joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422670
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Get file attributes

Disassembly:
sub esp, 0x220
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
mov ebx, edx
lea edx, [esp + 0x20]
push 0x104
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.004367c7
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422823
test al, 0x10
jne 0x422823
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x422727
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x422727
test edi, edi
jle 0x42270d
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00434b37
add esp, 0x220
ret
lea edx, [esp + 0xc]
push edx
push 0x4514dc
push 1
push 0
push 0x4514ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jl 0x42270d
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test eax, eax
jl 0x42270f
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422760
sub eax, edx
sar eax, 1
jne 0x422793
push esi
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.004367c7
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ebx, [esp + 0x20]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x24]
call eax
test eax, eax
jl 0x42270f
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jl 0x42270f
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jl 0x42270f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x4514fc
push eax
mov eax, dword [ecx]
call eax
mov edi, eax
test edi, edi
jl 0x422812
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x42270d
mov ecx, dword [esp + 0x224]
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.00434b37
add esp, 0x220
ret
Function at 0x422840
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x422867
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ebp, [ebx + 2]
push ebp
call fcn.004348ff
push ebp
mov esi, eax
push 0
push esi
call fcn.00440b00
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4228a8
mov ecx, dword [esp + 0x18]
sub eax, edx
push eax
push esi
call fcn.00405f20
push esi
call fcn.0043642d
add esp, 4
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
pop ecx
ret

Function at 0x4228e0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42290b
xor eax, eax
pop edi
add esp, 8
ret
push ebx
push ebp
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ebp, [esi + 2]
push ebp
call fcn.004348ff
push ebp
mov ebx, eax
push 0
push ebx
call fcn.00440b00
add esp, 0x10
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xfe
jbe 0x422956
mov esi, 0xfe
jmp 0x422959
and esi, 0xfffffffe
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4229af
cmp byte [ebx], 0xff
jne 0x422984
cmp byte [ebx + 1], 0xfe
jne 0x422984
mov eax, dword [esp + 0x1c]
lea edx, [ebx + 2]
push eax
call fcn.004029e0
jmp 0x422a46
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422990
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.00403d80
jmp 0x422a46
cmp byte [ebx], 0xef
mov dword [esp + 0x10], ebx
jne 0x4229cb
cmp byte [ebx + 1], 0xbb
jne 0x4229cb
cmp byte [ebx + 2], 0xbf
jne 0x4229cb
lea ecx, [ebx + 3]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
xor ecx, ecx
lea esi, [ebp + 2]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004348ff
push esi
mov edi, eax
push 0
push edi
call fcn.00440b00
mov eax, dword [esp + 0x20]
add esp, 0x10
push ebp
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422a23
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00403d80
push edi
call fcn.0043642d
add esp, 4
push ebx
call fcn.0043642d
add esp, 4
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 8
ret
Function at 0x422e30
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, ecx
test ebx, ebx
push esi
push edi
jne 0x422e62
push 0x208
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ebx, [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x422e8d
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00434b37
add esp, 0x220
ret
push edi
call fcn.004348ff
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x453abc
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
xor edx, edx
xor edi, edi
push esi
or edi, ecx
or ebx, edx
call fcn.0043642d
mov ecx, dword [esp + 0x228]
add esp, 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x220
ret

Function at 0x423080
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.temp
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
push 0
push 0x456860
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00434b37
add esp, 0x20c
ret
Function at 0x4230f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x670
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x66c], eax
mov eax, dword [esp + 0x674]
push ebx
mov ebx, dword [esp + 0x67c]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x474]
push 0x104
push eax
mov esi, ecx
xor edi, edi
call fcn.004367c7
add esp, 0xc
lea ecx, [esp + 0x470]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ebx
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x423178
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4232aa
mov ebp, dword [esp + 0x68c]
nop
mov ecx, 0x453ac0
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4231b6
test dx, dx
je 0x4231b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4231b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x423190
xor eax, eax
jmp 0x4231bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42326e
mov ecx, 0x453ac4
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4231f6
test dx, dx
je 0x4231f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4231f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4231d0
xor eax, eax
jmp 0x4231fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42326e
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x26c]
push 0x104
push eax
call fcn.004367c7
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x18], 0x10
push ebp
je 0x423256
push ebx
lea eax, [esp + 0x270]
push eax
mov ecx, esi
call fcn.004230f0
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov edi, eax
push ebp
lea eax, [esp + 0x26c]
push eax
jmp 0x423262
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0x26c]
push ecx
mov ecx, esi
call edx
test al, al
jne 0x4232c5
test edi, edi
jne 0x423296
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x423180
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x423180
cmp edi, 0x12
jne 0x42329d
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x670
ret 0xc
mov edi, 0x4c7
jmp 0x42329d
Function at 0x423400
Capabilities:
Create directory

Disassembly:
sub esp, 0x878
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x874], eax
mov eax, dword [esp + 0x880]
push ebx
push ebp
mov ebp, dword [esp + 0x884]
push esi
push edi
push ebp
lea ecx, [esp + 0x67c]
push 0x104
push ecx
mov dword [esp + 0x20], eax
call fcn.004367c7
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push 0x45550c
lea edx, [esp + 0x67c]
push edx
call edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x67c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x42347e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4235f5
mov ebx, dword [esp + 0x894]
jmp 0x423490
mov ecx, 0x453ac0
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4234c6
test dx, dx
je 0x4234c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4234c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4234a0
xor eax, eax
jmp 0x4234cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4235c5
mov ecx, 0x453ac4
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x423506
test dx, dx
je 0x423502
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x423506
add eax, 4
add ecx, 4
test dx, dx
jne 0x4234e0
xor eax, eax
jmp 0x42350b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4235c5
push ebp
lea edx, [esp + 0x474]
push 0x104
push edx
call fcn.004367c7
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x474]
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x26c]
push 0x104
push eax
call fcn.004367c7
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x26c]
push edx
call edi
test byte [esp + 0x18], 0x10
je 0x423599
test bl, bl
je 0x4235c5
push 0
lea eax, [esp + 0x26c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
lea ecx, [esp + 0x26c]
push ecx
lea edx, [esp + 0x478]
push edx
call fcn.00423400
add esp, 0xc
jmp 0x4235bb
push 0
lea eax, [esp + 0x26c]
push eax
lea ecx, [esp + 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4235c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4235e8
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x423490
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x4235e8
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov ecx, dword [esp + 0x884]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x878
ret
Function at 0x423610
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
xor bl, bl
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42364a
mov al, 1
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00434b37
add esp, 0x218
ret
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x4236a4
lea eax, [esp + 8]
push eax
push 0
push 0x456860
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x42369b
push 0
push 0x4000000
push 2
push 0
push 5
push 0xc0000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42369b
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00422ef0
add esp, 4
mov ecx, dword [esp + 0x214]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x218
ret

Function at 0x423c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44feee
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x462408]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea eax, [edi + 0x248]
mov dword [esp + 0x14], 2
call fcn.0041fbe0
cmp dword [edi + 0x30], 8
jb 0x423cdb
mov eax, dword [edi + 0x1c]
push eax
call fcn.0043642d
add esp, 4
xor ebx, ebx
mov dword [edi + 0x30], 7
mov dword [edi + 0x2c], ebx
lea eax, [edi + 0xc]
mov word [edi + 0x1c], bx
mov byte [esp + 0x14], bl
call fcn.00402f20
mov dword [esp + 0x14], 0xffffffff
call fcn.0041ea60
mov eax, dword [edi + 4]
push eax
call fcn.0043642d
add esp, 4
mov dword [edi + 4], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x424f40
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
push ebx
push esi
lea esi, [eax + 0xa68]
push edi
lea eax, [esi + 0x3c]
push eax
lea ecx, [esp + 0x20c]
push 0x104
push ecx
call fcn.004367c7
add esp, 0xc
push str.MediaSDKconfig.ini
lea edx, [esp + 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x208]
push eax
push str.Looking_for_MediaSDK_configuration_at__s
push 0x463650
xor eax, eax
call fcn.0042a920
add esp, 0xc
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4250a6
push str.Reading_config.ini
push 0x463650
xor eax, eax
call fcn.0042a920
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
lea edx, [esp + 0x208]
push edx
push 0xfa
lea eax, [esp + 0x18]
push eax
push 0x453920
push str.version
push str.Setup
call edi
lea ecx, [esp + 0x10]
push ecx
push str.__SDK_version___s
push 0x463650
xor eax, eax
call fcn.0042a920
add esp, 0xc
lea edx, [esp + 0x208]
push edx
push 0xfa
lea eax, [esp + 0x18]
push eax
push 0x453920
push str.merit
push str.Setup
call edi
push esi
lea ebx, [esp + 0x14]
mov edx, str.MSDK_MERIT
call fcn.00423b60
mov ecx, ebx
push ecx
push str.__Merit___s
push 0x463650
xor eax, eax
call fcn.0042a920
add esp, 0xc
lea edx, [esp + 0x208]
push edx
push 0xfa
mov eax, ebx
push eax
push 0x453920
push str.apiversion
push str.Setup
call edi
push esi
mov edx, str.MSDK_APIVERSION
call fcn.00423b60
mov ecx, ebx
push ecx
push str.__APIVersion___s
push 0x463650
xor eax, eax
call fcn.0042a920
add esp, 0xc
jmp 0x4250bd
push str.config.ini_not_found
push 0x463650
mov eax, 1
call fcn.0042a920
add esp, 8
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x40c
ret 4
Function at 0x428c50
Capabilities:
Extract resource via kernel32 functions
Get common file path
Set thread local storage value

Disassembly:
sub esp, 0x654
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x64c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
mov ecx, dword [0x464af8]
push eax
push ecx
mov edi, edx
mov dword [esp + 0x18], vtable.CCabinetExtractBase.0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
xor ebx, ebx
push edi
mov dword [esp + 0x18], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x248], eax
mov dword [esp + 0x14], vtable.CCabMemExtract.0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x428cfc
lea edx, [esp + 0x450]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0x250]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x428d12
push edi
lea edx, [esp + 0x24c]
push 0x104
push edx
call fcn.004367c7
add esp, 0xc
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, dword [esi + 4]
push 0xa
push 0x4b0
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x428d76
mov edx, dword [esi + 4]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
cmp ebp, ebx
je 0x428d76
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, esi
lea esi, [esp + 0x10]
call fcn.004015f0
lea ecx, [esp + 0x248]
push ecx
call fcn.00401370
jmp 0x428d7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], vtable.CCabinetExtractBase.0
je 0x428d97
push eax
call sub.Cabinet.dll_FDIDestroy
add esp, 4
mov ecx, dword [esp + 0x65c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x654
ret

Function at 0x4294c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x4324b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x464bf8]
push 0
push 0x4323f0
push 0
push 0x9b
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
jmp eax
Function at 0x42a0f0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push str.Cleanup
push str.__s_
push 0x463650
xor eax, eax
call fcn.0042a920
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
mov ebx, 1
add dword [0x463670], ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
push str.Marking___s__for_deletion_on_reboot
push 0x463650
xor eax, eax
call fcn.0042a920
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call edi
test eax, eax
je 0x42a1e4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathIsRootW]
lea ecx, [esp + 0x10]
push ecx
call ebp
test eax, eax
jne 0x42a1c4
lea edx, [esp + 0x10]
push edx
push str.Marking___s__for_deletion_on_reboot
push 0x463650
call fcn.0042a920
add esp, 0xc
push 4
push 0
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
jne 0x42a185
sub dword [0x463670], 1
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00434b37
add esp, 0x20c
ret
sub dword [0x463670], ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434b37
add esp, 0x20c
ret
Function at 0x42a920
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 8
mov esi, eax
jb 0x42a935
mov eax, dword [edi + 8]
jmp 0x42a938
lea eax, [edi + 8]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42aa9e
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 1
jne 0x42a975
mov esi, 0x45a038
jmp 0x42a984
cmp esi, 2
mov esi, str._
je 0x42a984
mov esi, 0x453920
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a990
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebp
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a9c0
sub eax, edx
mov edx, dword [edi + 0x20]
sar eax, 1
add edx, edx
test edx, edx
mov esi, eax
mov eax, 0x4652c0
jle 0x42a9ff
mov ecx, edx
shr ecx, 1
mov eax, 0x200020
mov edi, 0x4652c0
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
lea eax, [edx*2 + 0x4652c0]
mov word [eax], 0
mov ecx, dword [edi + 0x20]
push 0
add ecx, ecx
lea eax, [esp + 0x14]
push eax
sub ecx, esi
add ecx, ecx
push ecx
push 0x4652c0
push ebp
call ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00438924
mov esi, eax
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004348ff
mov ecx, dword [esp + 0x28]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
push edi
call fcn.00438ab9
push 0x45a04c
push esi
push edi
call fcn.00436c84
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42aa70
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push ebp
call ebx
push edi
call fcn.0043642d
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x42abb0
Capabilities:
Set registry value

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42abb6
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8