecx, dword [edx + 0x60]
add esp, 0xc
push 0x100
lea eax, [esp + 0x20]
push eax
push edi
push esi
call ecx
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x226]
push eax
mov word [esp + 0x228], dx
call fcn.0045bc00
mov ecx, dword [esi]
mov eax, dword [ecx + 0x60]
add esp, 0xc
push 0x100
lea edx, [esp + 0x220]
push edx
push ebx
push esi
call eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x220]
push edx
call fcn.0042d840
add esp, 8
test eax, eax
jg 0x42e768
mov eax, dword [esi]
mov eax, dword [eax + 0x40]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
xor ebx, ebx
push esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call eax
mov ecx, dword [esp + 0x14]
push edi
mov esi, eax
call fcn.0042c650
cmp esi, ebx
je 0x42e741
cmp dword [esp + 0x10], ebx
jne 0x42e745
cmp eax, ebx
je 0x42e759
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s_version_is_lower_or_equal_than_local_and_check_sign_successfully__DO_NOT_Copy_back__PE_file.
call fcn.004197f0
jmp 0x42e77f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s_check_sign_failed__PE_file__and_Copy_back.
jmp 0x42e775
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s_version_is_higher_than_local__PE_file__and_Copy_back..
call fcn.004197f0
mov ebp, 1
add esp, 8
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045bbec
add esp, 0x410
ret 8
Function at 0x42eb50
Capabilities:
Check if file exists
Create directory
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4744b1
mov eax, dword fs:[0]
push eax
sub esp, 0xa88
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0xa84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0xa9c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0xaac]
mov ebp, dword [esp + 0xab0]
xor ebx, ebx
cmp esi, ebx
je 0x42ed9a
cmp ebp, ebx
je 0x42ed9a
cmp word [esi], bx
je 0x42ed9a
cmp word [ebp], bx
je 0x42ed9a
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42ebc5
sub eax, edx
sar eax, 1
cmp eax, 0x104
jge 0x42ed9a
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42ebe4
sub eax, edx
sar eax, 1
cmp eax, 0x104
jge 0x42ed9a
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ec13
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x42ec42
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42ec42
push ebp
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.0042d890
mov ecx, dword [esp + 0x14]
push 3
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
call fcn.0041a500
push 0x410
lea edx, [esp + 0x68c]
push ebx
push edx
call fcn.0045bc00
push 0x206
lea ecx, [esp + 0x492]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x498], ax
call fcn.0045bc00
add esp, 0x18
push 0x47d76c
push esi
lea edx, [esp + 0x690]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, 0x5c
mov word [esp + 0x474], ax
mov dword [esp + 0x478], ebx
mov dword [esp + 0x47c], ebx
lea ecx, [esp + 0x688]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xaa8], ebx
call fcn.0042c8e0
cmp eax, ebx
je 0x42ed88
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ebx, [ebx]
lea ecx, [esp + 0x1c]
call fcn.0042c8a0
lea ecx, [esp + 0x1c]
test eax, eax
je 0x42eced
call fcn.0042c6d0
mov esi, eax
jmp 0x42ed80
lea edx, [esp + 0x14]
push edx
call fcn.0042d4f0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xaa8], 1
call fcn.0042d480
mov byte [esp + 0xaa4], 2
cmp dword [esp + 0x47c], ebx
je 0x42ed2c
mov eax, dword [esp + 0x1c]
shr eax, 4
and eax, 1
cmp eax, ebx
jne 0x42ed5c
push ebp
lea ecx, [esp + 0x484]
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x484]
push eax
call edi
mov edx, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x484]
push ecx
push edx
call fcn.0042dcb0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.0042c6d0
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0041a500
lea ecx, [esp + 0x14]
mov byte [esp + 0xaa4], bl
call fcn.0041a500
cmp esi, ebx
jne 0x42ecd0
lea ecx, [esp + 0x1c]
call fcn.0042c870
lea ecx, [esp + 0x1c]
call fcn.0042c870
mov ecx, dword [esp + 0xa9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa84]
xor ecx, esp
call fcn.0045bbec
add esp, 0xa94
ret 8
Function at 0x4308a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4746f6
