joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f79e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x20], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x24], eax
call fcn.00409005
mov esi, eax
test esi, esi
je 0x40f904
mov eax, dword [ebx + 0x140]
xor edi, edi
cmp dword [eax + 0x24], edi
je 0x40f83e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40f7e9
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0x40f83e
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
sub esp, 0xc
mov ecx, esp
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
call fcn.00413e89
lea ecx, [ebp - 0x18]
call fcn.00407ff6
add esp, 0xc
push dword [ebp - 0x18]
call fcn.0042b20a
pop ecx
test eax, eax
je 0x40f834
push esi
mov esi, eax
call fcn.00429eaf
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00413fa9
xor edi, edi
cmp dword [ebx + 0xc], 0xffffffff
je 0x40f84c
push edi
mov ecx, ebx
call fcn.0040fa55
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40f862
push 0xffffffffffffffff
push esi
push dword [ebp + 0x18]
push eax
call fcn.0042c517
add esp, 0x10
push dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov ecx, esi
call fcn.0040f51d
mov dword [ebx + 0xc], eax
pop ecx
cmp eax, 0xffffffff
jne 0x40f8a6
mov edx, dword [ebx + 0x140]
mov ecx, esi
push dword [ebp - 0x1c]
mov edx, dword [edx + 0x24]
call fcn.004085d0
pop ecx
test eax, eax
je 0x40f8f7
push dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov ecx, esi
call fcn.0040f51d
mov dword [ebx + 0xc], eax
pop ecx
cmp eax, 0xffffffff
je 0x40f8f7
push esi
call fcn.0042b20a
mov dword [ebx + 0x14], eax
pop ecx
test esi, esi
je 0x40f8f4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x40f8f4
push 0x3a
pop ecx
cmp word [esi + 2], cx
jne 0x40f8f4
push 0x5c
pop edx
cmp word [esi + 4], dx
jne 0x40f8f4
mov ax, word [esi]
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], cx
mov word [ebp - 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebx + 0x38], eax
xor edi, edi
inc edi
test esi, esi
je 0x40f902
push esi
call fcn.00429eaf
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421e3f
leave
ret 0x18
Function at 0x40fa55
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x44700c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [0x4416f4]
push ebx
mov ebx, ecx
mov dword [esp + 8], eax
push esi
xor esi, esi
mov dword [esp + 0x14], eax
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
cmp dword [ebx + 0x14], esi
je 0x40faa7
push dword [ebx + 0x14]
lea ecx, [esp + 0x1c]
call fcn.00413fd2
push dword [ebx + 0x14]
call fcn.00429eaf
mov eax, dword [esp + 0x1c]
pop ecx
mov dword [esp + 0x10], eax
cmp dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x10], esi
jne 0x40fab8
xor esi, esi
inc esi
jmp 0x40fb33
mov ecx, ebx
call fcn.0040f915
neg eax
push ecx
push dword [ebx + 0xc]
sbb esi, esi
mov ecx, ebx
and esi, 1
push esi
call fcn.0040fc15
push edx
push eax
lea ecx, [ebx + 0x148]
call fcn.0040e786
mov ecx, dword [ebx + 0xc]
lea edi, [ebx + 0x18]
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x14], eax
cmp ecx, 0xffffffff
je 0x40fb08
mov edx, edi
call fcn.0040e8c3
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0xc], 0xffffffff
and dword [ebx + 0x38], 0
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], eax
je 0x40fb28
cmp dword [esp + 0x1c], eax
je 0x40fb28
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebx + 0x144], 0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.00413fa9
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421e3f
mov esp, ebp
pop ebp
ret 4

Function at 0x40fbae
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ecx + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4

Function at 0x40fc04
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
call fcn.0040f915
mov ecx, dword [esi + 0xc]
pop esi
jmp fcn.0040928a
Function at 0x40feb9
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x43a6d3
call fcn.00438668
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
call fcn.00409005
mov ebx, eax
test ebx, ebx
je 0x40ffb9
mov dword [ebp - 0x18], ebx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x78], 0xffffffff
je 0x40fefb
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x24]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40ff11
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x14]
push eax
call fcn.0042c517
add esp, 0x10
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp - 0x1c]
push ebx
call fcn.0040ffc1
test eax, eax
jne 0x40ff4d
mov edx, dword [esi + 0x98]
mov ecx, ebx
push dword [ebp - 0x1c]
mov edx, dword [edx + 0x24]
call fcn.004085d0
