joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x448], ax
push 0x20a
push 0
lea ecx, [ebp - 0x446]
push ecx
call fcn.004227a0
add esp, 0xc
push 0x102
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x448]
push eax
call fcn.00422a45
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x20a
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004227a0
add esp, 0xc
push 0x102
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00422a45
add esp, 0xc
push 0x1e
push 0
lea edx, [ebp - 0x238]
push edx
call fcn.004227a0
add esp, 0xc
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 4
lea eax, [ebp - 0x448]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x22c], ecx
mov edx, 0x614
mov word [ebp - 0x228], dx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4045db
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4045db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0
jne 0x4045d3
mov dword [ebp - 0x44c], 1
mov eax, dword [ebp - 0x44c]
jmp 0x4045dd
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret

Function at 0x404b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 0xc], 1
jne 0x404b8b
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040c3a0
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403260
cmp eax, 1
jne 0x404b62
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
push 0x405210
push 0
push 0
call fcn.004226ed
add esp, 0x18
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x74], eax
jmp 0x404b77
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
call fcn.0040c3d0
mov eax, dword [ebp - 0x2c]
jmp 0x404baf
push 0
push 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
push 0x405420
push 0
push 0
call fcn.004226ed
add esp, 0x18
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x6c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404bc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 8]
call fcn.00401bf0
mov ecx, 0x43e210
call fcn.00411410
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041e860
add esp, 8
mov ecx, eax
call fcn.004074a0
push eax
lea ecx, [ebp - 8]
call fcn.00401360
lea ecx, [ebp - 0x30]
call fcn.00407480
push str.temp
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00406c00
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00404e40
push str.updatefiles
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00406c00
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00404e40
push str.oem.txt
push 0x43e210
lea ecx, [ebp - 0x10]
push ecx
call fcn.00406c00
push str.ProductInfo.txt
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.00406c00
lea ecx, [ebp - 0x10]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc]
call fcn.00401860
lea ecx, [ebp - 0x10]
call fcn.00401860
lea ecx, [ebp - 0x14]
call fcn.00401860
lea ecx, [ebp - 4]
call fcn.00401860
lea ecx, [ebp - 8]
call fcn.00401860
mov esp, ebp
pop ebp
ret

Function at 0x404cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00404bc0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x4055d0
push 0
push 0
call fcn.004226ed
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x70], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404d90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406c80
push 2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 8]
call fcn.00407300
push 1
lea ecx, [ebp - 8]
call fcn.00406c60
lea ecx, [ebp - 4]
call fcn.00401bf0
lea edx, [ebp - 4]
push edx
call fcn.00404d40
add esp, 4
push 0x433cac
lea ecx, [ebp - 4]
call fcn.00403060
push 0x433cb0
lea ecx, [ebp - 4]
call fcn.00403060
lea ecx, [ebp - 4]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.00401860
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404e40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x270], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00401310
push str..
lea ecx, [ebp - 4]
call fcn.00403060
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 4]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x404fe4
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x264]
call fcn.00402fc0
push 0x433ccc
lea ecx, [ebp - 0x264]
call fcn.00403220
test eax, eax
je 0x404ed5
push 0x433cd0
lea ecx, [ebp - 0x264]
call fcn.00403220
test eax, eax
jne 0x404ee7
lea ecx, [ebp - 0x264]
call fcn.00401860
jmp 0x404fbb
mov eax, dword [ebp - 0x258]
and eax, 0x10
je 0x404f5f
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x268]
call fcn.00401310
push 0x433cd8
lea ecx, [ebp - 0x268]
call fcn.00403060
lea edx, [ebp - 0x264]
push edx
lea ecx, [ebp - 0x268]
call fcn.00406bd0
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp - 0x270]
call fcn.00404e40
lea ecx, [ebp - 0x268]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x268]
call fcn.00401860
lea ecx, [ebp - 0x264]
call fcn.00401860
jmp 0x404fbb
lea ecx, [ebp - 0x264]
push ecx
push 0x433cdc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x26c]
push eax
call fcn.00406c00
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.00406ce0
lea ecx, [ebp - 0x26c]
call fcn.00401860
lea ecx, [ebp - 0x260]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x260]
call fcn.00401860
lea ecx, [ebp - 0x264]
call fcn.00401860
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404e9b
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 4]
call fcn.00401860
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret 4
Function at 0x405000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00406c80
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402130
mov dword [ebp - 0x18], 0x122
push 1
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00406d40
push 0x41e
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0x10]
call fcn.00407300
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00406d90
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00406db0
mov dword [ebp - 0x30], 0x1f5
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406d40
push 1
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00406df0
push 0x3023
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0x3c]
call fcn.00407300
push 0
lea ecx, [ebp - 0x3c]
call fcn.00402fa0
push 0
lea ecx, [ebp - 0x14]
call fcn.004018e0
push eax
lea ecx, [ebp - 0xc]
call fcn.00402380
push 1
push 0xf060
lea ecx, [ebp - 0xc]
call fcn.004023d0
lea ecx, [ebp - 0xc]
call fcn.00414f10
push 2
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 8]
call fcn.00407300
push 0
lea ecx, [ebp - 8]
call fcn.00406c60
push 0
push 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 4]
push ecx
push 0x405210
push 0
push 0
call fcn.004226ed
add esp, 0x18
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x74], eax
lea ecx, [ebp - 4]
call fcn.00401bf0
push 0x110
lea ecx, [ebp - 4]
call fcn.00401d90
push 0x43e210
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00406ce0
mov ecx, 0x43e210
call fcn.00411410
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x64
call fcn.004018c0
lea ecx, [ebp - 0x28]
call fcn.00411410
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x5c
call fcn.00407370
push 1
mov ecx, dword [ebp - 0x50]
add ecx, 0x60
call fcn.004073e0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x28]
call fcn.00401860
lea ecx, [ebp - 4]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.004023a0
mov eax, dword [ebp - 0x4c]
mov esp, ebp
pop ebp
ret
Function at 0x406650
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00401310
push 0x5c
push 0x2f
lea ecx, [ebp - 4]
call fcn.00407020
push 0x5c
lea ecx, [ebp - 4]
call fcn.004070b0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x406894
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 4]
call fcn.00406fb0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
call fcn.00401c30
push 0x4340c4
lea ecx, [ebp - 0x10]
call fcn.00403220
test eax, eax
jne 0x406705
lea edx, [ebp - 0x14]
push edx
push 0x43e210
lea eax, [ebp - 0x434]
push eax
call fcn.00406ce0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406e50
lea ecx, [ebp - 0x434]
call fcn.00401860
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
jmp 0x406884
push str.AppData
lea ecx, [ebp - 0x10]
call fcn.00403220
test eax, eax
jne 0x40679d
lea ecx, [ebp - 0x18]
call fcn.00401bf0
mov ecx, 0x43e210
call fcn.00411410
push eax
lea edx, [ebp - 0x450]
push edx
call fcn.0041e860
add esp, 8
mov ecx, eax
call fcn.004074a0
push eax
lea ecx, [ebp - 0x18]
call fcn.00401360
lea ecx, [ebp - 0x450]
call fcn.00407480
lea ecx, [ebp - 0x18]
call fcn.00411410
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x454]
push edx
call fcn.00406ce0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406e50
lea ecx, [ebp - 0x454]
call fcn.00401860
lea ecx, [ebp - 0x18]
call fcn.00401860
jmp 0x406884
push 0x4340ec
lea ecx, [ebp - 0x10]
call fcn.00403220
test eax, eax
jne 0x406806
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0x4340f8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402fc0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x458]
push ecx
call fcn.00406ce0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406e50
lea ecx, [ebp - 0x458]
call fcn.00401860
lea ecx, [ebp - 0x1c]
call fcn.00401860
jmp 0x406884
push 0x434104
lea ecx, [ebp - 0x10]
call fcn.00403220
test eax, eax
jne 0x406884
xor edx, edx
mov word [ebp - 0x430], dx
push 0x206
push 0
lea eax, [ebp - 0x42e]
push eax
call fcn.004227a0
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x430]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401360
push str.duowanyyyypip
mov ecx, dword [ebp + 0xc]
call fcn.00403060
mov ecx, dword [ebp + 0xc]
call fcn.00411410
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406bd0
lea ecx, [ebp - 0x14]
call fcn.00401860
lea ecx, [ebp - 0x10]
call fcn.00401860
lea ecx, [ebp - 4]
call fcn.00401860
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret
Function at 0x4068b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
push str.yywizard.exe
push 0x43414c
push 0x43e210
lea eax, [ebp - 0x64]
push eax
call fcn.00406c00
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00406c00
lea ecx, [ebp - 0x64]
call fcn.00401860
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.004227a0
add esp, 0xc
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], 0x44
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x406961
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401860
mov esp, ebp
pop ebp
ret
Function at 0x40a010
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x40a02a
mov eax, dword [ebp - 0x40]
sub eax, 0x50
mov dword [ebp - 0x44], eax
jmp 0x40a031
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x40a0bd
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040a190
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40a0ac
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00401f30
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x40a0bb
mov dword [ebp - 4], 0
jmp 0x40a0d8
mov ecx, dword [ebp + 0xc]
call fcn.00411410
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040a160
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a0f3
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040bde0
jmp 0x40a156
cmp dword [ebp + 0x14], 0
je 0x40a156
cmp dword [ebp + 0x18], 0
