joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403da0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x808
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [esp + 0x80c]
test eax, eax
push esi
je 0x403e82
lea esi, [eax + 0x200]
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403dd0
sub eax, edx
sar eax, 1
je 0x403e82
push edi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004ab450
add esp, 0xc
push 0
push 0x400
push 0x527d38
lea edi, [esp + 0x18]
mov edx, esi
call fcn.00458ee0
test eax, eax
pop edi
je 0x403e2e
push 0x3ff
push esi
lea ecx, [esp + 0x10]
push 0x400
push ecx
call fcn.004a9be0
add esp, 0x10
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403e65
push 0
push 0
lea ecx, [esp + 0x10]
call fcn.00441850
add esp, 8
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a998e
add esp, 0x808
ret 4
mov eax, 2
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a998e
add esp, 0x808
ret 4
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004a998e
add esp, 0x808
ret 4

Function at 0x403ea0
Capabilities:
Create process on windows

Disassembly:
push ecx
test eax, eax
push esi
je 0x403f18
lea esi, [eax + 0x200]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403eb1
sub eax, edx
sar eax, 1
je 0x403f18
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push esi
push str.IEXPLORE.EXE
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x403ef6
push 1
push 0
push 0
push esi
push str.open
push 0
call edi
cmp eax, 0x20
jbe 0x403eff
pop edi
mov eax, 1
pop esi
pop ecx
ret
push esi
push str.Fail___Open___s__in_CCmdOperator::FNT_OPEN_URL____
mov ecx, 0x527b30
call fcn.00449000
add esp, 8
pop edi
xor eax, eax
pop esi
pop ecx
ret
push str.Fail_____Invalid_Parameter_in_CCmdOperator::FNT_OPEN_FILE____
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
Function at 0x406dc0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x4ce8b6
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x1020], eax
push esi
push edi
mov eax, dword [0x51c080]
xor eax, esp
push eax
lea eax, [esp + 0x1030]
mov dword fs:[0], eax
push 0x800
xor edi, edi
lea eax, [esp + 0x830]
push edi
push eax
call fcn.004ab450
add esp, 0xc
push 0x800
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.004ab450
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push 0xc
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push str.PROGRAM_NAME
mov word [esi + 4], di
call fcn.004102a0
mov dword [esp + 0x1054], edi
push 0x52c1fc
mov dword [esp + 0x1058], 0xffffffff
lea esi, [esp + 0x30]
call fcn.00411c20
mov dword [esp + 0x1038], 1
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x406e82
mov eax, dword [eax + 4]
jmp 0x406e85
add eax, 4
push eax
push str._s_lite_install
lea edx, [esp + 0x34]
call fcn.00411a00
add esp, 8
mov dword [esp + 0x1038], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x406eb5
mov edx, dword [esp + 0x14]
push edx
call fcn.004993dd
add esp, 4
push edi
push 1
push 0x800
lea eax, [esp + 0x838]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x40]
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], di
call fcn.00456030
add esp, 0x14
test eax, eax
jne 0x406f05
lea ecx, [esp + 0x82c]
call fcn.00442a00
test al, al
mov eax, 1
jne 0x406f07
mov eax, edi
mov ecx, dword [esp + 0x1030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1020]
xor ecx, esp
call fcn.004a998e
add esp, 0x1030
ret
Function at 0x408290
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ce810
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
mov eax, dword [0x51c080]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
push str.TRUE
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 1
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x4dcf2c
mov word [esi + 4], bx
call fcn.004102a0
mov dword [esp + 0x98], ebx
push 0x52c1fc
mov dword [esp + 0x9c], 0xffffffff
lea esi, [esp + 0x3c]
call fcn.004116f0
mov dword [esp + 0x7c], 1
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x408316
mov eax, dword [eax + 4]
jmp 0x408319
add eax, 4
push eax
call fcn.004a9af1
add esp, 8
test eax, eax
sete byte [esp + 0x13]
mov dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x30], esi
jb 0x408344
mov eax, dword [esp + 0x1c]
push eax
call fcn.004993dd
add esp, 4
cmp byte [esp + 0x13], bl
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
je 0x4083d0
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 4
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jl 0x4083be
push 0x3c
lea edx, [esp + 0x38]
push ebx
push edx
call fcn.004ab450
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x5c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], str.open
mov dword [esp + 0x54], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4083d0
push 0x4dcf30
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x70
ret
Function at 0x414830
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7070
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2008
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x2018], edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4148f1
cmp eax, edi
je 0x4148f1
mov dword [ebp - 4], edi
push 0x2000
push edi
lea eax, [ebp - 0x2014]
push eax
call fcn.004ab450
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea eax, [ebp - 0x2014]
push eax
call fcn.004aa0b4
add esp, 0x1c
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 0x2014]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4148c0
sub eax, edx
sar eax, 1
push edi
lea edx, [ebp - 0x2018]
push edx
add eax, eax
push eax
lea ecx, [ebp - 0x2014]
push ecx
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a998e
mov esp, ebp
pop ebp
ret

Function at 0x414920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, edx
push 0x800
push 0
lea eax, [ebp - 0x818]
push eax
call fcn.004ab450
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x414984
cmp eax, 0xffffffff
je 0x414984
mov al, 1
jmp 0x414a0f
test ebx, ebx
je 0x414a2b
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414991
sub eax, edx
sar eax, 1
je 0x414a2b
lea ecx, [ebp - 0x818]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [edi + 4]
push ebx
lea edx, [ebp - 0x818]
push edx
push str._s_s.txt
mov edx, esi
call fcn.00411a00
push 0
push 1
mov ecx, esi
call fcn.0045d900
add esp, 0x14
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
setne byte [ebp - 0x819]
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x819]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a998e
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x414a0f
Function at 0x414a50
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1810
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x180c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x181c]
push esi
push edi
push 0x800
lea eax, [esp + 0x81c]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.004ab450
add esp, 0xc
push 0x800
lea ecx, [esp + 0x101c]
push 0
push ecx
call fcn.004ab450
add esp, 0xc
push 0x800
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.004ab450
add esp, 0xc
test edi, edi
je 0x414c75
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414ac6
sub eax, edx
sar eax, 1
je 0x414c75
test ebp, ebp
push 0x3ff
jne 0x414af7
add esi, 0xa24
push esi
push 0x400
lea eax, [esp + 0x24]
push eax
jmp 0x414b08
add esi, 0x1224
push esi
push 0x400
lea ecx, [esp + 0x24]
push ecx
call fcn.004a9be0
lea eax, [esp + 0x28]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414b17
sub eax, edx
sar eax, 1
je 0x414c71
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414c71
push 0x800
lea eax, [esp + 0x101c]
push 0
push eax
call fcn.004ab450
add esp, 0xc
push 0x3ff
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1020]
push 0x400
push edx
call fcn.004a9be0
lea eax, [esp + 0x1028]
push 0x5c
push eax
call fcn.004a9ce4
add esp, 0x18
test eax, eax
je 0x414b8d
add eax, 2
jmp 0x414b94
lea eax, [esp + 0x1018]
mov ecx, edi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x414ba0
sub ecx, esi
sar ecx, 1
je 0x414bd6
mov ecx, edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x414bb6
sub ecx, esi
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x414bd6
push eax
push edi
push str._s_s
jmp 0x414bdd
push eax
push edi
push 0x4dd780
lea edx, [esp + 0x824]
call fcn.00411a00
add esp, 0xc
push 0
push 1
lea ecx, [esp + 0x820]
call fcn.0045d900
push 0
push 1
xor ebx, ebx
lea edi, [esp + 0x828]
lea eax, [esp + 0x28]
call fcn.0045cfb0
add esp, 0x10
test eax, eax
jne 0x414c46
test ebp, ebp
mov eax, 0x4dea94
je 0x414c27
mov eax, 0x4dced4
lea ecx, [esp + 0x818]
push ecx
push eax
push 0x4dea98
mov ecx, 0x527b30
call fcn.00449000
add esp, 0xc
mov al, 1
jmp 0x414c77
test ebp, ebp
mov ecx, 0x4dea94
je 0x414c54
mov ecx, 0x4dced4
lea edx, [esp + 0x818]
push edx
push ecx
push str.Create__sFXML_FAIL_____:__s
mov ecx, eax
mov edx, 0x527b30
call fcn.00448ec0
add esp, 0xc
mov al, 1
jmp 0x414c77
xor al, al
mov ecx, dword [esp + 0x181c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a998e
add esp, 0x1810
ret 4
Function at 0x414ca0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x3010
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x300c], eax
test esi, esi
push ebp
mov ebp, dword [esp + 0x3018]
push edi
mov dword [esp + 0xc], 0
je 0x414ec5
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414cd6
sub eax, edx
sar eax, 1
je 0x414ec5
test ebp, ebp
je 0x414ec5
mov eax, ebp
lea edx, [eax + 2]
jmp 0x414d00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414d00
sub eax, edx
sar eax, 1
je 0x414ec5
test ebx, ebx
je 0x414ec5
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414d22
sub eax, edx
sar eax, 1
je 0x414ec5
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414ec5
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004ab450
add esp, 0xc
push 0x800
lea ecx, [esp + 0x814]
push 0
push ecx
call fcn.004ab450
add esp, 0xc
cmp byte [0x52c25c], 0
push 0x400
je 0x414daa
lea edx, [esp + 0x14]
push edx
push str.config_file_64
mov edx, 0x4deb24
mov ecx, 0x52895c
call fcn.0044e2b0
test eax, eax
je 0x414ddb
push 0x800
push 0
lea eax, [esp + 0x18]
push eax
jmp 0x414dd3
lea ecx, [esp + 0x14]
push ecx
push str.config_file_32
mov edx, 0x4deb24
mov ecx, 0x52895c
call fcn.0044e2b0
test eax, eax
je 0x414ddb
push 0x800
push 0
lea edx, [esp + 0x18]
push edx
call fcn.004ab450
add esp, 0xc
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414de2
sub eax, edx
sar eax, 1
jne 0x414dfd
mov eax, 2
jmp 0x414eca
push 0
push 0x400
push 0x527d38
lea edi, [esp + 0x81c]
lea edx, [esp + 0x1c]
call fcn.00458ee0
test eax, eax
je 0x414e37
push 0x3ff
lea eax, [esp + 0x14]
push eax
mov ecx, edi
push 0x400
push ecx
call fcn.004a9be0
add esp, 0x10
push 0x2000
lea edx, [esp + 0x1014]
push 0
push edx
call fcn.004ab450
add esp, 0xc
push ebx
push ebp
push esi
push str._d__s___o__s___f__s_
lea eax, [esp + 0x1020]
push 0x1000
push eax
call fcn.004a9ca9
lea ecx, [esp + 0x1028]
push ecx
lea edx, [esp + 0x82c]
push edx
push str.Call_DCU_Update_Configuration:___s___s_
mov ecx, 0x527b30
call fcn.00449000
add esp, 0x24
push 0
lea eax, [esp + 0x10]
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x101c]
lea ecx, [esp + 0x81c]
call fcn.004414b0
add esp, 0xc
test eax, eax
je 0x414ebf
push str.Run_Execute_fail__
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x414eca
mov eax, 0x57
mov ecx, dword [esp + 0x3014]
pop edi
pop ebp
xor ecx, esp
call fcn.004a998e
add esp, 0x3010
ret 4
Function at 0x4164c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x110
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push 0x104
lea eax, [esp + 0xc]
push eax
xor esi, esi
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
je 0x416525
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x416525
mov eax, dword [eax + 0xc]
cmp dword [eax], esi
je 0x416525
mov edx, dword [eax]
mov eax, dword [edx]
xor ecx, ecx
mov ch, al
mov edx, eax
shr edx, 0x10
xor ebx, ebx
mov bh, dl
mov cl, ah
shr eax, 0x18
movzx edx, bx
shl ecx, 0x10
or ecx, edx
or ecx, eax
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004a998e
add esp, 0x110
ret

Function at 0x417130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x417149
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x417184
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x417180
lea ebx, [ebx]
cmp esi, eax
jae 0x417184
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x417170
cmp esi, eax
jb 0x41718a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x41cda0
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x3c
push ebx
push edi
push 1
push 0
push 0x11
push 0x10
lea ebx, [esi + 0x1588]
push 0x10
mov ecx, ebx
call fcn.004a16ad
call fcn.0049a770
call fcn.0049a770
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x97
push eax
call edi
mov ecx, dword [esi + 0x158c]
push eax
push ecx
call fcn.0049a770
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.0041d910
call fcn.0049a770
call fcn.0049a770
mov eax, dword [eax + 0xc]
push 0x98
push eax
call edi
mov ecx, dword [esi + 0x158c]
push eax
push ecx
call fcn.0049a770
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.0041d910
call fcn.0049a770
call fcn.0049a770
mov eax, dword [eax + 0xc]
push 0x99
push eax
call edi
mov ecx, dword [esi + 0x158c]
push eax
push ecx
call fcn.0049a770
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.0041d910
call fcn.0049a770
call fcn.0049a770
mov eax, dword [eax + 0xc]
push 0x9a
push eax
call edi
mov ecx, dword [esi + 0x158c]
push eax
push ecx
call fcn.0049a770
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.0041d910
call fcn.0049a770
call fcn.0049a770
mov eax, dword [eax + 0xc]
push 0x9b
push eax
call edi
mov ecx, dword [esi + 0x158c]
push eax
push ecx
call fcn.0049a770
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.0041d910
test ebx, ebx
je 0x41cea5
mov ebx, dword [ebx + 4]
mov edx, dword [esi + 0x1554]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 1
push 0x1003
push edx
call edi
push eax
call fcn.004a15fb
mov ecx, dword [esi + 0x1554]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 8]
mov ecx, dword [esi + 0x1554]
lea eax, [esp + 0x18]
push eax
push 0
push 0x1061
sub edx, 0xa
push ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], 0x4dd578
call edi
pop edi
pop ebx
add esp, 0x3c
ret
Function at 0x41f1a0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x210
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x20c], eax
test ebx, ebx
mov dword [esp], 0
mov dword [esp + 4], 0
je 0x41f30c
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f1d0
sub eax, edx
sar eax, 1
je 0x41f30c
mov al, byte [esp + 0x214]
mov edx, dword [esi]
push 0
mov byte [esi + 0x2ac], al
mov eax, dword [edx + 0x134]
push 0x66
mov ecx, esi
call eax
test eax, eax
jne 0x41f210
push str._r_n__________________Create_Main_Windows_fail______r_n
jmp 0x41f311
push 0x200
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.004ab450
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str..pipeSEI_Flow_Pipe_d
push str._s_d
lea edx, [esp + 0x18]
call fcn.0040bfd0
add esp, 0xc
push 0x1000
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x41f278
push str.Create_Flow_Pipe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, 0x527b30
call fcn.00448ec0
jmp 0x41f31b
mov eax, dword [esp]
mov ecx, dword [esp + 4]
push edi
push 0xff
push ebx
lea edx, [esi + 0x8c]
push 0x100
lea edi, [esi + 0x84]
push edx
mov dword [esi + 0x294], ecx
mov dword [esi + 0x290], eax
mov dword [edi], eax
mov dword [esi + 0x88], esi
call fcn.004a9be0
add esp, 0x10
push 0
push 0
push 0
push 0
push edi
push 0x41f340
call fcn.00499e6b
test eax, eax
mov dword [esi + 0x28c], eax
pop edi
jne 0x41f2e4
push str.Init_Flow_Thread_fail___
mov ecx, 0x527b30
call fcn.00449000
add esp, 4
xor edx, edx
xor ecx, ecx
mov eax, esi
call fcn.0041f7e0
neg al
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a998e
add esp, 0x210
ret 4
push str.Flow_name_is_not_vaild__
mov ecx, 0x527b30
call fcn.00449000
mov ecx, dword [esp + 0x210]
add esp, 4
xor ecx, esp
xor eax, eax
