joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [0x4f7510], 0
push esi
push edi
jne 0x40b86a
push 0x24d0
call fcn.0042336c
add esp, 4
test eax, eax
je 0x40b860
mov esi, eax
call fcn.00415ef0
mov dword [0x4f7510], eax
jmp 0x40b86a
mov dword [0x4f7510], 0
mov eax, dword [0x4f36ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4f36ec
call edx
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push str._s__main
lea edi, [ebp - 8]
call fcn.00404650
push 0x40
lea ecx, [ebp - 0x60]
push 0
push ecx
mov dword [ebp - 0x64], 0x44
call fcn.004276b0
mov esi, dword [ebp - 8]
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0x30
push 0
push 0
push 0
push esi
mov edx, 1
push 0
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], dx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b8f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004276b0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 4
Function at 0x40e550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x10
je 0x40e574
cmp eax, 0xa3
je 0x40e580
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call sym.Setup.exe_public_virtual:_long_int___thiscall_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop ebp
ret 0xc
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop ebp
ret 0xc

Function at 0x40edc0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x4f36ec]
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
push edi
lea edi, [eax + eax]
mov eax, dword [edx + 0xc]
mov ecx, 0x4f36ec
call eax
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0
add eax, 0x10
push 1
mov dword [ecx], eax
mov eax, dword [esi]
push edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420929
mov esi, dword [esi]
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
push edi
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x40ee65
test ebx, ebx
jne 0x40ee42
xor eax, eax
jmp 0x40ee56
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ee47
sub eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
push ebx
push ecx
mov ebx, eax
call fcn.00403580
mov ebx, dword [ebp - 8]
push ebx
call fcn.00423305
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ee80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov esi, ecx
call fcn.004276b0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str._localappdata_GamePPGamePPConfig.ini
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [0x4f36ec]
mov eax, dword [edx + 0xc]
mov ecx, 0x4f36ec
call eax
add eax, 0x10
cmp byte [ebp + 8], 0
mov dword [ebp - 0x210], eax
mov ebx, 2
je 0x40ef4c
push 0x4cdb80
lea ecx, [ebp - 0x210]
push ecx
call fcn.00403580
mov eax, esi
call fcn.0040f870
mov eax, esi
call fcn.0040f030
mov eax, dword [0x4f7510]
test eax, eax
jne 0x40ef40
push 0x24d0
call fcn.0042336c
add esp, 4
test eax, eax
je 0x40ef39
mov esi, eax
call fcn.00415ef0
mov dword [0x4f7510], eax
mov dword [eax + 0x22c4], 1
jmp 0x40ef9f
xor eax, eax
mov dword [0x4f7510], eax
mov dword [eax + 0x22c4], 1
jmp 0x40ef9f
push 0x4cdb88
lea edx, [ebp - 0x210]
push edx
call fcn.00403580
mov eax, esi
call fcn.0040f930
mov eax, esi
call fcn.0040f450
mov eax, dword [0x4f7510]
test eax, eax
jne 0x40ef95
push 0x24d0
call fcn.0042336c
add esp, 4
test eax, eax
je 0x40ef8e
mov esi, eax
call fcn.00415ef0
jmp 0x40ef90
xor eax, eax
mov dword [0x4f7510], eax
mov dword [eax + 0x22c4], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
call fcn.0040edc0
mov edx, dword [eax]
add esp, 4
lea ecx, [ebp - 0x20c]
push ecx
push edx
push str.CurrentType
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop esi
pop ebx
test edx, edx
jg 0x40eff2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x210]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f014
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret 4
Function at 0x410960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
call fcn.0040a740
mov ebx, eax
mov eax, str._usilent
lea esi, [ebp - 4]
call fcn.004032d0
mov eax, esi
call fcn.00407120
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4109a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x410a21
mov edx, dword [0x4f36ec]
mov eax, dword [edx + 0xc]
push edi
mov ecx, 0x4f36ec
call eax
add eax, 0x10
push ebx
lea edi, [ebp - 8]
mov dword [ebp - 4], eax
call fcn.004078b0
mov ecx, dword [eax]
push ecx
push str._sUninstall.exe
lea edi, [ebp - 4]
call fcn.00404650
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
test ecx, ecx
jg 0x4109fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411d60
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call fcn.0040a740
cmp dword [0x4f7510], 0
mov edi, eax
jne 0x411daf
push 0x24d0
call fcn.0042336c
add esp, 4
test eax, eax
je 0x411da5
push esi
mov esi, eax
call fcn.00415ef0
mov dword [0x4f7510], eax
pop esi
jmp 0x411daf
mov dword [0x4f7510], 0
mov eax, edi
call fcn.004075d0
pop edi
test eax, eax
je 0x411e04
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004276b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 3
jmp 0x411e08
push 0
push 1
call fcn.0041a590
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.0042292e
mov esp, ebp
pop ebp
ret

Function at 0x412730
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
xor eax, eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov byte [edi + 0x88], al
mov eax, 0x7a7a7a7a
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
push ebx
mov dword [edi + 0x74], eax
push esi
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], eax
push 0x4ceec8
mov dword [edi + 0x80], eax
push ecx
mov dword [edi + 0x84], eax
call fcn.00425797
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4127fa
push ebx
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.00425a66
add esp, 0x10
test eax, eax
je 0x4127ea
push eax
lea ecx, [ebp - 0x404]
push ecx
mov ecx, edi
call fcn.00412540
push ebx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call fcn.00425a66
add esp, 0x10
test eax, eax
jne 0x4127c0
mov ecx, edi
call fcn.004125f0
push ebx
call fcn.00424c3b
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
lea eax, [edi + 0x68]
pop ebx
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x412810
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx]
sub esp, 0x10
xor ecx, ecx
push esi
cmp dword [eax - 0xc], ecx
jne 0x412834
mov esi, dword [ebp + 8]
mov eax, 0x4cb44c
call fcn.004032d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push edi
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 4]
push edx
push ecx
mov dword [ebp - 4], 0x400
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov ecx, dword [eax - 0xc]
push 1
push ecx
push eax
call esi
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420929
mov edi, eax
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
push ecx
push 0
push edi
call fcn.004276b0
mov eax, dword [ebx]
add esp, 0x10
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [eax - 0xc]
lea edx, [ebp - 4]
push edx
push edi
push 1
push ecx
push eax
call esi
mov eax, edi
lea esi, [ebp - 0x10]
call fcn.004032d0
push edi
call fcn.00423305
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
add esp, 4
mov eax, esi
call fcn.004043b0
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4128e4
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4128f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41298c
push 0x103
push eax
lea ecx, [ebp - 0x107]
push ecx
mov byte [ebp - 0x108], al
call fcn.004276b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp - 0x10c]
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
lea ecx, [ebp - 0x108]
push ecx
push edx
mov dword [ebp - 0x110], 0x77
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x412cd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
mov dword [ebp - 4], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412ce3
sub eax, edx
sar eax, 1
jne 0x412d0f
mov eax, 0x4cbd48
mov edx, esi
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x412d00
mov eax, dword [ebx]
push edi
push 0x104
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.ChannelID
push eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebx]
push 0x104
push ecx
push 1
push 0
push str.SetupPath
push edx
mov edi, eax
call esi
test edi, edi
pop edi
mov esi, 1
je 0x412d50
mov esi, dword [ebp - 4]
mov eax, dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x412d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
mov dword [ebp - 0x58], 0x44
call fcn.004276b0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x30
push 0
push 0
mov ecx, 1
mov word [ebp - 0x28], cx
mov ecx, dword [ebp + 8]
push 0
push ecx
push 0
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp + 0xc], 0
jne 0x412dcd
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0xc]
push eax
call esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x412e10
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa28
mov eax, dword [0x4f2500]
xor eax, esp
mov dword [esp + 0xa24], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x412e8f
lea eax, [esp + 0xc]
push eax
push 0x4b863c
push 1
push 0
push 0x4b865c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x412e8f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x4b868c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x412ea7
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xa24]
xor ecx, esp
call fcn.0042292e
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je 0x412ef8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push edi
push eax
call edx
push 0x800
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004276b0
push 0x400
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.00425661
add esp, 0x18
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
test ebx, ebx
je 0x412f17
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
push eax
call edx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x412f2e
