joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413837
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString_2
push str..html
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::operator_2
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push edi
call sub.MFC42.DLL_CString::CString_1
mov bl, 3
push str.http
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::Find_2
cmp eax, 0xffffffff
je 0x401b8d
lea ecx, [esp + 0x30]
push 4
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 4
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
mov dl, byte [esi + str._:_____]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42.DLL_CString::Remove
inc esi
cmp esi, 9
jl 0x401b8d
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.00412f7a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
add ecx, 0xfffffefc
test ecx, ecx
jl 0x401c2f
mov eax, dword [eax - 8]
sub eax, ecx
lea ecx, [esp + 0x30]
sub eax, 0xa
push eax
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
push edi
lea ecx, [esp + 0x14]
call fcn.00412f38
lea edx, [esp + 0xc]
push str..html
lea eax, [esp + 0x34]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 6
call fcn.00412f7a
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc

Function at 0x402010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], edi
mov eax, dword [ebp]
test eax, eax
je 0x402031
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi]
add eax, 0xa
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
test edi, edi
jle 0x402058
mov edx, dword [esp + 0x10]
mov ecx, esi
sub edx, esi
mov al, byte [edx + ecx]
xor al, 0x6f
mov byte [ecx], al
inc ecx
dec edi
jne 0x40204d
mov dword [ebp], esi
pop edi
pop esi
mov eax, 1
pop ebp
ret 0x10
Function at 0x4025f0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4139c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x18]
call fcn.00412f62
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.00412f62
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 1
call fcn.00412f62
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.00412f62
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 3
call fcn.00412f62
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 4
call fcn.00412f62
lea edi, [esi + 0x40]
mov byte [esp + 0x1c], 5
mov ecx, edi
call fcn.00412f62
lea ebp, [esi + 0x48]
mov byte [esp + 0x1c], 6
mov ecx, ebp
call fcn.00412f62
lea ecx, [esi + 0x4c]
mov byte [esp + 0x1c], 7
call fcn.00412f62
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 8
call fcn.00412f62
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1c], 9
call fcn.00412fb6
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 0xa
call fcn.00412f62
lea ecx, [esi + 0x98]
mov byte [esp + 0x1c], 0xb
call fcn.00412f62
mov eax, 1
push 0x41a894
mov ecx, edi
mov byte [esp + 0x20], 0xc
mov dword [esi], 0x415668
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], 0x64
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
call fcn.00412f38
push 0x41a894
mov ecx, ebp
call fcn.00412f38
or edi, 0xffffffff
mov word [esi + 0x44], 0x50
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
push str.Mozilla_4.0__compatible_MSIE_6.0__windows_NT_5.0_
lea ecx, [esi + 0x50]
call fcn.00412f38
mov eax, 0x2710
push 0x41a894
lea ecx, [esi + 0x94]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x58], 0x7530
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
call fcn.00412f38
push 0x41a894
lea ecx, [esi + 0x98]
call fcn.00412f38
lea eax, [esi + 0xc0]
mov dword [esi + 0x34], ebx
push eax
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov byte [esi + 0x90], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4027d0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x413a65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x415668
mov dword [esp + 0x10], 0xc
call fcn.00404bc0
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x40281d
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0xa4], 0
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x402830
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea eax, [esi + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push str.CDownHttp::CDownHttp_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esi + 0x98]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x94]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x7c]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CPtrArray::CPtrArray
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405600
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x413d69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x41567c
mov dword [esp + 0x10], 1
call fcn.00405870
push str.CDownWebPage::CDownWebPage_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esi + 0xf4]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.004027d0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x405689
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x413da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
call fcn.00405870
lea ecx, [esp + 0x14]
call fcn.00412f62
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00412f62
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.00412f62
mov ebx, 2
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call fcn.00412f62
mov eax, dword [esp + 0x28]
lea ecx, [esi + 0xf4]
push eax
mov byte [esp + 0x24], 3
call fcn.00412f38
push 0
push 4
push 0
push 0
push esi
push 0x4057d0
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0xf8], eax
je 0x40575f
mov dword [esi + 0xdc], ebx
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
lea ecx, [esp + 8]
mov dword [esi + 0xdc], 0
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x405fd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x413e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x41a8a4]
test eax, eax
jne 0x40607b
push esi
lea ecx, [esp + 4]
call fcn.00412f62
push 0x514
push 0x514
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406062
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x406062
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x41a8a4], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406090
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x51c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4060f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x514
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x52c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x51c
ret

Function at 0x406300
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa28
push ebx
mov ebx, dword [esp + 0xa34]
push ebp
mov ebp, dword [esp + 0xa34]
push esi
push edi
push ebx
push 0
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4063eb
lea eax, [esp + 0x10]
push eax
push str..htm
push closesocket
call fcn.00406090
add esp, 0xc
test eax, eax
jne 0x4063eb
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str._shellopencommand
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
push closesocket
call fcn.00406090
add esp, 0xc
test eax, eax
jne 0x4063eb
lea ecx, [esp + 0x10]
push str.__1_
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4063c5
lea edx, [esp + 0x10]
push 0x419868
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4063c5
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x4063c8
mov byte [esi], 0
push 0x419864
push esi
call edi
push ebp
push esi
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa28
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa28
ret
Function at 0x406400
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
push 5
mov eax, dword [esi + 0x54]
push eax
call fcn.00406300
mov edi, eax
add esp, 8
cmp edi, 0x20
jg 0x40642d
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push edi
call fcn.00406100
add esp, 4
pop edi
pop esi
ret
mov eax, dword [esi + 0x20]
push 1
push 0
push eax
mov dword [esi + 0x4c], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x40642a
mov eax, dword [0x41aaec]
test eax, eax
je 0x406459
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, byte [esp + 4]
push esi
mov esi, ecx
test al, 1
mov dword [esi], 0x415944
je 0x40648a
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, esi
pop esi
ret 4

Function at 0x4066c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x413f6d
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.004133a0
push esi
mov esi, ecx
mov dword [esp + 8], 0
lea ecx, [esp + 4]
mov dword [esp + 0x1014], 3
call fcn.00412f62
mov esi, dword [esi + 4]
mov ecx, dword [esp + 0x1024]
mov edx, dword [esp + 0x1020]
push esi
lea eax, [esp + 0x10]
push 0x1000
push eax
push 0x41a894
push ecx
push edx
mov byte [esp + 0x102c], 4
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
test al, al
jne 0x40674f
lea eax, [esp + 0x1028]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator
jmp 0x40675d
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.00412f38
mov esi, dword [esp + 0x101c]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x1014], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1020]
mov byte [esp + 0x1014], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1024]
mov byte [esp + 0x1014], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1028]
mov byte [esp + 0x1014], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x100c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1014
ret 0x10

Function at 0x406a40
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
test esi, esi
jne 0x406a66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x406a68
mov eax, esi
pop esi
ret
Function at 0x406a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x518
test edx, edx
push edi
je 0x406b37
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jb 0x406b37
mov ecx, 0x145
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x514
lea eax, [esp + 8]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jne 0x406b06
cmp byte [esp + 5], 0x3a
jne 0x406b37
mov edi, 0x419264
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebx
jmp 0x406b16
lea eax, [esp + ecx + 3]
mov cl, byte [esp + ecx + 3]
cmp cl, 0x5c
jne 0x406b16
mov byte [eax], 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406b37
test al, 0x10
je 0x406b37
mov eax, 1
pop edi
add esp, 0x518
ret
xor eax, eax
pop edi
add esp, 0x518
ret
Function at 0x406ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x406f10
pop edi
pop esi
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x18]
push esi
push edi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406f2d
pop edi
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
ret

Function at 0x406f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
lea eax, [esp + 0x10]
push eax
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x406fb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
add esp, 8
ret
mov eax, dword [esp + 0xc]
lea edx, [esp]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x18], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406ff6
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 8
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret

Function at 0x407450
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
mov ebx, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.zssetup.log
cmp byte [esp + ecx + 0xf], 0x5c
je 0x40748f
mov edi, 0x4198b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4198b0
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
xor ecx, ecx
test eax, eax
pop edi
pop esi
setne cl
mov dword [ebx + 4], eax
pop ebp
mov eax, ecx
pop ebx
add esp, 0x104
ret
Function at 0x408c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1968
call fcn.004133a0
mov edx, dword [esp + 0x196c]
push ebx
test edx, edx
push edi
je 0x408d07
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jb 0x408d07
mov ecx, 0x145
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x514
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jne 0x408ccc
cmp byte [esp + 9], 0x3a
jne 0x408d07
mov edi, 0x419264
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x408cdc
lea eax, [esp + ecx + 7]
mov cl, byte [esp + ecx + 7]
cmp cl, 0x5c
jne 0x408cdc
mov byte [eax], 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
je 0x408d07
test bl, 0x10
je 0x408d07
pop edi
mov eax, 1
pop ebx
add esp, 0x1968
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x1968
ret

Function at 0x4090d0
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x4141c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea ecx, [esp + 4]
call fcn.00412f62
push str.FileProgress_running
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.00412f38
mov eax, dword [esp + 4]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x409152
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409152
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x409180
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x414238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.00412f62
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.00412f62
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.00412f62
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 2
call fcn.00412f62
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 3
call fcn.00412f62
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 4
call fcn.00412f62
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.00412f62
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.00412f62
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 7
call fcn.00412f62
mov ecx, dword [esp + 8]
mov dword [esi], 0x415bac
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x409250
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4142a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x415bac
lea ecx, [esi + 0x38]
mov dword [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret