joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418b70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451b0a
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x469090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push str.Handle_response...
push str.INFO
call fcn.0040c980
cmp dword [edi + 0xc14], 0
jne 0x418d9c
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x418d62
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
push edi
call fcn.0043723a
add esp, 4
push 0
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push ebx
call fcn.00408b40
add esp, 8
lea esi, [ebp - 0x48]
call fcn.0040eeb0
xor edi, edi
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x14]
push 0x46dcf0
push esi
lea ecx, [ebp - 0x48]
call fcn.00430fc0
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x418c4e
mov ecx, dword [ebx]
push str.Cant_parse_xml
push str.INFO
call fcn.0040c980
push str.time
lea eax, [ebp - 0x48]
call fcn.00431480
push str.idState
lea eax, [ebp - 0x48]
call fcn.00431480
cmp eax, edi
je 0x418c6f
mov edi, dword [eax + 4]
push esi
call fcn.00437245
add esp, 4
test edi, edi
je 0x418d3e
mov ecx, str.free
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418cad
test dx, dx
je 0x418ca9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418cad
add eax, 4
add ecx, 4
test dx, dx
jne 0x418c87
xor eax, eax
jmp 0x418cb2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x418ced
cmp word [ebx + 0x804], ax
lea esi, [ebx + 0x804]
je 0x418cdc
push str.s_user_id
mov ecx, str.SoftwarePinstall
mov edx, SysReAllocString
call fcn.00407930
add esp, 4
mov dword [ebx + 0xc14], 1
push str.s_user_id_is_free
jmp 0x418d32
mov ecx, str.busy
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418d1a
test dx, dx
je 0x418d16
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418d1a
add eax, 4
add ecx, 4
test dx, dx
jne 0x418cf4
xor eax, eax
jmp 0x418d1f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x418d3e
mov dword [ebx + 0xc14], 2
push str.s_user_id_is_busy
mov ecx, dword [ebx]
push str.INFO
call fcn.0040c980
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.004302a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x400
call fcn.0043723a
add esp, 4
push ebx
push str.Cant_open_response_file__s
mov esi, eax
push 0x200
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ecx, dword [edi]
add esp, 0x10
push esi
push str.INFO
call fcn.0040c980
push esi
call fcn.00437245
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4195a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44fb7e
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x469090]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x469090]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, ecx
push 0x400
mov dword [esp + 0x1c], edi
call fcn.0043723a
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x20]
add esp, 4
add eax, 0x264
push eax
mov eax, dword [edx + 0x30]
push 0x200
push esi
call eax
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00437245
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0xc]
mov ebx, dword [eax + 8]
add esp, 4
push 0x18
mov dword [esp + 0x24], ecx
call fcn.004372a1
mov esi, eax
add esp, 4
test esi, esi
je 0x4196ac
mov edx, dword [edi + 8]
mov eax, dword [edi + 0x14]
mov ecx, dword [edx + 0x20]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push 0
push 0
push 0
push edx
push 0xa
push ebx
add eax, 0xfffffff6
push eax
push 0
push 0x50000001
push 0x4589c0
push str.msctls_progress32
add ecx, 8
push 0
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0xa
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x640000
push 0
push 0x401
push eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4196ae
xor esi, esi
mov eax, dword [edi + 8]
mov dword [edi + 0x5c], esi
mov eax, dword [eax + 0x10]
push 0x424
mov dword [esp + 0x2c], eax
call fcn.004372a1
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
xor eax, eax
mov dword [esp + 0x240], eax
cmp esi, eax
je 0x41974f
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x20]
mov ecx, 0x45b350
mov ebx, eax
shl ebx, 5
sub ebx, eax
movzx eax, word [ecx]
add ecx, 2
add eax, ebx
cmp ecx, 0x45b366
jl 0x4196e6
mov dword [esp + 0x14], eax
lea eax, [edx + 0x264]
lea edx, [esp + 0x14]
call fcn.0040d2b0
mov ebx, dword [eax]
test ebx, ebx
jne 0x41971b
mov ebx, 0x45b350
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x28]
mov edi, dword [ecx + 4]
mov eax, dword [eax + 4]
push ebx
push 0x64
add edx, 0xffffffe2
push edx
push 0x14
add ecx, 8
push ecx
push eax
mov ebx, 0x14
call fcn.0042d6c0
mov edi, dword [esp + 0x18]
mov dword [esi], vtable.UrlLinkLabel.0
jmp 0x419751
xor esi, esi
mov dword [esp + 0x240], 0xffffffff
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
mov ecx, edi
mov dword [edi + 0x60], esi
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push 0x100
lea ecx, [esp + 0x30]
push ecx
mov ecx, eax
call edx
mov ecx, dword [edi + 0x60]
lea eax, [esp + 0x2c]
push eax
add ecx, 0x224
push 0x100
push ecx
call fcn.0043782b
add esp, 0xc
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x41b160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x17f4]
push ebx
push esi
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x224]
push eax
lea edx, [ebp - 0x220]
push edx
mov edx, str.files
call fcn.00412ce0
mov edi, eax
test edi, edi
je 0x41b2c2
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x210], ebx
inc ebx
push ebx
mov dword [ebp - 0x218], eax
call fcn.0043723a
add esp, 4
push ebx
mov esi, eax
push 0
push esi
call fcn.0043c0c0
mov ecx, dword [ebp - 0x218]
add esp, 0xc
push 0
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [ebp - 0x210]
push 0
lea edx, [ebp - 0x214]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [ebp - 0x214]
lea ecx, [ebp - 0x210]
push ecx
push edx
mov eax, esi
call fcn.00407de0
push esi
mov ebx, eax
call fcn.00437245
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
push esi
mov eax, ebx
call fcn.00408b40
push esi
call fcn.00437245
mov ebx, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x214]
add esp, 0xc
mov edx, ebx
mov ecx, esi
call fcn.0041a110
push esi
mov edi, eax
call fcn.00437245
add esp, 4
test edi, edi
je 0x41b2c2
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x41b2a0
mov eax, dword [ebx + 0x9938]
mov ecx, dword [esi]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
push 0x100
lea eax, [ebp - 0x20c]
push eax
call edx
mov eax, dword [esi]
push eax
call fcn.00437245
add esi, 4
add esp, 4
cmp esi, dword [edi + 4]
jne 0x41b271
mov eax, dword [edi]
test eax, eax
je 0x41b2af
push eax
call fcn.00437245
add esp, 4
xor eax, eax
push edi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
call fcn.00437245
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x41b690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x9938]
mov esi, eax
xor eax, eax
push ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
mov ecx, esi
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
call fcn.00408f40
mov edi, dword [edi + 0x9938]
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x41b6d6
mov eax, dword [esi]
jmp 0x41b6d8
mov eax, esi
mov ecx, dword [ebp + 8]
push edi
push 0x41af30
push 0x41aef0
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0042ec40
add esp, 0x1c
call fcn.0042ea70
cmp dword [esi + 0x14], 8
jb 0x41b705
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41b720
test al, 0x10
jne 0x41b720
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x208
mov edi, ecx
call fcn.0043723a
push 0x208
mov esi, eax
call fcn.0043723a
add edi, 0x17f8
push edi
push str.Software_s
push 0x104
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ecx, dword [ebp - 4]
push SysReAllocString
mov ebx, 0x104
mov edi, str.exec
call fcn.00407740
mov eax, dword [ebp - 4]
push eax
call fcn.00437245
add esp, 0x20
xor bl, bl
cmp word [esi], 0
je 0x41d30b
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d309
test al, 0x10
jne 0x41d309
push esi
mov bl, 1
call fcn.00437245
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
push esi
call fcn.00437245
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d320
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45119b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x469090]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
mov eax, dword [0x469090]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
cmp word [ebx + 0x11d0], 0
lea esi, [ebx + 0x11d0]
jne 0x41d397
push 0x104
push esi
lea eax, [ebx + 0xfc8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
test eax, eax
jne 0x41d38b
xor ecx, ecx
mov word [esi], cx
cmp word [esi], 0
jne 0x41d397
lea esi, [ebx + 0xfc8]
push esi
lea edx, [esp + 0x280]
push str._s.
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x280]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edi, eax
xor edx, edx
push 4
mov eax, str.PFL:
lea esi, [esp + 0x14]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], dx
call fcn.00402510
mov dword [esp + 0x420], 0
cmp edi, 0xffffffff
je 0x41d445
mov esi, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
lea eax, [esp + 0x58]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d407
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x14]
call fcn.00402190
mov ecx, eax
push 1
mov eax, 0x45b178
call fcn.00402190
lea eax, [esp + 0x2c]
push eax
push edi
call esi
test eax, eax
jne 0x41d400
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 7
mov eax, str.PFL_end
lea ecx, [esp + 0x14]
call fcn.00402190
push 0
lea ecx, [esp + 0x14]
push ecx
lea esi, [ebx + 0xb56c]
or eax, 0xffffffff
call fcn.00402420
mov ecx, eax
push 1
mov eax, 0x45b178
call fcn.00402190
cmp dword [esp + 0x24], 8
jb 0x41d48c
mov edx, dword [esp + 0x10]
push edx
call fcn.00437245
add esp, 4
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x41d4f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x208
call fcn.0043723a
push 0x208
mov esi, eax
call fcn.0043723a
mov ecx, dword [ebp + 8]
add ecx, 0x17f8
push ecx
push str.Software_s
push 0x104
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ecx, dword [ebp - 4]
push SysReAllocString
mov ebx, 0x104
mov edi, str.exec
call fcn.00407740
mov edx, dword [ebp - 4]
push edx
call fcn.00437245
mov eax, esi
add esp, 0x20
xor bl, bl
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d555
push 0x45b6cc
sub eax, edx
sar eax, 1
xor ecx, ecx
push 0x104
push esi
mov word [esi + eax*2 - 6], cx
call fcn.00437c36
add esp, 0xc
cmp word [esi], 0
je 0x41d5ac
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d5aa
test al, 0x10
jne 0x41d5aa
push esi
mov bl, 1
call fcn.00437245
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
xor bl, bl
push esi
call fcn.00437245
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41df10
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00410040
lea eax, [ebx + 0x17f8]
push eax
lea esi, [ebx + 0xfc8]
push esi
push str._s_s.exe
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push 0x208
call fcn.0043723a
push esi
push str._sZona.exe__MINIMIZED
mov edi, eax
push 0x104
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x28
cmp byte [ebx + 9], 0
je 0x41df9c
mov ecx, dword [ebp - 0x414]
push ecx
mov esi, edi
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, SysReAllocString
call fcn.00407930
add esp, 4
jmp 0x41dfd8
lea edx, [ebp - 0x410]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41dfd8
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00437245
movzx eax, byte [ebx + 0xa]
push ebx
push eax
call fcn.0041d920
add esp, 0xc
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp byte [ebx + 0xb], 0
je 0x41e07c
push 0x414
call fcn.004372a1
mov esi, eax
add esp, 4
test esi, esi
je 0x41e047
lea edx, [ebp - 0x20c]
push edx
lea eax, [esi + 4]
xor ecx, ecx
push 0x208
push eax
mov dword [esi], vtable.CommandWithOneArg.0
mov word [eax], cx
call fcn.0043782b
add esp, 0xc
mov dword [esi], vtable.FirewallAdd.0
mov dword [ebp - 0x410], esi
jmp 0x41e051
mov dword [ebp - 0x410], 0
mov ecx, dword [ebp - 0x410]
mov esi, dword [ebx + 0x9940]
push 0x100
lea edi, [ebp - 0x40c]
call fcn.004055c0
mov eax, dword [ebp - 0x410]
push eax
call fcn.00437245
add esp, 4
mov ecx, dword [ebp - 0x414]
push ecx
call fcn.00408980
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043722b
mov esp, ebp
pop ebp
ret

Function at 0x41e0a0
Capabilities:
Persist via run registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0040ff10
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
movzx eax, al
neg eax
sbb eax, eax
and eax, 2
mov dword [esi + 0x993c], eax
je 0x41e0d8
mov ecx, dword [esi + 0x9938]
push str.Installed_already
push str.INFO
call fcn.0040c980
mov ecx, esi
call fcn.0040f7e0
mov ecx, esi
pop esi
jmp fcn.0041e0f0
Function at 0x41e0f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x208
mov dword [ebp - 0x430], esi
call fcn.0043723a
lea ecx, [esi + 0x17f8]
push ecx
push str.Software_s
push 0x104
push eax
mov dword [ebp - 0x42c], eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ecx, dword [ebp - 0x42c]
add esi, 0xb9b8
push SysReAllocString
mov ebx, 0x104
mov edi, str.DownloadsDir
call fcn.00407740
add esp, 0x18
cmp word [esi], 0
jne 0x41e1e7
lea edx, [ebp - 0x434]
push edx
lea ebx, [ebp - 0x14]
call fcn.004079a0
push SysReAllocString
mov ebx, 0x104
lea esi, [ebp - 0x428]
mov edi, str.Personal
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00407740
mov ax, word [ebp - 0x14]
add esp, 8
push str.Zona_Downloads
cmp ax, word [ebp - 0x428]
jne 0x41e1b8
mov ecx, esi
push ecx
push str._s_s
push ebx
lea edx, [ebp - 0x220]
push edx
jmp 0x41e1cd
lea eax, [ebp - 0x14]
push eax
push 0x459618
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ecx, dword [ebp - 0x430]
