joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44309f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5bec29
call fcn.0058f985
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], ebx
push dword [edi + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call esi
cmp eax, ebx
je 0x44312b
cmp eax, 2
jne 0x44311b
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str.Key_doesnt_have_value__s
push eax
mov dword [ebp - 4], 1
call fcn.00401518
add esp, 0xc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004428b2
push 0x64056c
lea eax, [ebp - 0x34]
push eax
call fcn.005902bc
push eax
lea ecx, [ebp - 0x34]
call fcn.0043a39a
push 0x639fc4
jmp 0x443112
cmp dword [ebp - 0x18], 1
je 0x44316c
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str.Key_value__s_is_not_of_type_SZ.
push eax
mov dword [ebp - 4], 2
call fcn.00401518
add esp, 0xc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004428e6
push 0x64055c
jmp 0x443112
lea ecx, [ebp - 0x28]
call fcn.00436875
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.004368ac
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.00436911
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call esi
cmp eax, ebx
jne 0x44311b
mov ecx, dword [ebp + 8]
call fcn.0040144d
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], 1
call fcn.00436911
mov ecx, dword [ebp + 8]
push eax
call fcn.00401287
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004368a1
mov eax, dword [ebp + 8]
call fcn.0058fa5d
ret 8

Function at 0x44346a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x667508], 0
push esi
mov esi, dword [ebp + 8]
jne 0x4434df
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x659924]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edi, edi
inc edi
test eax, eax
je 0x4434d8
push 3
lea eax, [ebp - 0x20c]
push 0x5ec40c
push eax
call fcn.00595426
add esp, 0xc
test eax, eax
je 0x4434d2
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401287
mov dword [0x667504], edi
mov dword [0x667508], edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [0x667504]
xor ecx, ebp
pop esi
call fcn.0058f976
leave
ret
Function at 0x4434f1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, dword [ebp + 8]
mov esi, 0x667518
test byte [0x667514], bl
jne 0x443538
or dword [0x667514], ebx
call fcn.00496dcd
push eax
mov ecx, esi
call fcn.0040141e
push 0x5d2200
call fcn.00592134
pop ecx
cmp dword [0x667510], 0
jne 0x443591
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x659924]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x44358b
push 3
lea eax, [ebp - 0x20c]
push 0x5ec40c
push eax
call fcn.00595426
add esp, 0xc
test eax, eax
je 0x443585
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401287
mov dword [0x66750c], ebx
mov dword [0x667510], ebx
push esi
mov ecx, edi
call fcn.0040227d
mov ecx, dword [ebp - 4]
mov eax, dword [0x66750c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f976
leave
ret
Function at 0x4437b6
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x5bed4c
call fcn.0058f985
xor ebx, ebx
inc ebx
mov esi, 0x667530
test byte [0x66752c], bl
jne 0x4437f0
or dword [0x66752c], ebx
call fcn.00496dcd
push eax
mov ecx, esi
call fcn.0040141e
push 0x5d221c
call fcn.00592134
pop ecx
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4439e6
push esi
call fcn.0044346a
pop ecx
test eax, eax
je 0x4439e6
lea eax, [ebp - 0x28]
push eax
call fcn.00407304
push str._m__d__y__H:_M:_S
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.00443773
mov dword [ebp - 4], edi
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040141e
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004014a9
cmp dword [0x667528], edi
jne 0x44391c
mov eax, dword [0x667530]
cmp dword [eax - 0xc], edi
je 0x44391c
push dword [0x659928]
lea ecx, [ebp - 0x14]
call fcn.004039d7
mov byte [ebp - 4], 2
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00403913
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402192
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0040227d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401019
push 0x5c
mov ecx, esi
call fcn.00403913
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.00401f0b
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0040227d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401019
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
push edi
push 0x5ec41c
push esi
call fcn.00401518
add esp, 0x10
lea ecx, [edi - 0x10]
mov dword [0x667528], ebx
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401019
xor edi, edi
push 0x5ec418
lea ecx, [ebp - 0x10]
call fcn.00443427
mov esi, dword [ebp - 0x18]
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.0040202a
push 0x5ec414
lea ecx, [ebp - 0x10]
call fcn.00443427
mov eax, dword [0x667530]
cmp dword [eax - 0xc], edi
jne 0x443954
mov eax, dword [str.C:ROXIO_SETUP.LOG]
push edi
push 0x80
push 4
push edi
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x4439d3
push 2
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax - 0xc]
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004959d1
pop ecx
push dword [ebp - 0x10]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp ebx, edi
je 0x4439c7
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + esi - 2]
push eax
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.004959c6
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
lea ecx, [esi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x443de8
Capabilities:
Accept command line arguments

Disassembly:
push 0x10
mov eax, 0x5bee4b
call fcn.0058f985
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 2
cmp word [ebp + 8], si
jne 0x443e67
cmp edi, esi
jne 0x443e67
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov dword [0x667534], eax
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x10]
call fcn.004039d7
push esi
push 0x5ec528
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push 0x5ec520
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push 0x5ec518
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push 0x5ec510
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._qb_
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._Qb_
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._QB_
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._qB_
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._Silent
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push esi
push str._NoPrompt
lea ecx, [ebp - 0x10]
call fcn.00401d2f
test eax, eax
jge 0x443fc0
push 0xde
lea ecx, [ebp - 0x18]
call fcn.004014f8
push 0xdf
lea ecx, [ebp - 0x1c]
call fcn.004014f8
movzx eax, word [ebp + 8]
push edi
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.00401518
push 0x5ec49c
call fcn.004437b6
push dword [ebp - 0x14]
call fcn.004437b6
add esp, 0x18
cmp dword [0x667500], esi
jne 0x443fa9
push dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00443378
add esp, 4
push 0x10010
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [0x667534]
call dword [0x667500]
push 0x638a60
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], edi
call fcn.005902bc
int3
Function at 0x444375
Capabilities:
Set environment variable

Disassembly:
push 0xc
mov eax, 0x5bef13
call fcn.0058f985
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004439ec
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401019
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], edi
jne 0x444449
lea eax, [ebp - 0x18]
push eax
call fcn.00443b72
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401019
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], edi
jne 0x444449
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.0044369f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401019
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], edi
jne 0x444449
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
lea ecx, [esi - 0x10]
jmp 0x4444f5
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00401db5
lea eax, [ebp - 0x18]
push eax
call fcn.00443fd5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401019
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
push dword [0x659924]
call esi
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00401db5
call fcn.00443382
mov edi, eax
pop ecx
test edi, edi
je 0x4444ce
push 0x5ec40c
push dword [0x659924]
call esi
push edi
push ebx
lea eax, [ebp - 0x14]
push str.Could_not_create_folder_for_log_files:__s__Error:__d
push eax
call fcn.00401518
add esp, 0x10
jmp 0x4444e0
push ebx
lea eax, [ebp - 0x14]
push str.Created_folder_for_log_files:__s
push eax
call fcn.00401518
add esp, 0xc
mov esi, dword [ebp - 0x14]
push esi
call fcn.004437b6
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401019
lea ecx, [ebx - 0x10]
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x444e10
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 8
mov eax, 0x5bf370
call fcn.0058f985
lea eax, [ebp - 0x10]
push eax
push 0x626800
push 1
xor edi, edi
push edi
push 0x626830
mov dword [ebp - 4], 5
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x444ed6
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], edi
je 0x444e64
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx - 0xc], edi
je 0x444e76
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x1c]
cmp dword [ecx - 0xc], edi
je 0x444e8b
push dword [ebp + 0x20]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x44]
mov ecx, dword [ebp + 0x18]
cmp dword [ecx - 0xc], edi
je 0x444e9d
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x626890
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x444ecd
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push 1
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp + 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov eax, esi
call fcn.0058fa5d
ret

Function at 0x44555c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov esi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x44557c
xor al, al
jmp 0x445590
push ebx
push edi
call fcn.0059495a
mov ebx, eax
pop ecx
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x445596
xor al, al
pop ebx
pop edi
pop esi
leave
ret 4
push ebx
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4455b6
xor bl, bl
push dword [ebp - 8]
call fcn.005911fe
pop ecx
mov al, bl
jmp 0x44558f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5d4dc0
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4455a7
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [esi + 4], cx
mov cx, word [eax + 8]
mov word [esi + 6], cx
mov cx, word [eax + 0xe]
mov word [esi + 8], cx
mov ax, word [eax + 0xc]
mov word [esi + 0xa], ax
mov dword [esi + 0xc], 3
mov bl, 1
jmp 0x4455a9
Function at 0x446217
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x446263
push esi
call fcn.0058f15d
pop ecx
test eax, eax
je 0x446263
cmp dword [esp + 0xc], 0
je 0x446263
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x446263
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446263
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x446263
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x44638a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1004
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4463f1
xor eax, eax
xor edx, edx
cmp word [ebp - 0x20c], 0x30
jb 0x4463f1
movzx ecx, word [ebp - 0x20c]
cmp cx, 0x39
ja 0x4463f1
imul eax, eax, 0xa
movzx ecx, cx
inc edx
lea eax, [eax + ecx - 0x30]
movzx ecx, word [ebp + edx*2 - 0x20c]
cmp cx, 0x30
jae 0x4463d2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f976
leave
ret