call fcn.004a998e
add esp, 0x210
ret 4

Function at 0x41f7e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [eax + 0x294]
sub esp, 0x10
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x41f7f7
xor al, al
pop ebx
add esp, 0x10
ret
push ebx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x14], edx
push 0xc
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41f828
mov bl, 1
mov al, bl
pop ebx
add esp, 0x10
ret
push str.WriteFile_of_Flow_Pipe_Data
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, 0x527b30
call fcn.00448ec0
add esp, 4
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x4248a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push edi
xor edi, edi
mov eax, ebx
mov dword [esp + 0x14], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4248b2
sub eax, edx
sar eax, 1
jne 0x4248ce
pop edi
mov eax, 0x57
pop ebp
pop ecx
ret 8
push esi
push edi
push 0x80
push 4
push edi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x424939
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x424929
cmp ebp, edi
je 0x424929
push edi
lea ecx, [esp + 0x1c]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x424929
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
push str.Write_file_fail_____s_
mov ecx, edi
mov edx, 0x527b30
call fcn.00448ec0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebp
pop ecx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
push str.Create_file_fail_____s_
mov ecx, edi
mov edx, 0x527b30
call fcn.00448ec0
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebp
pop ecx
ret 8
Function at 0x4267e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce080
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2808
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.00424960
test al, al
je 0x426a53
push str.this_file_is_compressed_file___
mov ecx, 0x527b30
call fcn.00449000
push 0x800
push 0
lea eax, [ebp - 0x1814]
push eax
call fcn.004ab450
push 0x800
push 0
lea ecx, [ebp - 0x814]
push ecx
call fcn.004ab450
add esp, 0x1c
lea edx, [ebp - 0x1814]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x42688f
push 0x800
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.004ab450
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x1814]
push ecx
push str._s_04x
lea edx, [ebp - 0x814]
call fcn.00411a00
push 0
push 1
lea ecx, [ebp - 0x814]
call fcn.0045d900
add esp, 0x14
lea ecx, [ebp - 0x814]
call fcn.00423c90
test al, al
jne 0x4268f6
push str.Extract_files_to_fail___
mov ecx, 0x527b30
call fcn.00449000
push 0
push 1
lea ecx, [ebp - 0x814]
call fcn.0045d900
add esp, 0xc
mov al, 1
jmp 0x426a55
push 0x800
push 0
lea edx, [ebp - 0x2014]
push edx
call fcn.004ab450
push 0x800
push 0
lea eax, [ebp - 0x2814]
push eax
call fcn.004ab450
push 0x800
push 0
lea ecx, [ebp - 0x1014]
push ecx
call fcn.004ab450
add esp, 0x24
push str.INSTALLERFILE
mov ecx, 0x400
lea edx, [ebp - 0x2014]
call fcn.004247a0
test eax, eax
je 0x426969
push 0x3ff
push 0x4e502c
push 0x400
lea edx, [ebp - 0x2014]
push edx
call fcn.004a9be0
add esp, 0x10
lea eax, [ebp - 0x2014]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0x4dd780
lea edx, [ebp - 0x2814]
call fcn.00411a00
add esp, 0xc
push str.COMMAND
mov ecx, 0x400
lea edx, [ebp - 0x1014]
call fcn.004247a0
test eax, eax
je 0x4269b9
push 0x800
push 0
lea edx, [ebp - 0x1014]
push edx
call fcn.004ab450
add esp, 0xc
mov eax, dword [esi + 0x48]
test eax, eax
je 0x426a00
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4269c3
sub eax, edx
sar eax, 1
je 0x426a00
push 0x3ff
push 0x4e5040
push 0x400
lea eax, [ebp - 0x1014]
push eax
call fcn.004a9dea
add esp, 0x10
mov eax, dword [esi + 0x48]
lea ecx, [ebp - 0x1014]
call fcn.0040bfb0
push 0
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x1014]
lea ecx, [ebp - 0x2814]
call fcn.004414b0
push 0
push 1
lea ecx, [ebp - 0x814]
call fcn.0045d900
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x426a55
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a998e
mov esp, ebp
pop ebp
ret