joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64f250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x663808
push 0x653288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x64f329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x64f329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006521d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x64f329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x64f329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x64f32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0064f351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64fd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x64fd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x64fd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x64fd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x64fd94
push eax
push esi
call fcn.0065220b
add esp, 8
pop esi
ret 0x10

Function at 0x64fda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x64fe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x64fe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x668320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00651dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x64fdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x64fe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x64fec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x64feb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x668320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00651dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x64feab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x64fe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x650000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x650131
push esi
call fcn.00653145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00642080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x650131
push 0
push ebp
call fcn.006423a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00642260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x65008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006422f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x650121
push 0x668918
push edi
call fcn.006513f0
push eax
push ebx
push esi
call fcn.0064ff60
push 0x6688f8
push edi
call fcn.006513f0
push eax
push ebx
push esi
call fcn.0064ff60
push 0x6688d8
push edi
call fcn.006513f0
push eax
push ebx
push esi
call fcn.0064ff60
push 0x6688c0
push edi
call fcn.006513f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0064ff60
push 0x6688a0
push edi
call fcn.006513f0
push eax
push ebx
push esi
call fcn.0064ff60
push 0x668888
push edi
call fcn.006513f0
push eax
push ebx
push esi
call fcn.0064ff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6511b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00651140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00651140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00651140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00651140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x651bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x651c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x66387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x651c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x651c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e6dc
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov dword [esi + 0xc], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
mov dword [esp + 0x1c], ebx
lea ebp, [esi + 0x28]
mov ecx, ebp
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
call dword [0x422924]
lea ecx, [esi + 0x2c]
call dword [0x422924]
lea ecx, [esi + 0x30]
call dword [0x422924]
mov byte [esp + 0x1c], 3
lea ecx, [esi + 0x3c]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
mov byte [esp + 0x1c], 4
lea ecx, [esi + 0x58]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
mov byte [esp + 0x1c], 5
lea ecx, [esi + 0x74]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
mov byte [esp + 0x1c], 6
lea ecx, [esi + 0x90]
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
mov byte [esp + 0x1c], 7
lea ecx, [esi + 0xac]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
call sub.mfc90u.dll_CStringArray::CStringArray
push 0xffffffffffffffff
mov byte [esp + 0x20], 8
push ebx
mov ecx, edi
mov dword [esi + 0xc0], ebx
call sub.mfc90u.dll_CStringArray::SetSize
mov ecx, ebp
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x3c]
call sub.mfc90u.dll_CStringArray::SetSize
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x58]
call sub.mfc90u.dll_CStringArray::SetSize
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x74]
call sub.mfc90u.dll_CStringArray::SetSize
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x90]
call sub.mfc90u.dll_CStringArray::SetSize
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0xac]
call sub.mfc90u.dll_CStringArray::SetSize
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4023e0
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x41e593
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x10], esi
push 0x42803c
mov ecx, ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Trim]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov eax, dword [esp + 0x28]
mov edi, dword [eax - 0xc]
cmp edi, esi
jle 0x402688
nop
push esi
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::operator__]
movzx eax, ax
cmp ax, 0x30
je 0x402676
cmp ax, 0x31
je 0x402676
cmp ax, 0x32
je 0x402676
cmp ax, 0x33
je 0x402676
cmp ax, 0x34
je 0x402676
cmp ax, 0x35
je 0x402676
cmp ax, 0x36
je 0x402676
cmp ax, 0x37
je 0x402676
cmp ax, 0x38
je 0x402676
cmp ax, 0x39
je 0x402676
cmp ax, 0x41
je 0x402676
cmp ax, 0x42
je 0x402676
cmp ax, 0x43
je 0x402676
cmp ax, 0x44
je 0x402676
cmp ax, 0x45
je 0x402676
cmp ax, 0x46
je 0x402676
cmp ax, 0x47
je 0x402676
cmp ax, 0x48
je 0x402676
cmp ax, 0x49
je 0x402676
cmp ax, 0x4a
je 0x402676
cmp ax, 0x4b
je 0x402676
cmp ax, 0x4c
je 0x402676
cmp ax, 0x4d
je 0x402676
cmp ax, 0x4e
je 0x402676
cmp ax, 0x4f
je 0x402676
cmp ax, 0x50
je 0x402676
cmp ax, 0x51
je 0x402676
cmp ax, 0x52
je 0x402676
cmp ax, 0x53
je 0x402676
cmp ax, 0x54
je 0x402676
cmp ax, 0x55
je 0x402676
cmp ax, 0x56
je 0x402676
cmp ax, 0x57
je 0x402676
cmp ax, 0x58
je 0x402676
cmp ax, 0x59
je 0x402676
cmp ax, 0x5a
je 0x402676
cmp ax, 0x61
je 0x402676
cmp ax, 0x62
je 0x402676
cmp ax, 0x63
je 0x402676
cmp ax, 0x64
je 0x402676
cmp ax, 0x65
je 0x402676
cmp ax, 0x66
je 0x402676
cmp ax, 0x67
je 0x402676
cmp ax, 0x68
je 0x402676
cmp ax, 0x69
je 0x402676
cmp ax, 0x6a
je 0x402676
cmp ax, 0x6b
je 0x402676
cmp ax, 0x6c
je 0x402676
cmp ax, 0x6d
je 0x402676
cmp ax, 0x6e
je 0x402676
cmp ax, 0x6f
je 0x402676
cmp ax, 0x70
je 0x402676
cmp ax, 0x71
je 0x402676
cmp ax, 0x72
je 0x402676
cmp ax, 0x73
je 0x402676
cmp ax, 0x74
je 0x402676
cmp ax, 0x75
je 0x402676
cmp ax, 0x76
je 0x402676
cmp ax, 0x77
je 0x402676
cmp ax, 0x78
je 0x402676
cmp ax, 0x79
je 0x402676
cmp ax, 0x7a
jne 0x40267f
push eax
mov ecx, ebx
call dword [0x422744]
inc esi
cmp esi, edi
jl 0x402450
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x403380
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x41e509
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x28]
mov edi, dword [eax - 0xc]
test edi, edi
jne 0x4033d7
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
xor bl, bl
xor esi, esi
test edi, edi
jle 0x4033f2
nop
push esi
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::operator__]
inc esi
xor bl, al
cmp esi, edi
jl 0x4033e0
mov edx, dword [esp + 0x24]
xor eax, eax
test edx, edx
jbe 0x403408
mov ecx, dword [esp + 0x20]
xor byte [eax + ecx], bl
inc eax
cmp eax, edx
jb 0x403400
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x405430
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x41f4e9
mov eax, dword fs:[0]
push eax
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::TrimLeft]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::TrimRight]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405491
mov edx, dword [0x43d7b4]
lea ecx, [esp + 0x14]
push ecx
push edx
mov ecx, 0x43d7ac
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
Function at 0x405d90
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 7
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405e05
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x405e05
mov edx, dword [esp + 8]
fild dword [esp + 8]
test edx, edx
jge 0x405de7
fadd qword [0x42b7a0]
fmul qword [0x42b7a0]
mov dword [esp + 8], edi
fild dword [esp + 8]
test edi, edi
jge 0x405dff
fadd qword [0x42b7a0]
pop edi
faddp st(1)
pop esi
pop ecx
ret
fldz
pop edi
pop esi
pop ecx
ret
Function at 0x407d70
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4203fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x407e91
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x407e7e
lea ecx, [esp + 0x28]
call dword [0x422924]
push 0x42803c
push str.IDS_STR_LIST_FILE
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
mov esi, dword [sym.imp.SolvusoftWMhelper.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______thiscall_CSystweakApp::LoadStringW_wchar_t_const___wchar_t_const__]
push eax
mov ecx, 0x43d668
call esi
mov edi, eax
push 0x42803c
push str.IDS_UNABLE_TODELETE
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x43d668
mov byte [esp + 0x2c], 1
call esi
mov byte [esp + 0x20], 2
mov edx, dword [edi]
mov ecx, dword [ebp]
mov eax, dword [eax]
push edx
push ecx
push eax
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0x10
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov esi, dword [esp + 0x28]
call fcn.00407b60
lea eax, [esp + 0x28]
push eax
mov ecx, 0x43d820
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
mov ecx, dword [ebp]
push 0
push ecx
push 0x2005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
Function at 0x407eb0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041d6a0
mov eax, dword [0x433028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1002]
push ecx
mov word [ebp - 0x1004], ax
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x802]
push eax
mov word [ebp - 0x804], dx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x804]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.SYSTWEAK_ENCRYPT
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jg 0x407f59
lea eax, [esi + esi]
call fcn.0041d6d0
mov edi, esp
test edi, edi
je 0x407f59
push esi
push edi
push 0xffffffffffffffff
xor edx, edx
push str.SYSTWEAK_ENCRYPT
push edx
push 3
mov word [edi], dx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x407f5b
xor esi, esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407f80
sub eax, edx
sar eax, 1
jne 0x407f95
xor eax, eax
jmp 0x407fd6
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407fa0
sub eax, edx
sar eax, 1
je 0x407f91
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407f91
lea eax, [ebp - 0x1004]
push eax
mov ecx, ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
mov eax, 1
lea esp, [ebp - 0x1010]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cef2
mov esp, ebp
pop ebp
ret
Function at 0x408870
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xfc
mov eax, dword [0x433028]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x104]
push ebp
mov ebp, dword [esp + 0x104]
push esi
push edi
mov dword [esp + 0xc], eax
xor eax, eax
push 0x48
mov esi, ecx
push eax
lea ecx, [esp + 0xb0]
push ecx
mov byte [esp + 0xfc], 0
mov dword [esp + 0xfd], eax
mov dword [esp + 0x101], eax
mov dword [esp + 0x105], eax
mov dword [esp + 0x109], eax
mov word [esp + 0x10d], ax
mov byte [esp + 0x10f], al
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
call sub.MSVCR90.dll_memset
mov eax, esi
add esp, 0xc
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
mov dword [esp + 0xa4], 0xc3d2e1f0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408951
sub eax, edx
sar eax, 1
push 3
mov edi, eax
lea edx, [esp + 0x18]
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
call fcn.00403550
mov eax, dword [esp + 0x10]
push eax
mov eax, edi
lea esi, [esp + 0x98]
call fcn.0040b2c0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
add esp, 4
cmp eax, ecx
je 0x4089a2
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
lea ecx, [esp + 0x94]
lea edi, [esp + 0xf0]
call fcn.0040b360
mov edx, dword [esp + 0xf0]
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
mov dword [ebp], edx
mov edx, dword [esp + 0xfc]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x100]
mov dword [ebp + 8], ecx
mov ecx, dword [esp + 0xc]
mov dword [ebp + 0xc], edx
pop edi
mov dword [ebp + 0x10], eax
mov dword [ecx], 0x14
mov ecx, dword [esp + 0x100]
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0041cef2
add esp, 0xfc
ret 8