Function at 0x4463fd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xb
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x446461
xor eax, eax
xor edx, edx
cmp word [ebp - 0x20c], 0x30
jb 0x446461
movzx ecx, word [ebp - 0x20c]
cmp cx, 0x39
ja 0x446461
imul eax, eax, 0xa
movzx ecx, cx
inc edx
lea eax, [eax + ecx - 0x30]
movzx ecx, word [ebp + edx*2 - 0x20c]
cmp cx, 0x30
jae 0x446442
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f976
leave
ret
Function at 0x448661
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x5bf8f9
call fcn.0058f9b8
mov esi, ecx
mov dword [ebp - 0x1c], esi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0049ce17
mov ebx, eax
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
and dword [ebp - 4], 0
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040141e
lea edi, [esi + 0x140]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040116b
mov eax, dword [ebp + 8]
push dword [eax + 8]
lea eax, [ebp - 0x14]
push str.SetupDir_sProductInformationProductInformationSETUPLANG.xml
push eax
call fcn.00401518
add esp, 0xc
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00447ce1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040227d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401019
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x448787
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00446c0c
push edi
push str.__CustomizeDlg_ItemDescription
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00446c7b
push eax
call fcn.0040ba2c
pop ecx
push dword [edi]
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00447ce1
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0040227d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00401019
push 0x5dd3ac
mov ecx, edi
call fcn.004022ca
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00446861
mov dword [ebp - 4], 1
jmp 0x448787
xor eax, eax
cmp dword [ebp + 0xc], eax
lea ecx, [ebp - 0x18]
setne al
lea eax, [eax + eax + 0x26]
push eax
call fcn.004014f8
mov edi, dword [ebp - 0x18]
push dword [edi - 0xc]
lea ecx, [esi + 0x140]
push edi
call fcn.0040202a
lea ecx, [edi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret 8
Function at 0x44f52b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44f5bf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
test edi, edi
je 0x44f585
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x44f589
xor eax, eax
jmp 0x44f59f
lea esi, [eax + eax]
mov eax, esi
call fcn.00590290
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00403d96
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401019
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f976
leave
ret 4

Function at 0x44f667
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44f69e
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 8]
push eax
call fcn.00414a9e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret 4
Function at 0x45174a
Capabilities:
Get disk size

Disassembly:
push 0x28
mov eax, 0x5c054f
call fcn.0058f985
mov ebx, ecx
mov eax, dword [ebx + 0x1568]
add eax, 0xc0
push eax
lea ecx, [ebp - 0x10]
call fcn.00401db5
and dword [ebp - 4], 0
push 0
mov esi, 0x5d4dc0
push esi
lea ecx, [ebp - 0x10]
call fcn.00401d2f
mov dword [ebp - 0x18], eax
inc eax
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f0b
lea edi, [ebx + 0x15a8]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040227d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401019
push esi
mov ecx, edi
call fcn.00401ba2
test eax, eax
jne 0x451807
push esi
lea ecx, [ebp - 0x10]
call fcn.004022ca
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00401d2f
inc eax
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00401d2f
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f0b
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov edi, dword [edi]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x45183c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
fild qword [ebp - 0x1c]
fstp qword [ebx + 0x15a0]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
call fcn.0058fa5d
ret
Function at 0x45184d
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x5c058a
call fcn.0058f985
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x15f4], bl
je 0x4519cc
mov eax, dword [esi + 0x15ec]
push 0x60
pop edi
lea ecx, [edi + 0x30]
cmp eax, ecx
jle 0x451896
add edi, 0x60
jmp 0x4518a6
cmp eax, 0x78
jle 0x45189f
mov edi, ecx
jmp 0x4518a6
cmp eax, edi
jle 0x4518a6
push 0x78
pop edi
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0058fa90
add esp, 0xc
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
mov dword [ebp - 4], ebx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
push 0x104
lea eax, [ebp]
push eax
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401287
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.00403913
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f0b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040227d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401019
push str._bin_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.header_96.png
lea ecx, [ebp - 0x14]
call fcn.00401287
mov eax, edi
sub eax, 0x78
je 0x45197b
sub eax, 0x18
je 0x451974
sub eax, 0x30
jne 0x451988
push str.header_192.png
jmp 0x451980
push str.header_144.png
jmp 0x451980
push 0x5f12c0
lea ecx, [ebp - 0x14]
call fcn.00401287
mov edi, dword [ebp - 0x14]
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
push edi
call fcn.0040202a
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4519b1
push ebx
lea ecx, [esi + 0x15b0]
call fcn.00450ec0
lea ecx, [edi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
lea ecx, [ebx - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret