joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408169
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408169
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40815a
cmp esi, edx
jae 0x408169
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408148
cmp esi, edx
jae 0x408169
cmp word [esi], 0
je 0x408169
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420680
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x42f1b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ATL::CComAggObject_class_CHXTEncodingJobWrap5_.0
mov dword [esi + 4], 0xc0000001
call fcn.00408ec0
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4088e6
mov dword [esi + 0x30], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [0x431b04]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4088fe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [esi + 0x2c], 0
lea eax, [esi + 0x14]
je 0x408912
push eax
mov byte [eax + 0x18], 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [ebp + 8], 1
je 0x408923
push 0x38
push esi
call fcn.0040f88d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40e9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x42f174]
push esi
push edi
mov edi, ecx
mov esi, 1
mov ecx, dword [0x42f178]
mov dword [ebp - 8], edi
cmp ebx, ecx
jae 0x40ea58
test esi, esi
js 0x40ea55
mov edi, dword [ebx]
test edi, edi
je 0x40ea4e
mov eax, dword [edi + 8]
mov dword [ebp - 4], 0
test eax, eax
jne 0x40ea0f
xor esi, esi
jmp 0x40ea4e
lea ecx, [ebp - 4]
push ecx
push 0x421328
push dword [edi + 0xc]
call eax
mov esi, eax
test esi, esi
js 0x40ea3b
mov eax, dword [edi + 0x10]
add eax, 4
push eax
push 5
push 4
push dword [ebp - 4]
push dword [edi]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40ea48
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [0x42f178]
add ebx, 4
cmp ebx, ecx
jb 0x40e9f3
mov edi, dword [ebp - 8]
test esi, esi
js 0x40eb5e
jne 0x40eaf7
cmp byte [edi + 0x3c], 0
je 0x40eae2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x40eaa9
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x40e490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x40eab7
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], ebx
mov ecx, edi
mov esi, 0x80004005
call fcn.0040e980
jmp 0x40eafb
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x40ead9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x34]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40eaea
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x40eafd
mov ecx, edi
call fcn.0040e980
jmp 0x40eafb
mov byte [edi + 0x3c], 0
test esi, esi
jne 0x40eb42
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x24]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x40eb46
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
nop dword [eax + eax]
lea eax, [ebp - 0x24]
push eax
call ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
jg 0x40eb20
jmp 0x40eb46
test esi, esi
js 0x40eb5e
mov ecx, edi
call fcn.0040e980
cmp byte [edi + 0x3c], 0
mov esi, eax
je 0x40eb5e
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417e02
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00417aad
arpl bx, sp
or al, 0x8d
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00417abd
push eax
push esi
push dword [ebp + 8]
call fcn.00417a72
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00417abd
push eax
push esi
push dword [ebp + 8]
call fcn.00417a72
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00417abd
push eax
push esi
push dword [ebp + 8]
call fcn.00417a72
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00417aad
je 0x417f6a
push 0x7c9d881b
invalid
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
Function at 0x41810a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x418161
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x41815c
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x418146
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x41814e
cmp edx, ebx
jne 0x41829c
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x41811d
add eax, dword [eax + 4]
jmp fcn.0041810a
mov dword [ebp + 0xc], ebx
jmp 0x41816c
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x418184
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4181a2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x418200
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4181e7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4181f0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4181fa
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4181dc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x418166
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41824d
dec eax
je 0x418244
sub eax, 3
je 0x41823b
mov dword [ebp - 4], 0x40
jmp 0x41826a
mov dword [ebp - 4], 4
jmp 0x418250
mov dword [ebp - 4], 0x20
jmp 0x418250
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41829c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41821c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00417aad
and al, 0xf1
xchg edx, edi
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x4182a8
Function at 0x419c50
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
lds esp, [esp + edx*2]
call fcn.00417aad
loop 0x419c67