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
mov edi, dword [esp + 0x834]
mov ebp, dword [esp + 0x838]
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x430ac8
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
lea edx, [esi + 0x20]
push edx
push edi
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ecx, dword [0x496ca4]
test ecx, ecx
je 0x430adb
call fcn.0043e7e0
test eax, eax
je 0x430adb
mov ecx, dword [0x496ca4]
call fcn.00425cf0
mov ecx, eax
call fcn.00425d80
test eax, eax
je 0x43095c
mov ecx, dword [0x496ca4]
call fcn.00425cf0
mov ecx, eax
call fcn.00425d70
test eax, eax
jne 0x43095c
push edi
mov ecx, esi
call fcn.0042e1c0
cmp eax, 1
je 0x430adb
push 0x800
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.0045bc00
mov eax, dword [esi + 0x10]
add esp, 0xc
push edi
push eax
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [0x493014]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0xbf
lea ecx, [esp + 0x14]
mov dword [esp + 0x830], 0
call fcn.0041c830
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x830], 1
call fcn.0041c290
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov byte [esp + 0x82c], 0
cmp ecx, dword [0x493010]
je 0x4309f3
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4309f3
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041c290
mov edx, dword [esi + 0x2d8]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x3443
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x430a4a
push edi
push str._s_DOES_NOT_exists_and_will_Extract.
call fcn.004197f0
add esp, 8
lea ecx, [esp + 0x14]
call fcn.0041a530
mov eax, 1
jmp 0x430add
push ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0042ffb0
test eax, eax
je 0x430a66
lea ecx, [esp + 0x14]
call fcn.0041a530
jmp 0x430adb
cmp dword [esi + 0x228], 0
je 0x430a8a
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.004300e0
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0041a530
mov eax, edi
jmp 0x430add
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.004302e0
cmp dword [esp + 0x10], 0
mov edi, eax
je 0x430abb
lea edx, [esp + 0x20]
push edx
push ebp
mov ecx, esi
call fcn.00430440
mov edi, eax
lea ecx, [esp + 0x14]
call fcn.0041a530
mov eax, edi
jmp 0x430add
push 0x2a0
push 0
add esi, 0x20
push esi
call fcn.0045bc00
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0045bbec
add esp, 0x820
ret 8
Function at 0x4316d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x496cac]
push esi
mov esi, ecx
test eax, eax
je 0x4316ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x496cac], 0
lea ecx, [esi + 0x48]
call fcn.0043e560
mov ecx, eax
call fcn.00419b10
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x431716
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00431430
xor eax, eax
pop esi
ret 0x10

Function at 0x431bd0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x20]
call fcn.0043e4e0
test eax, eax
jne 0x431c18
push edi
push eax
push eax
lea eax, [esi - 0x28]
push eax
push 0x4318b0
push 0
push 0
call fcn.0045cc9c
mov edi, eax
add esp, 0x18
test edi, edi
je 0x431c09
mov ecx, dword [esi - 0x24]
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 2
mov ecx, esi
call eax
mov eax, 1
pop esi
ret

Function at 0x433370
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x43344c
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43344c
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x43344c
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x43344c
lea ecx, [esp + 0x14]
push ecx
push 2
push 0
push edi
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4333e8
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001f
push 0
push 0x484624
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433443
test ebx, ebx
jle 0x433438
push ebp
mov ebp, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x43342f
mov edx, dword [esi + 4]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433401
sub eax, edi
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esi]
push 1
push 0
push edx
push eax
call ebx
test eax, eax
je 0x43342f
mov dword [esp + 0x10], 0
add esi, 8
sub ebp, 1
jne 0x4333f5
pop ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret