joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401061
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [0x43a050]
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4010c9
lea eax, [ebp - 0x20c]
push 0x208
push eax
mov ecx, esi
call fcn.004010ce
test eax, eax
je 0x4010c9
lea eax, [ebp - 0x20c]
push str.safemon_safemon.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010c9
push 1
pop eax
jmp 0x4010cb
xor eax, eax
pop esi
leave
ret

Function at 0x401123
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0x43a238
call dword [sym.imp.USER32.dll_FindWindowW]
push 4
mov esi, eax
pop eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
neg esi
sbb esi, esi
push 0x43a204
push reloc.OLEAUT32.dll_SysReAllocString
neg esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 0
je 0x40117d
test esi, esi
je 0x40117d
push 1
pop eax
jmp 0x40117f
xor eax, eax
pop esi
leave
ret 4

Function at 0x40120e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
mov dword [ebp - 4], 2
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.update
push str.SOFTWARE360Safe_setting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
cmp eax, 1
jb 0x401252
cmp eax, 3
jbe 0x401255
push 2
pop eax
leave
ret

Function at 0x401257
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
call fcn.00401061
cmp dword [ebp + 8], eax
jne 0x401272
push 1
pop eax
jmp 0x4012c1
lea eax, [ebp - 0x208]
push 0x208
push eax
mov ecx, esi
call fcn.004010ce
test eax, eax
je 0x4012bf
lea eax, [ebp - 0x208]
push str.safemon_safemon.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012bf
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00406331
pop ecx
pop ecx
jmp 0x4012c1
xor eax, eax
pop esi
leave
ret 4
Function at 0x401341
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
mov ebx, str.360Safetray
push eax
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 4], ecx
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp + 8], 0
mov dword [ebp - 8], eax
jne 0x4013a1
test eax, eax
jne 0x40141e
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40141e
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.004010ce
test eax, eax
je 0x401423
lea eax, [ebp - 0x218]
push str.safemon360tray.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.__start
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
cmp dword [ebp - 8], 0
jne 0x4013fd
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x40141e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
pop eax
jmp 0x401425
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40142c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
xor ebx, ebx
push ebx
mov dword [ebp - 4], ecx
push 0x43a238
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
jne 0x4014e7
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov ecx, dword [ebp - 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
push 0x208
push eax
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 5
call fcn.004010ce
test eax, eax
pop edi
je 0x40149b
lea eax, [ebp - 0x260]
push str.safemon360tray.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4014fb
push esi
push 0x3e8
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 4]
call fcn.0040131d
cmp eax, ebx
pop esi
je 0x4014fb
push 0x168
push dword [ebp + 8]
push 0x416
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
pop eax
pop ebx
leave
ret 4
Function at 0x407ba8
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
push eax
mov ebx, 0x43ad00
push 0
push ebx
call edi
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x407c5d
add eax, eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
je 0x407c5d
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], 0x100000
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
call edi
xor ebx, ebx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x407c56
mov edi, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x407c25
cmp word [eax], bx
je 0x407c25
push eax
call fcn.00407a3e
test eax, eax
pop ecx
je 0x407c25
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push dword [ebp - 8]
call edi
push dword [ebp - 4]
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call edi
cmp eax, ebx
jne 0x407c05
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0042f3fe
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x407c64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.00404729
mov eax, dword [0x43a50c]
push 0x43ad40
lea ecx, [ebp - 4]
mov dword [ebp + 8], eax
call fcn.00407ead
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push 0x43ad34
push eax
call fcn.00407f72
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00407f31
push eax
lea ecx, [ebp + 8]
call fcn.0040478a
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 0x10]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push str.regedit.exe
push 0x43ad10
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
leave
ret
Function at 0x413981
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall23F3F476_BE34_4f48_9C77_2806A8393EC4
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov ebp, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [0x43a50c]
mov esi, 0x4446cc
push esi
push 0x443154
mov dword [esp + 0x18], eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x4139d5
push 0x444ce4
push 0x444adc
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x4139d5
push esi
jmp 0x4139da
push 0x43dea0
lea eax, [esp + 0x14]
push 0x43ab18
push eax
call fcn.00409921
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push str.CurName
push str.Software360360se3
push SysReAllocStringLen
call esi
mov eax, dword [0x43a50c]
push str.360_4.1
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 0x43ab18
push eax
call fcn.00409921
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43de78
push ebx
push edi
call esi
mov eax, dword [ebp + 0x30]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push str.DisplayIcon
push ebx
push edi
call esi
mov eax, dword [ebp + 4]
push 0x43de40
add eax, 0x14
push 0x43af64
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041a0ea
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041a0ea
lea ecx, [esp + 0x1c]
call fcn.00404c0d
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push str.UninstallString
push ebx
push edi
call esi
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push str.4.1.3.8
call ebp
pop ecx
shl eax, 1
push eax
push str.4.1.3.8
push 1
push str.DisplayVersion
push ebx
push edi
call esi
push 0x43ddf0
call ebp
pop ecx
shl eax, 1
push eax
push 0x43ddf0
push 1
push str.Publisher
push ebx
push edi
call esi
push str.www.360.cn
call ebp
pop ecx
shl eax, 1
push eax
push str.www.360.cn
push 1
push str.Publisher
push ebx
push edi
call esi
lea ecx, [esp + 0x18]
call fcn.00404c0d
lea ecx, [esp + 0x14]
call fcn.00404c0d
lea ecx, [esp + 0x10]
call fcn.00404c0d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x413b1a
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
mov eax, dword [esi + 4]
add eax, 0x14
push eax
call fcn.004046e3
mov esi, dword [esi + 0x30]
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov eax, dword [esi - 8]
shl eax, 1
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x443154
push ebx
push edi
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43a1f8
push ebx
push edi
call esi
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
test eax, eax
pop ecx
je 0x413bb4
sub eax, dword [ebp - 4]
sar eax, 1
cmp eax, 0xffffffff
je 0x413bb4
push eax
lea eax, [ebp - 8]
push 0
push eax
lea ecx, [ebp - 4]
call fcn.0040ccb7
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push str.PathSub
push ebx
push edi
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4182a5
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.0042f4a0
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
and dword [ebp - 4], 0
mov ebx, 0x103
push dword [eax + 0x2c]
lea eax, [ebp - 0x414]
push 0x43fce4
push ebx
push eax
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push 0x4404ec
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x4183fe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4183e2
and word [ebp - 0x145c], 0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x145a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov edi, 0x440418
push eax
lea eax, [ebp - 0x145c]
push 0x823
push eax
push 0x443154
mov esi, str.InternetShortcut
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x145c], 0
je 0x4183d9
lea eax, [ebp - 0x145c]
push eax
push str.http:__www.baidu.com_index.php_tn360se_dg
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x4183d9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 1
jmp 0x4183fe
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push 0x440418
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418a24
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
push dword [edx + 0x34]
xor eax, eax
lea edi, [ebp - 0x412]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x103
push str._s_seup.exe__delv3cfg
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 4], edx
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 4]
add esp, 0x10
push dword [eax + 0x34]
lea eax, [ebp - 0x20c]
push str._s_seup.exe
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x418acb
push 0
push 0xbb8
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00420ed0
add esp, 0x10
leave
ret

Function at 0x418acd
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x208]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x418b5f
lea eax, [ebp - 0x208]
push 0x43ae98
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418b5f
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418b5f
test al, 0x10
jne 0x418b5f
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret
Function at 0x418d8d
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x418e83
lea eax, [ebp + 8]
push str._skin.ini
push eax
add ecx, 0x34
push str.Skin_
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0041a0ea
push eax
lea eax, [ebp - 8]
push eax
call fcn.00407f31
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418e7b
and word [ebp - 0x214], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x103
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
mov ebx, 0x443154
push eax
push ebx
mov edi, str.General
push 0x4406d0
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x418e59
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push 0x103
push eax
push ebx
push 0x4406bc
push edi
call esi
cmp word [ebp - 0x214], 0x33
pop edi
pop esi
pop ebx
jne 0x418e7b
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
push 1
pop eax
jmp 0x418e8d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
xor eax, eax
leave
ret 4
Function at 0x41a4f7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x822]
mov word [ebp - 0x824], bx
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x824]
push 0x17
push eax
push ebx
call esi
test eax, eax
je 0x41a557
lea eax, [ebp - 0x824]
push 0x43dea0
push eax
mov eax, dword [ebp - 4]
add eax, 0x1c
push 0x43bb44
push eax
call fcn.00409921
add esp, 0x10
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61a]
mov word [ebp - 0x61c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x61c]
push 0x16
push eax
push ebx
call esi
test eax, eax
je 0x41a5ac
mov eax, dword [ebp - 4]
lea edi, [eax + 0x20]
lea eax, [ebp - 0x61c]
test eax, eax
je 0x41a59d
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x61c]
push ecx
push eax
mov ecx, edi
call fcn.00404ce9
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x414]
push 0x19
push eax
push ebx
call esi
test eax, eax
je 0x41a601
mov eax, dword [ebp - 4]
lea edi, [eax + 0x24]
lea eax, [ebp - 0x414]
test eax, eax
je 0x41a5f2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x414]
push ecx
push eax
mov ecx, edi
call fcn.00404ce9
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa2a]
mov word [ebp - 0xa2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0xa2c]
push 0x1a
push eax
push ebx
call esi
test eax, eax
je 0x41a64a
lea eax, [ebp - 0xa2c]
push 0x440bc8
push eax
mov eax, dword [ebp - 4]
add eax, 0x28
push 0x43bb44
push eax
call fcn.00409921
add esp, 0x10
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x20c]
push 6
push eax
push ebx
call esi
test eax, eax
je 0x41a69f
mov eax, dword [ebp - 4]
lea edi, [eax + 0x2c]
lea eax, [ebp - 0x20c]
test eax, eax
je 0x41a690
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov ecx, edi
call fcn.00404ce9
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc32]
mov word [ebp - 0xc34], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0xc34]
push 0x1a
push eax
push ebx
call esi
test eax, eax
je 0x41a6e5
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc34]
push eax
push 0x43ab18
lea eax, [esi + 0x18]
push eax
call fcn.00409921
add esp, 0xc
jmp 0x41a6e8
mov esi, dword [ebp - 4]
push 0xb0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x41a701
push esi
mov ecx, eax
call fcn.004129a8
jmp 0x41a703
xor eax, eax
mov ecx, eax
mov dword [esi + 0x30], eax
call fcn.00412c47
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a712
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and word [ebp - 0x41c], 0
mov dword [ebp - 4], eax
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x41c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41a85c
push dword [ebp - 4]
lea eax, [ebp - 0x41c]
lea esi, [ebx + 0xc]
push eax
push 0x440c64
push esi
call fcn.00409921
mov eax, dword [esi]
add esp, 0x10
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41a85c
push dword [esi]
and word [ebp - 0x210], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20e]
push str._smini.exe
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0xe4
lea eax, [ebp - 0x210]
push 0x440c44
push eax
call fcn.00421c0b
add esp, 0x1c
test al, al
je 0x41a85c
push dword [esi]
add ebx, 0x10
push str._smini
push ebx
call fcn.00409921
mov eax, dword [ebx]
add esp, 0xc
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41a85c
push dword [ebx]
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x626]
mov word [ebp - 0x628], si
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
push str.__s___P_s
lea eax, [ebp - 0x628]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a85c
push esi
push 0xea60
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.00420ed0
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a896
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret
Function at 0x41e67f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
lea eax, [ebp - 0x114]
push esi
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x104], 2
push 1
mov dword [0x4453c0], eax
mov dword [0x4453cc], eax
mov dword [0x4453c4], eax
mov dword [0x4453c8], eax
pop esi
jne 0x41e720
cmp dword [ebp - 0x110], 5
jne 0x41e6eb
cmp dword [ebp - 0x10c], eax
jne 0x41e6db
mov dword [0x4453cc], esi
jmp 0x41e72e
cmp dword [ebp - 0x10c], esi
jne 0x41e72e
mov dword [0x4453c4], esi
jmp 0x41e72e
cmp dword [ebp - 0x110], 6
jne 0x41e72e
cmp dword [ebp - 0x10c], eax
je 0x41e704
cmp dword [ebp - 0x10c], esi
jne 0x41e72e
cmp dword [ebp - 0x10c], esi
mov dword [0x4453c4], esi
mov dword [0x4453c8], esi
jne 0x41e72e
mov dword [0x4453d0], esi
jmp 0x41e72e
cmp dword [ebp - 0x104], esi
jne 0x41e72e
mov dword [0x4453c0], esi
mov ax, word [0x443154]
push edi
mov word [ebp - 0x31c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x31a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x31c]
push 0x103
push eax
call fcn.0041f7ff
cmp word [ebp - 0x31c], 0x37
pop ecx
pop ecx
pop edi
jne 0x41e773
mov dword [0x4453d4], esi
jmp 0x41e795
cmp word [ebp - 0x31c], 0x36
jne 0x41e785
mov dword [0x4453d8], esi
jmp 0x41e795
cmp word [ebp - 0x31c], 0x38
jne 0x41e795
mov dword [0x4453dc], esi
pop esi
leave
ret

Function at 0x41e807
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x41e87b
cmp dword [ebp - 0x110], 5
jne 0x41e87b
cmp dword [ebp - 0x10c], 1
jne 0x41e87b
push esi
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x100]
push 0x4414ec
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x41e875
lea eax, [ebp - 0x100]
push str.Service_Pack_3
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x41e875
xor eax, eax
jmp 0x41e878
push 1
pop eax
pop esi
leave
ret
xor eax, eax
leave
ret

Function at 0x41f046
Capabilities:
Delete file
Move file

Disassembly:
cmp dword [esp + 8], 0
jne 0x41f067
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x41f05f
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41f06a
push 5
pop eax
cmp eax, 5
je 0x41f078
cmp eax, 0x20
je 0x41f078
push 1
pop eax
ret
cmp dword [0x4453c0], 0
je 0x41f099
push 0
push dword [esp + 8]
call fcn.0041f0ab
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov eax, ecx
ret
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 2
pop eax
ret