joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c12f
Capabilities:
Check for software breakpoints

Disassembly:
stosb byte es:[edi], al
invalid
salc
push esi
sbb dword [ebp + 0x1a], 0x7d85847b
add ebp, dword [esi]
sal byte [ecx], 1
jb 0x46c0df
jb 0x46c170
sal byte [ecx - 0x76], cl
jmp 0xa4578dd
jb 0x46c1f1
mov edi, 0xaeb94ff6
push ebx
adc al, byte [eax - 0x2dd9e407]
cmp al, 2
dec eax
dec ecx
div dword [esi]
jmp 0x46c1af
movsb byte es:[edi], byte [esi]
sbb dh, dh
sub eax, dword [ebx]
fcmovbe st(0), st(0)
xlatb
je 0x46c212
bound edx, qword [edx]
mov edx, 0xd22d275f
adc bh, byte [edx - 0x2dd2d8a1]
test eax, 0xd0eaf0a3
dec eax
jns 0x46c1c4
sub al, 0x98
xchg ebx, eax
or esp, ecx
or ch, byte [esi]
jnp 0x46c235
jnp 0x46c235
aam 0x50
wait
xor dword [ebx - 0x49b3bf74], 0x77
push 0x3a
sub eax, 0xc166a689
jecxz 0x46c1a5
push ds
cmp al, 0xcc
retf 0xe66e
mov bl, 0xd4
hlt
jb 0x46c22a
or dl, byte [ebx]
pop ecx
mov bl, 0x7f
jae 0x46c1e4
push edx
bound edx, qword [eax - 0x1367be9f]
in al, 0xa0
popfd
cld
sub dword [eax + 0x3f248b39], esp
xchg ecx, eax
pop ds
push esi
wait
xchg esi, eax
out dx, al
lea ebp, [ebx]
mov ebx, 0xd1256568
loope 0x46c1a6
and eax, 0xdb90e1d1
stosd dword es:[edi], eax
adc bh, byte [edi]
sbb byte [edi], ah
fld xword [ebx + 0x27183f12]
insd dword es:[edi], dx
daa
loopne 0x46c296
jp 0x46c239
aas
push cs
int1
mov dword [0x5c180246], eax
jl 0x46c254
shl byte [ebx], cl
aad 0x96
ja 0x46c276
enter 0x338c, 0x31
loop 0x46c1ed
xor edx, esp
mov ch, 0x91
xchg ecx, eax
xchg dword [ebx], eax
lodsd eax, dword [esi]
sbb edx, dword [esi - 0x251f0702]
packuswb mm4, qword [eax + 0x17cba0ee]
sub dword [ecx + 0x47], ebp
sahf
imul bl
cmpsb byte [esi], byte es:[edi]
fisub dword [ebp + 0x46]
test dword [ebx - 9], 0xe07083b3
pop es
dec ebx
div dword [ebx + 0x7e07083]
mov esi, 0x95ebb446
idiv edi
cmp byte [esi - 0x32], dh
inc esp
shr dword [ebp + 0x2d], 0xb8
xchg ebp, eax
test dword [ecx + 0x2bdadb26], esi
invalid
mov cl, 0x26
fcmovnu st(0), st(2)
sub ecx, dword [edi]
or eax, 0xbbb30b33
mov bl, 0xbb
push cs
jle 0x46c279
mov ebx, 0xa23db661
into
stc
xchg edi, eax
out 0x25, eax
jl 0x46c26d
clc
cwde
mov ebp, 0xf53a3687
in al, 0xed
jge 0x46c2d9
push esp
int 0x23
push esi
arpl word [esi], bx
ret
inc ebx
ret 0xa222
push ebp
jb 0x46c2f3
je 0x46c2a1
scasb al, byte es:[edi]
xchg byte [ebp + 0x57], cl
inc edi
sub byte [ebx - 0x7b531a9a], ah
push es
pop es
mov ebx, 0x63aefda2
add bl, byte [esi + 0x6ef66758]
insd dword es:[edi], dx
imul byte [bp + 0x6d]
mov bh, 0xd4
cmc
add bl, byte [ecx]
cmp ebx, dword [esi]
sbb al, 0x17
fucompi st(6)
wait
not dl
xchg esi, eax
xchg dword [ebp + 0x784d4cc4], eax
mov dword fs:[0x42364896], eax
inc edx
mov ah, byte [edi + 0x6b]
pop ss
mov ecx, 0x37b41732
invalid
Function at 0x4981ff
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x49824b
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x498230
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x498240
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x49825b
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x49829a
test ebx, ebx
je 0x49826f
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x498264
cmp ecx, 0xfff1
jb 0x49827d
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x498385
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4982bf
sub ebx, 0x15b0
mov eax, 0x15b
jmp 0x4982cf
movzx edx, byte [esi]
add ecx, edx
movzx edx, byte [esi + 1]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 2]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 3]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 4]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 5]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 6]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 7]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 8]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 9]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xa]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xb]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xc]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xd]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xe]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xf]
add edi, ecx
add ecx, edx
add edi, ecx
add esi, 0x10
dec eax
jne 0x4982cf
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
dec dword [ebp + 8]
jne 0x4982bf
test ebx, ebx
je 0x49845e
cmp ebx, 0x10
jb 0x49842b
mov eax, ebx
shr eax, 4
lea esp, [esp]
Function at 0x59722f
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [esi - 0xdd24540]
clc
jb 0x5971b4
jg 0x597140
adc dword [eax - 0x19], esp
cmp al, 0xb1
cmp byte [ebx], ah
or dh, dh
mov cl, 0x78
sub edx, edi
jmp 0x2fa17bf4
or cl, byte [eax + 0x2f]
sbb ah, byte [ecx + 0x50]
popfd
vunpckhps xmm4, xmm2, xmmword [ebx]
push esi
js 0x597190
and edx, dword [esi + 0x78]
fmul dword [eax + 0x3e]
xor edi, eax
dec eax
xor edi, eax
stc
sbb al, 0x9f
xor eax, esp
inc edi
cli
stc
pop eax
test dword [ebp + 0x77], esp
lea edx, [esi + 0x46e145d8]
loope 0x597214
mov fs, word [ebx]
in eax, 0x80
dec ebp
xlatb
jl 0x5971d8
fadd dword [edi + 0x25]
or byte ds:[esi + ebx*4 + 0x5ca269e1], dl
sal ebp, 1
push ss
and eax, 0x9e94083e
loope 0x597248
mov byte [0x16f5d15c], al
lds esp, [ecx - 0x50]
daa
enter 0x23f4, 0xffffffffffffffa9
mov byte [edi - 0x269a3b77], dl
popal
pop edx
lahf
and ebp, ebp
xchg ecx, eax
mov bl, 0xbc
cmp ecx, edx
js 0x5971aa
outsb dx, byte [esi]
jp 0x597242
dec ebp
mov ch, 0x6f
scasb al, byte es:[edi]
mov bh, 0xa8
loop 0x5971f3
cdq
xchg dword [ebp + 0x44], esp
inc ebx
retf
mov cl, 0xfe
sub esi, ebp
jno 0x597299
test al, 0x80
cmp ah, dh
adc eax, dword [esi - 0x7ad4dd8c]
and ch, byte [ebx]
test dword [ecx], ecx
jne 0x5971f8
or dword [ebp - 0x2f], esi
or esp, 0xf20e9b13
jae 0x5971cc
and eax, dword [edi + 0x6ed7b9d7]
mov dl, 0xaa
fist word [esi + 0x59d01ded]
mov byte [0x2778b572], al
sub eax, 0x1261fb5
pop ss
fisub word [ebp + 0x2d981d16]
xor al, 0x36
jp 0x597224
dec edi
add byte [ebp - 0x591d2f09], ch
wait
push ecx
dec dword [eax + 0x748776ad]
ror dword [esi + 0x1f72da86], cl
jge 0x59727e
inc esp
sub ch, byte [edi]
push edx
inc edx
dec esi
insb byte es:[edi], dx
insd dword es:[edi], dx
mov ecx, 0x4920480f
dec esp
xchg ebp, eax
cdq
dec eax
jp 0x597221
mov byte [0xc14d9fa6], al
movsd dword es:[edi], dword [esi]
adc dl, byte [eax - 0x38722e1c]
adc al, 0x22
push ebp
mov bl, 0x3e
dec edx
cmp bl, ch
cmp byte [eax + 0x29], bh
stosb byte es:[edi], al
sbb dword [edi + 9], esi
cmpsb byte [esi], byte es:[edi]
lahf
dec ebp
shl dword [ebp - 0x2e1b6fee], 0x8d
invalid
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x623eff
Capabilities:
Encode data using xor

Disassembly:
mov dl, dl
mov edi, 0x63df0d10
das
movsb byte es:[edi], byte [esi]
mov dh, 0xbf
scasd eax, dword es:[edi]
inc esp
fiadd word [ecx + ebp*4 + 0x44]
push ecx
xchg edi, eax
pop ebx
mov ebx, dword [edi - 0x79]
push ecx
mov eax, dword [0xf0a88572]
invalid
Function at 0x4016f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x44c], ax
push 0x206
push 0
lea ecx, [ebp - 0x44a]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x210], 0
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x439020
push 0x208
lea edx, [ebp - 0x20c]
push edx
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x214], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x220], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x220], 0
jne 0x4017db
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x230]
sar eax, 1
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
add ecx, 1
push ecx
push 0x439028
push 1
push 0x43902c
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.::Asso__UnRegisterElexViewer_HKEY_CLASSES_ROOT__s__d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x43909c
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.00401000
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x21c], 0x4390c8
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x21c]
mov dx, word [ecx]
mov word [ebp - 0x21e], dx
add dword [ebp - 0x21c], 2
cmp word [ebp - 0x21e], 0
jne 0x4018aa
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x224]
sar eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
add ecx, 1
push ecx
push 0x4390cc
push 1
push 0x4390d0
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str._UnRegisterElexViewer___s____d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x402be0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jb 0x402c4a
movzx edx, byte [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004027b0
add esp, 0xc
jmp 0x402c5f
movzx edx, byte [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004023e0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x402c70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str.SOFTWAREClasses_s
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.00401000
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp - 0x21c]
mov ax, word [edx]
mov word [ebp - 0x224], ax
add dword [ebp - 0x21c], 2
cmp word [ebp - 0x224], 0
jne 0x402d04
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp - 0x22c]
sar ecx, 1
mov dword [ebp - 0x240], ecx
mov edx, dword [ebp - 0x240]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x43994c
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
add ecx, 2
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x220]
mov ax, word [edx]
mov word [ebp - 0x222], ax
add dword [ebp - 0x220], 2
cmp word [ebp - 0x222], 0
jne 0x402d74
mov ecx, dword [ebp - 0x220]
sub ecx, dword [ebp - 0x234]
sar ecx, 1
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x23c]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0x439950
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea eax, [ebp - 0x214]
push eax
push str.OpenWithProgids
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x226], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x226], 0
jne 0x402dfd
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x230]
sar eax, 1
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x439974
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402be0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x402e90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push str.SOFTWAREClasses
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402ee0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402be0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x4084a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0
push 0x38
push 0
lea eax, [ebp - 0x3c]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x439fec
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
call fcn.004059f0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x14], 0
je 0x40852b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x4097a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433be8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp + 8]
push eax
push 0x43a3bc
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040c860
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.iImportLib.dll_bool___cdecl_elex::os::IsX64System_void_]
movzx edx, al
test edx, edx
je 0x409836
mov eax, dword [ebp + 8]
push eax
push 0x43a3d0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040c860
add esp, 0xc
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x28]
call fcn.004032c0
lea ecx, [ebp - 0x4c]
call fcn.00405b70
mov eax, dword [ebp - 0x30]
or eax, 0x200
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
or edx, 0xf003f
push edx
push 0
lea ecx, [ebp - 0x28]
call fcn.004059f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409880
lea ecx, [ebp - 0x28]
call fcn.004059f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.::helper_delete_ptidinfo_succeed
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 4
xor eax, eax
jne 0x409836
cmp dword [ebp - 0x2c], 0
je 0x409894
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x40a960
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433788
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004065b0
mov dword [ebp - 4], 0
push 0
push 0x43ab4c
lea ecx, [ebp - 0x28]
call fcn.0040b9d0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x28]
call fcn.004033f0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.004032c0
lea ecx, [ebp - 0x50]
call fcn.00405b70
lea ecx, [ebp - 0x28]
call fcn.004059f0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jne 0x40aa06
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405b70
mov al, byte [ebp - 0x2a]
jmp 0x40aa1c
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405b70
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x40aa40
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43369c
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0
call fcn.00409af0
add esp, 4
mov byte [ebp - 0x2f1], al
movzx edx, byte [ebp - 0x2f1]
test edx, edx
je 0x40ab88
push str.CUninstMainDlg::helper_GetInstallPath_::_bInstalled__true
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 4
lea ecx, [ebp - 0x2f0]
call fcn.00407760
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2f0]
push eax
push 0x43ac30
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040c860
add esp, 0xc
mov byte [ebp - 4], 1
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x43ac9c
lea ecx, [ebp - 0x230]
call fcn.004059f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bd40
mov ecx, eax
call fcn.00424b50
mov byte [ebp - 0x2f2], al
movzx eax, byte [ebp - 0x2f2]
test eax, eax
je 0x40ab62
lea ecx, [ebp - 0x218]
push ecx
push 0x208
mov edx, dword [ebp + 8]
push edx
call fcn.004078a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00405b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f0]
call fcn.004094d0
jmp 0x40ac6d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00405b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f0]
call fcn.004094d0
jmp 0x40ac6d
push str.CUninstMainDlg::helper_GetInstallPath_::_bInstalled__false
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 4
push 0
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x314]
call fcn.004065b0
mov dword [ebp - 4], 2
push 0x43acbc
lea edx, [ebp - 0x314]
push edx
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.iImportLib.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_elex::filepath::pathcombine_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
mov dword [ebp - 0x2f8], eax
mov ecx, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2fc]
push edx
call fcn.0040eeb0
add eax, 0x78
mov ecx, eax
call fcn.004032c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x32c]
call fcn.00405b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x314]
call fcn.00405b70
call fcn.0040eeb0
movzx eax, byte [eax + 0xb3]
test eax, eax
je 0x40ac6d
call fcn.0040eeb0
add eax, 0x90
mov ecx, eax
call fcn.00406660
movzx ecx, al
test ecx, ecx
jne 0x40ac6d
call fcn.0040eeb0
add eax, 0x90
push eax
call fcn.0040eeb0
add eax, 0x78
mov ecx, eax
call fcn.00405ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x40ac90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [ebp - 0x414]
push edx
call fcn.0040ba00
mov ecx, eax
call fcn.00424ca0
mov byte [ebp - 0x415], al
movzx eax, byte [ebp - 0x415]
test eax, eax
je 0x40ad9e
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
add edx, 2
mov dword [ebp - 0x424], edx
mov eax, dword [ebp - 0x41c]
mov cx, word [eax]
mov word [ebp - 0x41e], cx
add dword [ebp - 0x41c], 2
cmp word [ebp - 0x41e], 0
jne 0x40ad0e
mov edx, dword [ebp - 0x41c]
sub edx, dword [ebp - 0x424]
sar edx, 1
mov dword [ebp - 0x428], edx
je 0x40ad9e
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0x43ad40
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ad9e
call fcn.0040ba00
lea ecx, [ebp - 0x20c]
call fcn.00424d60
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret