joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415890
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x4551e4]
push ebx
push esi
push edi
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SystemCurrentControlSetControlKeyboard_Layouts
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4159bb
mov edx, dword [esp + 0x10]
mov word [esp + 0x20], si
mov ecx, 0x18
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x88], si
xor eax, eax
mov ecx, 0x18
lea edi, [esp + 0x8a]
rep stosd dword es:[edi], eax
push 0x32
lea ecx, [esp + 0x8c]
push ecx
push esi
push edx
stosw word es:[edi], ax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4159bb
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [esp]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x8c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x415994
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push str.Ime_File
push edx
mov dword [esp + 0x34], 0x32
call esi
mov eax, dword [esp + 0x18]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call fcn.004246fc
mov eax, dword [ebx + 0x10]
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00423d1d
add esp, 0xc
test eax, eax
je 0x4159d0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x32
lea ecx, [esp + 0x8c]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x415930
xor eax, eax
mov ecx, dword [esp + 0xf4]
call fcn.00423492
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xf4]
mov eax, 1
mov dword [ebx + 0x34], eax
call fcn.00423492
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415cc0
Capabilities:
Check if file exists

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [0x45616c]
mov edx, dword [ecx + 0x14]
push edi
lea eax, [esi + 4]
push eax
add edx, 0x1c
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00407fd0
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415d09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test edi, edi
je 0x415d14
mov dword [esi + 0x50], 1
pop edi
pop esi
pop ecx
ret
Function at 0x415f80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4551e4]
push esi
mov dword [esp + 0x214], eax
push 0x104
lea eax, [esp + 0x10]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0xc]
push 0x443cf8
push ecx
call fcn.00423ed7
mov edx, dword [esi + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00423ed7
mov ecx, dword [0x45616c]
mov ecx, dword [ecx + 0x18]
add esp, 0x10
call fcn.0040ba90
test eax, eax
je 0x416039
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x18]
lea edx, [esp + 8]
push edx
call fcn.0040bac0
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 8], esp
push edx
call fcn.00403ca0
mov eax, dword [0x45616c]
mov ecx, dword [eax + 0x28]
call fcn.00407f50
test eax, eax
jne 0x416012
mov dword [esi + 0x54], 1
mov ecx, dword [esp + 8]
mov edx, dword [0x45616c]
push ecx
mov ecx, dword [edx + 0x18]
call fcn.0040bae0
mov ecx, dword [esp + 0x214]
call fcn.00423492
pop esi
add esp, 0x214
ret
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 8], esp
push eax
call fcn.00403ca0
mov ecx, dword [0x45616c]
mov ecx, dword [ecx + 0x28]
call fcn.00407f50
test eax, eax
jne 0x416063
mov dword [esi + 0x54], 1
mov ecx, dword [esp + 0x214]
call fcn.00423492
pop esi
add esp, 0x214
ret

Function at 0x416410
Capabilities:
Check if file exists
Manipulate boot configuration

Disassembly:
push 0xffffffffffffffff
push 0x4415d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [0x45616c]
mov edx, dword [ecx + 0x14]
push edi
lea eax, [esi + 0x18]
push eax
add edx, 0x1c
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00407fd0
push str.delboot.ini
push eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], 0
call fcn.00403020
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415c38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415c5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test edi, edi
je 0x415c69
mov dword [esi + 0x58], 1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 0x443d70
push eax
call fcn.00423d1d
add esp, 8
test eax, eax
je 0x41642f
mov ecx, esi
call fcn.00415c80
mov eax, dword [esi + 0x10]
push 0x443d70
push eax
call fcn.00423d1d
add esp, 8
test eax, eax
je 0x41644b
mov ecx, esi
call fcn.00415f80
mov ecx, esi
pop esi
jmp 0x415bc0
Function at 0x417220
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043836f
mov ebx, eax
push edi
push ebx
call fcn.00423f01
add esp, 0xc
cmp esi, ebp
jl 0x41734b
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x417293
test ax, ax
jne 0x417335
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.00403ca0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x70]
add esi, 0x6c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x4172c6
xor edx, edx
jmp 0x4172ce
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x417300
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x417300
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403620
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x417312
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417335
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x417281
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x417371
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x417390
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043836f
mov ebx, eax
push edi
push ebx
call fcn.00423f01
add esp, 0xc
cmp esi, ebp
jl 0x4174be
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x417403
test ax, ax
jne 0x4174a8
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.00403ca0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x80]
add esi, 0x7c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x417439
xor edx, edx
jmp 0x417441
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x417473
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x417473
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403620
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x417485
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4174a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x4173f1
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x4174e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x417500
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043836f
mov ebx, eax
push edi
push ebx
call fcn.00423f01
add esp, 0xc
cmp esi, ebp
jl 0x417631
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x417573
test ax, ax
jne 0x41761b
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.00403ca0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x90]
add esi, 0x8c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x4175ac
xor edx, edx
jmp 0x4175b4
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x4175e6
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x4175e6
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403620
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x4175f8
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41761b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x417561
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x417657
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x417670
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043836f
mov ebx, eax
push edi
push ebx
call fcn.00423f01
add esp, 0xc
cmp esi, ebp
jl 0x4177a1
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x4176e3
test ax, ax
jne 0x41778b
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.00403ca0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xa0]
add esi, 0x9c
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41771c
xor edx, edx
jmp 0x417724
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x417756
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x417756
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403620
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x417768
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41778b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x4176d1
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x4177c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4177e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x34]
mov esi, dword [edi - 0xc]
lea eax, [esi + esi + 2]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.0043836f
mov ebx, eax
push edi
push ebx
call fcn.00423f01
add esp, 0xc
cmp esi, ebp
jl 0x417911
mov dword [esp + 0x14], ebp
mov ebp, 2
sub ebp, ebx
inc esi
mov edi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], esi
mov ax, word [edi]
cmp ax, 0x2c
je 0x417853
test ax, ax
jne 0x4178fb
mov ecx, dword [esp + 0x14]
add ecx, ebx
push ecx
lea ecx, [esp + 0x14]
mov word [edi], 0
call fcn.00403ca0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xb0]
add esi, 0xac
test eax, eax
lea edx, [edi + ebp]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x14], edx
jne 0x41788c
xor edx, edx
jmp 0x417894
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x4178c6
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x4178c6
mov eax, dword [esp + 0x34]
mov ebp, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
call fcn.00403620
add ebp, 4
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x20]
jmp 0x4178d8
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00403ec0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4178fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x417841
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x417937
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4187d0
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x84c
mov eax, dword [0x4551e4]
push edi
mov edi, dword [esp + 0x854]
test edi, edi
mov dword [esp + 0x84c], eax
mov dword [esp + 4], ecx
je 0x418a3f
mov eax, dword [esp + 0x858]
test eax, eax
je 0x418a3f
push ebp
lea eax, [esp + 0xc]
push eax
push 1
push 0x417c90
push 0x417c80
push 0x417c70
push 0x417c60
push 0x417c50
push 0x417c40
push 0x417c30
call sub.Cabinet.dll_FDICreate
mov ebp, eax
add esp, 0x24
test ebp, ebp
jne 0x418855
pop ebp
pop edi
mov ecx, dword [esp + 0x848]
call fcn.00423492
add esp, 0x84c
ret 0xc
push esi
push edi
lea ecx, [esp + 0x13c]
push 0x443ce8
push ecx
call fcn.0042396a
push 0x104
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0042592b
push 0
lea ecx, [esp + 0x50]
push 0x8020
push ecx
call fcn.00424fe9
mov esi, eax
add esp, 0x24
cmp esi, 0xffffffff
jne 0x4188be
push ebp
call sub.Cabinet.dll_FDIDestroy
add esp, 4
pop esi
pop ebp
xor eax, eax
pop edi
mov ecx, dword [esp + 0x848]
call fcn.00423492
add esp, 0x84c
ret 0xc
lea edx, [esp + 0x1c]
push edx
push esi
push ebp
call sub.Cabinet.dll_FDIIsCabinet
add esp, 0xc
test eax, eax
jne 0x4188e2
push esi
call fcn.004255c0
push ebp
call sub.Cabinet.dll_FDIDestroy
add esp, 8
jmp 0x4188a4
push ebx
push esi
call fcn.004255c0
push 0x5c
push edi
call fcn.00425a1a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, eax
add esp, 0xc
test esi, esi
lea eax, [esp + 0x650]
jne 0x418921
push edi
push eax
call ebx
push 1
lea ecx, [esp + 0x348]
push 0x443d70
push ecx
call fcn.004259dd
jmp 0x418948
lea edx, [esi + 2]
push edx
push eax
call ebx
sub esi, edi
sar esi, 1
lea ecx, [esi + 1]
push ecx
lea edx, [esp + 0x348]
push edi
push edx
call fcn.004259dd
mov word [esp + esi*2 + 0x352], 0
mov eax, dword [esp + 0x870]
add esp, 0xc
push eax
push 0x4563c8
call ebx
mov eax, dword [esp + 0x868]
test eax, eax
je 0x41896d
push eax
push 0x4561c0
call ebx
push 0x4563c8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop ebx
jne 0x418989
push eax
push 0x4563c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x64c]
push ecx
lea edx, [esp + 0x13c]
push 0x443ce8
push edx
call fcn.0042396a
push 0x104
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0042592b
lea edx, [esp + 0x358]
push edx
lea eax, [esp + 0x154]
push 0x443ce8
push eax
call fcn.0042396a
push 0x104
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x574]
push edx
call fcn.0042592b
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
push ecx
push 0
push 0x417d00
push 0
lea edx, [esp + 0x588]
push edx
lea eax, [esp + 0x78]
push eax
push ebp
call sub.Cabinet.dll_FDICopy
add esp, 0x4c
cmp eax, 1
push ebp
jne 0x41889c
call sub.Cabinet.dll_FDIDestroy
add esp, 4
pop esi
pop ebp
pop edi
mov ecx, dword [esp + 0x848]
call fcn.00423492
add esp, 0x84c
ret 0xc
mov ecx, dword [esp + 0x84c]
xor eax, eax
pop edi
call fcn.00423492
add esp, 0x84c
ret 0xc
Function at 0x418d30
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4551e4]
push esi
push edi
mov dword [esp + 0x21c], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
test eax, eax
push 0
je 0x418d74
push 0x17
lea eax, [esp + 0x18]
push eax
jmp 0x418d7b
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x418d9b
mov ecx, dword [esp + 0x21c]
call fcn.00423492
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x10]
push 0x4470f8
push edx
call fcn.00423ed7
lea eax, [esp + 0x18]
push 0x447738
push eax
call fcn.00423ed7
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00403ca0
mov ecx, esi
call fcn.00418a60
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x21c]
mov eax, 1
call fcn.00423492
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x418e00
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4551e4]
push esi
push edi
mov dword [esp + 0x21c], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
test eax, eax
push 0
je 0x418e44
push 0x17
lea eax, [esp + 0x18]
push eax
jmp 0x418e4b
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x418e6b
mov ecx, dword [esp + 0x21c]
call fcn.00423492
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x10]
push 0x4470f8
push edx
call fcn.00423ed7
lea eax, [esp + 0x18]
push 0x447744
push eax
call fcn.00423ed7
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00403ca0
mov ecx, esi
call fcn.00418a60
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x21c]
mov eax, 1
call fcn.00423492
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x419103
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x400
xor ebx, ebx
push ebx
mov esi, 0x4565d8
push esi
call fcn.00425a50
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419183
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41917a
cmp dword [ebp - 4], 1
je 0x41917a
cmp dword [ebp - 4], 2
je 0x41917a
cmp dword [ebp - 4], 7
je 0x41917a
mov byte [0x4565d8], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret