joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406e], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.timecraft
push str.named
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401188
xor eax, eax
jmp 0x4011a3
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x406200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4063b4
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x4063b4
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4063b4
call fcn.00453dc3
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x406246
call fcn.00453dc3
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x68]
call fcn.00453dc3
mov dword [eax + 0xc], edi
call fcn.00453dc3
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x406271
mov eax, dword [esi + 0x60]
push eax
push str.Cound_not_find_dialog_resource_in_resource_chain_for_ID__d
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret
mov ax, word [esi + 0x6c]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceExA]
xor ecx, ecx
push eax
mov cx, word [esi + 0x60]
mov word [esi + 0x6e], ax
push ecx
push 5
push edi
call ebp
test eax, eax
jne 0x4062c6
mov ax, word [esi + 0x6c]
xor edx, edx
mov dx, word [esi + 0x60]
and eax, 0x3ff
or ah, 4
push eax
push edx
push 5
push edi
mov word [esi + 0x6e], ax
call ebp
test eax, eax
jne 0x4062c6
mov ax, word [esi + 0x60]
push 0x400
push eax
push 5
push edi
mov word [esi + 0x6e], 0x400
call ebp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esi + 0x64], eax
jne 0x4062df
push str.Cound_not_load_dialog_template
jmp 0x40639e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4062f8
push str.Cound_not_lock_dialog_template
jmp 0x40639e
cmp word [eax + 2], 0xffff
jne 0x406399
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x406312
or dword [eax + 8], 0x402000
mov cx, word [esi + 0x6e]
xor edx, edx
mov dx, word [esi + 0x60]
push ebx
push ecx
push edx
xor ebx, ebx
push 0xf0
push edi
mov dword [esi + 0x68], ebx
call ebp
test eax, eax
je 0x406344
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esi + 0x68], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov edi, dword [esp + 0x10]
xor eax, eax
mov ax, word [esi + 0x6e]
push eax
push eax
mov eax, dword [esi + 0x78]
push ebx
push eax
push edi
push str.Init_create_dialog_indirect_with___p___p___p__for_langid_d__0x_x_n
push 0x80
push 0x4788a8
call fcn.0041f763
mov eax, dword [esi + 0x70]
add esp, 0x20
test eax, eax
push ebx
je 0x406387
mov ecx, dword [esi + 0x78]
push ecx
push edi
mov ecx, esi
call fcn.0044e167
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov edx, dword [esi + 0x78]
mov ecx, esi
push edx
push edi
call fcn.0044de7a
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push str.Dialog_template_is_not_DIALOGEX._Please_change_it_for_RTL_language_compatibility.
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x40ad15
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4573a8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
push str.CProcessIssue::ResolveIssue___n
push 2
mov edi, ecx
push 0x4788a8
call fcn.0041f763
mov eax, dword [edi + 0x98]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
xor ebx, ebx
and esi, 9
cmp eax, ebx
je 0x40ae1f
cmp dword [esp + 0x2c], ebx
jne 0x40acdd
cmp dword [edi + 0xa8], 3
jne 0x40ae1f
mov eax, dword [edi + 0x84]
mov ecx, dword [edi + 0x80]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00409890
add esp, 0xc
mov eax, dword [eax + 4]
mov dword [esp + 0x24], ebx
cmp eax, ebx
jne 0x40ad08
mov eax, 0x45b980
push eax
lea eax, [edi + 0x12c]
push eax
push str.Terminating_proces__s_version__I64X_n
push 0x41
push 0x4788a8
call fcn.0041f763
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, ebx
mov dword [esp + 0x24], 0xffffffff
je 0x40ad51
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x40ad48
cmp al, 0xff
je 0x40ad48
dec al
mov byte [ecx], al
jmp 0x40ad51
push ecx
call fcn.0044d4f6
add esp, 4
mov ecx, dword [edi + 0x110]
mov dword [esp + 0x10], ebx
push ecx
push ebx
push 0x1f0fff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
jne 0x40adb5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call sym.HPZshl01.exe_char_const____cdecl_GetErrorString_long_int_
add esp, 4
push eax
push str.OpenProcess_PROCESS_ALL_ACCESS__so_no_kill
push str._s_failed_returning__s_n
push 0x4788a8
call fcn.0041f963
add esp, 0x10
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40aded
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x6c]
xor esi, esi
cmp eax, ebx
jne 0x40add6
mov eax, 0x45b980
push eax
push str.Terminated_process__s_n
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0x10
jmp 0x40ae17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi + 0x6c]
cmp eax, ebx
jne 0x40ae01
mov eax, 0x45b980
push esi
push eax
push str.__Cannot_terminate__s_error___d_n
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0x14
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 0x18]
push str.CProcessIssue::ResolveIssue___n
push 2
push 0x4788a8
call fcn.0041f763
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x40b9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ebp, dword [0x478664]
push esi
push ebx
mov dword [esp + 0x18], eax
call ebp
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 4]
cmp ecx, eax
jne 0x40ba53
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call ebp
test eax, eax
je 0x40baaa
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 4]
cmp eax, edx
je 0x40ba6d
call edi
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
ja 0x40ba8b
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 4]
cmp ecx, eax
je 0x40ba1e
call edi
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x24]
sub eax, esi
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, 0x5b4
pop ebx
pop ecx
ret
push str._Service_successfully_transitioned.
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0xc
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push str.__Service_attempting_to_start_stop.__Service_found_to_be_pending_a_stop_event_and_timed_out_waiting_for_the_service_to_start_stop.
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0xc
mov eax, 0x5b4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.__Service_attempting_transition.__Service_found_to_be_pending_a_start_stop_event_and_QueryServiceStatus_failed.
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x410616
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
mov eax, dword [esi + 0x10c]
test eax, eax
jne 0x410628
mov eax, 0x45b980
push eax
push str.CFolderIssue::IsPresent__s__n
push 0x42
push 0x4788a8
call fcn.0041f763
mov eax, dword [esi + 0xa8]
add esp, 0x10
cmp eax, 4
jne 0x410652
xor eax, eax
pop esi
add esp, 0x104
ret
mov dword [esi + 0x98], 0
mov eax, dword [esi + 0x10c]
test eax, eax
mov edx, 0x45b980
je 0x41066d
mov edx, eax
mov al, byte [0x48840c]
push edi
mov byte [esp + 8], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0
stosw word es:[edi], ax
push ecx
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
je 0x4106e9
mov edx, dword [esi + 0xb0]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [esi + 0x98], eax
je 0x41072f
mov eax, dword [esi + 0x10c]
mov ecx, 0x45b980
test eax, eax
je 0x4106d4
mov ecx, eax
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x4106e0
mov eax, 0x45b980
push ecx
push eax
push str.Found__s._Folder_s__n
jmp 0x410720
cmp dword [esi + 0xb0], 3
jne 0x41072f
mov dword [esi + 0x98], 1
mov eax, dword [esi + 0x10c]
test eax, eax
mov ecx, 0x45b980
je 0x41070d
mov ecx, eax
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x410719
mov eax, 0x45b980
push ecx
push eax
push str.Found__s_issue._Folder__s_does_not_exist_n
push 0x41
push 0x4788a8
call fcn.0041f763
add esp, 0x14
push str.CFolderIssue::IsPresent___n
push 4
push 0x4788a8
call fcn.0041f763
mov eax, dword [esi + 0x98]
add esp, 0xc
pop esi
add esp, 0x104
ret

Function at 0x410bbe
Capabilities:
Set file attributes

Disassembly:
push esi
push str.CFileIssue::ResolveIssue___n
push 2
mov esi, ecx
push 0x4788a8
call fcn.0041f763
mov ecx, dword [esi + 0x98]
add esp, 0xc
mov eax, ecx
neg eax
sbb eax, eax
and eax, 9
test ecx, ecx
je 0x410c12
mov edx, dword [esp + 8]
mov ecx, 3
test edx, edx
jne 0x410b93
cmp dword [esi + 0xa8], ecx
jne 0x410c12
cmp dword [esi + 0xb0], ecx
jne 0x410c12
push edi
mov edi, dword [esi + 0x10c]
test edi, edi
jne 0x410bab
mov edi, 0x45b980
push edi
call fcn.0041d3a4
add esp, 4
test eax, eax
je 0x410bf3
push edi
push str.Created_folder__s_n
push 1
push 0x4788a8
call fcn.0041f763
mov eax, dword [esi + 0x118]
add esp, 0x10
test eax, eax
je 0x410c0f
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x410c0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_set_the_hidden_attribute_for__s___error_d_n
jmp 0x410c00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.__Failed_to_create_folder__s___error__d_n
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x418e90
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.CShieldPlugIn::ProcessCommandLine__s__n
push 2
push 0x4788a8
call fcn.0041f763
mov eax, dword [esi + 0x12c]
add esp, 0x10
test eax, eax
jne 0x418ee4
mov eax, dword [esi + 0x108]
test eax, eax
jne 0x418ee4
push str.Shield_plug_in_requires_a_section_name_to_run___
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0xc
mov dword [esi + 0xc0], 0x57
xor eax, eax
pop esi
ret
push str.CShieldPlugIn::ProcessCommandLine___n
push 4
push 0x4788a8
call fcn.0041f763
add esp, 0xc
mov eax, 1
pop esi
ret
Function at 0x41bf30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
push edi
push ebx
push ebp
push esi
push str.VerifyInfAndVersion___s___I64X_
push 2
push 0x4788a8
call fcn.0041f763
mov al, byte [0x48840c]
mov ecx, 0x40
mov byte [esp + 0x28], al
xor eax, eax
lea edi, [esp + 0x29]
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0
stosw word es:[edi], ax
push ecx
push 0x104
push esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push esi
je 0x41c00d
call fcn.0041c170
add esp, 4
cmp edx, ebx
jl 0x41bff2
jg 0x41bfb5
cmp eax, ebp
jb 0x41bff2
push ebx
push ebp
push edx
push eax
push esi
push str.File__s_exists_and_is_correct_version_I64X.__minVersion_I64X
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x20
push str.VerifyDriverAndVersion____returns_TRUE
push 4
push 0x4788a8
call fcn.0041f763
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push ebx
push ebp
push edx
push eax
push esi
push str.File__s_exists_and_is_INCORRECT_version_I64X.__minVersion_I64X
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x20
jmp 0x41c021
push str.File__s_does_not_exist
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x10
push str.VerifyDriverAndVersion____returns_FALSE
push 4
push 0x4788a8
call fcn.0041f763
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x41c050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
push edi
push ebx
push ebp
push esi
push str.VerifyDriverAndVersion___s___I64X_
push 2
push 0x4788a8
call fcn.0041f763
mov al, byte [0x48840c]
mov ecx, 0x40
mov byte [esp + 0x28], al
xor eax, eax
lea edi, [esp + 0x29]
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0
stosw word es:[edi], ax
push ecx
push 0x104
push esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push esi
je 0x41c12d
call fcn.00427582
add esp, 4
cmp edx, ebx
jl 0x41c112
jg 0x41c0d5
cmp eax, ebp
jb 0x41c112
push ebx
push ebp
push edx
push eax
push esi
push str.File__s_exists_and_is_correct_version_I64X.__minVersion_I64X
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x20
push str.VerifyDriverAndVersion____returns_TRUE
push 4
push 0x4788a8
call fcn.0041f763
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push ebx
push ebp
push edx
push eax
push esi
push str.File__s_exists_and_is_INCORRECT_version_I64X.__minVersion_I64X
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x20
jmp 0x41c141
push str.File__s_does_not_exist
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x10
push str.VerifyDriverAndVersion____returns_FALSE
push 4
push 0x4788a8
call fcn.0041f763
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x41c170
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x114
mov al, byte [0x48840c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov byte [esp + 0x20], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x24]
push 0x104
push ecx
stosw word es:[edi], ax
push 0x48840c
xor ebx, ebx
push str.DriverVer
push str.Version
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x41c278
lea edx, [esp + 0x20]
push esi
push edx
push str.Read_DriverVer_s_from__s
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x30]
push str._d__d__d___d._d._d._d
push ecx
call fcn.0043719f
add esp, 0x18
cmp eax, 4
je 0x41c294
push str.Error_reading_DriverVer_in_normal_method
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x30]
push str._d._d._d._d
push eax
call fcn.0043719f
add esp, 0x18
cmp eax, 4
jge 0x41c294
push str.__Error_getting_DriverVer_from_the_DAT_file
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0xc
xor edi, edi
xor esi, esi
xor eax, eax
mov dword [esp + 0x18], ebx
jmp 0x41c2a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.__Could_not_get_DriverVer_from__s._GetLastError___d
push 1
push 0x4788a8
call fcn.0041f763
add esp, 0x14
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
and eax, 0xffff
push ebx
mov ebp, eax
push 0x10000
push ebx
mov dword [esp + 0x1c], ebp
push ecx
xor ebp, ebp
call fcn.00437e90
mov ecx, dword [esp + 0x10]
push 0
add ecx, eax
push 0x10000
adc ebp, edx
push ebp
push ecx
call fcn.00437e90
and esi, 0xffff
xor ecx, ecx
add eax, esi
push ecx
adc edx, ecx
push 0x10000
push edx
push eax
call fcn.00437e90
and edi, 0xffff
xor ecx, ecx
add eax, edi
pop edi
pop esi
pop ebp
adc edx, ecx
pop ebx
add esp, 0x114
ret
Function at 0x41d3a4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41d3bc
push str.Trying_to_create_folder_with_pFolder__NULL___
jmp 0x41d3cc
push esi
call fcn.004386d0
test eax, eax
pop ecx
jne 0x41d3e0
push str.Trying_to_create_folder_with_pFolder_______
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0xc
jmp 0x41d492
push esi
call fcn.0041d497
test eax, eax
pop ecx
je 0x41d3f3
push 1
pop eax
jmp 0x41d494
mov al, byte [0x48840c]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.0041d4ed
lea eax, [ebp - 0x104]
push eax
call fcn.0041d3a4
add esp, 0x10
test eax, eax
pop edi
je 0x41d477
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41d459
push esi
push str.Created_folder__s
push 0x20
push 0x4788a8
call fcn.0041f763
add esp, 0x10
jmp 0x41d3eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateDirectory___s__failed.__error0x_x_n
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0x14
jmp 0x41d492
lea eax, [ebp - 0x104]
push eax
push str.CreateDirectory___s__failed.
push 8
push 0x4788a8
call fcn.0041f763
add esp, 0x10
xor eax, eax
pop esi
leave
ret

Function at 0x41d497
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x48840c]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
leave
ret

Function at 0x41e5a9
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call ebx
push eax
mov esi, 0x4788a8
push str._s__u_WAITs_for_the_spooler_mutex_n
push esi
call fcn.0041f7d9
add esp, 0x10
mov ecx, ebp
push 0xffffffffffffffff
call sym.HPZshl01.exe_public:_long_int___thiscall_CInfrastructureMutex::Wait_unsigned_long_int_
test eax, eax
je 0x41e5f0
push str.Failure_on_waiting_for_the_spooler_mutex_n
push esi
call fcn.0041f963
pop ecx
pop ecx
jmp 0x41e604
call edi
push eax
call ebx
push eax
push str._s__u_GETs_the_spooler_mutex_n
push esi
call fcn.0041f7d9
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41e609
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov esi, 0x4788a8
push str._s__u_RELEASEs_the_spooler_mutex_n
push esi
call fcn.0041f7d9
add esp, 0x10
mov ecx, edi
call sym.HPZshl01.exe_public:_unsigned_int___thiscall_CInfrastructureMutex::Release_void_
test eax, eax
jne 0x41e646
push str.Failure_on_releasing_the_spooler_mutex_n
push esi
call fcn.0041f963
pop ecx
pop ecx
pop edi
pop esi
ret
Function at 0x42015f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x4201d3
call sym.HPZshl01.exe_public:_unsigned_int___thiscall_CFactory::InitLanguageMap_void_const
mov eax, dword [ebx + 0x114]
mov esi, dword [eax]
mov eax, dword [ebx + 0x108]
mov eax, dword [eax]
cmp esi, dword [ebx + 0x114]
mov dword [ebp - 4], eax
je 0x4201d3
push dword [ebp + 8]
lea edi, [esi + 8]
call fcn.004386d0
pop ecx
push eax
mov ecx, edi
push dword [ebp + 8]
push dword [edi + 8]
push 0
call fcn.00404100
test eax, eax
je 0x4201b5
mov esi, dword [esi]
mov eax, dword [ebp - 4]
jmp 0x420181
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4201c4
mov eax, 0x45b980
push 0x10
push 0
push eax
call fcn.0043a00c
add esp, 0xc
jmp 0x4201d9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x427582
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x4275c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.HPZshl01.exe_char_const____cdecl_GetErrorString_long_int_
pop ecx
push eax
push str.GetFileVersionInfoSize_failed_with__s_n
push 0x80
push 0x4788a8
call fcn.0041f763
jmp 0x42761f
push eax
call fcn.0044d4cd
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x4275e9
push str.Can_not_allocate_memory._n
push 0x4788a8
call fcn.0041f963
pop ecx
pop ecx
jmp 0x427622
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x427628
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.HPZshl01.exe_char_const____cdecl_GetErrorString_long_int_
pop ecx
push eax
push str.GetFileVersionInfo_failed_with__s_n
push 0x4788a8
call fcn.0041f963
push dword [ebp - 4]
call fcn.0044d4f6
add esp, 0x10
xor eax, eax
xor edx, edx
jmp 0x42768f
push ebx
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
push eax
push 0x46e4f8
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x427660
cmp dword [ebp - 0xc], esi
je 0x427660
mov edx, dword [ebp - 4]
xor ecx, ecx
xor esi, esi
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
or ecx, edx
or eax, esi
mov esi, ecx
mov edi, eax
jmp 0x427682
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.HPZshl01.exe_char_const____cdecl_GetErrorString_long_int_
pop ecx
push eax
push str.VerQueryValue_failed_with__s_n
push 0x4788a8
call fcn.0041f963
add esp, 0xc
xor edi, edi
push ebx
call fcn.0044d4f6
pop ecx
mov edx, edi
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret

Function at 0x4290ad
Capabilities:
Check os version

Disassembly:
cmp dword [0x488be8], 0
jne 0x429141
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov edi, 0x488be8
push edi
mov dword [0x488be8], 0x9c
call esi
test eax, eax
jne 0x4290e5
push edi
mov dword [0x488be8], 0x94
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x42911d
push str.IsWow64Process
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x429116
push 0x488c84
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x488bec], 5
pop edi
pop esi
jne 0x429141
cmp dword [0x488bf0], 2
jne 0x429141
push 1
pop eax
cmp byte [0x488c82], al
jne 0x429141
mov dword [0x488bf0], eax
ret