joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov byte [ebp], 0
je 0x40c2d4
mov eax, dword [0x427550]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40c299
mov cl, byte [esi]
push edi
mov byte [esp + 0x10], cl
mov edi, ebp
mov eax, dword [esp + 0x10]
and eax, 0xff
inc esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [eax + ebp], 0
pop esi
pop ebp
ret
mov edx, dword [0x427224]
mov eax, esi
sub eax, edx
mov dl, byte [esi]
mov cl, al
inc esi
xor cl, dl
xor cl, 0x6a
inc eax
test cl, cl
mov byte [esp + 0xc], cl
jbe 0x40c2d0
mov ecx, dword [esp + 0xc]
and ecx, 0xff
mov dl, byte [esi]
xor dl, al
xor dl, 0x6a
mov byte [ebp], dl
inc ebp
inc esi
inc eax
dec ecx
jne 0x40c2c0
mov byte [ebp], 0
pop esi
pop ebp
ret

Function at 0x40c380
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov ecx, dword [0x427644]
sub esp, 0x24
push ebx
push esi
mov esi, dword [ecx*4 + 0x427450]
test esi, esi
je 0x40c4d5
mov edx, dword [ecx*4 + 0x427390]
xor eax, eax
test edx, edx
jbe 0x40c3c4
mov bl, byte [eax + esi]
mov cl, al
add cl, 0x40
xor bl, cl
mov byte [eax + esi], bl
mov edx, dword [0x427644]
inc eax
cmp eax, dword [edx*4 + 0x427390]
jb 0x40c3a7
xor eax, eax
mov ax, word [esi]
add esi, 2
test eax, eax
jbe 0x40c4d5
push ebp
push edi
mov dword [esp + 0x18], eax
mov al, byte [esi]
inc esi
mov byte [esp + 0x13], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], esi
lea edx, [esi + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov ebp, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov ebx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x14], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [edx + ecx + 1]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4271bc]
push ecx
push edx
call fcn.0040c2e0
mov al, byte [esp + 0x1b]
add esp, 8
test al, 1
je 0x40c466
mov eax, dword [0x4271bc]
lea ecx, [esp + 0x20]
push eax
push 0x14
push ecx
push 0x42768c
push ebx
push ebp
mov byte [esp + 0x38], 0
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jne 0x40c4c4
mov edx, dword [esp + 0x14]
push 0xffdc
push edx
push 0
call fcn.0040bd90
mov dword [esp + 0x28], eax
lea eax, [eax + eax + 1]
push eax
call fcn.00418c70
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
inc ecx
mov edi, eax
push ecx
push edx
push edi
call fcn.0040bd90
mov eax, dword [0x4271bc]
add esp, 0x1c
push eax
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
push ebp
call ebx
mov ecx, dword [0x4271bc]
push ecx
push 0
push 0
push 0
call ebx
push edi
call fcn.00418dd3
add esp, 4
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jne 0x40c3da
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x40c4e0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov ecx, dword [0x427644]
sub esp, 0x38
push ebx
push esi
mov esi, dword [ecx*4 + 0x427410]
test esi, esi
je 0x40c6e4
mov edx, dword [ecx*4 + 0x427350]
xor eax, eax
test edx, edx
jbe 0x40c524
mov bl, byte [eax + esi]
mov cl, al
add cl, 0x41
xor bl, cl
mov byte [eax + esi], bl
mov edx, dword [0x427644]
inc eax
cmp eax, dword [edx*4 + 0x427350]
jb 0x40c507
xor eax, eax
mov ax, word [esi]
add esi, 2
test eax, eax
jbe 0x40c6e4
push ebp
push edi
mov dword [esp + 0x2c], eax
mov ebp, dword [esi]
mov bl, byte [esi + 4]
add esi, 4
or ecx, 0xffffffff
inc esi
xor eax, eax
mov edi, esi
mov dword [esp + 0x24], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esi + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x28], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, 0x10
lea esi, [edx + ecx + 1]
jb 0x40c58b
mov eax, dword [0x422048]
mov dword [esp + 0x14], eax
jmp 0x40c596
mov ecx, dword [ebp*4 + 0x422044]
mov dword [esp + 0x14], ecx
test bl, 1
je 0x40c634
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
mov dword [esp + 0x30], 0
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c615
test bl, 2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x14
je 0x40c5e9
mov eax, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x30]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, 2
je 0x40c628
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x40c6d3
jmp 0x40c634
mov al, byte [esp + 0x30]
test al, al
jne 0x40c6d3
mov edx, dword [esp + 0x20]
push 0xffdc
push edx
push 0
call fcn.0040bd90
mov edi, eax
lea eax, [edi + edi + 1]
push eax
call fcn.00418c70
mov edx, dword [esp + 0x30]
lea ecx, [edi + 1]
mov ebp, eax
push ecx
push edx
push ebp
call fcn.0040bd90
add esp, 0x1c
mov dword [esp + 0x20], 1
test bl, 2
je 0x40c687
push ebp
call fcn.0041932c
mov edi, 4
add esp, 4
mov dword [ebp], eax
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40c6ca
mov eax, dword [esp + 0x20]
cmp eax, 1
jne 0x40c6aa
inc edi
mov ecx, dword [esp + 0x10]
push edi
push ebp
push eax
mov eax, dword [esp + 0x34]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00418dd3
add esp, 4
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x40c53a
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x40d450
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
lea eax, [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x18]
push eax
push 0x800
mov ebp, 1
call fcn.00402100
add esp, 8
test eax, eax
jne 0x40d47c
mov eax, ebp
pop esi
pop ebp
add esp, 0xc
ret
mov edx, dword [0x4271bc]
lea ecx, [esp + 0x10]
push ebx
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0xc], eax
je 0x40d5d1
push eax
call fcn.00418c70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40d5d1
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4271bc]
push edi
push ebx
push eax
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d5c7
mov al, byte [esi + 0x16]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test al, 2
je 0x40d557
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x422590
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d557
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x24]
mov eax, dword [edx + 8]
cmp eax, ecx
ja 0x40d50d
jne 0x40d557
mov edx, dword [edx + 0xc]
mov eax, dword [esi + 0x28]
cmp edx, eax
jbe 0x40d557
push 0x1d
push 7
call fcn.00403580
mov cl, byte [eax]
add esp, 8
test cl, cl
je 0x40d5c5
mov ecx, dword [0x427658]
test ecx, ecx
jne 0x40d5c5
mov ecx, dword [0x4271bc]
mov edx, dword [esp + 0x20]
push ecx
push eax
push edx
call edi
mov eax, dword [esp + 0x2c]
push 0x124
push eax
call fcn.00403540
add esp, 0x14
cmp eax, 6
jne 0x40d5c5
mov eax, dword [0x427658]
test eax, eax
jne 0x40d5c7
test byte [esi + 0x16], 4
je 0x40d5c7
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d5c7
mov ecx, dword [esp + 0x14]
xor eax, eax
mov ax, word [ecx]
mov ecx, dword [esi + 0x34]
cmp ecx, eax
je 0x40d5c7
push 0x1e
push 7
call fcn.00403580
add esp, 8
test eax, eax
je 0x40d5c7
mov edx, dword [0x4271bc]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
call edi
mov ecx, dword [esp + 0x2c]
push 0x124
push ecx
call fcn.00403540
add esp, 0x14
cmp eax, 6
je 0x40d5c7
xor ebp, ebp
push ebx
call fcn.00418dd3
add esp, 4
pop edi
lea edx, [esp + 0x1c]
push edx
call fcn.00402140
add esp, 4
mov eax, ebp
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x40e180
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e229
lea ecx, [esp + 0xc]
lea edx, [esp]
push ecx
mov ecx, dword [0x4271bc]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e1ec
inc dword [esp]
jmp 0x40e1fc
mov dword [esp], 1
mov dword [esp + 4], 4
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [0x4271bc]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret

Function at 0x40e230
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x427188]
test eax, eax
jne 0x40e2e6
push esi
push str.wininet.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.InternetOpenA
push eax
mov dword [0x427188], eax
call esi
mov dword [0x427184], eax
mov eax, dword [0x427188]
push str.InternetCloseHandle
push eax
call esi
mov ecx, dword [0x427188]
push str.InternetOpenUrlA
push ecx
mov dword [0x427180], eax
call esi
mov edx, dword [0x427188]
push str.InternetQueryDataAvailable
push edx
mov dword [0x42717c], eax
call esi
mov dword [0x427178], eax
mov eax, dword [0x427188]
push str.InternetReadFile
push eax
call esi
mov ecx, dword [0x427184]
mov dword [0x427174], eax
test ecx, ecx
pop esi
je 0x40e2d8
mov ecx, dword [0x427180]
test ecx, ecx
je 0x40e2d8
mov ecx, dword [0x42717c]
test ecx, ecx
je 0x40e2d8
mov ecx, dword [0x427178]
test ecx, ecx
je 0x40e2d8
test eax, eax
jne 0x40e2dd
call fcn.0040e320
mov eax, dword [0x427188]
test eax, eax
je 0x40e30b
mov eax, dword [0x427170]
test eax, eax
jne 0x40e310
push eax
push eax
push eax
push eax
push eax
push 7
call fcn.00403580
add esp, 8
push eax
call dword [0x427184]
mov dword [0x427170], eax
ret
mov eax, dword [0x427170]
ret
Function at 0x40e360
Capabilities:
Copy file
Write file on windows

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
mov esi, dword [esp + 0x138]
push edi
push 7
xor ebp, ebp
push str.file:__
push esi
mov dword [esp + 0x30], ebp
call fcn.004191f0
add esp, 0xc
test eax, eax
jne 0x40e407
lea edi, [esi + 7]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x40e3d0
cmp byte [esp + eax + 0x30], 0x2f
jne 0x40e3cb
mov byte [esp + eax + 0x30], 0x5c
inc eax
cmp eax, ecx
jl 0x40e3bf
lea ecx, [esp + 0x30]
push 0x422644
push ecx
call fcn.00419020
add esp, 8
test eax, eax
je 0x40e598
mov edx, dword [esp + 0x138]
push 0
dec eax
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret
call fcn.0040e230
mov edi, eax
test edi, edi
je 0x40e598
push 0x1000
call fcn.00418c70
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x40e598
push 0
push 0
push 0
push 0
push esi
push edi
call dword [0x42717c]
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x40e58f
mov eax, dword [esp + 0x138]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x40e588
mov esi, dword [esp + 0x144]
mov ebx, dword [esp + 0x148]
xor edi, edi
mov ebp, esi
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
call dword [0x427178]
test eax, eax
je 0x40e558
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x40e558
cmp eax, 0x1000
jbe 0x40e4c6
mov eax, 0x1000
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [0x427174]
cmp eax, 1
jne 0x40e534
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x40e534
mov ecx, dword [esp + 0x20]
add edi, ecx
cmp ebx, esi
je 0x40e53c
mov ecx, dword [esp + 0x140]
test ecx, ecx
jle 0x40e53c
mov eax, ebx
xor edx, edx
sub eax, esi
imul eax, edi
div ecx
add eax, esi
cmp eax, ebp
je 0x40e53c
push eax
mov ebp, eax
call fcn.00401e00
add esp, 4
jmp 0x40e53c
mov dword [esp + 0x10], 1
call fcn.00404b00
mov eax, dword [0x4275ec]
test eax, eax
jne 0x40e571
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40e492
jmp 0x40e571
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40e571
push ebx
mov dword [esp + 0x28], 1
call fcn.00401e00
add esp, 4
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push esi
call dword [0x427180]
push ebx
call fcn.00418dd3
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x124
ret
Function at 0x40e5b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x427588]
sub esp, 0x208
test eax, eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
jne 0x40e696
push 0x427588
push 0x104
call fcn.00402100
add esp, 8
test eax, eax
jne 0x40e5fb
pop edi
pop esi
pop ebp
mov dword [0x42765c], 0xc
or eax, 0xffffffff
pop ebx
add esp, 0x208
ret
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov ebx, 1
mov eax, dword [0x427588]
push eax
push 0x104
call ebp
mov ecx, dword [0x427588]
push ecx
call fcn.00402040
mov edx, dword [0x427588]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
add ecx, edx
push str.ictmp_d
push ecx
call esi
mov edx, dword [0x427588]
push edx
call fcn.00418e68
add esp, 0x10
test eax, eax
jne 0x40e65d
inc ebx
cmp ebx, 0x3e7
jl 0x40e606
jmp 0x40e66f
mov eax, dword [0x427588]
push eax
call fcn.00418e3c
add esp, 4
test eax, eax
je 0x40e696
mov ecx, dword [0x427588]
mov dword [0x42765c], 0x11
push ecx
call fcn.0040a490
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov edx, dword [0x427588]
push edx
call fcn.00402040
mov ebx, dword [esp + 0x220]
mov ecx, dword [0x427588]
add esp, 4
lea edx, [esp + 0x10]
mov eax, dword [ebx + 6]
push eax
push ecx
push str._s_d.bin
push edx
call esi
mov eax, dword [0x427588]
push eax
call fcn.00402090
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00401040
mov ebp, dword [esp + 0x240]
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x40e794
mov eax, dword [0x427574]
mov edx, dword [ebx + 6]
push edx
lea edx, [esp + 0x118]
mov ecx, dword [eax + 0x70]
add ecx, eax
push ecx
push str._s_d.bin
push edx
call esi
mov eax, dword [esp + 0x230]
mov ecx, dword [ebx + 0xa]
push ebp
push eax
lea edx, [esp + 0x12c]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0040e360
add esp, 0x24
test eax, eax
je 0x40e76d
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00401040
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x40e794
lea edx, [esp + 0x10]
mov dword [0x42765c], 0x10
push edx
call fcn.0040a490
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
lea eax, [esp + 0x114]
mov dword [0x42765c], 0x10
push eax
call fcn.0040a490
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
push ebp
call fcn.00401e00
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40e7b0
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x427588]
test eax, eax
je 0x40e84e
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push eax
call ebx
test eax, eax
je 0x40e840
push esi
push 1
push 0x118
call fcn.00418d22
mov esi, eax
add esp, 8
test esi, esi
je 0x40e829
push edi
push esi
push str..bin
call fcn.0041940f
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x40e81f
test byte [esi], 0x10
jne 0x40e808
lea eax, [esi + 0x14]
push eax
call fcn.004190a0
add esp, 4
push esi
push edi
call fcn.004194d9
add esp, 8
test eax, eax
je 0x40e7f7
push edi
call fcn.0041959e
add esp, 4
push esi
call fcn.00418dd3
add esp, 4
pop edi
push 0x422664
call ebx
mov ecx, dword [0x427588]
push ecx
call fcn.004193e5
add esp, 4
pop esi
push 0x427588
call fcn.00402140
add esp, 4
pop ebx
ret

Function at 0x40ea70
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x104
xor ebp, ebp
call fcn.00402100
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call fcn.00418b20
mov edx, eax
add esp, 0x10
test edx, edx
je 0x40eac1
inc edx
jmp 0x40eac5
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x40eb38
mov dword [0x42765c], 0x3e8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x427660], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [0x42764c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40eb63
push 2
push esi
mov ebp, 1
call fcn.00418ad1
add esp, 8
test eax, eax
je 0x40eb63
cmp dword [0x427690], 0xd
jne 0x40eb63
push 0x180
push esi
call fcn.00418990
add esp, 8
lea eax, [esp + 0x10]
push eax
call fcn.00402140
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x410f90
Capabilities:
Get common file path
Move file

Disassembly:
mov eax, dword [0x4275f4]
sub esp, 0x318
test eax, eax
push ebx
push esi
push edi
je 0x410fe3
mov eax, dword [esp + 0x328]
test eax, eax
jne 0x410fc8
push 4
push eax
mov eax, dword [esp + 0x334]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
pop edi
pop esi
pop ebx
add esp, 0x318
ret
mov ecx, dword [esp + 0x32c]
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
pop edi
pop esi
pop ebx
add esp, 0x318
ret
mov eax, dword [esp + 0x32c]
mov edi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
lea edx, [esp + 0x11c]
push 0x104
push edx
push eax
call edi
mov esi, dword [esp + 0x328]
test esi, esi
je 0x41101b
lea ecx, [esp + 0x220]
push 0x104
push ecx
push esi
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
push str.WININIT.INI
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
test esi, esi
je 0x411078
mov esi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x224]
push edx
push eax
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
pop edi
pop esi
pop ebx
add esp, 0x318
ret
mov esi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
push eax
push 0x422674
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
lea edx, [esp + 0x18]
push 2
push edx
call fcn.00401040
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x411198
push ebp
push ebx
call fcn.004011c0
mov ebp, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebp
lea ecx, [ebp + 0x200]
push ecx
call fcn.004020c0
add esp, 0xc
test eax, eax
je 0x41118e
mov edx, dword [esp + 0x10]
push ebp
push edx
push ebx
call fcn.004010c0
add esp, 0xc
test eax, eax
jne 0x411181
mov edx, dword [esp + 0x10]
add ebp, 0xfffffffc
test ebp, ebp
jbe 0x411181
mov eax, 0xfffffffe
sub eax, edx
mov dword [esp + 0x18], eax
cmp byte [edx], 0x78
jne 0x411150
cmp byte [edx + 1], 0x79
jne 0x411150
cmp byte [edx + 2], 0x7a
jne 0x411150
cmp byte [edx + 3], 0x3d
jne 0x411150
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x120]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41115b
mov eax, dword [esp + 0x18]
inc edx
lea ecx, [eax + edx + 2]
cmp ecx, ebp
jb 0x411114
jmp 0x411181
push 0
push ebx
mov byte [edx], 0x4e
mov byte [edx + 1], 0x55
mov byte [edx + 2], 0x4c
call fcn.00401160
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebx
call fcn.00401100
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.00402140
add esp, 4
push ebx
call fcn.004012c0
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x318
ret
Function at 0x411980
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
push edi
push 0
push str.InstItClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4119d5
push ebx
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ebx, dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
mov edi, eax
call ebx
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4119c2
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, edi
je 0x4119c9
push edi
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xa0]
mov dword [0x427644], 0xffffffff
mov dword [0x427628], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
xor ecx, ecx
lea edi, [esp + 8]
mov cl, ah
lea edx, [esp + 8]
mov ch, al
xor eax, eax
mov word [0x4275fc], cx
mov ecx, 0x25
mov esi, 0x2000
push edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x94
mov dword [0x4275f8], esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
mov edi, 1
je 0x411ab9
mov eax, dword [esp + 0x18]
dec eax
je 0x411a85
dec eax
jne 0x411ab9
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, 4
mov dword [0x4275f4], edi
sete cl
cmp eax, 5
mov dword [0x4275f8], 0x10000
mov dword [0x4275f0], ecx
jb 0x411ab9
mov eax, dword [esp + 0x10]
mov dword [0x4275f8], 0x40000
test eax, eax
jne 0x411ab9
mov dword [0x4275f8], 0x20000
jmp 0x411ab9
mov eax, dword [esp + 0xc]
mov dword [0x4275f8], esi
cmp eax, 4
jne 0x411aad
mov eax, dword [esp + 0x10]
cmp eax, 0x5a
jae 0x411aaf
test eax, eax
jbe 0x411ab9
mov dword [0x4275f8], 0x4000
jmp 0x411ab9
jbe 0x411ab9
mov dword [0x4275f8], 0x8000
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00402cb0
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.RICHED20.DLL
call esi
test eax, eax
mov dword [0x4275d4], eax
jne 0x411aea
push str.RICHED32.DLL
call esi
mov dword [0x4275d4], eax
jmp 0x411af0
mov dword [0x4275d0], edi
push 0x427590
push 0x104
call fcn.00402100
push 0x427594
push 0x104
call fcn.00402100
push 0x427648
push 0x104
call fcn.00402100
push 0x4271bc
push 0x208
call fcn.00402100
push 0x4271b8
push 0x104
call fcn.00402100
push 0x42764c
push 0x104
call fcn.00402100
push 0x4271b4
push 0x104
call fcn.00402100
push 0x427228
push 0x29e
call fcn.00402100
add esp, 0x40
push 0x427224
push 0x29e
call fcn.00402100
mov edx, dword [0x427590]
mov eax, dword [0x427628]
add esp, 8
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov eax, edi
pop edi
pop esi
add esp, 0x94
ret