joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402019
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402019
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40200a
cmp esi, edx
jae 0x402019
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401ff8
cmp esi, edx
jae 0x402019
cmp word [esi], 0
je 0x402019
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x402210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40229b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x40225d
cmp eax, 2
jne 0x402279
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x402295
test ecx, ecx
je 0x402290
test cl, 1
jne 0x402279
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x402295
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b3004
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4022b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4022c5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4022d0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4035e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60eb00
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
test ecx, ecx
je 0x403759
test eax, eax
je 0x403759
cmp eax, 0x698774
je 0x403759
test esi, esi
je 0x403759
cmp esi, 0x698774
je 0x403759
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push 0x201
push eax
push ecx
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0
call fcn.00402130
mov edi, dword [ebp - 0x228]
test eax, eax
jne 0x403710
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x22c], 0x208
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403710
mov eax, dword [ebp - 0x21c]
cmp eax, 1
je 0x4036f2
cmp eax, 2
jne 0x403710
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x403721
test cl, 1
jne 0x403710
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x40372a
xor bl, bl
test edi, edi
je 0x40371d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x40375b
xor eax, eax
mov word [ebp - 0x218], ax
shr ecx, 1
je 0x403710
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403737
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00404cd0
mov bl, 1
jmp 0x403712
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret

Function at 0x403780
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
je 0x40380f
test eax, eax
je 0x40380f
cmp eax, 0x698774
je 0x40380f
push ebx
push esi
push 0x202
push eax
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00402130
mov esi, dword [ebp - 0x10]
cmp eax, 2
je 0x4037ef
test eax, eax
je 0x4037df
xor bl, bl
jmp 0x4037f1
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4037ef
xor bl, bl
jmp 0x4037f1
mov bl, 1
test esi, esi
je 0x4037fc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.004b3004
mov esp, ebp
pop ebp
ret
Function at 0x408050
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x68], eax
test eax, eax
je 0x4081e4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [edi + 0x68]
mov dword [edi + 4], eax
call esi
push str.WinHttpOpenRequest
push dword [edi + 0x68]
mov dword [edi + 8], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [edi + 0x68]
mov dword [edi + 0xc], eax
call esi
push str.WinHttpSendRequest
push dword [edi + 0x68]
mov dword [edi + 0x10], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi + 0x68]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpQueryHeaders
push dword [edi + 0x68]
mov dword [edi + 0x18], eax
call esi
push str.WinHttpReadData
push dword [edi + 0x68]
mov dword [edi + 0x1c], eax
call esi
push str.WinHttpCloseHandle
push dword [edi + 0x68]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpCrackUrl
push dword [edi + 0x68]
mov dword [edi + 0x24], eax
call esi
push str.WinHttpSetOption
push dword [edi + 0x68]
mov dword [edi + 0x28], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi + 0x68]
mov dword [edi + 0x2c], eax
call esi
push str.WinHttpQueryOption
push dword [edi + 0x68]
mov dword [edi + 0x30], eax
call esi
cmp dword [edi + 4], 0
mov dword [edi + 0x34], eax
pop esi
je 0x4081d1
cmp dword [edi + 0x10], 0
je 0x4081d1
cmp dword [edi + 0x24], 0
je 0x4081d1
cmp dword [edi + 8], 0
je 0x4081d1
cmp dword [edi + 0xc], 0
je 0x4081d1
cmp dword [edi + 0x1c], 0
je 0x4081d1
cmp dword [edi + 0x20], 0
je 0x4081d1
cmp dword [edi + 0x18], 0
je 0x4081d1
cmp dword [edi + 0x14], 0
je 0x4081d1
cmp dword [edi + 0x28], 0
je 0x4081d1
cmp dword [edi + 0x2c], 0
je 0x4081d1
cmp dword [edi + 0x30], 0
je 0x4081d1
test eax, eax
je 0x4081d1
mov eax, 1
mov dword [edi], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [edi]
xor ecx, ebp
pop edi
call fcn.004b3004
mov esp, ebp
pop ebp
ret
Function at 0x408200
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.wininet.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x6c], eax
test eax, eax
je 0x408370
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
call esi
push str.InternetConnectW
push dword [edi + 0x6c]
mov dword [edi + 0x3c], eax
call esi
push str.HttpOpenRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x40], eax
call esi
push str.HttpAddRequestHeadersW
push dword [edi + 0x6c]
mov dword [edi + 0x44], eax
call esi
push str.HttpSendRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x48], eax
call esi
push str.HttpQueryInfoW
push dword [edi + 0x6c]
mov dword [edi + 0x4c], eax
call esi
push str.InternetReadFile
push dword [edi + 0x6c]
mov dword [edi + 0x50], eax
call esi
push str.InternetCloseHandle
push dword [edi + 0x6c]
mov dword [edi + 0x54], eax
call esi
push str.InternetCrackUrlW
push dword [edi + 0x6c]
mov dword [edi + 0x58], eax
call esi
push str.InternetSetOptionW
push dword [edi + 0x6c]
mov dword [edi + 0x5c], eax
call esi
push str.InternetQueryOptionW
push dword [edi + 0x6c]
mov dword [edi + 0x60], eax
call esi
cmp dword [edi + 0x3c], 0
mov dword [edi + 0x64], eax
pop esi
je 0x40835c
cmp dword [edi + 0x40], 0
je 0x40835c
cmp dword [edi + 0x44], 0
je 0x40835c
cmp dword [edi + 0x48], 0
je 0x40835c
cmp dword [edi + 0x4c], 0
je 0x40835c
cmp dword [edi + 0x50], 0
je 0x40835c
cmp dword [edi + 0x54], 0
je 0x40835c
cmp dword [edi + 0x58], 0
je 0x40835c
cmp dword [edi + 0x5c], 0
je 0x40835c
cmp dword [edi + 0x60], 0
je 0x40835c
test eax, eax
je 0x40835c
mov eax, 1
mov dword [edi + 0x38], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi + 0x38], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x38]
xor ecx, ebp
pop edi
call fcn.004b3004
mov esp, ebp
pop ebp
ret
Function at 0x40b9c5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x40b9de
mov eax, dword [ebp - 4]
jmp 0x40bab8
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x40ba93
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x612988]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x612988]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x612988]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x612988]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x612988]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x612988]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x612988]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x612988]
dec ebp
jne 0x40b9fd
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x40baaf
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x612988]
dec ecx
jne 0x40ba9d
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c45e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40c47f
mov eax, 0x80070057
jmp 0x40c551
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.004076e0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0x5c
cmovae eax, dword [ebp - 0x1c]
push 0xffffffffffffffff
push dword [ebp - 0xc]
push eax
call fcn.0040c003
add esp, 0x10
cmp eax, 0xffffffff
je 0x40c541
push eax
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040d394
cmp dword [eax + 0x14], 8
jb 0x40c4c5
mov eax, dword [eax]
push edi
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00407870
test edi, edi
je 0x40c4fa
cmp edi, 0x50
je 0x40c4fa
cmp edi, 0xb7
je 0x40c4fa
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
jmp 0x40c53e
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push esi
cmovae eax, dword [ebp - 0x1c]
push 0x80
push 1
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40c537
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x40c53e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x40c546
mov esi, 0x80070057
lea ecx, [ebp - 0x1c]
call fcn.00407870
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
leave
ret 4
Function at 0x40c955
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c9f0
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 8], eax
cmp dword [ebp - 8], ebx
jne 0x40c9de
cmp eax, 0x200000
ja 0x40c9de
add eax, 2
push eax
call fcn.004b2ff6
pop ecx
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c9de
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jne 0x40c9de
mov byte [eax + esi], bl
mov eax, dword [ebp - 4]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov esi, ebx
mov eax, dword [ebp + 0x10]
inc ebx
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40c9f0
push esi
call fcn.004b2fff
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x40cca7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], edi
call fcn.00404190
lea ecx, [ebp - 0x14]
call fcn.00404190
push edi
push edi
push 2
push edi
xor eax, eax
mov ebx, edi
inc eax
mov esi, edi
push eax
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x40ce34
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, 1
je 0x40cdb0
sub eax, 1
je 0x40cd5a
sub eax, 1
jne 0x40ce00
push edi