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push 0
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [esp + 0x14]
push esi
push ecx
push str._s_s
lea edx, [esp + 0x82c]
call fcn.00411e20
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
add esp, 0xc
push ecx
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x824]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
lea eax, [esp + 0x824]
push eax
push 5
push 2
call edi
push 0
push 0
push 0
push 0x8000000
call edi
mov ecx, dword [esp + 0xa2c]
xor eax, eax
test esi, esi
pop edi
setns al
pop esi
xor ecx, esp
call fcn.0042292e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413330
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413341
mov eax, 1
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41335c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41333b
xor eax, eax
ret
Function at 0x413c40
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004276b0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x413cb6
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x413cc0
mov eax, dword [0x4cb7dc]
mov ecx, dword [esi + 0x22c4]
push 0
mov dword [edi], eax
push ecx
lea eax, [ebp - 0x20c]
lea esi, [ebp - 0x210]
call fcn.00414330
mov ebx, dword [ebp - 0x210]
cmp dword [ebx - 4], 1
jle 0x413d0b
mov edx, dword [ebx - 0xc]
push edx
mov eax, esi
push eax
call fcn.00403690
mov ebx, dword [ebp - 0x210]
mov eax, ebx
mov edx, ebx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413d10
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x413d26
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx - 8]
push eax
push ebx
call fcn.00423a17
add esp, 8
test eax, eax
js 0x413dca
cmp eax, dword [ebx - 8]
jg 0x413dca
lea edx, [ebp - 0x20c]
xor ecx, ecx
mov dword [ebx - 0xc], eax
push edx
mov word [ebx + eax*2], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edx, 0xffffffff
test eax, eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
je 0x413da4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413db7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042292e
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402e50
int3
Function at 0x414330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, eax
mov eax, dword [0x4f36ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4f36ec
call edx
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x4f36ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4f36ec
call edx
add eax, 0x10
cmp dword [ebp + 8], 0
mov dword [ebp - 4], eax
je 0x41437f
push str.GamePP.lnk
push esi
mov ebx, 0xa
call fcn.00403580
push edi
push 0x4cd9e4
jmp 0x414395
push 0x4cf47c
push esi
mov ebx, 8
call fcn.00403580
push edi
push 0x4cd9c8
lea edi, [ebp - 4]
call fcn.00404650
mov edi, dword [ebp - 4]
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x4143b0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop ebx
test edx, edx
jg 0x4143ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4143e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, eax
mov eax, dword [0x4f36ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4f36ec
call edx
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x4f36ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4f36ec
call edx
add eax, 0x10
cmp dword [ebp + 8], 0
mov dword [ebp - 4], eax
je 0x41442f
push str.Uninstall.lnk
push esi
mov ebx, 0xd
call fcn.00403580
push edi
push 0x4cf4ac
jmp 0x414445
push 0x4cf4c8
push esi
mov ebx, 0xa
call fcn.00403580
push edi
push str._sUninstall.lnk
lea edi, [ebp - 4]
call fcn.00404650
mov edi, dword [ebp - 4]
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop ebx
test edx, edx
jg 0x414478
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov esp, ebp
pop ebp
ret 4

Function at 0x414480
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x4f2500]
xor eax, esp
mov dword [esp + 0x804], eax
test esi, esi
je 0x414504
test edi, edi
je 0x414504
push 0x800
lea eax, [esp + 4]
push 0
push eax
call fcn.004276b0
push 0x400
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.00425661
add esp, 0x18
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebx + 0x2084], 0
mov eax, 1
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0042292e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x804]
xor ecx, esp
xor eax, eax
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x414520
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x234]
push 0
push eax
mov esi, ecx
call fcn.004276b0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x234]
push ecx
push str._localappdata_GamePPGamePPConfig.ini
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x234]
push eax
push 0x14
lea ecx, [ebp - 0x2c]
push ecx
push 0x4cb44c
push str.CurrentType
xor edx, edx
push str.LANGUAGE
mov word [ebp - 0x2c], dx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2c]
call fcn.004032d0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042292e
mov esp, ebp
pop ebp
ret