joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41766d
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x48
mov eax, 0x5b98b1
call fcn.0058f985
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0058fa90
add esp, 0xc
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
or dword [ebp - 0x18], 0xffffffff
xor eax, eax
push 0xa
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], bl
xor esi, esi
mov dword [ebp - 0x24], vtable.CVersionInfo.0
mov word [ebp - 0x1a], ax
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], ax
call fcn.00496ef8
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004964e5
push str.d3d9.dll
push dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.00496bdc
push str.d3d10.dll
push dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
call fcn.00496bdc
push str.d3d11.dll
push dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
call fcn.00496bdc
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [ebp - 0x30], ebx
jle 0x4177d0
lea ecx, [ebp - 0x54]
call fcn.00496fe0
push esi
lea ecx, [ebp - 0x38]
call fcn.00446d5b
push dword [eax]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00415aaf
add esp, 0xc
cmp dword [ebp - 0x48], ebx
je 0x4177c1
mov eax, dword [ebp - 0x4c]
add eax, 8
push eax
lea ecx, [ebp - 0x14]
call fcn.0040227d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.0044555c
cmp byte [ebp - 0xd], bl
jne 0x417796
push str.___DirectX_was_found_on_this_system:
call fcn.004437b6
pop ecx
mov byte [ebp - 0xd], 1
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._______s_file_version:__hu._hu._hu._hu
call fcn.004437b6
add esp, 0x18
inc esi
cmp esi, dword [ebp - 0x30]
jl 0x417740
cmp byte [ebp - 0xd], bl
jne 0x4177db
push str.___There_were_no_d3dx.dll_files_found_on_this_system.
call fcn.004437b6
pop ecx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004968d3
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00497022
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret
Function at 0x418111
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x5c
mov eax, 0x5b9949
call fcn.0058f985
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0058fa90
or dword [ebp - 0x1c], 0xffffffff
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x28], vtable.CVersionInfo.0
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], ax
mov word [ebp - 0x22], ax
mov word [ebp - 0x24], ax
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
mov dword [ebp - 4], ebx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040141e
push 0xa
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], bl
call fcn.00496ef8
push 0xa
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00496ef8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.00496fe0
call fcn.0044631c
cmp eax, 6
lea eax, [ebp]
push eax
push ebx
push ebx
jae 0x4181d1
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x4181ea
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.WinSxS
lea eax, [ebp]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.msxml
lea eax, [ebp]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00415aaf
mov esi, dword [ebp - 0x64]
add esp, 0xc
cmp esi, ebx
je 0x4182d4
mov eax, esi
cmp esi, ebx
je 0x418330
mov esi, dword [esi]
add eax, 8
push eax
lea ecx, [ebp - 0x14]
call fcn.0040227d
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.msxml.dll
mov byte [ebp - 4], 4
call fcn.004039d7
mov byte [ebp - 4], 3
call fcn.004168b0
pop ecx
pop ecx
cmp al, bl
je 0x4182c7
push dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.0044555c
cmp byte [ebp - 0xd], bl
jne 0x418273
push str.___MS_XML_was_found_on_this_system:
call fcn.004437b6
pop ecx
mov byte [ebp - 0xd], 1
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x18]
push str._______s_file_version:__hu._hu._hu._hu
push eax
call fcn.00401518
add esp, 0x1c
push ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4c]
call fcn.00496fa7
test eax, eax
jne 0x4182c7
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00497110
push dword [ebp - 0x18]
call fcn.004437b6
pop ecx
cmp esi, ebx
jne 0x41820a
cmp byte [ebp - 0xd], bl
jne 0x4182df
push str.___There_were_no_msxml.dll_files_found_on_this_system.