jg 0x419c8f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x419c71
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00417aad

Function at 0x419c7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dword [ebx], ecx
pop esp
push 0x478bf88b
cmp al, 0x8b
push esp
pop es
js 0x419c8b
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
sbb byte [ebx - 0x20fcdfa6], cl
add ebx, edi
call fcn.00417aad
xchg edi, eax
pop ecx
and esi, dword [ebp + 0x49]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x419c9a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x419c9a
call fcn.00417aad
nop
loopne 0x419c7e
stosb byte es:[edi], al
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
invalid
fcomp st(5)
Function at 0x405123
Capabilities:
Encode data using xor

Disassembly:
in al, dx
wait
pop esp
or eax, 0xff3267c
add byte [eax], ah
cmpsb byte [esi], byte es:[edi]
pop eax
movsb byte es:[edi], byte [esi]
jne 0x40519c
pop ds
inc ebx
in al, 1
outsd dx, dword [esi]
invalid
inc edx
xlatb
mov ebx, 0x1cfba246
jnp 0x4051da
fmul dword [edx]
ror dword [ebx - 0x4f73a67c], 0x76
xor eax, 0x2bc2f80d
pop ss
pushfd
in al, 0x95
sbb ecx, edi
loop 0x4051ce
mov dword [0x8807778], eax
sbb byte [edi + ecx*4], ah
ljmp 0x8b21
sbb dword [edx], ebx
int1
test dword [ecx], esi
adc edi, dword [edx + 0x31754ebd]
sal ecx, cl
int1
push eax
jb 0x4051ee
mov byte [0x339482fc], al
mov edi, 0x1b2d0a06
xor ecx, edx
insd dword es:[edi], dx
invalid
lodsd eax, dword [esi]
mov esp, dword gs:[esi - 0x3c4f986b]
xchg esi, eax
ret 0x988d
Function at 0x401452
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
xor eax, eax
push 3
inc eax
call fcn.00401392
cmp byte [0x403366], 0
jne 0x401534
push ebx
push edi
mov ebx, 0x403366
push ebx
push str.VisualFoxProRuntime.9
call fcn.004012d8
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll__access]
je 0x4014a5
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x4014a5
mov byte [0x403366], 0
jmp 0x401528
cmp byte [0x403366], 0
jne 0x401532
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40151f
add eax, 0xc
cmp eax, 0x105
jg 0x40151f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4020e8
lea eax, [ebp - 0x118]
push eax
call esi
push 3
call fcn.00401037
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
pop esi
jne 0x40151f
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
cmp byte [0x403366], 0
jne 0x401532
xor eax, eax
inc eax
push 3
call fcn.00401392
pop edi
pop ebx
leave
ret

Function at 0x13e87b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13e87c2
pushal
call 0x13e87c8
pop ebp
sub ebp, 0x10
sub ebp, 0xfe87b8
jmp 0x13e87de
mov eax, 0xfe87b8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ba
mov edx, 0x78a15221
xor byte [eax], dl
inc eax
dec ecx
jne 0x13e87f5
jmp 0x13e8808
stosb byte es:[edi], al
in al, dx
stosb byte es:[edi], al
test al, 0x1d
and dword [ecx], esp
and dword [eax + 0x2121d9e0], esp
and dword [edx], esp
in al, dx
cdq
daa
and dword [ecx], esp
and dword [ebx + 0x21212109], ebx
salc
ret
Function at 0x4047a3
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.00490160
call fcn.004053b0
push 0x5a
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 0
push 0x59
call fcn.00470370
push 0x17
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 1
push 0x59
call fcn.00470370
push 8
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 2
push 0x59
call fcn.00470370
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
je 0x40483b
mov ebx, 4
cmp ebx, dword [esp]
je 0x40483b
mov ebx, 0x7c04
cmp ebx, dword [esp]
jne 0x40487d
mov ebp, dword [0x637cd0]
mov edx, 0x55edf8
lea ecx, [ebp]
call fcn.00446008
mov eax, 0x55edf8
push eax
call fcn.0040d1ee
push 2
push 0x59
call fcn.004703d5
mov eax, 0x55edf8
push eax
push 0x59
call fcn.0047040d
jmp 0x404903
mov ebx, 9
cmp ebx, dword [esp]
jne 0x4048c6
mov ebp, dword [0x637cd0]
mov edx, str.English
lea ecx, [ebp]
call fcn.00446008
mov eax, str.English
push eax
call fcn.0040d1ee
push 1
push 0x59
call fcn.004703d5
mov eax, str.English
push eax
push 0x59
call fcn.0047040d
jmp 0x404903
mov ebp, dword [0x637cd0]
mov edx, 0x54b70c
lea ecx, [ebp]
call fcn.00446008
mov eax, 0x54b70c
push eax
call fcn.0040d1ee
push 0
push 0x59
call fcn.004703d5
mov eax, 0x54b70c
push eax
push 0x59
call fcn.0047040d
pop eax
call fcn.00404915
call fcn.0042d7e8
jmp 0x404909
Function at 0x4058b6
Capabilities:
Delete registry value

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00490160
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00446000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00446000
mov dword [esp + 0xc], 0x20006
cmp dword [esp + 0x2c], 0
je 0x4058fa
mov ebx, dword [esp + 0xc]
or ebx, 0x100
mov dword [esp + 0xc], ebx
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048d8a0
call fcn.004901c0
mov edx, 0x54c848
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x405960
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048d940
lea eax, [esp + 4]
push eax
call fcn.00490090
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048d940
call fcn.004901c0
mov edx, 0x54c848
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x4059c6
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048d8a0
lea eax, [esp + 4]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x4059e1
push 0x5649a0
push 0x24
push dword [esp + 0x38]
call fcn.0048eeb0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x405a4c
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405a38
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406c78
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.00490090
cmp dword [esp + 0x10], 0
je 0x405a48
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x405aab
push dword [esp + 4]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegDeleteValueW
mov dword [esp + 8], eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x405aa2
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405a9e
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406c78
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.00490090
xor eax, eax
jmp 0x405aab
mov eax, 1
jmp 0x405aab
push dword [esp]
call fcn.004901f0
push dword [esp + 4]
call fcn.004901f0
add esp, 0x14
pop ebx
pop ebp
ret 0x14
Function at 0x40c780
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.00490160
call fcn.00409876
push 0x34
push 0
call fcn.0041e358
push 0xffffffec
push 0x32
call fcn.004732ad
push eax
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
or ebx, 0x20
push ebx
push 0xffffffec
push 0x32
call fcn.004732ad
push eax
call sub.USER32.dll_SetWindowLongW
push 0x5a
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 0
push 5
call fcn.00470370
push 0x17
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 1
push 5
call fcn.00470370
push 8
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 2
push 5
call fcn.00470370
mov ebp, dword [0x637cf0]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40c8e2
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40c881
mov eax, 0x55edf8
push eax
call fcn.0040d1ee
push 2
push 5
call fcn.004703d5
mov eax, 0x55edf8
push eax
push 5
call fcn.0047040d
jmp 0x40c8e1
mov ebx, 9
cmp ebx, dword [esp]
jne 0x40c8b7
mov eax, str.English
push eax
call fcn.0040d1ee
push 1
push 5
call fcn.004703d5
mov eax, str.English
push eax
push 5
call fcn.0047040d
jmp 0x40c8e1
mov eax, 0x54b70c
push eax
call fcn.0040d1ee
push 0
push 5
call fcn.004703d5
mov eax, 0x54b70c
push eax
push 5
call fcn.0047040d
pop eax
mov ebp, dword [0x637cf0]
mov ebx, dword [ebp + 0x1c]
xor ebx, 1
and ebx, ebx
je 0x40c9a0
mov ebp, dword [0x637cd0]
push dword [ebp]
mov edx, 0x55edf8
mov ecx, dword [esp]
call fcn.00446340
je 0x40c93a
mov eax, 0x55edf8
push eax
call fcn.0040d1ee
push 2
push 5
call fcn.004703d5
mov eax, 0x55edf8
push eax
push 5
call fcn.0047040d
jmp 0x40c99f
mov edx, str.English
mov ecx, dword [esp]
call fcn.00446340
je 0x40c975
mov eax, str.English
push eax
call fcn.0040d1ee
push 1
push 5
call fcn.004703d5
mov eax, str.English
push eax
push 5
call fcn.0047040d
jmp 0x40c99f
mov eax, 0x54b70c
push eax
call fcn.0040d1ee
push 0
push 5
call fcn.004703d5
mov eax, 0x54b70c
push eax
push 5
call fcn.0047040d
pop eax
call fcn.0040ab59
call fcn.004073b1
call fcn.0043face
mov ebp, dword [0x637cf0]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40c9c4
call fcn.0042d7e8
jmp 0x40c9bd
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x41e629
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
call fcn.00490160
push dword [esp + 0x14]
call fcn.00446320
lea eax, [esp]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp dword [esp], 0
je 0x41e682
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048f140
lea eax, [esp + 8]
push eax
call fcn.00490090
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
mov edx, dword [esp + 4]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x41e6aa
push dword [esp + 4]
call fcn.004901f0
add esp, 8
ret 8
Function at 0x41ec4b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41ec52
call fcn.00490160
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00446000
mov edx, dword [esp + 0x34]
lea ecx, [esp + 4]
call fcn.00446000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
call fcn.00446000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
call fcn.00446000
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x10]
call fcn.00446000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.00446000
push 0
call sub.ole32.dll_CoInitialize
lea eax, [esp + 0x18]
push eax
mov ebp, 0x633d70
push ebp
push 1
push 0
mov ebp, 0x633d50
push ebp
call sub.ole32.dll_CoCreateInstance
mov ebx, eax
and ebx, ebx
jne 0x41edbf
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
add esp, 4
push dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
push 0
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov ebp, 0x633d60
push ebp
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax]
mov ebx, eax
and ebx, ebx
jne 0x41edb5
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
add esp, 4
mov ebx, eax
and ebx, ebx
jne 0x41edab
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.ole32.dll_CoUninitialize
mov eax, dword [esp + 0x20]
jmp 0x41edcc
push dword [esp + 8]
call fcn.004901f0
push dword [esp + 0xc]
call fcn.004901f0
push dword [esp]
call fcn.004901f0
push dword [esp + 4]
call fcn.004901f0
push dword [esp + 0x10]
call fcn.004901f0
push dword [esp + 0x14]
call fcn.004901f0
add esp, 0x24
pop ebx
pop ebp
ret 0x20