joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x80c
mov eax, dword [0x460cd0]
xor eax, esp
mov dword [esp + 0x804], eax
push 0
push 0x24
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d992
push 0x3ff
push str._twain_32_
lea ecx, [esp + 8]
push 0x400
push ecx
call fcn.0042f0da
push 0x3ff
push 0x465138
lea edx, [esp + 0x18]
push 0x400
push edx
call fcn.0042f0da
add esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d97a
push 1
lea ecx, [esp + 4]
call fcn.0041be50
add esp, 4
test eax, eax
je 0x40d9a4
lea ecx, [esp]
push ecx
push str.RemoveDirectory_:_Fail_to_remove___s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x40d9a4
lea edx, [esp]
push edx
push str.Twain_Directory_:___s__is_not_exist
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x40d9a4
push str.RemoveDirectory_:_cannot_get_windows_PAth
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov ecx, 0x465138
call fcn.00401d10
test al, al
jne 0x40d9c4
push str.RemoveDirectory_:_cannot_get_program_files_path
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov ecx, dword [esp + 0x804]
xor ecx, esp
xor al, al
call fcn.0042f002
add esp, 0x80c
ret

Function at 0x40dff0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446730
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x460cd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
call fcn.004272b3
mov eax, dword [eax + 8]
push 0xc3
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x40e0ba
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x40e0ba
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40e087
lea ecx, [ebp - 0x4c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x44]
push edi
push esi
push str.icon_Size_:_Width__d__Height___d______icon_Path_:_default_driver
mov ecx, 0x466338
call fcn.0041a690
add esp, 0xc
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40e097
mov ecx, dword [ecx + 4]
push 3
push 0
push 0
push 0
push 0
push ebx
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x18]
sub edx, esi
push edx
push ecx
call dword [sym.imp.USER32.dll_DrawIconEx]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4482d8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004240b0
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x24]
push ecx
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0x26]
mov dword [esp + 0x18], ecx
xor edi, edi
lea ecx, [esp + 0x14]
mov edx, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
call fcn.00402070
mov dword [esp + 0xc], vtable.CGdiObject.0
mov dword [esp + 0x10], edi
mov dword [esp + 0x40], edi
mov edi, vtable.CBrush.0
mov dword [esp + 0xc], edi
mov eax, 1
mov dword [esp + 0x40], eax
sub dword [esp + 0x1c], eax
add dword [esp + 0x18], eax
push 0xf2f2f1
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x10]
call fcn.00424251
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
or eax, 0xffffffff
mov dword [esp + 0x40], eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xc]
call fcn.00402e60
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414110
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x449018
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
xor ebx, ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0xe200]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x80000002
call esi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
call esi
lea edi, [ebx + 2]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
mov edx, str.SEINst_InstallComponents
call fcn.00416500
add esp, 4
test eax, eax
jne 0x4141b5
mov ecx, dword [esp + 0x1c]
mov edx, str.SEINst_InstallComponentsInstallOrder
call fcn.0041b370
test al, al
je 0x4141b5
mov byte [esp + 0x44], 1
jmp 0x4141bb
cmp byte [esp + 0x44], bl
je 0x4141ea
mov eax, dword [esp + 0x24]
cmp eax, ebx
jne 0x4141cc
xor eax, eax
mov eax, 0xffffffff
jmp 0x41420b
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, 0xffffffff
jmp 0x41420b
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x414214
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
mov byte [esp + 0x1b], 1
jg 0x414218
mov byte [esp + 0x1b], bl
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x414227
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x40]
mov eax, dword [edx + 0xe204]
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x80000002
mov dword [esp + 0x28], ebx
call esi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
call esi
sub edi, 1
jne 0x414182
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x414286
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x28]
push ecx
call fcn.00409db0
mov edx, dword [esp + 0x28]
add esp, 4
push edx
call fcn.0041e7a3
add esp, 4
mov al, byte [esp + 0x1b]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x414560
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4473a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00403710
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push edi
push eax
call fcn.00403000
add esp, 8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_LoadImageW]
je 0x41460a
mov eax, dword [esp + 8]
cmp dword [eax - 0xc], 0
jl 0x4145fd
push str..exe
push eax
call fcn.0042f7ec
add esp, 8
test eax, eax
je 0x4145fd
sub eax, dword [esp + 8]
sar eax, 1
test eax, eax
jle 0x4145fd
push 0x44e830
push 0x44e838
lea ecx, [esp + 0x10]
push ecx
call fcn.00402370
mov edx, dword [esp + 8]
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x414622
push 0x50
push 0
push 0
push 1
push edi
push 0
jmp 0x414620
call fcn.004272b3
mov eax, dword [eax + 8]
push 0x40
push 0x30
push 0x30
push 1
push 0xc3
push eax
call ebx
test eax, eax
mov dword [esi], eax
jne 0x414642
call fcn.004272b3
mov eax, dword [eax + 8]
push 0x40
push 0x30
push 0x30
push 1
push 0xc3
push eax
call ebx
mov dword [esi], eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 8]
call fcn.004036b0
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x10
ret

Function at 0x414670
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4466fb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1010
call fcn.00434bf0
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1020], ebx
mov byte [ebp - 0x101c], bl
mov dword [ebp - 0x1018], ebx
push 0x800
push ebx
lea eax, [ebp - 0x1014]
push eax
call fcn.00430500
add esp, 0xc
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
push 0x800
push ebx
lea ecx, [ebp - 0x814]
push ecx
call fcn.00430500
add esp, 0xc
push ebx
push 0x26
lea edx, [ebp - 0x814]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41470b
lea eax, [ebp - 0x814]
push eax
jmp 0x41473b
push 1
push 0x800
lea ecx, [ebp - 0x814]
push ecx
push str.ProgramFilesDir
push 0x80000002
mov edx, str.SoftwareMicrosoftWindowsCurrentVersion
call fcn.0041ad70
add esp, 0x14
test eax, eax
jne 0x414749
lea edx, [ebp - 0x814]
push edx
push 0x400
push esi
call fcn.0042f50c
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push str.Program_Files_path:__s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
mov dword [ebp - 4], ebx
jmp 0x414788
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x101c], bl
je 0x4147a8
mov eax, dword [ebp - 0x1020]
cmp eax, ebx
je 0x4147a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
Function at 0x415cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x4e24]
mov eax, 0x4e24
call fcn.00434bf0
push 0xffffffffffffffff
push 0x4466a0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp + 0x4e20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], 0x2710
mov dword [ebp - 0x2c], VariantClear
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x415e74
cmp dword [ebp - 0x18], edi
je 0x415e74
cmp edx, edi
je 0x415d8f
mov eax, edx
lea esi, [eax + 2]
jmp 0x415d50
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x415d50
sub eax, esi
sar eax, 1
je 0x415d8f
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push edi
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x415d96
mov dword [ebp - 0x38], eax
push 0x459988
lea ecx, [ebp - 0x38]
push ecx
call fcn.00430c48
mov dword [ebp - 0x1c], VariantClear
mov edx, dword [ebp - 0x18]
push edx
call fcn.0041e79e
mov esi, eax
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x18]
push eax
push edi
push esi
call fcn.00430500
add esp, 0x10
cmp esi, edi
jne 0x415dcb
mov dword [ebp - 0x28], 0xe
push 0x459988
lea ecx, [ebp - 0x28]
push ecx
call fcn.00430c48
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push str.Dependent_Files
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
je 0x415e01
mov dword [ebp - 0x30], esi
push 0x459988
lea eax, [ebp - 0x30]
push eax
call fcn.00430c48
push 7
mov ecx, dword [ebp - 0x20]
push ecx
push str.dwDataType_:___d___dwType_:___d_
mov ecx, 0x466338
call fcn.0041a690
add esp, 0xc
cmp dword [ebp - 0x20], 7
jne 0x415e55
xor eax, eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jge 0x415e41
cmp word [ebp + eax*2], di
jne 0x415e39
mov word [ebp + eax*2], 0xa
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x415e27
push ecx
lea edx, [ebp]
push edx
push ecx
push ebx
call fcn.0042f84a
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x14], esi
lea eax, [ebp]
push eax
push str.szName_:___s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x415eb5
mov dword [ebp - 0x3c], 0x57
push 0x459988
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00430c48
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, 0x415eb0
ret
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x415ec8
cmp eax, dword [ebp - 0x2c]
je 0x415ec8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
cmp eax, edi
je 0x415ed8
push eax
call fcn.0041e7a3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4e20]
xor ecx, ebp
call fcn.0042f002
add ebp, 0x4e24
mov esp, ebp
pop ebp
ret
Function at 0x416500
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448f4b
mov eax, dword fs:[0]
push eax
sub esp, 0x858
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x834], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x82c], eax
xor edi, edi
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x828], 0xffffffff
mov dword [ebp - 4], edi
cmp edx, edi
je 0x4165a7
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416560
sub eax, esi
sar eax, 1
je 0x4165a7
lea ecx, [ebp - 0x824]
push ecx
push 0x20019
push edi
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x820], eax
cmp eax, edi
je 0x4165ad
mov dword [ebp - 0x83c], eax
push 0x459988
lea edx, [ebp - 0x83c]
push edx
call fcn.00430c48
mov dword [ebp - 0x824], ebx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x828]
push eax
push edi
push edi
push edi
mov ecx, dword [ebp - 0x824]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x820], eax
cmp eax, edi
je 0x4165ec
mov dword [ebp - 0x838], eax
push 0x459988
lea edx, [ebp - 0x838]
push edx
call fcn.00430c48
mov dword [ebp - 0x830], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp edi, dword [ebp - 0x828]
jge 0x416671
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.00430500
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x81c]
push ecx
push edi
mov edx, dword [ebp - 0x824]
push edx
call ebx
test eax, eax
jne 0x416666
lea edx, [ebp - 0x81c]
lea eax, [ebp - 0x860]
call fcn.0040b3d0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x860]
push eax
mov esi, dword [ebp - 0x82c]
call fcn.00415fb0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x860]
call fcn.0040b3a0
add edi, 1
mov dword [ebp - 0x830], edi
jmp 0x4165f8
mov dword [ebp - 0x820], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x824]
test eax, eax
je 0x41669b
cmp eax, dword [ebp - 0x834]
je 0x41669b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
Function at 0x418b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446630
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x460cd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 3
call fcn.004272b3
mov ebx, dword [eax + 0xc]
mov dword [ebp - 4], 0
test ebx, ebx
je 0x418d8e
mov eax, str.RT_DATA
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418be1
sub eax, edx
sar eax, 1
je 0x418d8e
mov eax, 0x453f38
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418c00
sub eax, edx
sar eax, 1
je 0x418d8e
cmp dword [ebp + 8], 0
je 0x418d8e
push str.RT_DATA
push 0x453f38
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x418c6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x453f38
push str.RT_DATA
push str.Find_Resource_Fail_____s____s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 0xc
mov dword [ebp - 0x18], esi
push 0x459988
lea eax, [ebp - 0x18]
push eax
call fcn.00430c48
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x418caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x14], esi
push str.Get_Resource_size_Fail__
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x1c], esi
push 0x459988
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00430c48
cmp edi, 0x200
jbe 0x418cd9
push str.the_Resource_size_is_bigger_than_the_buffer_sizel__
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x20], 0x7a
push 0x459988
lea edx, [ebp - 0x20]
push edx
call fcn.00430c48
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x418d13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x14], esi
push str.Load_Resource_Fail__
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x24], esi
push 0x459988
lea eax, [ebp - 0x24]
push eax
call fcn.00430c48
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x418d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x14], esi
push str.Lock_Resource_Fail__
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x28], esi
push 0x459988
lea ecx, [ebp - 0x28]
push ecx
call fcn.00430c48
push 0x200
push 0
mov ebx, dword [ebp + 8]
push ebx
call fcn.00430500
push edi
push esi
push ebx
call fcn.00438530
add esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x2c], 0x57
push 0x459988
lea edx, [ebp - 0x2c]
push edx
call fcn.00430c48
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x418dbf
push str.CtotalUninstallerApp::GetResource
mov edx, 0x466338
call fcn.0041a540
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x418dcc
ret
Function at 0x41a380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4465b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1810
call fcn.00434bf0
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1818]
push eax
call fcn.00430500
add esp, 0xc
push 0x800
push ebx
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00430500
add esp, 0xc
push 0x800
push ebx
lea edx, [ebp - 0x818]
push edx
call fcn.00430500
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x41a407
mov al, 1
jmp 0x41a4e5
push 0x400
lea eax, [ebp - 0x1818]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41a435
mov byte [ebp - 0x181a], bl
push 0x459ad8
lea ecx, [ebp - 0x181a]
push ecx
call fcn.00430c48
push 0x5c
lea edx, [ebp - 0x1818]
push edx
call fcn.0043024a
add esp, 8
mov edi, eax
cmp edi, ebx
je 0x41a451
add edi, 2
jmp 0x41a456
mov edi, 0x454c60
lea eax, [ebp - 0x1018]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea ecx, [ebp - 0x1018]
push ecx
push str._s_s.log
lea edx, [ebp - 0x818]
call fcn.00402fe0
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
lea edx, [ebp - 0x818]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41a4ad
mov byte [ebp - 0x1819], bl
mov byte [esi + 0x204], 1
push str.TotallUninstaller
push 0x100
lea eax, [esi + 4]
push eax
call fcn.0042f50c
add esp, 0xc
mov ecx, esi
call fcn.0041a8a0
mov byte [ebp - 0x1819], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1819]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
Function at 0x41a540
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446580
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4008
call fcn.00434bf0
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
cmp dword [esi], 0
je 0x41a64c
mov dword [ebp - 4], 0
push 0x2000
push 0
lea eax, [ebp - 0x2014]
push eax
call fcn.00430500
push 0x2000
push 0
lea ecx, [ebp - 0x4014]
push ecx
call fcn.00430500
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000
lea ecx, [ebp - 0x2014]
push ecx
call fcn.0042f3ea
add esp, 0x28
test edi, edi
je 0x41a61e
push 0
push 0
lea edx, [ebp - 0x4018]
push edx
push 0x409
push edi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x4018]
test eax, eax
je 0x41a61e
push eax
push edi
lea eax, [esi + 4]
push eax
push str.___s___Error_Code___d_:_s
lea edx, [ebp - 0x4014]
call fcn.0041acd0
add esp, 0x10
mov ecx, dword [ebp - 0x4018]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [ebp - 0x2014]
mov ecx, esi
call fcn.0041a780
test edi, edi
je 0x41a645
lea edx, [ebp - 0x4014]
mov ecx, esi
call fcn.0041a780
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret

Function at 0x41abc0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00434bf0
push 0xffffffffffffffff
push 0x4464c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [esi], ebx
jne 0x41ac14
xor eax, eax
jmp 0x41ac91
cmp byte [esi + 0x20c], bl
jne 0x41ac10
mov dword [ebp - 4], ebx
mov byte [esi + 0x20c], 1
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x1000
push ebx
lea ecx, [ebp]
push ecx
call fcn.00430500
add esp, 0xc
push ebx
push ebx
push 0x1000
lea edx, [ebp]
push edx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x41ac60
sub eax, edx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
lea edx, [ebp]
push edx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov byte [esi + 0x20c], bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0042f002
add ebp, 0x1004
mov esp, ebp
pop ebp
ret