lea eax, [ebp - 8]
mov word [ebp - 0xc], 0xfeff
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
call ecx
test eax, eax
je 0x40ce2b
cmp dword [ebp - 8], 2
jne 0x40ce2b
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebx - 0xc]
add esi, esi
jmp 0x40ce00
push edi
lea eax, [ebp - 8]
mov word [ebp - 0x10], 0xbbef
push eax
push 3
lea eax, [ebp - 0x10]
mov byte [ebp - 0xe], 0xbf
push eax
push dword [ebp - 0x1c]
call ecx
test eax, eax
je 0x40ce2b
cmp dword [ebp - 8], 3
jne 0x40ce2b
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40cde3
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
pop ecx
cmp eax, 0x3fffffff
jg 0x40cde3
lea esi, [eax + eax]
mov eax, esi
call fcn.004b34e0
mov eax, esp
push 0xfde9
jmp 0x40cdd5
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40cde3
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
pop ecx
cmp eax, 0x3fffffff
jg 0x40cde3
lea esi, [eax + eax]
mov eax, esi
call fcn.004b34e0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0040c425
mov esi, eax
test esi, esi
jne 0x40cde7
mov eax, edi
jmp 0x40cdee
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00407a70
mov eax, dword [ebp - 0x14]
mov ebx, eax
mov esi, dword [eax - 0xc]
cmp dword [ebp + 0x10], edi
je 0x40ce0e
push esi
push ebx
call dword [ebp + 0x10]
test eax, eax
je 0x40ce2b
push edi
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ce2b
cmp dword [ebp - 8], esi
push 1
pop eax
cmove edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, edi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3004
leave
ret 0xc

Function at 0x41023f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x41336b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 4]
push edi
call fcn.00404190
lea eax, [ebp - 4]
mov ecx, ebx
push eax
call fcn.004121a8
mov edi, eax
test edi, edi
je 0x413406
push ecx
mov ecx, esp
push dword [ebp + 8]
call fcn.004040f0
mov esi, dword [ebp - 4]
push ecx
mov edi, esp
lea eax, [esi - 0x10]
push eax
call fcn.00404b40
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.00413469
mov edi, eax
test edi, edi
je 0x413409
mov eax, dword [esi - 0xc]
lea ecx, [ebx + 4]
mov edx, dword [ecx]
cmp eax, dword [edx - 0xc]
jl 0x413409
lea eax, [ebp - 4]
push eax
call fcn.004048f0
push str.product_tag_cmpc_ch.tag
lea ecx, [ebp - 4]
call fcn.00412004
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4133fe
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4133fe
mov dword [ebx], 0x12
jmp 0x413409
mov dword [ebx], 0x65
jmp 0x413409
mov esi, dword [ebp - 4]
lea ecx, [esi - 0x10]
call fcn.004023e0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4134d1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00404190
lea ecx, [ebp - 4]
call fcn.00404190
lea ecx, [ebp - 8]
call fcn.00404190
lea ecx, [ebp - 0x10]
call fcn.00404190
lea ecx, [ebp - 0x18]
call fcn.00404190
call fcn.00413302
mov eax, dword [eax + 4]
sub eax, 0x10
push eax
call fcn.00404b40
pop ecx
lea ecx, [ebp - 0xc]
lea esi, [eax + 0x10]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
call fcn.004048f0
lea ecx, [esi - 0x10]
call fcn.004023e0
mov esi, str.drivermain.ini
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc]
call fcn.0040c36b
mov ebx, 0x104
lea ecx, [ebp - 8]
push ebx
call fcn.004047c0
mov esi, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push ebx
push eax
mov ebx, 0x698774
push ebx
push str.version
push str.infos
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.0040e311
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004047c0
push esi
push 0x104
push eax
push ebx
push str.MainVersion
mov ebx, str.DisplayVersions
push ebx
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040e311
push 0x104
lea ecx, [ebp - 4]
call fcn.004047c0
push esi
push 0x104
push eax
push 0x698774
push 0x613464
push ebx
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
push 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00403b90
push eax
lea ecx, [ebp - 0x18]
call fcn.004048f0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push 0
push 0x2e
lea ecx, [ebp - 4]
call fcn.0040c55f
mov ecx, dword [ebp - 4]
add eax, 3
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00403da0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.004048f0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 6
jle 0x41365e
push 6
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.00403c90
push eax
lea ecx, [ebp - 8]
call fcn.004048f0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
push eax
push dword [ebp - 4]
push esi
push edi
push str._s._s._s._s
push dword [ebp + 8]
call fcn.0040c593
add esp, 0x18
lea ecx, [esi - 0x10]
call fcn.004023e0
lea ecx, [edi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.004023e0
pop edi
pop esi
mov al, 1
pop ebx
leave
ret