joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085e3
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x59b90e
call fcn.005693c7
mov ebx, ecx
lea eax, [ebx + 0x74]
cmp dword [eax + 0x14], 8
jb 0x4085ff
mov eax, dword [eax]
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.0040374b
mov esi, str.WanNengWBInfo.ini
push esi
call fcn.00578706
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00408c34
push str.guanf
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004071a1
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00403628
push str.guanf
mov ecx, esi
call fcn.00408d28
test eax, eax
jne 0x4086d8
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0056f390
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x408689
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x4086ba
xor eax, eax
jmp 0x4086c7
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00403772
jmp 0x4086dd
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00408d28
test eax, eax
jne 0x4087a0
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00402a71
and dword [ebp - 4], 0
push str.WanNengWBInfo.ini
call fcn.00578706
pop ecx
push eax
push str.WanNengWBInfo.ini
lea ecx, [ebp - 0x230]
call fcn.00408c34
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x408771
xor eax, eax
jmp 0x40877e
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00403772
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.00403628
push edi
mov ecx, esi
call fcn.00408d28
test eax, eax
jne 0x4087dc
push edi
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040703a
push eax
mov ecx, esi
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00403628
call fcn.00569382
ret
Function at 0x40ebd1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x59b7a4
call fcn.00569393
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00403ac6
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00403b8c
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x40ec11
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ec71
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40ec4c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ec71
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00403ad9
call fcn.0056936d
ret 0xc
Function at 0x40f0f9
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x59c3a6
call fcn.005693c7
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x40f1f0
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x40f175
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
and dword [ebp - 4], 0
push 0x5a0a50
call fcn.00578706
pop ecx
push eax
push 0x5a0a50
lea ecx, [ebp - 0x230]
call fcn.00408c34
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0040ed5c
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x40f1e1
call fcn.00403628
mov eax, edi
jmp 0x40f2a2
or dword [ebp - 4], 0xffffffff
call fcn.00403628
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x40f2a0
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x40f237
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403772
mov esi, 0x5a0a50
mov dword [ebp - 4], 1
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00408c34
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040ed5c
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.00403628
test esi, esi
je 0x40f2a0
mov eax, esi
jmp 0x40f2a2
xor eax, eax
call fcn.00569382
ret 4
Function at 0x40f2aa
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
jne 0x40f2d2
xor eax, eax
jmp 0x40f408
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f2cb
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f3f6
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40f3d0
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.0056f390
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f3c4
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x40f3fe
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x40f33b
push dword [ebp - 0x418]
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x40fef6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x40ff1b
xor eax, eax
jmp 0x40ffae
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ffac
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x40ff8a
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0057bdc8
pop ecx
pop ecx
test eax, eax
je 0x40ff9c
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x40ff69
jmp 0x40ff9f
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x4103ac
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x59ef3f
call fcn.005693c7
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x410417
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.00403772
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.00578706
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.00408c34
xor ebx, ebx
cmp word [esi], bx
jne 0x410451
mov eax, ebx
jmp 0x410458
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00408c34
mov esi, str..lnk
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00408c34
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x410566
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.0056f390
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0056f390
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00578f87
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0040eab7
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.00578706
pop ecx
test eax, eax
jne 0x410554
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00578f87
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x410566
xor esi, esi
inc esi
jmp 0x410568
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.00403628
mov eax, esi
call fcn.00569382
ret 4
Function at 0x410580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x62c284]
test al, al
jne 0x410619
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x410610
lea eax, [ebp - 0x20c]
push eax
call fcn.0057c0eb
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5a34b4
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
jne 0x410608
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
je 0x410610
mov byte [0x62c284], bl
jmp 0x410616
mov bl, byte [0x62c284]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x4110e2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41114d
lea eax, [ebp - 0x20c]
push 0x5a0a50
push eax
call fcn.00578f16
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00410627
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x413033
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
push 0x5a0a54
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00408d5e
add esp, 0x18
call fcn.0042a8b9
test al, al
je 0x41308d
out 0x26, al
cmp dh, byte [eax]
and dword [ecx], ebp
sbb bh, 0xc8
out dx, eax
xchg esi, eax
adc eax, 0xc6dc565
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x413176
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.00569440
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.00413033
test eax, eax
je 0x413320
xor ebx, ebx
push ebx
call fcn.0057a2fd
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0057d151
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00412cf6
add esp, 0x28
call fcn.0042ac7f
test al, al
je 0x41322e
adc eax, 0xfedccf4a
lds esi, [ebp + 0x1ed11484]
cmpsb byte [esi], byte es:[edi]
sbb al, 0x41
xlatb
or eax, 0xbd8b965f
hlt
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.0042aeec
test al, al
je 0x41325f
pop edx
shr byte [eax], 0xc6
xchg esp, eax
dec edi
nop
bnd jnp 0x413270
adc byte [eax - 0x7d6e05f6], 0x33
test byte [esi + 0x68], 0xe8
pop edx
add byte [edi - 0x18], dl
das
push edi
push ss
add byte [ebx - 0xf627628], cl
invalid
push 0x5a36e8
push edi
call fcn.00578999
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x413320
invalid
cmp dword [ebp - 0x200c], 0
jne 0x4132a2
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.00578e7b
add esp, 0x10
call fcn.0042ae1d
test al, al
je 0x4132c3
inc edi
inc ebp
adc al, 0x59
cmp eax, 0xe7e94dd
pop ss
pop eax
shl dword [esi + 0x48], cl
xchg edx, eax
sub eax, 0xf09d8b91
invalid
lea eax, [ebp - 0x2004]
push eax
call fcn.00578706
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.00578e7b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.00578e7b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.00578e7b
push ebx
call fcn.00578797
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x413d60
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00578706
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00569947
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00578f87
add esp, 0x10
call fcn.0042aeec
test al, al
je 0x413db3
cli
add edi, ebp
xchg ebp, eax
xchg edi, eax
ror byte [esi + 0x22], 1
test byte [ebx - 0x4dd8e415], cl
xor bl, byte [esi - 0x75]
inc ebp
clc
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x413e7d
cmp word [edi + ebx*2], 0x5c
jne 0x413e6e
call fcn.0042ac3a
test al, al
je 0x413dee
push ds
adc al, byte [esi - 0x41]
mov edx, 0x1d3aab0e
rcr dl, 0xa1
dec edx
pop esi
popal
insd dword es:[edi], dx
or dh, bh
fcomp st(6)
call fcn.0042aa57
test al, al
je 0x413e18
cmp dl, dl
scasb al, byte es:[edi]
popfd
cmp byte [eax], al
inc edi
or eax, 0x62796823
inc eax
mov esi, dword [eax + 0x48]
inc esp
iretd
call fcn.0042ab26
test al, al
je 0x413e43
lodsd eax, dword [esi]
in al, 0x37
sar byte [ebx], cl
push 0xffffffffffffffb4
dec esi
in eax, dx
dec edx
wait
mov word [edx + 0x3f], ss
adc dword [edx + edi*8 + 0x3b], ebp
mov byte [ebx], ch
mov ecx, 0x691c5bda
xchg edi, eax
xor esp, edi
add ah, byte [edx - 0x382744c]
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413e67
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x413e8d
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x413dc6
xor esi, esi
inc esi
push edi
call fcn.0056947b
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x413e7d
Function at 0x414183
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.004155bb
lea eax, [ebp - 0x20c]
push eax
call fcn.00578706
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.0042a9cd
test al, al
je 0x4141fa
pop ebp
rcl al, 1
xchg ebx, eax
add al, 0x50
invalid
cmp dword [ebp - 0x214], 0
je 0x414306
mov esi, 0x5a0a50
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00578f16
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00578f16
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00578f16
add esp, 0x18
call fcn.0042af76
test al, al
je 0x41425a
leave
inc ebx
invalid
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414278
lea eax, [ebp - 0x20c]
push eax
call fcn.00413d60
pop ecx
call fcn.0042aa9c
test al, al
je 0x414295
xlatb
in al, dx
scasb al, byte es:[edi]
sbb ecx, esp
jnp 0x4142da
lcall 0x104a, 0x57b82805
stc
dec ebx
aas
sub edi, dword [ebx]
mov ch, 0xe8
mov ah, 0x6a
add dword [eax], eax
call fcn.0042ad4e
test al, al
je 0x4142ba
fisubr dword [edx]
sahf
push ds
test byte [0x1b3eb872], cl
inc ecx
out dx, al
or eax, dword [ecx - 2]
mov byte [0xb7b2ee66], al
push es
scasd eax, dword es:[edi]
jge 0x4142e9
dec edi
insd dword es:[edi], dx
push cs
popfd
call fcn.0042af76
test al, al
je 0x4142d8
movsb byte es:[edi], byte [esi]
xchg dword [edi + 0x660b47a5], ebp
test eax, 0xde282f77
pop ecx
mov byte [edi], ah
and ebx, 0x54de01a0
cmp word [ebp - 0x20c], 0
jne 0x4142e6
mov ebp, 0xfffffdf4
add byte [ebp + 4], dh
xor eax, eax
jmp 0x4142f3
lea eax, [ebp - 0x20c]
push eax
call fcn.00578706
pop ecx
std
invalid
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00403772
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
Function at 0x414f03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x62c3d8], 0
push ebx
push esi
push edi
je 0x414f8b
call fcn.0042aa9c
test al, al
je 0x414f3f
inc esp
sub byte [eax + 0x78], dh
js 0x414f4f
cmpsd dword [esi], dword es:[edi]
out 0xd2, al
push ecx
invalid
call fcn.0042ad4e
test al, al
je 0x414f64
jo 0x414f94
cmp esp, dword fs:[ebx]
invalid
cmc
aad 0x47
inc esi
test eax, esp
xchg esp, eax
fld qword [ebx + 0x4d]
mov al, byte [0x7e768124]
in al, dx
cmp ah, bh
fcomp dword [ecx + 0x1b]
call fcn.0042af76
test al, al
je 0x415082
and dl, ah
dec eax
pop ecx
pop eax
invalid
call fcn.0042af76
test al, al
je 0x414faf
mov ch, 0xab
fistp qword [eax]
push 0xfffffffffffffffe
fld dword [eax - 0x7660bcb0]
int3
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41501f
lea eax, [ebp - 0x20c]
push eax
call fcn.0057c0eb
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5a34b4
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
jne 0x415018
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
je 0x41501f
mov byte [0x62c3d8], 1
call fcn.0042add8
test al, al
je 0x41503a
mov ebx, 0xa0651809
ret 0x4fa5
call fcn.0042aa9c
test al, al
je 0x41505e
into
jecxz 0x415093
loopne 0x415097
pop es
mov ebx, 0x37d5422
adc al, 0xcd
cmp eax, 0xa95b7147
imul edx, edx, 7
push edi
scasd eax, dword es:[edi]
sti
pop eax
sbb al, ch
cmp dword [edx + 1], ebx
add byte [eax + eax*8 + 0x41671b74], al
call fcn.0042aa9c
test al, al
je 0x415082
inc ecx
inc esp
sbb byte [edx + 0x6f9c2627], dh
in eax, dx
lds esi, [eax - 0xf]
push esp
in al, dx
cmc
retf
mov ecx, dword [ebp - 4]
mov al, byte [0x62c3d8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
add byte [ebx + 0x68c35de5], cl
cmp byte [ecx], al
add byte [eax], al
ret

Function at 0x415098
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x59caea
call fcn.005693c7
mov al, byte [0x62c3d9]
test al, al
jne 0x415161
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x41515c
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.00403edb
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.00403edb
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.004091f1
movzx ecx, byte [0x62c3d9]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x62c3d9], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.00404928
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00404928
mov al, byte [0x62c3d9]
call fcn.00569382
ret