joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2a0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x214
mov eax, dword [0x452504]
push esi
push 0
mov dword [esp + 0x218], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x44b4c0
push 1
push 0
push 0x44b4d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40e3a0
mov edx, dword [esp + 0x220]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov edx, dword [esp + 0x224]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [esp + 0x230]
test eax, eax
je 0x40e32c
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push 0
push eax
push ecx
call dword [edx + 0x44]
mov ecx, dword [esp + 0x22c]
test ecx, ecx
je 0x40e342
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x44b4e0
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x40e396
mov ecx, dword [esp + 0x21c]
push 0x104
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
mov edx, dword [eax]
push 1
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
call fcn.00435083
add esp, 0x214
ret

Function at 0x40e3c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x452504]
mov dword [esp + 0x110], eax
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.httpShellOpenCommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e4ae
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0xc]
push eax
mov dword [esp + 0x14], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e424
sub eax, edx
push edi
mov edi, eax
test edi, edi
jg 0x40e44a
xor al, al
pop edi
mov ecx, dword [esp + 0x110]
call fcn.00435083
add esp, 0x114
ret
push esi
xor esi, esi
test edi, edi
jle 0x40e468
movsx edx, byte [esp + esi + 0x10]
push edx
call fcn.00436b81
add esp, 4
test eax, eax
jne 0x40e468
inc esi
cmp esi, edi
jl 0x40e451
lea eax, [esp + 0x10]
push eax
call fcn.00442c1a
lea esi, [esp + esi + 0x14]
push str..exe
push esi
call fcn.00436190
mov ecx, dword [esp + 0x12c]
sub eax, esi
add esp, 0xc
add eax, 4
push eax
push esi
call fcn.00402c70
pop esi
mov al, 1
pop edi
mov ecx, dword [esp + 0x110]
call fcn.00435083
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
xor al, al
call fcn.00435083
add esp, 0x114
ret
Function at 0x40e950
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x452504]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push edi
mov dword [esp + 0x128], eax
lea eax, [esp + 0x10]
push eax
push 0x20007
mov edi, ecx
push 0
lea esi, [edi + 0x100]
push esi
push SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], 1
call ebx
test eax, eax
jne 0x40e9d1
lea ecx, [esp + 0x18]
push ecx
lea ebp, [edi + 0x614]
push ebp
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x20]
push str.Home
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ea27
mov ecx, dword [esp + 0x10]
push ecx
mov byte [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20007
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x40eb37
lea ecx, [esp + 0x18]
push ecx
lea ebp, [edi + 0x614]
push ebp
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x20]
push str.Home
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ea27
mov ecx, dword [esp + 0x10]
push ecx
mov byte [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40eb37
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea37
sub eax, edx
mov dword [esp + 0x1c], eax
jne 0x40ea73
push 0
push 0xd1
push 0xb0003
call fcn.0041a7d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x118]
call fcn.00435083
add esp, 0x11c
ret
push edi
lea eax, [esp + 0x24]
push 0x447890
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x2c]
push ecx
push ebp
call fcn.00436190
add esp, 0x14
test eax, eax
jne 0x40eafc
push 0x5c
push ebp
call fcn.00436b20
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40eae6
push ebx
call fcn.00436cec
add esp, 4
mov esi, edi
lea eax, [ebx + 1]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40eadd
test cl, cl
je 0x40ead9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40eadd
add eax, 2
add esi, 2
test cl, cl
jne 0x40eab5
xor eax, eax
jmp 0x40eae2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40eafc
push 0
push 0xc3
push 0xb0004
call fcn.0041a7d0
add esp, 0xc
jmp 0x40eb37
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40eb11
mov dword [edi + 0x71c], 0
push edi
lea eax, [esp + 0x24]
push 0x447890
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x2c]
push ecx
push ebp
call fcn.00436190
add esp, 0x14
test eax, eax
je 0x40eb37
mov byte [eax], 0
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
call fcn.00435083
add esp, 0x11c
ret
Function at 0x40eb60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x820
mov eax, dword [0x452504]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push ecx
push 1
push 0
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x834]
fld qword [eax + 0x4260]
lea edx, [esi + 0x100]
push edx
fstp qword [esp + 0x20]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x40ebc9
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
test eax, eax
je 0x40ec00
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push GlobalAlloc
call fcn.0041a6e0
add esp, 4
mov eax, 3
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x40a]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.Home
mov ebx, 0x400
push edx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
je 0x40ec59
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.NVersion
push ecx
mov dword [esp + 0x28], ebx
call edi
cmp eax, 2
jne 0x40eca7
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
test eax, eax
je 0x40ece0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push GlobalAlloc
call fcn.0041a6e0
add esp, 4
pop edi
pop ebx
mov eax, 3
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
lea ecx, [esp + 0x20]
push ecx
call fcn.004365d6
fstp st(0)
lea edx, [esp + 0x24]
push edx
call fcn.004365d6
fcomp qword [esp + 0x20]
add esp, 8
fnstsw ax
test ah, 5
jp 0x40ed2c
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x81c]
call fcn.00435083
add esp, 0x820
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
lea edi, [esi + 0x614]
push edi
mov byte [esp + 0x428], 0
call ebx
test eax, eax
je 0x40ec3f
push esi
push edi
lea edx, [esp + 0x42c]
push 0x446508
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x424]
push eax
call ebx
mov ecx, dword [esp + 0x828]
neg eax
pop edi
sbb eax, eax
pop ebx
and eax, 2
pop esi
call fcn.00435083
add esp, 0x820
ret 4
Function at 0x40eda0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x818
mov eax, dword [0x452504]
push esi
mov esi, dword [esp + 0x820]
mov dword [esp + 0x818], eax
lea eax, [esi + 0x2003]
push eax
add ecx, 0x100
push ecx
lea ecx, [esp + 0x41c]
push 0x446508
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 4]
push edx
push 1
push 0
lea eax, [esp + 0x420]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
je 0x40ee64
test eax, eax
je 0x40ee36
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push reloc.KERNEL32.dll_GlobalAlloc
call fcn.0041a6e0
add esp, 4
mov eax, 3
pop esi
mov ecx, dword [esp + 0x814]
call fcn.00435083
add esp, 0x818
ret 4
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x4466f4
push eax
mov dword [esp + 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x40ee87
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x814]
call fcn.00435083
add esp, 0x818
ret 4
test eax, eax
je 0x40eebe
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x50005
call fcn.0041a6e0
add esp, 4
mov eax, 3
pop esi
mov ecx, dword [esp + 0x814]
call fcn.00435083
add esp, 0x818
ret 4
lea eax, [esp + 0x10]
push eax
call fcn.004365d6
fstp st(0)
lea ecx, [esp + 0x14]
push ecx
call fcn.004365d6
fcomp qword [esi + 0x4258]
add esp, 8
fnstsw ax
test ah, 5
jp 0x40ef0a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x814]
call fcn.00435083
add esp, 0x818
ret 4
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x818]
mov eax, 2
pop esi
call fcn.00435083
add esp, 0x818
ret 4

Function at 0x40ef30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x452504]
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x614]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ef57
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ef66
sub eax, edx
mov dword [esp + 8], eax
jne 0x40ef99
push 0x104
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [esp + 0xc]
push ecx
push str._c:Hangame
push esi
call fcn.004352bf
add esp, 0xc
lea edx, [esp + 0xc]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40efa1
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40efb2
sub eax, edx
mov cl, byte [esp + eax + 0xb]
push edi
add edi, 0x40a
cmp cl, 0x5c
push esi
jne 0x40efd3
push 0x4475b0
jmp 0x40efd8
push 0x446508
push edi
call fcn.004352bf
mov ecx, dword [esp + 0x120]
add esp, 0x10
pop edi
pop esi
call fcn.00435083
add esp, 0x10c
ret 4
Function at 0x40f000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x452504]
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
push 0x20007
push 0
add ecx, 0x100
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f048
xor eax, eax
mov ecx, dword [esp + 0x114]
call fcn.00435083
add esp, 0x118
ret
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.DefaultHomeSet
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
neg esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
call fcn.00435083
add esp, 0x118
ret

Function at 0x40f0b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x452504]
mov dword [esp + 0x21c], eax
lea eax, [esp]
push eax
push 0x20007
push 0
add ecx, 0x100
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f15e
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push str.DefaultHomeSet
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40f154
lea eax, [esp + 0xc]
mov word [esp + 0xc], 0x31
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f130
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.DefaultHomeSet
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x21c]
call fcn.00435083
add esp, 0x220
ret
Function at 0x40f3c0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34c
mov eax, dword [0x452504]
push ebx
push esi
push edi
mov dword [esp + 0x354], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x248]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x38]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40f410
lea eax, [esp + 0x38]
push 0x447910
push eax
call fcn.00435188
add esp, 8
test eax, eax
push 0x2f
je 0x40f438
add eax, 2
push eax
jmp 0x40f43d
lea ecx, [esp + 0x3c]
push ecx
call fcn.004362cd
lea esi, [esp + 0x250]
add esp, 8
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x40f450
mov byte [eax], dl
lea edx, [esp + 0x38]
push 0x447910
push edx
call fcn.00435188
add esp, 8
test eax, eax
je 0x40f477
add eax, 2
jmp 0x40f47e
lea eax, [esp + 0x140]
lea edx, [esp + 0x140]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40f487
push 0
push 0
push 0
push 0
or esi, 0xffffffff
push str.HanGame
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], esi
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
je 0x40f569
push 0
push 0
push 3
push 0x44654a
push 0x44654a
push 0
lea eax, [esp + 0x158]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
je 0x40f562
push 0
push 0x4000000
push 0
push 0
push 0
lea ecx, [esp + 0x25c]
push ecx
push 0x44790c
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x40f557
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x40f550
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push esi
mov dword [esp + 0x24], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x40f550
lea ecx, [esp + 0x18]
push ecx
call fcn.00436029
add esp, 4
mov dword [esp + 0x14], eax
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x354]
mov eax, esi
call fcn.00435083
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fab0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x452504]
push edi
mov dword [esp + 0x10c], eax
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHangame.com
push SysReAllocString
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40fb33
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHangame.com
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40fb33
push 0x13000e
call fcn.0041a6e0
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x108]
call fcn.00435083
add esp, 0x10c
ret
xor eax, eax
mov cl, byte [eax + 0x446e1c]
mov byte [esp + eax + 0xc], cl
inc eax
test cl, cl
jne 0x40fb35
lea eax, [esp + 0xc]
lea edx, [eax + 1]
jmp 0x40fb50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fb50
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.DisplayName
push ecx
call esi
test eax, eax
je 0x40fbaa
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13000e
call fcn.0041a6e0
add esp, 4
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x108]
call fcn.00435083
add esp, 0x10c
ret
push str.HanUninstall.exe
add edi, 0x55fa
push edi
lea eax, [esp + 0x18]
push 0x446508
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fbd0
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.DisplayIcon
push edx
call esi
test eax, eax
jne 0x40fc24
lea eax, [esp + 0x10]
lea edx, [eax + 1]
jmp 0x40fc00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fc00
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.UninstallString
push edx
call esi
test eax, eax
je 0x40fc2e
mov eax, dword [esp + 8]
push eax
jmp 0x40fb80
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
pop esi
mov eax, 1
pop edi
call fcn.00435083
add esp, 0x10c
ret
Function at 0x40fec0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
mov eax, dword [0x452504]
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x55fa]
push 0x447c08
push ebx
mov dword [esp + 0x34], eax
call fcn.00436190
add esp, 8
test eax, eax
jne 0x40fefa
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
mov ecx, ebx
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ff00
sub ecx, edi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40ff10
sub eax, edi
sub ecx, eax
add ecx, 2
mov edi, ecx
jne 0x40ff35
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
push edi
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.00435f00
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + edi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edx, dword [esi + 0x12c00]
mov eax, dword [esi + 0x12c14]
mov ecx, dword [esi + 0x12bec]
mov ebx, dword [esi + 0x12bd8]
mov edi, dword [esi + 0x12bc4]
add eax, edx
mov edx, dword [esi + 0x12bb0]
add eax, ecx
mov ecx, dword [esp + 0x10]
add eax, ebx
add eax, edi
add eax, edx
mov edx, dword [esp + 0xc]
shrd edx, ecx, 0xa
shr ecx, 0xa
xor esi, esi
shr eax, 0xa
cmp ecx, esi
ja 0x40ffc1
jb 0x40ffaf
cmp edx, eax
jae 0x40ffc1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.00435083
add esp, 0x28
ret

Function at 0x40ffe0
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x130
mov eax, dword [0x452504]
push esi
mov dword [esp + 0x130], eax
lea eax, [esp + 0x28]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00436e5c
add esp, 0x14
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x12bc4]
mov edx, dword [esp + 4]
shrd edx, eax, 0xa
xor esi, esi
shr eax, 0xa
shr ecx, 0xa
cmp eax, esi
pop esi
ja 0x410071
jb 0x41005c
cmp edx, ecx
jae 0x410071
xor eax, eax
mov ecx, dword [esp + 0x12c]
call fcn.00435083
add esp, 0x130
ret
mov ecx, dword [esp + 0x12c]
mov eax, 1
call fcn.00435083
add esp, 0x130
ret
Function at 0x4107c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x452504]
push ebx
push esi
push edi
mov dword [esp + 0x114], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
mov edi, ecx
push 0
lea esi, [edi + 0x52f0]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41081c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [edi + 0x55fa]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410827
sub eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
mov eax, dword [esp + 0x10]
push ecx
push 1
push 0
push str.Home
push eax
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41085a
mov ecx, dword [esp + 0xc]
push ecx
call ebx
fld qword [edi + 0xa3b0]
sub esp, 8
fstp qword [esp]
lea edx, [esp + 0x1c]
push str._.2f
push edx
call fcn.004352bf
lea eax, [esp + 0x24]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410880
mov ecx, dword [esp + 0xc]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x18]
push eax
push 1
push 0
push str.NVersion
push ecx
call esi
test eax, eax
je 0x4108ab
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4108b2
mov ecx, dword [esp + 0xc]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0x4466f4
push ecx
call esi
test eax, eax
je 0x4108dd
mov edx, dword [esp + 0xc]
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call ebx
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
call fcn.00435083
add esp, 0x10c
ret