joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b916
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
test edi, edi
je 0x40b99a
push esi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00431530
add esp, 0xc
push dword [ebp + 8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b992
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x40b98b
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040b74a
pop ecx
test eax, eax
jne 0x40b996
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40b999
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ea9f
leave
ret

Function at 0x40b9a6
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x5c8]
sub esp, 0x648
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x5c4], eax
push ebx
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
jne 0x40b9de
mov eax, 0x8618000b
jmp 0x40bb0f
push esi
mov esi, 0x22c
push esi
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bb03
push edi
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x70], eax
je 0x40baee
lea esi, [ebp - 0x80]
call fcn.0040b6c4
mov esi, dword [ebp - 0x70]
test eax, eax
je 0x40ba34
cmp esi, dword [ebp - 0x80]
je 0x40baee
xor eax, eax
push 0x206
mov word [ebp + 0x1b4], ax
lea eax, [ebp + 0x1b6]
push ebx
push eax
call fcn.00431530
push esi
lea edi, [ebp + 0x1b4]
call fcn.0040b916
xor eax, eax
push 0x206
mov word [ebp + 0x3bc], ax
lea eax, [ebp + 0x3be]
push ebx
push eax
call fcn.00431530
add esp, 0x1c
call fcn.0040193a
add eax, 0x98
cmp dword [eax + 0x18], 8
jb 0x40ba8e
mov eax, dword [eax + 4]
jmp 0x40ba91
add eax, 4
lea edx, [ebp + 0x3bc]
movzx ecx, word [eax]
inc eax
mov word [edx], cx
inc eax
inc edx
inc edx
cmp cx, bx
jne 0x40ba97
lea eax, [ebp + 0x3bc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40baaf
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x3bc]
push eax
lea eax, [ebp + 0x1b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40baee
push dword [ebp - 0x70]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x40baee
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40ba0a
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x5c4]
xor ecx, ebp
pop ebx
call fcn.0042ea9f
add ebp, 0x5c8
leave
ret
Function at 0x40bc19
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46eba8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4879c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x4879c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0040b598
test eax, eax
je 0x40bcdc
push 0
call fcn.0040193a
mov ecx, eax
call fcn.00401bf9
jmp 0x40bd42
call fcn.0040193a
mov ecx, eax
call fcn.00401b6a
test eax, eax
je 0x40bd39
lea eax, [esp + 0x10]
push eax
call fcn.00404e91
and dword [esp + 0x38], 0
push str.:_6RsQ
push 3
lea ecx, [esp + 0x18]
call fcn.0040ab17
push 0x479614
push 5
lea ecx, [esp + 0x18]
call fcn.0040ab17
push 3
lea edx, [esp + 0x14]
mov ebx, 0x47961c
mov ecx, edi
call fcn.0040d8b3
cmp eax, 2
je 0x40bce7
cmp eax, 1
je 0x40bcef
or dword [esp + 0x38], 0xffffffff
lea esi, [esp + 0x10]
call fcn.0040dc5f
call fcn.0040570f
test eax, eax
jne 0x40bc6f
jmp 0x40bd39
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040193a
call fcn.004057ef
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
or dword [esp + 0x38], 0xffffffff
lea esi, [esp + 0x10]
call fcn.0040dc5f
jmp 0x40bd39
call fcn.0040193a
mov ecx, eax
call fcn.00401b6a
test eax, eax
je 0x40bd42
push 4
xor edx, edx
mov ebx, 0x479660
mov ecx, edi
call fcn.0040d8b3
cmp eax, 2
je 0x40bce7
call fcn.0040570f
test eax, eax
jne 0x40bd14
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042ea9f
mov esp, ebp
pop ebp
ret
Function at 0x40cbcb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push 0x118
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00431530
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call esi
test eax, eax
jne 0x40cc22
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
je 0x40cc30
cmp dword [ebp - 0x7c], 6
jb 0x40cc30
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
jae 0x40cc32
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
pop esi
call fcn.0042ea9f
add ebp, 0xa0
leave
ret
Function at 0x40d948
Capabilities:
Set current directory

Disassembly:
push ebp
sub esp, 0x42c
lea ebp, [esp - 4]
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push 8
mov eax, 0x46edbb
call fcn.00431d47
mov edi, ecx
push 0x479eb4
lea ecx, [ebp]
call fcn.004036a3
and dword [ebp - 4], 0
push 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x477e98
push ebx
call fcn.004036a3
sub esp, 0x1c
mov byte [ebp - 4], 1
lea eax, [ebp]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004036c5
mov byte [ebp - 4], 0
call fcn.0040bd61
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.00431530
add esp, 0xc
call fcn.0040193a
add eax, 0x98
cmp dword [eax + 0x18], 8
jb 0x40d9e0
mov eax, dword [eax + 4]
jmp 0x40d9e3
add eax, 4
lea edx, [ebp + 0x1c]
movzx ecx, word [eax]
inc eax
mov word [edx], cx
inc eax
inc edx
inc edx
test cx, cx
jne 0x40d9e6
push 1
push str.gamebox.7z
push 0x71
call fcn.0040193a
lea edx, [ebp + 0x1c]
mov ecx, eax
call fcn.004020ff
test eax, eax
je 0x40dac6
push 0x50
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push ebx
call fcn.004036a3
sub esp, 0x1c
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x479edc
call fcn.004036a3
mov byte [ebp - 4], 0
call fcn.0040bd61
xor eax, eax
push esi
mov word [ebp + 0x224], ax
xor esi, esi
lea eax, [ebp + 0x226]
push esi
push eax
call fcn.00431530
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax + 0x1c]
mov word [ebp + eax + 0x224], cx
inc eax
inc eax
cmp cx, si
jne 0x40da62
push str.Program
lea eax, [ebp + 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 1
lea ecx, [ebp]
call fcn.00403f22
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x430
leave
ret
mov esi, 0x80004005
jmp 0x40da95
Function at 0x41046e
Capabilities:
Accept command line arguments

Disassembly:
push 0x60
mov eax, 0x46d4be
call fcn.00431db0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x68]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
cmp dword [ebp - 0x68], edi
mov ebx, eax
jle 0x410543
mov esi, 0x477e98
push dword [ebx + edi*4]
lea ecx, [ebp - 0x64]
call fcn.004036a3
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x48]
call fcn.004036a3
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004036a3
mov byte [ebp - 4], 2
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x2f
jne 0x4104f6
push eax
lea ecx, [ebp - 0x48]
call fcn.0040378d
lea eax, [edi + 1]
cmp eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
jge 0x4104f0
mov eax, dword [ebx + edi*4 + 4]
cmp word [eax], 0x2f
je 0x4104f0
push eax
jmp 0x4104f1
push esi
call fcn.0040378d
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x6c]
call fcn.00410a5a
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.00403c9c
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403f22
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00403f22
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00403f22
inc edi
cmp edi, dword [ebp - 0x68]
jl 0x41049d
xor eax, eax
call fcn.00431e33
ret