add esp, 0x14
lea eax, [ebp - 0x220]
call fcn.0041e210
mov edx, dword [ebp - 0x42c]
push edx
call fcn.00437245
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043722b
mov esp, ebp
pop ebp
ret

Function at 0x41e210
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push edi
push eax
mov edi, ecx
push 0x458e0c
lea esi, [edi + 0xb9b8]
push 0x104
push esi
call ebx
push 0x208
call fcn.0043723a
add edi, 0x17f8
push edi
push str.Software_s
push 0x104
push eax
mov dword [ebp - 8], eax
call ebx
add esp, 0x24
test esi, esi
je 0x41e2c2
mov edx, dword [ebp - 8]
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41e2c2
mov eax, esi
lea edx, [eax + 2]
jmp 0x41e290
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e290
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.DownloadsDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call fcn.00437245
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e2e0
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push edi
mov ebx, ecx
lea ecx, [ebx + 0x17f8]
push ecx
lea eax, [ebx + 0xfc8]
push eax
push str._s_s.exe
lea edx, [ebp - 0x414]
push 0x104
push edx
call esi
add esp, 0x14
push 0
lea eax, [ebp - 0xa2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareZona
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41e393
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e355
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0xa2c]
push ecx
lea edx, [ebp - 0x414]
push edx
push 1
push 0
push str.exec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xa2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor edx, edx
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push edx
push edx
mov word [ebp - 0x20c], dx
call edi
lea ecx, [ebp - 0x20c]
push ecx
push str._sZona.lnk
mov edx, ecx
push 0x104
push edx
call esi
lea esi, [ebx + 0xb9b8]
add esp, 0x10
cmp word [esi], 0
jne 0x41e3e8
push 0
push str.DEBUG
push str.Unknown_download_dir
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.00408a90
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push 0xb
push edx
mov word [ebp - 0x20c], dx
call edi
lea ecx, [ebp - 0x20c]
push ecx
push str._sProgramsZona.lnk
mov edx, ecx
push 0x104
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
cmp word [esi], 0
jne 0x41e44d
push 0
push str.DEBUG
push str.Unknown_download_dir
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.00408a90
lea eax, [ebx + 0xfc8]
push eax
lea eax, [ebp - 0xa24]
xor edx, edx
push 0x208
push eax
mov dword [ebp - method.std::error_category.virtual_4], vtable.CommandWithOneArg.0
mov word [ebp - 0xa24], dx
call fcn.0043782b
mov esi, dword [ebx + 0x9940]
add esp, 0x18
push 0x100
lea edi, [ebp - 0x614]
lea ecx, [ebp - 0xa28]
mov dword [ebp - method.AddUninstallInfoCommand.virtual_0], vtable.AddUninstallInfoCommand.0
call fcn.004055c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x41eda0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44fa9b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x469090]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0xc]
push 0x1c
mov dword [esp + 0x20], eax
call fcn.004372a1
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
xor ecx, ecx
mov dword [esp + 0x30], ecx
cmp esi, ecx
je 0x41eed6
mov eax, 0x45c62a
lea esp, [esp]
movzx edx, word [eax - 2]
mov edi, ecx
shl edi, 5
sub edi, ecx
add edx, edi
mov ecx, edx
shl ecx, 5
sub ecx, edx
movzx edx, word [eax]
add ecx, edx
mov edx, ecx
shl edx, 5
sub edx, ecx
movzx ecx, word [eax + 2]
add edx, ecx
mov ecx, edx
shl ecx, 5
sub ecx, edx
movzx edx, word [eax + 4]
add ecx, edx
mov edx, ecx
shl edx, 5
sub edx, ecx
movzx ecx, word [eax + 6]
add edx, ecx
mov ecx, edx
shl ecx, 5
sub ecx, edx
movzx edx, word [eax + 8]
add eax, 0xc
add ecx, edx
cmp eax, 0x45c64e
jl 0x41ee00
mov eax, dword [ebp + 8]
add eax, 0x264
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
call fcn.0040d2b0
mov edx, dword [eax]
test edx, edx
jne 0x41ee77
mov edx, 0x45c628
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
mov edi, dword [0x46dbc0]
push 0
push 0
push 0
push ecx
push ebx
add eax, 0xffffffd8
push eax
push 0x14
push 0x14
push 0x50000000
push edx
push str.Static
add edi, 8
push 0
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x14], 0x14
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
mov dword [esi], eax
mov edi, dword [edi]
push edi
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp + 0xc]
push 0x424
mov dword [esp + 0x34], 0xffffffff
call fcn.004372a1
mov esi, eax
add esp, 4
test esi, esi
je 0x41ef23
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
push str.http:__zona.ru_faq.html
add eax, 0xffffffd8
push eax
mov eax, dword [0x46dbc0]
mov edi, dword [eax + 4]
push 0x50
push 0x14
lea ecx, [eax + 8]
push ecx
push edx
mov ebx, 0x14
call fcn.0042d6c0
mov dword [esi], vtable.UrlLinkLabel.0
jmp 0x41ef25
xor esi, esi
push str.http:__zona.ru_faq.html
push 0x100
add esi, 0x224
push esi
call fcn.0043782b
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8