pop ecx
test eax, eax
je 0x40ffb0
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp - 0x1c]
push ebx
call fcn.0040ffc1
test eax, eax
je 0x40ffb0
push ebx
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
call fcn.0042b20a
lea ecx, [esi + 0x6c]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp], 0x8000
call fcn.004068d9
test eax, eax
jne 0x40ff8d
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x68], 8
mov dword [eax], 0xa0000063
jmp 0x40ffb0
cmp dword [esi + 0xc], edi
jne 0x40ffad
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push edi
push esi
push 0x41043b
push edi
push edi
call fcn.0042b6c0
add esp, 0x18
mov dword [esi + 0xc], eax
xor edi, edi
inc edi
push ebx
call fcn.00429eaf
pop ecx
mov eax, edi
call fcn.00438617
ret 0x14

Function at 0x40ffc1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x44700c]
xor eax, esp
mov dword [esp + 0x14], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ecx, esi
push edx
lea edx, [esp + 0x10]
mov eax, dword [edi + 0x98]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
call fcn.0040f51d
mov dword [edi + 0x78], eax
pop ecx
cmp eax, 0xffffffff
je 0x41005f
test esi, esi
je 0x41005f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x41005f
push 0x3a
pop ecx
cmp word [esi + 2], cx
jne 0x41005f
push 0x5c
pop edx
cmp word [esi + 4], dx
jne 0x41005f
mov ax, word [esi]
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0x12], ax
lea eax, [esp + 0xc]
push eax
mov word [esp + 0x12], cx
mov word [esp + 0x14], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 0xa8], eax
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp dword [edi + 0x78], 0xffffffff
pop edi
setne al
pop esi
xor ecx, esp
call fcn.00421e3f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41007b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x64], 1
je 0x4100cb
call fcn.0040e906
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
cmp edi, edx
jb 0x4100e7
ja 0x4100a4
cmp ebx, eax
jbe 0x4100e7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
test eax, eax
je 0x4100cb
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x78]
push edi
push ebx
call fcn.004076bb
pop ecx
pop ecx
test eax, eax
jne 0x4100d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x68], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add dword [esi + 0xa0], ebx
adc dword [esi + 0xa4], edi
xor eax, eax
inc eax
jmp 0x4100cd
lea eax, [esi + 0x40]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 0x10]
lea ecx, [esi + 0x18]
push ebx
push dword [ebp + 8]
call fcn.00408d03
test eax, eax
jne 0x41010d
mov dword [esi + 0x64], 1
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0040e906
cmp dword [esi + 0x3c], edx
jb 0x41012a
ja 0x410127
cmp dword [esi + 0x38], eax
jbe 0x41012a
xor edi, edi
inc edi
and dword [esi + 0x14], 0
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xbb8
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movlpd qword [esp + 0x18], xmm0
test edi, edi
je 0x4101ea
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x4101df
test edi, edi
je 0x410179
push 0xa
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x64], 0
jne 0x4101df
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
call fcn.0040e906
mov ecx, dword [esp + 0xc]
cmp ecx, edx
jb 0x4101cf
ja 0x4101aa
cmp edi, eax
jbe 0x4101cf
mov eax, dword [esp + 0x18]
xor edi, edi
inc edi
cmp dword [esp + 0x10], eax
jne 0x4101c0
cmp dword [esp + 0x14], ecx
jne 0x4101c0
dec ebx
jmp 0x4101d1
mov dword [esp + 0x10], eax
mov ebx, 0xbb8
mov dword [esp + 0x14], ecx
jmp 0x4101d1
xor edi, edi
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x410166
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x64], 1
je 0x4100cb
test eax, eax
jle 0x4100cb
add dword [esi + 0xa0], ebx
mov eax, dword [ebp + 0x10]
adc dword [esi + 0xa4], eax
jmp 0x4100e2

Function at 0x4103d6
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4
Function at 0x41044c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
and dword [esp + 8], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x70]
mov dword [esp + 0x10], eax
lea eax, [esi + 0x40]
mov dword [esp + 0xc], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x38]
mov edi, dword [esi + 0x3c]
mov dword [esp + 0x18], eax
test ecx, ecx
jne 0x4104b4
test eax, eax
jne 0x4104b4
test edi, edi
jne 0x4104ab
cmp ebx, 0x8000
jae 0x4104ab
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
jmp 0x4104c0
mov ebx, 0x8000
xor edi, edi
jmp 0x4104c0
test edi, edi
jne 0x4104d4
cmp ebx, 0x8000
jae 0x4104d4
mov eax, ebx
or eax, edi
jne 0x4104db
test ecx, ecx
je 0x4104f4
mov dword [esp + 0x14], 1
jmp 0x4104f4
mov ebx, 0x8000
xor edi, edi
push 1
push edi
push ebx
push dword [esp + 0x1c]
lea ecx, [esi + 0x18]
call fcn.00408e10
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x38]
push dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
or eax, edi
je 0x410538
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x78]
push edi
push ebx
call fcn.004076bb
pop ecx
pop ecx
test eax, eax
jne 0x410543
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], 1
jmp 0x410543
push 2
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x18], 0
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
je 0x410586
lea ebx, [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x64], 0
jne 0x41056c
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
jne 0x410579
push dword [esi + 0x5c]
and dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0x14], 0
je 0x41046d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4105b0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x20]
mov ecx, dword [esi + 0x78]
pop esi
jmp fcn.0040928a
Function at 0x413da8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413e60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 3
je 0x413ded
cmp esi, 2
je 0x413ded
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x413e54
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
sub esp, 0xc
mov ecx, esp
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
call fcn.00413e89
lea ecx, [ebp - 0x10]
call fcn.00413bed
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, 0xffffffff
je 0x413e42
test bl, 0x10
jne 0x413e42
lea ecx, [ebp - 0x10]
call fcn.00413fa9
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421e3f
leave
ret
lea ecx, [ebp - 0x10]
call fcn.00413fa9
cmp esi, 2
je 0x413e64
cmp esi, 3
je 0x413e64
cmp esi, 0x7b
je 0x413e64
cmp esi, 0x35
je 0x413e64
jmp 0x413e30
test al, 0x10
je 0x413e30
xor eax, eax
jmp 0x413e33
Function at 0x41482b
Capabilities:
Accept command line arguments
Set current directory

Disassembly:
push 0x7c
mov eax, 0x43aa69
call fcn.00438668
mov esi, ecx
cmp dword [esi], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x78], eax
jne 0x41484e
xor eax, eax
jmp 0x4149f3
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00424360
add esp, 0xc
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x74]
xor ebx, ebx
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [esi]
test eax, eax
je 0x414897
push dword [ebp - 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
jmp 0x4149f0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x4148c0
push 5
push dword [ebp - 0x78]
push eax
push edi
push str.open
push eax
call dword [esi + 4]
jmp 0x4149f0
cmp dword [ebp - 0x1c], 0
je 0x4149f0
push dword [ebx]
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
call fcn.00401e9c
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00401703
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.00401703
mov byte [ebp - 4], 2
inc edi
cmp dword [ebp - 0x1c], 1
jle 0x4149bc
push dword [ebx + edi*4]
lea ecx, [ebp - 0x14]
call fcn.00401e61
push ecx
push 0x442110
lea ecx, [ebp - 0x14]
call fcn.004033bb
test eax, eax
jle 0x414961
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x80]
call fcn.004030ec
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
mov edx, eax
mov dword [esp], 0x4411a8
call fcn.00401562
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00403420
lea ecx, [ebp - 0x7c]
call fcn.00401efe
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00401efe
push 0x442110
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x88]
call fcn.00401562
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.00403153
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00403420
lea ecx, [ebp - 0x84]
call fcn.00401efe
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 2
call fcn.00401efe
inc edi
cmp edi, dword [ebp - 0x1c]
jl 0x414901
push 5
push dword [ebp - 0x78]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push str.open
push 0
call dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x18]
call fcn.00401efe
lea ecx, [ebp - 0x14]
call fcn.00401efe
lea ecx, [ebp - 0x20]
call fcn.00401efe
xor eax, eax
inc eax
call fcn.00438617
ret 8
Function at 0x414a1d
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x43aab0
call fcn.00438668
mov edi, ecx
push 0x800
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x414aeb
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.00401703
mov dword [ebp - 4], ebx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
inc ecx
mov ebx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x414a75
push ebx
lea ecx, [ebp - 0x14]
call fcn.00401c50
mov esi, dword [ebp - 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [esi - 8]
push esi
call fcn.00425ebf
pop ecx
pop ecx
test eax, eax
js 0x414af3
cmp eax, dword [esi - 8]
jg 0x414af3
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea edx, [ebp - 0x14]
push 0x4410ac
lea ecx, [ebp - 0x1c]
call fcn.00401562
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401562
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00403420
lea ecx, [ebp - 0x18]
call fcn.00401efe
lea ecx, [ebp - 0x1c]
call fcn.00401efe
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00401efe
mov eax, esi
call fcn.00438617
ret
push 0x80070057
call fcn.00401d63
int3

Function at 0x415b36
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x415b49
push 0xd
pop eax
jmp 0x415b8d
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x415b5c
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x415b54
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4161d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x44700c]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
push esi
or eax, 0x2001f
mov dword [esp + 0xc], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x1c]
call fcn.00416160
jmp 0x41622f
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.004161d7
mov esi, eax
test esi, esi
jne 0x416283
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x416221
cmp dword [esp + 0x10], esi
je 0x416272
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
push dword [esp + 0xc]
mov ecx, ebx
mov dword [esp + 0x18], esi
call fcn.00416368
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x416294
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00421e3f
mov esp, ebp
pop ebp
ret 4
Function at 0x416ce8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x43ac7b
call fcn.004386d4
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], esi
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
call fcn.00424360
add esp, 0xc
mov dword [ebp - 0x424], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], edi
test edi, edi
jne 0x416d71
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], eax
test edi, edi
jne 0x416d71
call fcn.00415567
mov esi, eax
jmp 0x416e74
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x416d94
call fcn.00415567
jmp 0x416e67
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x416d8a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x416dc7
mov esi, 0x8007000e
jmp 0x416e69
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x416e97
jb 0x416de2
cmp eax, 0xffffffff
ja 0x416e97
cmp eax, 0x400
jbe 0x416df7
push eax
lea ecx, [ebp - 0x424]
call fcn.00415542
jmp 0x416e19
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x416e19
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x416dbd
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x416d8a
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00416ba1
mov esi, eax
test edi, edi
je 0x416e74
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x416e8d
lea ecx, [ebp - 0x424]
call fcn.0041552d
mov eax, esi
call fcn.00438626
ret 0x10
push 0x80070216
call fcn.00401d63
int3
Function at 0x4172a0
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x43acf1
call fcn.00438635
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x48]
mov dword [esi + 0x20], vtable.IArkEvent.0
mov dword [esi], vtable.CMainDlg.1.0
mov dword [esi + 0x20], vtable.CMainDlg.0
call fcn.00401703
mov byte [ebp - 4], 1
call fcn.004010c0
or dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0x1f4
mov dword [esi + 0x60], ebx
or dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.0040e7d0
lea ebx, [esi + 0x104]
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 4
push 0x3b0
mov dword [esi + 0x9c], 1
call fcn.004222d8
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 5
mov dword [esp], 0x3b0
push 0
push esi
call fcn.00424360
add esp, 0xc
mov ecx, esi
push edi
call fcn.00410912
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
push 0x70
mov dword [ecx + 0x24], eax
call fcn.004222d8
push 0x70
mov esi, eax
push 0
push esi
mov dword [ebp - 0x14], esi
call fcn.00424360
add esp, 0x10
mov ecx, esi
push edi
call fcn.0040bb30
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x28], eax
xor eax, eax
mov byte [esi + 0x100], al
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x412
xor edx, edx
cmp ax, cx
sete dl
push 0x6b
push dword [0x448124]
mov dword [0x448de0], edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, ebx
mov dword [esi + 0x40], eax
call fcn.00414779
mov eax, esi
call fcn.00438603
ret