je 0x40a156
mov ecx, dword [ebp + 0xc]
call fcn.00401c10
cmp eax, dword [ebp + 0x1c]
jle 0x40a156
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00401c10
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040be40
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40aa30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x3c], ecx
push 0xffffffffffffffff
push 1
mov ecx, dword [ebp - 0x3c]
call fcn.0040b7f0
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0x50], 1
lea ecx, [ebp - 0xc]
call fcn.00401bf0
push 0x427
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407300
push 3
lea edx, [ebp - 4]
push edx
mov ecx, 0x43e210
call fcn.00406fb0
fldz
fstp qword [ebp - 0x18]
push 8
call fcn.0042317e
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40ab8a
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
and dword [ebp - 0x40], 0x7fffffff
fild qword [ebp - 0x44]
and dword [ebp - 0x48], 0x80000000
mov dword [ebp - 0x4c], 0
fild qword [ebp - 0x4c]
fchs
faddp st(1)
fdiv qword [0x4348e8]
fstp qword [ebp - 0x18]
sub esp, 8
fld qword [ebp - 0x18]
fstp qword [esp]
push 0x434898
lea eax, [ebp - 0xc]
push eax
call fcn.00408680
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.00411410
push eax
lea ecx, [ebp - 0x1c]
call fcn.004018c0
push 5
lea ecx, [ebp - 0x1c]
call fcn.00402fa0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
and dword [ebp - 0x50], 0x7fffffff
fild qword [ebp - 0x54]
and dword [ebp - 0x58], 0x80000000
mov dword [ebp - 0x5c], 0
fild qword [ebp - 0x5c]
fchs
faddp st(1)
fdiv qword [0x4348e0]
fstp qword [ebp - 0x28]
fld qword [0x434880]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 0x41
jne 0x40ab88
mov edx, dword [ebp - 0x3c]
mov byte [edx + 0x50], 0
jmp 0x40ab94
push 0
lea ecx, [ebp - 0x1c]
call fcn.00402fa0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00422174
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 4]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401860
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d2e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x74], 0
jle 0x40d320
push 0x41a
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0x10]
call fcn.00407300
push 5
lea ecx, [ebp - 0x10]
call fcn.00402fa0
push 0x3fe
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0xc]
call fcn.00407300
push 0
lea ecx, [ebp - 0xc]
call fcn.00402fa0
push 0x384
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
call fcn.004073e0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
call fcn.00402fa0
push 5
mov ecx, dword [ebp - 0x24]
add ecx, 0x60
call fcn.00402fa0
push 0x40b
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 8]
call fcn.00407300
push 5
lea ecx, [ebp - 8]
call fcn.00402fa0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x74], 0
jne 0x40d3e0
lea ecx, [ebp - 0x14]
call fcn.00401bf0
push 0xf7
lea ecx, [ebp - 0x14]
call fcn.00401d90
lea ecx, [ebp - 0x14]
call fcn.00411410
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x64
call fcn.004018c0
lea ecx, [ebp - 0x14]
call fcn.00401860
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x58], 1
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x40d5e0
push 0
push 0
call fcn.004226ed
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x84], eax
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00406c80
push 1
lea ecx, [ebp - 4]
call fcn.0040dcd0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d890
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x2c], 0x103
jne 0x40d8c6
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x40d8f3
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x28]
call fcn.0040bf00
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403480
cmp eax, 1
jne 0x40d927
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x28]
call fcn.0040bf20
mov eax, dword [ebp - 0x30]
jmp 0x40d975
cmp dword [ebp - 0x2c], 0x103
jne 0x40d940
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 4], 0x103
jne 0x40d959
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x28]
call fcn.0040bf20
mov eax, dword [ebp - 0x34]
jmp 0x40d975
mov esp, ebp
pop ebp
ret

Function at 0x410010
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, 0x43e210
call fcn.00410600
test eax, eax
jne 0x410036
jmp 0x4100df
lea eax, [ebp - 8]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410084
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x410082
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x43e210
call fcn.00401360
push str.duowanyy
mov ecx, 0x43e210
call fcn.00403060
jmp 0x410093
push str.C:Program_Filesduowanyy
mov ecx, 0x43e210
call fcn.00401360
push 0x435714
lea ecx, [ebp - 0xc]
call fcn.00402fc0
lea ecx, [ebp - 0xc]
call fcn.00410600
test eax, eax
jne 0x4100d7
lea ecx, [ebp - 0xc]
push ecx
push 0x435718
lea edx, [ebp - 0x21c]
push edx
call fcn.00410620
push eax
mov ecx, 0x43e210
call fcn.00406bd0
lea ecx, [ebp - 0x21c]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401860
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret
Function at 0x410240
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x330]
push eax
call fcn.004227a0
add esp, 0xc
mov dword [ebp - 0x330], 0x114
lea ecx, [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x32c], 4
jbe 0x41029b
cmp dword [ebp - 0x32c], 5
jne 0x41029f
cmp dword [ebp - 0x328], 0
jne 0x41029f
mov al, 1
jmp 0x4102d9
push 0x104
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410120
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4102d7
xor al, al
jmp 0x4102d9
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret