joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402130
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18
Function at 0x415b90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4220
call fcn.004a9200
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x4220], ecx
mov ecx, dword [ebp - 0x4220]
add ecx, 0x238
call fcn.0040aef0
movzx eax, al
test eax, eax
je 0x415cf2
xor ecx, ecx
mov word [ebp - 0x4210], cx
push 0x206
push 0
lea edx, [ebp - 0x420e]
push edx
call fcn.00499250
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov cx, word [0x4c1160]
mov word [ebp - 0x4008], cx
push 0x3ffe
push 0
lea edx, [ebp - 0x4006]
push edx
call fcn.00499250
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4210]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x4214], eax
cmp dword [ebp - 0x4214], 0
je 0x415cf2
lea edx, [ebp - 0x4008]
push edx
mov eax, dword [ebp - 0x4214]
push eax
push 0
lea ecx, [ebp - 0x4210]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415cf2
lea edx, [ebp - 0x421c]
push edx
lea eax, [ebp - 0x4218]
push eax
push 0x4c1164
lea ecx, [ebp - 0x4008]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x415cf2
mov edx, dword [ebp - 0x4218]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4218]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4218]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4218]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push 0x4c1168
mov edx, dword [ebp - 0x4220]
add edx, 0x238
push edx
call fcn.00414920
add esp, 0x18
mov eax, dword [ebp - 0x4220]
add eax, 0x238
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret

Function at 0x415e10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 4
cmp dword [ebp + 8], 0
je 0x415e2f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x248], 0
jne 0x415e44
mov dword [ebp - 4], 3
jmp 0x415e9b
mov ecx, dword [ebp - 8]
call fcn.00415fe0
test eax, eax
jne 0x415e59
mov dword [ebp - 4], 0
jmp 0x415e9b
mov ecx, dword [ebp - 8]
call fcn.004161c0
test eax, eax
jne 0x415e6e
mov dword [ebp - 4], 1
jmp 0x415e9b
mov eax, dword [ebp - 8]
mov dword [eax + 0x244], 1
mov ecx, dword [ebp - 8]
call fcn.00416080
test eax, eax
jne 0x415e90
mov dword [ebp - 4], 2
jmp 0x415e9b
mov dword [ebp - 4], 5
xor ecx, ecx
jne 0x415e20
mov ecx, dword [ebp - 8]
call fcn.004165d0
mov ecx, eax
call fcn.00436d80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x415f40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.0040aef0
movzx eax, al
test eax, eax
jne 0x415fd1
mov ecx, dword [ebp + 0xc]
call fcn.0040aef0
movzx ecx, al
test ecx, ecx
je 0x415f69
xor eax, eax
jmp 0x415fd3
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00415ec0
test eax, eax
jne 0x415f88
mov eax, 1
jmp 0x415fd3
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x254], eax
mov ecx, dword [ebp + 0xc]
call fcn.00436d80
push eax
mov ecx, dword [ebp + 8]
call fcn.00436d80
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.0043d850
test eax, eax
je 0x415fbe
mov eax, 1
jmp 0x415fd3
mov ecx, dword [ebp + 0xc]
call fcn.00436d80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x415fd3
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14

Function at 0x416120
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00499250
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 0x234
call fcn.00436d80
push eax
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x4c11f8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040ab00
mov ecx, dword [ebp + 0x10]
call fcn.0040aef0
movzx eax, al
test eax, eax
je 0x4161ab
xor eax, eax
jmp 0x4161b0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x417f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x417f79
xor ecx, ecx
jne 0x417f79
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x417f9a
mov eax, 0xd
jmp 0x417ff5
xor eax, eax
jne 0x417f81
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x417fab
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x418000
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401ec0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00417e70
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41806b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00417c60
mov eax, dword [ebp - 0x224]
jmp 0x4180fc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4180d1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00418000
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4180c8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00417c60
mov eax, dword [ebp - 0x228]
jmp 0x4180fc
mov dword [ebp - 4], 0x100
jmp 0x418072
lea ecx, [ebp - 0x14]
call fcn.00417da0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00417ce0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00417c60
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret 4
Function at 0x424570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4

Function at 0x424a50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ecx
push 0
mov ecx, dword [ebp - 0x6c]
call fcn.00436a40
push 0
mov ecx, dword [ebp - 0x6c]
add ecx, 4
call fcn.00436a40
push 0
mov ecx, dword [ebp - 0x6c]
add ecx, 8
call fcn.00436a40
push 0
mov ecx, dword [ebp - 0x6c]
add ecx, 0xc
call fcn.00436a40
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea ecx, [ebp - 0x68]
call fcn.00401d00
push 0x4c2560
push 0x40
lea eax, [ebp - 0x4c]
push eax
call fcn.00401fe0
mov dword [ebp - 0x68], 0xfffffff4
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.0040b2c0
push 0x4c2560
push 0x40
lea edx, [ebp - 0x4c]
push edx
call fcn.00401fe0
mov dword [ebp - 0x68], 0xfffffff3
mov byte [ebp - 0x53], 1
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x6c]
add ecx, 4
call fcn.0040b2c0
push 0x4c2560
push 0x40
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00401fe0
mov dword [ebp - 0x68], 0xfffffff4
lea ecx, [ebp - 0x68]
call fcn.00401d20
mov byte [ebp - 0x53], 1
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x6c]
add ecx, 8
call fcn.0040b2c0
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
movzx eax, al
cmp eax, 5
jle 0x424b40
mov dword [ebp - 0x70], 0x4c1a70
jmp 0x424b47
mov dword [ebp - 0x70], 0x4c2560
mov ecx, dword [ebp - 0x70]
push ecx
push 0x40
lea edx, [ebp - 0x4c]
push edx
call fcn.00401fe0
mov dword [ebp - 0x68], 0xfffffff3
lea ecx, [ebp - 0x68]
call fcn.00401d20
mov byte [ebp - 0x53], 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x6c]
add ecx, 0xc
call fcn.0040b2c0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret

Function at 0x4250c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x4250de
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 0x20]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4250ed
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx - 0x20]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x4274e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x42751f
xor eax, eax
xor edx, edx
jmp 0x42753d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4275a0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4275cb
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
xor eax, eax
jmp 0x427707
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x427605
xor eax, eax
jmp 0x427707
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x4276f8
jg 0x427638
cmp dword [ebp - 0x10], 0x3200000
jbe 0x4276f8
mov edx, dword [ebp - 0x10]
sub edx, 0x3200000
mov eax, dword [ebp - 0xc]
sbb eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x24], eax
push 0x3200000
call fcn.00495360
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
push 0x3200000
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00499250
add esp, 0xc
push 0
lea edx, [ebp - 0x2c]
push edx
push 0x3200000
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4276c4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x427707
mov eax, dword [ebp + 0xc]
push eax
push 0x3200000
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0043f210
add esp, 0xc
cmp dword [ebp - 0x28], 0
je 0x4276f8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.0049640b
add esp, 4
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x427880
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4278a8
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
xor eax, eax
jmp 0x4278ef
mov eax, dword [ebp + 8]
push eax
call fcn.004274e0
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jl 0x4278df
jg 0x4278cb
cmp dword [ebp - 8], 0x3200000
jbe 0x4278df
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004275a0
add esp, 8
jmp 0x4278ef
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00427710
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x428150
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00499250
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x104
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Game.exe
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4281d3
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4281d3
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040ab00
mov eax, 1
jmp 0x4281d5
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret

Function at 0x4281f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x428211
push 0xcf
push 0x4bf9d8
push str.pszDir
call fcn.004970b7
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x428221
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x428225
xor eax, eax
jmp 0x428251
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42824e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42824e
mov eax, 1
jmp 0x428251
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x428430
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00436d80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x428464
lea ecx, [ebp + 8]
call fcn.00436d80
push eax
call fcn.00428260
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp + 8]
call fcn.0040aac0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x428a20
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aed50
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ccf60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00436d80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x428a7d
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040aac0
mov eax, dword [ebp - 0x28]
jmp 0x428bc4
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.00435b60
add eax, 1
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.0040adc0
mov byte [ebp - 4], 1
push 0x4bfba4
lea ecx, [ebp - 0x18]
call fcn.00435ae0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
call fcn.0040aa00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040aa00
mov byte [ebp - 4], 3
push 0xff
push 0xff
lea ecx, [ebp - 0x20]
call fcn.0040aeb0
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0xff
push 0xff
lea ecx, [ebp - 0x24]
call fcn.0040aeb0
push eax
lea ecx, [ebp - 0x18]
call fcn.00436d80
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0x4bfba8
lea ecx, [ebp - 0x20]
push ecx
call fcn.00435e70
add esp, 8
movzx edx, al
test edx, edx
jne 0x428b48
push 0x4bfbb0
lea eax, [ebp - 0x20]
push eax
call fcn.00435e70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x428b87
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040aac0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0040aac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040aac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040aac0
mov eax, dword [ebp - 0x2c]
jmp 0x428bc4
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040aac0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0040aac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040aac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040aac0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x429220
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00429710
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041d890
push 0x77
mov ecx, 0x4d717c
call fcn.00401410
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041dc10
push 1
mov ecx, 0x4d91d0
call fcn.00404f60
push eax
mov ecx, 0x4d91d0
call fcn.00404f40
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041d8b0
push 1
push 0xc9
push 0x194
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041d8b0
lea ecx, [ebp - 0x10]
call fcn.00401f20
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041d970
mov ecx, dword [ebp - 0x18]
call fcn.00429fd0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0041b9b0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0x428e10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call fcn.0043b740
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b8c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0fab
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x4ccf60]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
push 0
mov ecx, dword [ebp - 0x27c]
add ecx, 4
call fcn.0041db30
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
call fcn.0040aa00
mov dword [ebp - 4], 0
fild dword [ebp - 0x10]
fdiv qword [0x4c3360]
sub esp, 8
fstp qword [esp]
push 0x4bfda8
lea eax, [ebp - 0x14]
push eax
call fcn.00414920
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.00436d80
push eax
mov ecx, dword [ebp - 0x27c]
add ecx, 0x50c
call fcn.00405e10
mov ecx, dword [ebp - 0x27c]
call fcn.0042bdb0
test eax, eax
je 0x42ba04
lea ecx, [ebp - 0x278]
push ecx
call fcn.00428810
add esp, 4
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x284], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x284]
push eax
mov ecx, dword [ebp - 0x27c]
add ecx, 0x408
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00435cf0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x278]
call fcn.0040aac0
lea ecx, [ebp - 0x18]
call fcn.00436d80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b9dc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.0042e920
jmp 0x42b9f3
push 0
push 0x3e8
push 2
mov ecx, dword [ebp - 0x27c]
add ecx, 4
call fcn.0041db00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040aac0
jmp 0x42baf2
push 2
mov ecx, dword [ebp - 0x27c]
call fcn.004321d0
push 0x254
push 0
lea ecx, [ebp - 0x274]
push ecx
call fcn.00499250
add esp, 0xc
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp - 0x27c]
mov ecx, dword [eax + 0x608]
push ecx
call fcn.00440790
mov ecx, eax
call fcn.00440920
movzx edx, byte [ebp - 0x22f]
cmp edx, 5
jne 0x42ba7b
push 0
push 0
mov ecx, dword [ebp - 0x27c]
call fcn.00434640
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.004344d0
push eax
push 6
call fcn.0043c170
add esp, 0x14
jmp 0x42baad
movzx eax, byte [ebp - 0x22f]
cmp eax, 6
jne 0x42baad
push 0
push 0
mov ecx, dword [ebp - 0x27c]
call fcn.00434640
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.004344d0
push eax
push 5
call fcn.0043c170
add esp, 0x14
cmp dword [0x4d9134], 0
jne 0x42badd
mov ecx, dword [0x4d9134]
add ecx, 1
mov dword [0x4d9134], ecx
mov ecx, dword [ebp - 0x27c]
call fcn.0042ead0
mov ecx, dword [ebp - 0x27c]
call fcn.0042ece0
jmp 0x42baf2
mov dword [0x4d9134], 0
mov ecx, dword [ebp - 0x27c]
call fcn.0042b320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040aac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049536b
mov esp, ebp
pop ebp
ret