call fcn.004437b6
pop ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00497022
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.00497022
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret
call fcn.004963bf
int3
Function at 0x418a3d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SystemCurrentControlSetControlProductOptions
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x418a68
xor eax, eax
jmp 0x418b74
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
mov ebx, 0x5dc730
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x418b67
cmp dword [ebp - 8], edi
je 0x418b67
push dword [ebp - 8]
call fcn.004959d1
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x418b60
cmp dword [ebp - 0x10], 7
jne 0x418b60
push dword [ebp + 8]
call fcn.0058f15d
mov esi, eax
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004959d1
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push esi
push eax
call fcn.005921ff
push esi
push dword [ebp - 0xc]
call fcn.00590003
and dword [ebp + 8], 0
add esp, 0x20
cmp word [edi], 0
mov ebx, edi
je 0x418b42
push esi
push ebx
call fcn.00590003
push dword [ebp - 0xc]
push ebx
call fcn.0058fddd
add esp, 0x10
test eax, eax
jne 0x418b3b
push ebx
call fcn.0058f15d
lea ebx, [ebx + eax*2 + 2]
cmp word [ebx], 0
pop ecx
jne 0x418b11
jmp 0x418b42
mov dword [ebp + 8], 1
push dword [ebp - 0xc]
call fcn.004959c6
push edi
call fcn.004959c6
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
jmp 0x418b72
push edi
call fcn.004959c6
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x418b79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x5b9a1e
call fcn.0058f985
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418c83
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418c58
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.ServerNT
lea eax, [ebp]
push eax
call esi
test eax, eax
je 0x418c25
push str.LanmanNT
lea eax, [ebp]
push eax
call esi
test eax, eax
jne 0x418cae
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Failed_to_query_value_ProductType._Error_code___08X
push eax
call fcn.00401518
push dword [ebp - 0x10]
call fcn.004437b6
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418cae
push str.Failed_to_open_registry_key:_HKLMSYSTEMCurrentControlSetControlProductOptions
call fcn.004437b6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Error_code___08X
push eax
call fcn.00401518
push dword [ebp - 0x10]
call fcn.004437b6
add esp, 0x10
xor esi, esi
jmp 0x418c28
Function at 0x41bb41
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x5cf14a
call fcn.0058f985
mov esi, ecx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push str.UsersAppDataLocal
lea ecx, [esi + 0x174]
call fcn.004a29f8
test eax, eax
je 0x41bbd7
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x41bbd7
push str.Sonic_Solutions
lea ecx, [ebp - 0x10]
call fcn.004022ca
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41bbe2
push dword [ebp - 0x10]
call fcn.0041654a
mov eax, dword [esi + 0xd8]
cmp dword [eax + 0x17c], 1
sete al
movzx eax, al
push eax
push dword [ebp - 0x10]
call fcn.00416257
add esp, 0xc
test al, al
jne 0x41bbe2
push dword [ebp - 0x10]
push str.___WARNING:_The_folder__s_could_not_be_deleted.
call fcn.004437b6
pop ecx
jmp 0x41bbe1
push str.___WARNING:_The_ReplacementMap_UsersAppDataLocal_could_not_be_found.
call fcn.004437b6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret

Function at 0x41bbf3
Capabilities:
Check if file exists
Get disk information

Disassembly:
push 4
mov eax, 0x5cf14a
call fcn.0058f985
mov esi, ecx
cmp byte [esi + 0x14c], 0
je 0x41bccd
push str.Cleaning_up_source_files
call fcn.004437b6
pop ecx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push str.SetupDir
lea ecx, [esi + 0x174]
call fcn.004a29f8
test eax, eax
je 0x41bcb7
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x41bcb7
push 0x5d4dc0
lea ecx, [ebp - 0x10]
call fcn.004022ca
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebp - 0x10]
test eax, eax
je 0x41bcaa
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x41bc97
push dword [ebp - 0x10]
call fcn.0041654a
push 1
push dword [ebp - 0x10]
call fcn.00416257
add esp, 0xc
test al, al
jne 0x41bcc2
push dword [ebp - 0x10]
push str.___The_folder__s_could_not_be_deleted
jmp 0x41bcaf
push eax
push dword [ebp - 0x10]
push str.___The_folder__s_is_not_a_fixed_source._type_found:__d
call fcn.004437b6
add esp, 0xc
jmp 0x41bcc2
push str.___The_folder__s_does_not_exist
call fcn.004437b6
pop ecx
jmp 0x41bcc1
push str.___WARNING:_The_ReplacementMap_SetupDir_could_not_be_found
call fcn.004437b6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x41c301
Capabilities:
Check if file exists

Disassembly:
push 0x70
mov eax, 0x5ba122
call fcn.0058f9ee
mov esi, ecx
mov dword [ebp - 0x78], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x68]
call fcn.0040141e
and dword [ebp - 4], 0
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x70]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040141e
mov eax, dword [esi + 0xd8]
mov ebx, dword [eax + 0x1f0]
and dword [ebp - 0x74], 0
mov eax, dword [ebx + 0xc]
neg eax
sbb eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x7c], eax
je 0x41c4a7
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call fcn.0041bd4a
mov edi, dword [ebp - 0x74]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test al, al
jne 0x41c49d
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push str.Failed_loading_MSI_package_data_for__s
push eax
call fcn.00401518
push dword [ebp - 0x68]
call fcn.004437b6
mov ecx, dword [esi + 0xdc]
add esp, 0x10
call fcn.00561a95
cmp eax, 8
je 0x41c499
mov ecx, dword [esi + 0xdc]
call fcn.00561a95
cmp eax, 7
je 0x41c499
mov ecx, dword [esi + 0xdc]
call fcn.00561a95
cmp eax, 5
je 0x41c499
mov ecx, dword [esi + 0xdc]
call fcn.00561a95
cmp eax, 6
je 0x41c499
push dword [edi + 0x38]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x68]
test eax, eax
je 0x41c423
push 0xad
call fcn.004014f8
push str._n_2_
push str._2_.
jmp 0x41c434
push 0x6d
call fcn.004014f8
push str._n_2__n
push 0x5de358
lea ecx, [ebp - 0x68]
call fcn.00405d13
xor eax, eax
push 0x50
push eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push eax
call fcn.0058fa90
add esp, 0xc
push 0
push 0x29
push dword [edi + 0x38]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCompactPathExW]
lea eax, [ebp - 0x64]
push eax
push 0x5de350
lea ecx, [ebp - 0x68]
call fcn.00405d13
push 0x2b9f
lea ecx, [ebp - 0x70]
call fcn.004014f8
mov eax, dword [esi + 0xd4]
push 0x10010
push dword [ebp - 0x70]
push dword [ebp - 0x68]
push dword [eax + 0x20]
call fcn.00409adc
and dword [ebp - 0x78], 0
cmp dword [ebp - 0x7c], 0
jne 0x41c36c
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x68]
add ecx, 0xfffffff0
call fcn.00401019
mov eax, dword [ebp - 0x78]
call fcn.0058fa71
ret
Function at 0x41d578
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x3c
mov eax, 0x5ba39c
call fcn.0058f9b8
mov esi, ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x20], 1
call fcn.0041406b
and dword [ebp - 4], 0
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
mov eax, dword [esi + 0xd8]
mov ebx, dword [eax + 0x1f0]
and dword [ebp - 0x18], 0
lea edi, [esi + 0xe8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x41d77a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d77a
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.00413fc1
xor eax, eax
inc eax
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
call fcn.00459a50
mov dword [ebp - 0x34], 1
mov eax, dword [ebx + 0xc]
neg eax
sbb eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], eax
je 0x41d6ff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.0041bd4a
push dword [esi + 0xd8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0x2c]
test al, al
jne 0x41d665
push dword [ebp - 0x14]
push str.Failed_loading_cached_product_data_for__s
call fcn.004437b6
and dword [ebp - 0x20], 0
pop ecx
pop ecx
lea edi, [esi + 0xdc]
mov ecx, dword [edi]
call fcn.00401b44
cmp eax, 3
je 0x41d683
mov ecx, dword [edi]
call fcn.00401b44
cmp eax, 2
jne 0x41d6db
push dword [ebp - 0x14]
mov ecx, dword [edi]
call fcn.00401b8e
push eax
lea eax, [ebp - 0x1c]
push 0x5dea04
push eax
call fcn.00401518
mov edi, dword [ebp - 0x18]
mov eax, dword [edi]
add esp, 0x10
push dword [esi + 0xd8]
mov ecx, edi
push dword [ebp - 0x1c]
call dword [eax + 0x30]
test al, al
jne 0x41d6de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41d6de
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push str.Failed_loading_cached_package_data_for__s_from__s__error_code___d
call fcn.004437b6
add esp, 0x10
and dword [ebp - 0x20], 0
jmp 0x41d6de
mov edi, dword [ebp - 0x18]
push dword [edi + 0xc]
mov ecx, dword [esi + 0xd8]
push dword [ebp - 0x14]
add ecx, 0x154
call fcn.0040ed7a
cmp dword [ebp - 0x24], 0
jne 0x41d629
