joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ee0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x430], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004ac380
add esp, 0xc
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x44c], 1
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push 0
push 0x5f5c94
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x402fc5
xor eax, eax
jmp 0x40312b
lea edx, [ebp - 0x424]
push edx
push 0x20019
push 0
push 0x5f5ca0
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x402ffb
xor eax, eax
jmp 0x40312b
lea ecx, [ebp - 0x428]
push ecx
push 0x20019
push 0
push 0x5f5cac
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x403031
xor eax, eax
jmp 0x40312b
mov dword [ebp - 0x430], 0x104
mov dword [ebp - 0x434], 1
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0
push 0x5f5cc8
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0326
add esp, 4
mov dword [ebp - 0x420], eax
push 0x5f5ccc
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.00408070
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x4030c4
xor eax, eax
jmp 0x40312b
mov edx, dword [ebp - 0x41c]
add edx, 2
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x438], eax
push 0x5f5cd0
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.00408070
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x403106
xor eax, eax
jmp 0x40312b
xor edx, edx
mov eax, dword [ebp - 0x41c]
mov word [eax], dx
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403126
xor eax, eax
jmp 0x40312b
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
Function at 0x403ac0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x403b17
xor eax, eax
jmp 0x403c2f
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.004ac380
add esp, 0xc
mov dword [ebp - 0x420], 0x104
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x424]
push edx
push 0
push 0x5f5d14
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403c0a
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x20c]
push eax
call fcn.004afd5e
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403bf0
xor eax, eax
jmp 0x403c2f
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004afd8f
add esp, 8
mov eax, 1
jmp 0x403c2f
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004afd8f
add esp, 8
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 4
Function at 0x403c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00406b50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403cc3
mov eax, dword [ebp - 4]
add eax, 4
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xac
call fcn.00404e90
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00406b50
push eax
mov ecx, dword [ebp - 4]
call fcn.004029f0
test eax, eax
jne 0x403cc3
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00406b50
push eax
call fcn.004413fc
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403cc3
mov eax, 1
jmp 0x403d3b
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.00406b50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403d39
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xac
call fcn.00404e90
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00406b50
push eax
mov ecx, dword [ebp - 4]
call fcn.004029f0
test eax, eax
jne 0x403d39
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00406b50
push eax
call fcn.004413fc
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403d39
mov eax, 1
jmp 0x403d3b
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x408260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3141
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x28
call fcn.00406dd0
movzx eax, al
test eax, eax
je 0x4082fc
lea ecx, [ebp - 0xb9]
call fcn.0049ada0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0xb9]
call fcn.00448e1b
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
push edx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x28
call fcn.00404c90
lea ecx, [ebp - 0x58]
call fcn.00404b40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9]
call fcn.005c3930
mov ecx, dword [ebp - 0xc0]
add ecx, 0x58
call fcn.00406dd0
movzx eax, al
test eax, eax
je 0x408367
push 0x5f5f10
lea ecx, [ebp - 0x28]
call fcn.00404a20
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x70]
push edx
call fcn.00442ee1
add esp, 8
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0xc0]
add ecx, 0x58
call fcn.00404c90
lea ecx, [ebp - 0x70]
call fcn.00404b40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404b90
mov ecx, dword [ebp - 0xc0]
add ecx, 0x70
call fcn.00406dd0
movzx ecx, al
test ecx, ecx
je 0x4083d8
push str.4.0.1.9
lea ecx, [ebp - 0x40]
call fcn.00404a20
mov dword [ebp - 4], 2
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00442ee1
add esp, 8
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
push ecx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x70
call fcn.00404c90
lea ecx, [ebp - 0x88]
call fcn.00404b40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404b90
lea edx, [ebp - 0xb8]
push edx
call fcn.0040bad0
mov ecx, eax
call fcn.0044393e
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xa0]
push edx
call fcn.00442ee1
add esp, 8
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xc0]
add ecx, 0x40
call fcn.00404c90
lea ecx, [ebp - 0xa0]
call fcn.00404b40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.00404b90
cmp dword [ebp + 8], 0
je 0x408489
mov ecx, dword [ebp - 0xc0]
mov byte [ecx], 1
lea edx, [ebp - 0xdc]
push edx
push 0
mov eax, dword [ebp - 0xc0]
push eax
push 0x40a340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 4
Function at 0x4084b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x408561
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 1]
test edx, edx
je 0x408561
mov ecx, dword [ebp - 4]
call fcn.0040a5f0
mov dword [ebp - 8], 0
mov eax, 1
test eax, eax
je 0x408523
cmp dword [ebp - 8], 0x14
jl 0x408500
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 3]
test edx, edx
jne 0x408500
jmp 0x408523
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
test ecx, ecx
je 0x40850d
jmp 0x408523
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4084e4
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
test ecx, ecx
jne 0x408561
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x408577
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x410880
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x4109b0
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4109b0
push 0
lea ecx, [ebp - 0x20c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jbe 0x4109b0
mov edx, dword [ebp - 0x214]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4109b0
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
push 0
lea edx, [ebp - 0x20c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4109a3
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0x5f63d8
mov edx, dword [ebp - 0x210]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4109a3
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x4109d0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x2b9], 0
mov dword [ebp - 0x2c0], 0
lea eax, [ebp - 0x2c0]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jne 0x410aac
mov dword [ebp - 0x2b8], 0
push 0x2b0
push 0
lea edx, [ebp - 0x2b4]
push edx
call fcn.004ac380
add esp, 0xc
push 0x208
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov ecx, dword [ebp - 0x2c0]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x410a6b
mov byte [ebp - 0x2ba], 1
jmp 0x410a72
mov byte [ebp - 0x2ba], 0
mov dl, byte [ebp - 0x2ba]
mov byte [ebp - 0x2b9], dl
movzx eax, byte [ebp - 0x2b9]
test eax, eax
je 0x410a9f
push 0x208
lea ecx, [ebp - 0x2ac]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov al, byte [ebp - 0x2b9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 8
Function at 0x4110b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
push 0
push 0x19
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jge 0x411115
jmp 0x4111c3
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jge 0x411159
jmp 0x4111c3
lea ecx, [ebp - 0x214]
push ecx
push 0x5f86dc
push 0
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jge 0x411188
jmp 0x4111c3
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.00410ec0
add esp, 8
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [edx + 8]
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x4111e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
push 0
push 0x10
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jge 0x411245
jmp 0x4112f3
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jge 0x411289
jmp 0x4112f3
lea ecx, [ebp - 0x214]
push ecx
push 0x5f86dc
push 0
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jge 0x4112b8
jmp 0x4112f3
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.00410ec0
add esp, 8
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [edx + 8]
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
Function at 0x413d70
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3afe
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbc], ecx
lea ecx, [ebp - 0xac]
call fcn.004496a3
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov ecx, dword [ebp - 0xbc]
add ecx, 0x164
call fcn.00406b50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413f78
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 0xbc]
add ecx, 0x164
call fcn.00406b50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffff
jne 0x413e1e
jmp 0x413f78
push 0
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
add ecx, 1
push ecx
call fcn.0043c1fd
add esp, 4
mov dword [ebp - 0xc0], eax
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0xb0], edx
cmp dword [ebp - 0xb0], 0
jne 0x413e65
jmp 0x413f78
mov eax, dword [ebp - 0xb4]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xb0]
push ecx
call fcn.004ac380
add esp, 0xc
push 0
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
lea ecx, [ebp - 0xac]
call fcn.0044a05e
cmp dword [ebp - 0xb0], 0
je 0x413ef8
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
push ecx
call fcn.0043c206
add esp, 4
mov dword [ebp - 0xb0], 0
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0xac]
call fcn.004498ac
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00442c83
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00404b40
lea ecx, [ebp - 0x28]
call fcn.00411380
test eax, eax
jbe 0x413f69
lea ecx, [ebp - 0x28]
call fcn.00406b50
push eax
push 0x5f6718
push 0x5f6728
mov ecx, dword [ebp - 0xbc]
call fcn.00444a9f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret

Function at 0x414040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x414084
mov eax, dword [ebp - 4]
add eax, 0x2b8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4149e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2b4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2b4], 0
jne 0x414082
jmp 0x41408c
jmp 0x41408c
mov ecx, dword [ebp - 4]
call fcn.00414a00
mov esp, ebp
pop ebp
ret 4
Function at 0x414ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004ac380
add esp, 0xc
mov dword [ebp - 0x41c], 0
push 0
push 0x2b
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp - 0x418]
add ecx, 0x104
call fcn.00406b50
push eax
lea edx, [ebp - 0x414]
push edx
call fcn.004afd8f
add esp, 8
push 0x5f68f4
lea eax, [ebp - 0x20c]
push eax
call fcn.004afd5e
add esp, 8
push 0x5f68f8
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004afd5e
add esp, 8
push 0x5f6904
lea edx, [ebp - 0x20c]
push edx
call fcn.004afd5e
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.0044a0ff
add esp, 4
push 0x5f6908
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004afd5e
add esp, 8
push 0x5f6914
lea edx, [ebp - 0x20c]
push edx
call fcn.004afd5e
add esp, 8
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0x5f6920
push 0x5f6938
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [ebp - 0x414]
push edx
push 0x5f6948
mov ecx, dword [ebp - 0x418]
call fcn.004156c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret
Function at 0x4156c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3d00
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x66a344]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x4c]
call fcn.00449567
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.0044959b
test eax, eax
je 0x4157cf
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x10]
push eax
push 0xf013f
push 0
push 0x5f6960
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41574d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0044957a
jmp 0x4158a3
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push 0x5f6974
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x415796
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0044957a
jmp 0x4158a3
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push 0x5f6980
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x415815
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0044957a
jmp 0x4158a3
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5f6994
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41585b
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0044957a
jmp 0x4158a3
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0044957a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8