Function at 0x411680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xa14], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
mov esi, ecx
and dword [esi], 0
push eax
call fcn.00431530
add esp, 0xc
push dword [ebp - 0xa14]
lea eax, [ebp - 0x210]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4116ec
mov eax, 0x8618000a
jmp 0x411740
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x41173e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xa10], ax
lea eax, [ebp - 0xa0e]
push eax
call fcn.00431530
push esi
lea eax, [ebp - 0xa10]
push str.LoadUEModule_error__d
push eax
call fcn.00405867
add esp, 0x18
mov eax, 0x86180006
jmp 0x411740
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042ea9f
leave
ret 4
Function at 0x41174f
Capabilities:
Get common file path
Link many functions at runtime
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
mov ebx, ecx
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.XLFSIO.dll
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], esi
call fcn.00411680
cmp dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x4117c3
push str.XLFS_Init
push dword [ebp - 0x80]
call esi
and dword [ebp - 0x80], 0
mov dword [edi], eax
push str.zlib1.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
and dword [ebp - 0x80], 0
push str.libpng13.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
and dword [ebp - 0x80], 0
push str.XLGraphic.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
cmp dword [ebp - 0x80], 0
je 0x411823
push str.XL_SetFreeTypeEnabled
push dword [ebp - 0x80]
call esi
push str.XL_PrepareGraphicParam
push dword [ebp - 0x80]
mov dword [edi + 0x10], eax
call esi
push str.XL_InitGraphicLib
push dword [ebp - 0x80]
mov dword [edi + 0x14], eax
call esi
and dword [ebp - 0x80], 0
mov dword [edi + 0x18], eax
push str.XLLuaRuntime.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
and dword [ebp - 0x80], 0
push str.libexpat.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
and dword [ebp - 0x80], 0
push str.XLUE.dll
lea ecx, [ebp - 0x80]
call fcn.00411680
mov ebx, dword [ebp - 0x80]
test ebx, ebx
je 0x411890
push str.XLUE_AddXARSearchPath
push ebx
call esi
push str.XLUE_LoadXAR
push ebx
mov dword [edi + 4], eax
call esi
push str.XLUE_InitLoader
push ebx
mov dword [edi + 8], eax
call esi
push str.XLUE_GetHostWndByID
push ebx
mov dword [edi + 0xc], eax
call esi
push str.XLUE_GetHostWndWindowHandle
push ebx
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp + 0x18c]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042ea9f
add ebp, 0x190
leave
ret

Function at 0x4119d4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
push edi
mov eax, 0x80
push eax
push 3
push edi
push edi
push eax
push dword [ebp + 8]
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x411a01
mov eax, 0x80004005
jmp 0x411a1a
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x411a87
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jg 0x411aa8
mov eax, 0x80004005
jmp 0x411b2d
lea eax, [esi + 4]
push eax
call fcn.0042d95a
pop ecx
mov edi, eax
push edi
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x411ad1
test edi, edi
je 0x411a9e
push edi
call fcn.0042f2c4
pop ecx
jmp 0x411a9e
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x477eb4
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x411ac4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov esi, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 0x10
mov dword [esi], ecx
mov esi, dword [ebp + 0x10]
mov ecx, 0xffff
and eax, ecx
mov dword [esi], eax
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, eax
and eax, ecx
mov ecx, dword [ebp + 0x18]
shr edx, 0x10
mov dword [esi], edx
mov dword [ecx], eax
test edi, edi
je 0x411b2b
push edi
call fcn.0042f2c4
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x411bea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
test ecx, ecx
je 0x411c88
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x411c88
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, dword [esi]
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.0040f570
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x14]
call fcn.0040f570
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x411c45
cmp eax, dword [ebp - 0x14]
je 0x411c4a
call fcn.0042f239
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x411c80
lea esi, [ebp - 0xc]
call fcn.00403854
cmp dword [eax + 0x18], 8
jb 0x411c65
mov eax, dword [eax + 4]
jmp 0x411c68
add eax, 4
push dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x411ca1
lea esi, [ebp - 0xc]
call fcn.00411d8e
jmp 0x411c29
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
jmp 0x411c8b
mov esi, dword [esi + 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x411ca1
push dword [ebp + 0xc]
call fcn.00411cdd
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x411ca8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
call fcn.00411de5
add esp, 0xc
test esi, esi
je 0x411cd9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
leave
ret
Function at 0x411cdd
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411cf9
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
ret

Function at 0x411de5
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e014
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x4879c0]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
push esi
push edi
mov eax, dword [0x4879c0]
xor eax, esp
push eax
lea eax, [esp + 0x498]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push edi
lea ecx, [esp + 0x1c]
call fcn.004036a3
and dword [esp + 0x4a0], 0
mov eax, dword [esp + 0x2c]
dec eax
push eax
lea ecx, [esp + 0x1c]
call fcn.004102a9
cmp word [eax], 0x5c
je 0x411e63
push 0x477eb4
lea ecx, [esp + 0x1c]
call fcn.004036f5
push 0x47ac9c
lea ecx, [esp + 0x1c]
call fcn.004036f5
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x411e80
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x411eca
xor esi, esi
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.00403f22
mov eax, esi
mov ecx, dword [esp + 0x498]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x480]
xor ecx, esp
call fcn.0042ea9f
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [esp + 0x288]
push 0
push eax
call fcn.00431530
add esp, 0xc
push 0x479530
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x411f52
push 0x479544
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x411f52
lea eax, [esp + 0x60]
push eax
push edi
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test byte [esp + 0x34], 0x10
lea eax, [esp + 0x284]
je 0x411f4b
push ebx
push esi
push eax
call fcn.00411de5
add esp, 0xc
cmp dword [esi], 0
je 0x411f52
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x411f52
push eax
push ebx
call fcn.00411bea
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411ee1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
inc esi
jmp 0x411e97

Function at 0x412180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040378d
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0042ea9f
leave
ret 4
Function at 0x4121dd
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [esi + 0x1e4]
xor ebx, ebx
cmp dword [eax], ebx
jne 0x412361
push edi
push 0x47aca0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
lea eax, [esi + 0x24]
push eax
push 0x4749d8
mov eax, esi
call fcn.00412141
cmp dword [esi + 4], ebx
jne 0x412243
lea edi, [esi + 0x40]
push 0x1c
call fcn.00412180
jmp 0x412253
lea eax, [esi + 0x40]
push eax
push 0x4749f8
mov eax, esi
call fcn.00412141
lea edi, [esi + 8]
push 0x26
call fcn.00412180
lea eax, [esi + 0x94]
push eax
push 0x4749e8
mov eax, esi
call fcn.00412141
push ebx
push 0x1a
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x78]
call fcn.0040378d
lea eax, [esi + 0xb0]
push eax
push 0x474a18
mov eax, esi
call fcn.00412141
lea edi, [esi + 0x104]
push 0x24
call fcn.00412180
lea edi, [esi + 0xe8]
push 0x25
call fcn.00412180
lea edi, [esi + 0x120]
push 0x10
call fcn.00412180
lea edi, [esi + 0x13c]
push 2
call fcn.00412180
lea eax, [esi + 0x158]
push eax
push 0x474a08
mov eax, esi
call fcn.00412141
lea edi, [esi + 0x190]
push 0x19
call fcn.00412180
lea edi, [esi + 0x1ac]
push 0x17
call fcn.00412180
lea edi, [esi + 0x174]
push 0x2e
call fcn.00412180
lea edi, [esi + 0xcc]
push 0x23
call fcn.00412180
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x1c8]
call fcn.0040378d
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042ea9f
leave
ret

Function at 0x412464
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x388], eax
push 0x400
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00431530
or dword [ebp - 0x7c], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.EnableLUA
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], 0x200
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4124cc
and dword [esi], 0
mov eax, 0x80004005
jmp 0x4124d3
mov eax, dword [ebp - 0x78]
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp + 0x388]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x38c
leave
ret
Function at 0x4127c9
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
cmp dword [esi + 0x18], 8
jb 0x4127ef
mov ecx, dword [esi + 4]
jmp 0x4127f2
lea ecx, [esi + 4]
lea edx, [ebp - 0x60]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
test ax, ax
jne 0x4127f5
mov eax, dword [esi + 0x14]
add eax, eax
xor ecx, ecx
and dword [ebp - 0x80], ecx
and dword [ebp - 0x74], ecx
and dword [ebp - 0x66], ecx
mov word [ebp + eax - 0x60], cx
mov word [ebp + eax - 0x5e], cx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, 0x414
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp + 0x1ac]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0042ea9f
add ebp, 0x1b0
leave
ret

Function at 0x412858
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jb 0x4128a8
cmp dword [ebp - 0x70], 2
jne 0x4128a8
xor eax, eax
inc eax
jmp 0x4128aa
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x98
leave
ret

Function at 0x4128bf
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x412915
cmp dword [ebp - 0x78], 0
jne 0x412915
cmp dword [ebp - 0x70], 2
jne 0x412915
xor eax, eax
inc eax
jmp 0x412917
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x98
leave
ret

Function at 0x4129dd
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00431530
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x412a30
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
jne 0x412a30
cmp dword [ebp - 0x70], 2
je 0x412a32
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x98
leave
ret