joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044b9
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 4
mov eax, dword [0x40a904]
dec dword [0x40a904]
push ebx
push esi
test eax, eax
push edi
jg 0x4044d5
xor eax, eax
jmp 0x4045ab
cmp dword [0x412b3c], 0
jne 0x40458a
lea eax, [esp + 0xc]
push 0
push eax
push 0x2800
push dword [0x412b38]
push dword [0x412b68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x404515
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x412b3c], eax
jmp 0x40451f
mov dword [0x412b3c], 0xffffffff
cmp dword [0x412b3c], 0
jg 0x40452c
xor eax, eax
jmp 0x4045ab
add dword [0x413030], 0x2800
cmp dword [0x415214], 0
mov eax, dword [0x412b38]
mov dword [0x412ed0], eax
je 0x40458a
mov edi, dword [0x40a904]
inc edi
cmp dword [0x412b3c], edi
jg 0x40455e
mov edi, dword [0x412b3c]
mov esi, dword [0x412b38]
mov eax, edi
dec edi
test eax, eax
je 0x40458a
call fcn.00404391
movzx ecx, byte [esi]
xor eax, ecx
push eax
mov ebx, eax
call fcn.004043aa
add esp, 4
mov eax, edi
dec edi
mov byte [esi], bl
inc esi
test eax, eax
jne 0x40456b
mov eax, dword [0x412ed0]
mov edx, dword [esp + 0x14]
movzx cx, byte [eax]
mov word [edx], cx
mov eax, 8
inc dword [0x412ed0]
dec dword [0x412b3c]
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4045b2
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
cmp dword [0x412c74], 0
push ebx
push esi
push edi
push ebp
je 0x4045ed
mov eax, dword [0x41301c]
mov ecx, dword [0x413018]
add dword [0x413038], eax
mov dword [0x413040], ecx
mov dword [0x41301c], 0
mov eax, 0x32
jmp 0x40486c
cmp dword [0x41301c], 0
je 0x40486a
cmp dword [0x4150b0], 0
mov esi, dword [0x41301c]
jne 0x404624
mov eax, dword [0x41302c]
add eax, esi
cmp eax, dword [0x40a8b8]
jle 0x404624
mov esi, dword [0x40a8b8]
sub esi, dword [0x41302c]
test esi, esi
jg 0x404693
cmp dword [0x4150b0], 0
jne 0x40467d
mov eax, 1
mov dword [0x41508c], eax
mov dword [0x4150a4], eax
mov eax, dword [0x41301c]
mov ecx, dword [0x413018]
add dword [0x413038], eax
mov dword [0x413040], ecx
mov dword [0x41301c], 0
cmp dword [0x4150b0], 0
je 0x404856
mov eax, dword [0x4150c0]
mov dword [0x41302c], eax
jmp 0x40485c
mov dword [0x41508c], 1
mov dword [0x412c74], 2
jmp 0x404640
push esi
mov eax, dword [0x413018]
push eax
call fcn.00405b70
add esp, 8
cmp dword [0x4150f8], 0
jne 0x404792
cmp dword [0x4150b0], 0
jne 0x40479f
cmp dword [0x41315c], 0x4000
jne 0x404747
mov edi, dword [0x41303c]
mov ebx, esi
mov byte [esp + 0x12], 0xd
mov byte [esp + 0x13], 0xa
xor ebp, ebp
test esi, esi
jle 0x404640
test ebp, ebp
jne 0x404640
xor ebp, ebp
cmp byte [edi], 0xa
jne 0x404716
lea eax, [esp + 0x14]
push ebp
lea ecx, [esp + 0x16]
push eax
push 2
push ecx
push dword [0x412ca8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404737
cmp dword [esp + 0x14], ebp
jmp 0x404735
lea eax, [esp + 0x14]
push 0
push eax
push 1
push edi
push dword [0x412ca8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404737
cmp dword [esp + 0x14], 0
ja 0x40473c
mov ebp, 1
inc edi
dec ebx
test ebx, ebx
jg 0x4046e4
jmp 0x404640
mov edi, esi
push 0
lea eax, [esp + 0x18]
push eax
push edi
push dword [0x41303c]
mov eax, dword [0x412ca8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404771
cmp dword [esp + 0x14], edi
je 0x404640
cmp dword [0x4150ec], 0
jne 0x404640
mov dword [0x412c74], 2
mov eax, 0x32
jmp 0x40486c
cmp dword [0x4150b0], 0
je 0x404640
mov ecx, dword [0x41303c]
mov edx, dword [0x4150c0]
add edx, dword [0x4150bc]
mov eax, dword [0x4150b4]
mov edi, eax
cmp dword [0x40a8b8], eax
jge 0x4047cc
mov edi, dword [0x40a8b8]
sub edi, dword [0x4150b8]
test esi, esi
jle 0x404640
mov eax, dword [0x4150b8]
cmp dword [0x4150c4], eax
jl 0x404805
mov eax, dword [0x4150b4]
cmp dword [0x4150c0], eax
jge 0x404834
cmp dword [0x4150c0], edi
jge 0x404823
mov al, byte [ecx]
dec esi
inc ecx
mov byte [edx], al
inc edx
inc dword [0x4150c0]
jmp 0x40481a
mov eax, dword [0x412c96]
inc dword [0x4150c4]
cmp dword [0x4150c4], eax
jge 0x404845
dec esi
inc ecx
test esi, esi
jg 0x4047d4
jmp 0x404640
mov dword [0x412c74], 3
mov eax, 2
jmp 0x40486c
mov dword [0x412c74], 2
mov eax, 0x32
jmp 0x40486c
mov dword [0x412c74], 3
mov eax, 2
jmp 0x40486c
add dword [0x41302c], esi
mov eax, dword [0x41302c]
push eax
call fcn.00403adf
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x404874
Capabilities:
Set file attributes

Disassembly:
push ebp
mov eax, dword [0x412ca8]
mov ebp, esp
sub esp, 0x10
cmp eax, 0xffffffff
push esi
push edi
je 0x40489b
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [0x412ca8], 0xffffffff
jmp 0x4048a1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cx, word [0x412c8a]
lea eax, [ebp - 0x10]
mov dx, word [0x412c8c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
push 0x8000080
push 3
push 0
push 0
push 0x40000000
push 0x412cb0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov edi, eax
je 0x404910
mov eax, dword [0x413034]
or al, 0x20
push eax
push 0x412cb0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 8]
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405b70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ecx, dword [0x40a798]
mov edx, dword [esp + 0xc]
push esi
mov eax, edx
dec edx
test eax, eax
je 0x405ba5
mov esi, dword [esp + 0xc]
mov al, byte [esi]
xor ebx, ebx
xor al, cl
inc esi
shr ecx, 8
mov bl, al
mov eax, dword [ebx*4 + 0x4155c8]
xor eax, ecx
mov ecx, eax
mov eax, edx
dec edx
test eax, eax
jne 0x405b87
pop esi
mov dword [0x40a798], ecx
pop ebx
ret

Function at 0x405d4a
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x406e54
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x415c0c], eax
mov al, ah
and eax, 0xff
mov dword [0x415c18], eax
mov eax, dword [0x415c0c]
shr dword [0x415c0c], 0x10
and eax, 0xff
mov dword [0x415c14], eax
shl eax, 8
add eax, dword [0x415c18]
mov dword [0x415c10], eax
call fcn.00406daa
mov dword [ebp - 4], 0
call fcn.00406cbc
call fcn.00406605
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41347c], eax
call fcn.00406a5c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x4159c8], eax
call fcn.00406991
call fcn.00406610
mov esi, dword [0x41347c]
mov al, byte [esi]
cmp al, 0x22
je 0x405dfe
cmp al, 0x20
jbe 0x405e2a
inc esi
cmp byte [esi], 0x20
ja 0x405df6
jmp 0x405e2a
inc esi
cmp byte [esi], 0x22
je 0x405e29
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x405e24
movzx eax, bl
push eax
call fcn.0040694e
add esp, 4
test eax, eax
je 0x405e1e
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x405e07
cmp byte [esi], 0x22
jne 0x405e2a
inc esi
cmp byte [esi], 0
je 0x405e3a
cmp byte [esi], 0x20
ja 0x405e3a
inc esi
cmp byte [esi], 0
jne 0x405e2f
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x405e5a
movzx eax, word [ebp - 0x40]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00406640
jmp 0x405e96
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406662
Capabilities:
Terminate process

Disassembly:
mov dword [0x415c44], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x415c40], bl
jne 0x4066be
cmp dword [0x413478], 0
je 0x4066ac
mov esi, dword [0x413470]
sub esi, 4
cmp dword [0x413478], esi
ja 0x4066ac
mov eax, dword [esi]
test eax, eax
je 0x4066a1
call eax
sub esi, 4
cmp dword [0x413478], esi
jbe 0x406699
push 0x4166c4
push 0x4166c0
call fcn.004066e1
add esp, 8
push 0x4166cc
push 0x4166c8
call fcn.004066e1
add esp, 8
test ebx, ebx
jne 0x4066de
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x408010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40804e
cmp byte [ebp - 0x103], 0x3a
jne 0x40804e
movzx eax, byte [ebp - 0x104]
push eax
call fcn.00408602
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4083e9
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x408450
push ebx
call fcn.004084dc
add esp, 4
test eax, eax
jne 0x408422
mov dword [0x415c04], 0xf
mov dword [0x415c00], 0xd
jmp 0x4084d3
add bl, 0x40
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10c]
lea ebx, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x408462
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4084d3
inc eax
cmp eax, 0x104
ja 0x4084d3
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x408499
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jg 0x40847e
mov eax, ecx
push eax
call fcn.0040623a
add esp, 4
mov edx, eax
test edx, edx
jne 0x4084aa
mov dword [0x415c00], 0xc
jmp 0x4084d3
cmp eax, dword [ebp + 0x10]
jle 0x4084aa
mov dword [0x415c00], 0x22
jmp 0x4084d3
lea edi, [ebp - 0x10c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x4084d5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409502
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
test esi, esi
je 0x4096f2
push 0x3d
push esi
call fcn.0040991e
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x4096f2
cmp ebp, esi
je 0x4096f2
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x415c2c]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x415c28], ecx
jne 0x40955f
mov eax, dword [0x415c28]
push eax
call fcn.0040975c
add esp, 4
mov dword [0x415c28], eax
cmp dword [0x415c28], 0
jne 0x4095ee
cmp dword [esp + 0x1c], 0
je 0x40958a
cmp dword [0x415c30], 0
je 0x40958a
call fcn.00408fc3
test eax, eax
je 0x4095ee
jmp 0x4096f2
cmp dword [esp + 0x10], 0
je 0x409598
xor eax, eax
jmp 0x4096f7
cmp dword [0x415c28], 0
jne 0x4095c3
push 4
call fcn.0040623a
add esp, 4
mov dword [0x415c28], eax
test eax, eax
je 0x4096f2
mov eax, dword [0x415c28]
mov dword [eax], 0
cmp dword [0x415c30], 0
jne 0x4095ee
push 4
call fcn.0040623a
add esp, 4
mov dword [0x415c30], eax
test eax, eax
je 0x4096f2
mov eax, dword [0x415c30]
mov dword [eax], 0
mov edi, dword [0x415c28]
sub ebp, esi
push ebp
push esi
call fcn.004096ff
add esp, 8
mov ebx, eax
test ebx, ebx
jl 0x409644
cmp dword [edi], 0
je 0x409644
cmp dword [esp + 0x10], 0
je 0x40963f
lea eax, [edi + ebx*4]
cmp dword [eax], 0
je 0x409628
mov ecx, dword [eax + 4]
inc ebx
mov dword [eax], ecx
add eax, 4
cmp dword [eax], 0
jne 0x40961a
lea eax, [ebx*4]
push eax
push edi
call fcn.004097cc
add esp, 8
test eax, eax
je 0x40967f
jmp 0x40967a
mov dword [edi + ebx*4], esi
jmp 0x40967f
cmp dword [esp + 0x10], 0
jne 0x4096ee
test ebx, ebx
jge 0x409655
neg ebx
lea eax, [ebx*4 + 8]
push eax
push edi
call fcn.004097cc
add esp, 8
test eax, eax
je 0x4096f2
lea ecx, [eax + ebx*4]
mov dword [ecx], esi
mov dword [ecx + 4], 0
mov dword [0x415c28], eax
cmp dword [esp + 0x1c], 0
je 0x4096ea
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.0040623a
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4096ea
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call ebp
push ebx
call fcn.00406109
add esp, 4
xor eax, eax
jmp 0x4096f7
xor eax, eax
jmp 0x4096f7
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareCyberlinkCommonOLReg
push 0x80000002
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401072
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.DumpMsg
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov dword [0x419f24], eax
jmp 0x401077
mov eax, dword [0x419f24]
test eax, eax
je 0x401096
cmp dword [0x419f20], 0
jne 0x401096
push 0x20000
call fcn.00404c50
add esp, 4
mov dword [0x419f20], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x419f24], 0
je 0x40110b
mov eax, dword [0x419f20]
test eax, eax
je 0x40110b
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffff
push 0x10000
push eax
call fcn.00405133
add esp, 0x14
push dword [0x419f20]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
ret

Function at 0x401900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x419168]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
mov dword [ebp - 0x80c], 0x400
call fcn.00407130
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push 0x4103d0
lea eax, [ebp - 0x804]
push 0x400
push eax
mov dword [ebp - 0x810], 1
call fcn.00406e86
lea eax, [ebp - 0x804]
push eax
call fcn.00406b6c
add esp, 0x24
lea eax, [ebp - 0x808]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4019db
lea eax, [ebp - 0x80c]
push eax
push 0x419f50
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x808]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4019db
mov eax, 0x419f50
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a09
mov esp, ebp
pop ebp
ret
push str..exe
lea eax, [ebp - 0x804]
push eax
push str._s_s
push 0x400
push eax
call fcn.00406e86
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401a54
lea eax, [ebp - 0x80c]
push eax
push 0x419f50
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x808]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4019c7
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00405a09
mov esp, ebp
pop ebp
ret
Function at 0x401a70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x419168]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x401aa6
push 0x208
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [ebp - 0x20c]
lea eax, [ebp - 0xa1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
push 0x410364
push 0x4103f4
push 0x400
push 0x41a750
mov ebx, eax
call fcn.00406e86
add esp, 0x10
test ebx, ebx
je 0x401cb3
push ebx
call fcn.00404c50
mov edi, eax
add esp, 4
test edi, edi
je 0x401cb3
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa18]
push eax
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0xa10], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401caa
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xa0c], ax
lea eax, [ebp - 0xa0a]
push eax
call fcn.00407130
mov ecx, dword [ebp - 0xa18]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xProductVersion
lea eax, [ebp - 0xa0c]
push 0x400
push eax
call fcn.00406e86
add esp, 0x20
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa14]
push eax
lea eax, [ebp - 0xa0c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401caa
mov eax, dword [ebp - 0xa14]
test eax, eax
je 0x401caa
cmp dword [ebp - 0xa10], 0
je 0x401caa
push eax
push 0x4103f4
push 0x400
push 0x41a750
call fcn.00406e86
push 0x2e
push 0x41a750
call fcn.004064ef
add esp, 0x18
test eax, eax
jne 0x401be0
pop edi
pop esi
mov eax, 0x410364
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a09
mov esp, ebp
pop ebp
ret
add eax, 2
push 0x2e
push eax
call fcn.004064ef
push 0x410364
push 0x4103f4
push 0x400
push 0x41af50
mov esi, eax
call fcn.00406e86
add esp, 0x18
test esi, esi
jne 0x401c45
xor ecx, ecx
nop
movzx eax, word [ecx + 0x41a750]
mov word [ecx + 0x41af50], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401c10
push edi
call fcn.00405a04
add esp, 4
mov eax, 0x41af50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a09
mov esp, ebp
pop ebp
ret
mov ecx, 0x41a750
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401c50
sub ecx, edx
sar ecx, 1
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401c62
sub esi, edx
sar esi, 1
sub ecx, esi
push ecx
push 0x41a750
push 0x400
push 0x41af50
call fcn.004065f9
add esp, 0x10
push edi
call fcn.00405a04
add esp, 4
mov eax, 0x41af50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a09
mov esp, ebp
pop ebp
ret
push edi
call fcn.00405a04
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x41a750
pop ebx
call fcn.00405a09
mov esp, ebp
pop ebp
ret
Function at 0x403890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x419168]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, 0x410364
mov edx, ebx
mov dword [ebx + 0x208], 0
mov dword [ebx + 0x20c], 0
mov dword [ebx + 0x210], 0
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4038d0
push esi
push edi
push 1
push 0x2e
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push ebx
call esi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403904
mov ecx, 8
mov esi, str.CyberLinkOLReg
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebx + 0x208]
mov dword [ebx + 0x20c], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [ebx + 0x214], 1
call fcn.00407130
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
push 3
push 2
push 0
push 0
mov dword [ebp - 0x11c], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
pop edi
test eax, eax
pop esi
mov eax, ebx
je 0x40398f
mov dword [ebx + 0x214], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405a09
mov esp, ebp
pop ebp
ret
Function at 0x403f10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x419168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x210], edx
add edx, 0x208
push esi
cmp eax, 0x80000000
jne 0x403f61
mov esi, str.HKEY_CLASS_ROOT_
mov ecx, edx
sub ecx, esi
lea esp, [esp]
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x403f50
jmp 0x403fdf
mov esi, edx
cmp eax, 0x80000001
jne 0x403f82
mov ecx, str.HKEY_CURRENT_USER_
sub esi, ecx
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403f71
jmp 0x403fdf
cmp eax, 0x80000002
jne 0x403fa1
mov ecx, str.HKEY_LOCAL_MACHINE_
sub esi, ecx
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403f90
jmp 0x403fdf
cmp eax, 0x80000003
jne 0x403fc1
mov ecx, str.HKEY_USERS_
sub esi, ecx
nop
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403fb0
jmp 0x403fdf
mov ecx, str.HKEY_UNKNOWN_
sub esi, ecx
jmp 0x403fd0
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403fd0
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x403fe1
push edi
sub ebx, esi
lea edi, [edx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403ff2
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x20c]
mov ecx, ebx
sub esi, ebx
lea esp, [esp]
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x404020
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404031
lea edi, [ebp - 0x20c]
sub edx, esi
add edi, 0xfffffffe
jmp 0x404050
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404050
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x404093
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a09
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + 0x410], eax
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00405a09
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4045e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp dword [edx + 0x214], 0
je 0x4045f5
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [edx + 0x208]
mov edx, dword [edx + 0x20c]
sub edx, ecx
mov eax, 0x7d8c42b3
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 8]
cmp edx, eax
jb 0x404624
mov eax, 6
pop ebp
ret 0x18
test edx, edx
je 0x404632
mov eax, edx
imul eax, eax, 0x414
add ecx, eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004041b0

Function at 0x4049c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp dword [edx + 0x214], 0
je 0x4049dc
mov dword [ebp + 0x10], 0
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [edx + 0x208]
mov edx, dword [edx + 0x20c]
sub edx, ecx
mov eax, 0x7d8c42b3
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 8]
cmp edx, eax
jb 0x404a0b
mov eax, 6
pop ebp
ret 0x18
test edx, edx
je 0x404a19
mov eax, edx
imul eax, eax, 0x414
add ecx, eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.00404640