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx + 0xc]
cmp eax, 1
jne 0x41d736
neg eax
sbb eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.0041bd4a
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x58]
mov eax, dword [ecx]
push 0
push 1
call dword [eax]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004141d1
mov eax, dword [ebp - 0x20]
jmp 0x41d79e
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004141d1
xor eax, eax
call fcn.0058fa5d
ret
Function at 0x429140
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x10
mov eax, 0x5bba7c
call fcn.0058f985
mov esi, ecx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
and dword [ebp - 4], 0
push 0x5d45c0
lea ecx, [ebp - 0x1c]
call fcn.004039d7
push str.LaunchPointLink
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004039d7
push str.Shortcut
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004039d7
mov ecx, dword [esi + 0x158]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.004583d0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401019
test edi, edi
je 0x429263
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00426cdb
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040227d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401019
push str.Cleanup_Launch_Point
call fcn.004437b6
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebp - 0x10]
test eax, eax
je 0x429257
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.00403913
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f0b
mov esi, dword [ebp - 0x1c]
push esi
mov byte [ebp - 4], 5
call fcn.004162ec
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401019
jmp 0x429263
push str.___The_folder__s_does_not_exist
call fcn.004437b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x429274
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x1c
mov eax, 0x5bbad7
call fcn.0058f985
push str.AllUsersDesktop
lea eax, [ebp - 0x18]
push eax
call fcn.00426cdb
and dword [ebp - 4], 0
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
mov byte [ebp - 4], 2
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
push str.Creating_shortcut_for_logging_folder
mov byte [ebp - 4], 3
call fcn.004437b6
lea ecx, [ebp - 0x14]
mov dword [esp], 0x2be6
call fcn.004014f8
push 0x5d4dc0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004021b5
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 4
call fcn.00403e34
add esp, 0x18
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0040227d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401019
lea eax, [ebp - 0x10]
push eax
call fcn.004435ad
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x429369
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
jmp 0x42941a
mov edi, dword [ebp - 0x1c]
cmp dword [edi - 0xc], 0
mov ebx, dword [ebp - 0x14]
je 0x429404
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x42938d
push eax
push dword [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp - 0x10]
push str.___Working_Folder:_____s
call fcn.004437b6
push edi
push str.___Launch_Point_Link:__s
call fcn.004437b6
push ebx
push str.___Launch_Point_Desc:__s
call fcn.004437b6
add esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 6
call fcn.00401db5
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 7
call fcn.00401db5
mov byte [ebp - 4], 3
call fcn.00444f20
add esp, 0xc
test eax, eax
jge 0x429404
push eax
push str.___Failed_to_create_shortcut_with_error:__d
call fcn.004437b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
lea ecx, [ebx - 0x10]
call fcn.00401019
lea ecx, [edi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x436299
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x420
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0058fa90
add esp, 0xc
test esi, esi
jne 0x4362d2
xor eax, eax
jmp 0x43631a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x424]
push eax
call esi
test edi, edi
je 0x4362f0
push edi
lea eax, [ebp - 0x21c]
push eax
call esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x424]
push eax
push 0x4360cc
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f976
leave
ret

Function at 0x4397d4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0
push 1
push dword [esp + 0xc]
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x439801
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esp + 8]
push 0x5e9590
call fcn.004437b6
add esp, 0xc
xor al, al
ret
mov al, 1
ret