joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d85a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40d904
cmp dword [ebp + 0xc], ebx
je 0x40d904
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push str.hao123Juzi.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x40d900
lea eax, [ebp - 0x208]
push eax
push 0x4260b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 1
pop ebx
mov eax, ebx
jmp 0x40d906
xor eax, eax
pop ebx
leave
ret 8

Function at 0x40d90b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40d98a
cmp dword [ebp + 0xc], esi
je 0x40d98a
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
pop edi
je 0x40d986
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Uninst.exe
lea eax, [ebp - 0x208]
push str.hao123JuziBrowser
push eax
push str._s_s_s
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x18
push 1
pop esi
mov eax, esi
jmp 0x40d98c
xor eax, eax
pop esi
leave
ret 8
Function at 0x40dd5d
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40dde4
cmp dword [ebp + 0xc], esi
je 0x40dde4
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], si
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push str._uppath:
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00402ad1
add esp, 0x10
test eax, eax
pop edi
je 0x40dde0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dde0
lea eax, [ebp - 0x208]
push eax
push 0x4260b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 1
pop esi
mov eax, esi
jmp 0x40dde6
xor eax, eax
pop esi
leave
ret 8

Function at 0x40ded9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 1
lea eax, [ebp - 4]
pop esi
push eax
push str._nadmin:
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00402b7f
add esp, 0xc
test eax, eax
je 0x40df03
xor esi, esi
mov eax, esi
pop esi
leave
ret

Function at 0x40df08
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x40df38
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x40df2c
push 1
pop esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x410066
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0xc], esi
je 0x41019a
cmp dword [ebp + 0xc], esi
je 0x41019a
push ebx
push edi
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x8e]
mov word [ebp - 0x90], si
cmp dword [ebp + 0x10], esi
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 1
stosw word es:[edi], ax
pop edi
mov dword [ebp - 4], 0x7e
mov dword [ebp - 8], edi
jne 0x4100e8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 8]
push eax
push 0x42a560
push str.Softwarehao123JuziBrowser
push SysReAllocString
call ebx
test eax, eax
jne 0x4100e8
cmp word [ebp - 0x90], si
jne 0x410175
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
push esi
push eax
push 0x40fff0
push esi
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x493e0
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x410163
push 0x80
lea eax, [ebp - 0x90]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x7e
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 8]
push eax
push 0x42a560
push str.Softwarehao123JuziBrowser
push SysReAllocString
call ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x90], si
je 0x410193
lea eax, [ebp - 0x90]
push eax
push 0x4260b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
jmp 0x41019c
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x4101a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push 1
xor eax, eax
cmp dword [ebp + 8], eax
pop edx
mov dword [ebp - 0xc], edx
je 0x41028c
cmp dword [ebp + 0xc], eax
je 0x41028c
push ebx
push esi
push edi
push 0x1f
pop ecx
lea edi, [ebp - 0x8a]
mov word [ebp - 0x8c], ax
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov ebx, 0x428f44
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 4]
push eax
mov edi, str.Softwarehao123JuziBrowser
push ebx
push edi
push SysReAllocString
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0x7e
call esi
test eax, eax
jne 0x41021a
cmp word [ebp - 0x8c], ax
jne 0x410269
push 0x80
lea eax, [ebp - 0x8c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x7e
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x410263
cmp word [ebp - 0x8c], ax
jne 0x410269
and dword [ebp - 0xc], 0
jmp 0x410284
lea eax, [ebp - 0x8c]
push eax
push 0x4260b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
jmp 0x41028e
mov eax, edx
leave
ret 8
Function at 0x4104b5
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x46
pop ecx
xor eax, eax
lea edi, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x140]
push eax
call esi
test eax, eax
jne 0x410505
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x114
push eax
call esi
test eax, eax
je 0x41059e
mov eax, dword [ebp - 0x130]
xor ecx, ecx
sub eax, ecx
je 0x41059e
dec eax
je 0x41059e
dec eax
jne 0x41059e
cmp dword [ebp - 0x13c], 6
jne 0x410549
mov eax, dword [ebp - 0x138]
cmp eax, 2
je 0x410538
cmp eax, 3
jne 0x41053c
mov al, 3
jmp 0x4105a0
cmp eax, 1
je 0x410545
cmp eax, ecx
jne 0x41059e
mov al, 2
jmp 0x4105a0
cmp dword [ebp - 0x13c], 5
jne 0x41059e
cmp dword [ebp - 0x138], 2
jne 0x410593
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], 0x24
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41059e
cmp byte [ebp - 0x26], 1
jne 0x41059e
cmp word [ebp - 0x24], 9
jne 0x41059e
mov al, 1
jmp 0x4105a0
cmp dword [ebp - 0x138], 1
mov al, 1
je 0x4105a0
mov al, 4
pop edi
pop esi
leave
ret

Function at 0x41061a
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
and word [ebp - 0x294], 0
push esi
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x292]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 4]
push eax
push 0x42a560
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push SysReAllocString
mov dword [ebp - 8], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x410703
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410703
and word [ebp - 0x88], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x86]
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
je 0x410703
mov esi, dword [sym.imp.MSVCRT.dll_wcschr]
lea eax, [ebp - 0x88]
push 0x2e
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x410703
add eax, 2
push 0x2e
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x410703
and word [eax], 0
lea eax, [ebp - 0x88]
push eax
push 0x4260b8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 1
pop eax
jmp 0x410705
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x4115c9
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x6c]
cmp eax, edi
jne 0x4115db
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4115f1
mov ecx, esi
call fcn.004116cb
test eax, eax
je 0x41161d
mov ecx, esi
call fcn.00411855
test eax, eax
je 0x411634
mov ecx, esi
call fcn.004122db
cmp dword [esi + 0x2c], edi
je 0x41160f
mov ecx, esi
call fcn.00413216
push 3
mov ecx, esi
call fcn.004150cb
push 1
pop edi
jmp 0x411649
push 1
mov ecx, esi
call fcn.004150cb
call fcn.0040e275
mov dword [eax + 0xc], 0x68
jmp 0x41163d
push 2
mov ecx, esi
call fcn.004150cb
call fcn.00413ee3
mov ecx, eax
call fcn.00414073
mov eax, edi
pop edi
pop esi
ret
Function at 0x4116cb
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
and word [ebp - 0x694], 0
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, 0x81
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x692]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x694]
mov esi, 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x411850
and word [ebp - 0x284], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x282]
rep stosd dword es:[edi], eax
and dword [ebp - 0x18], 0
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x41177c
and word [ebp - 0x7c], ax
push 0x18
pop ecx
lea edi, [ebp - 0x7a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push 0x32
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x41179c
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x694]
push str.JuziBrowser
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x284]
push eax
call fcn.004014a3
test eax, eax
pop ecx
je 0x41184d
and word [ebp - 0x48c], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x48a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
push eax
push str._sdhres.tmp
lea eax, [ebp - 0x48c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x84
lea eax, [ebp - 0x48c]
push 0x429804
push eax
call fcn.00402990
add esp, 0x1c
test eax, eax
je 0x41184d
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.00402d59
pop ecx
test eax, eax
pop ecx
je 0x41184d
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x284]
push eax
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x68]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411ee9
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 8], ebx
cmp dword [edi + 0x18], ebx
jne 0x411f95
call fcn.0040ce1c
cmp dword [eax + 8], 3
je 0x411f95
push esi
mov esi, dword [esp + 0x14]
push esi
push 2
push 0x421750
mov ecx, edi
call fcn.00411f9d
mov ecx, dword [esi + 4]
mov edi, 0x420
cmp ecx, ebx
je 0x411f42
mov eax, dword [esi + 8]
sub eax, ecx
mov ecx, edi
cdq
idiv ecx
test eax, eax
je 0x411f42
mov dword [esp + 0xc], 1
push ebp
mov dword [esp + 0x18], ebx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x411f79
mov eax, dword [esi + 8]
mov ebp, edi
sub eax, ecx
cdq
idiv ebp
cmp dword [esp + 0x18], eax
jae 0x411f79
lea eax, [ebx + ecx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411f74
inc dword [esp + 0x18]
add ebx, edi
jmp 0x411f47
and dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0
pop ebp
jne 0x411f8e
push dword [esi + 8]
mov ecx, esi
push dword [esi + 4]
call fcn.0041388e
mov eax, dword [esp + 0xc]
pop esi
jmp 0x411f97
xor eax, eax
pop edi
pop ebx
pop ecx
ret 4
Function at 0x4122db
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call fcn.004134b5
mov eax, dword [esi + 0x18]
push 4
test eax, eax
pop edi
je 0x412396
cmp eax, edi
je 0x412396
lea eax, [ebp - 0x18]
and dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
mov esi, str.Softwarehao123JuziBrowser
push str.firstrun
mov ebx, SysReAllocString
push esi
push ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41234f
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push edi
push eax
push edi
push str.firstrun
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 8]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push str.favimport
push esi
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x412480
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push str.favimport
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x412480
lea eax, [ebp - 0x10]
push edi
push eax
push edi
mov esi, str.Softwarehao123JuziBrowser
push str.firstrun
mov ebx, SysReAllocString
push esi
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and word [ebp - 0x224], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x224]
push 0x103
push eax
call fcn.0040383d
pop ecx
test eax, eax
pop ecx
je 0x41243c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
shl eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
push 1
push str.lastdefbrowser
push esi
push ebx
call edi
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
push 1
push str.lastdefbrowser
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
jmp 0x412442
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 8]
xor eax, eax
push 4
cmp dword [ecx + 0x18], eax
sete al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.favimport
push esi
push ebx
call edi
call fcn.0040ce1c
mov eax, dword [eax + 0xc]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push str.sltinst
push esi
push ebx
call edi
push 4
pop edi
call fcn.0040e275
mov ecx, eax
call fcn.0040efa8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push edi
push eax
push edi
push str.lastinsttype
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4126c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
xor edx, edx
cmp esi, edx
je 0x412737
cmp word [esi], dx
je 0x412737
cmp dword [ecx + 0x14], 8
jge 0x412737
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x28
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0x10
neg eax
sbb eax, eax
pop edi
inc eax
jmp 0x41273a
push 1
pop eax
pop esi
leave
ret 4

Function at 0x412aab
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
cmp ecx, esi
je 0x412b28
cmp word [ecx], si
je 0x412b28
push edi
xor eax, eax
lea edi, [ebp - 0x22]
mov word [ebp - 0x24], si
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 3
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 8], esi
stosd dword es:[edi], eax
lea edi, [ebp - 4]
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
pop edi
je 0x412b24
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 0x14
pop ecx
call fcn.0041fce0
cmp eax, dword [ebp + 0xc]
jbe 0x412b24
push 1
pop esi
mov eax, esi
jmp 0x412b2a
xor eax, eax
pop esi
leave
ret 8
Function at 0x412b2f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp eax, ebx
je 0x412cc3
cmp word [eax], bx
je 0x412cc3
cmp dword [ecx + 0x14], 8
jl 0x412cc3
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x38a]
mov word [ebp - 0x38c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x38c]
push 0x24
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x102]
mov word [ebp - 0x104], bx
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push str._c:Program_Files
lea eax, [ebp - 0x104]
push 0x3f
push eax
call esi
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x182]
mov word [ebp - 0x184], bx
push 0x1f
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push str._c:Program_Files__x86_
lea eax, [ebp - 0x184]
push 0x3f
push eax
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x592]
mov word [ebp - 0x594], bx
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x594]
push 0x28
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x82]
mov word [ebp - 0x84], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x594]
push eax
push 0x4260b8
lea eax, [ebp - 0x84]
push 0x3f
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x38c]
push edi
push eax
mov ecx, esi
call fcn.00412cca
test eax, eax
jne 0x412cba
lea eax, [ebp - 0x104]
push edi
push eax
mov ecx, esi
call fcn.00412cca
test eax, eax
jne 0x412cba
lea eax, [ebp - 0x184]
push edi
push eax
mov ecx, esi
call fcn.00412cca
test eax, eax
jne 0x412cba
lea eax, [ebp - 0x84]
push edi
push eax
mov ecx, esi
call fcn.00412cca
test eax, eax
je 0x412cbd
lea eax, [ebp - 0x594]
push edi
push eax
mov ecx, esi
call fcn.00412cca
test eax, eax
jne 0x412cbd
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
jmp 0x412cc5
xor eax, eax
pop ebx
leave
ret 4
Function at 0x412d78
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x208
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x81
mov ebx, dword [ebp + 0x20]
lea edi, [esp + 0x12]
neg ebx
sbb ebx, ebx
and word [esp + 0x10], 0
xor eax, eax
add ebx, reloc.OLEAUT32.dll_SysReAllocString
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x7c]
test eax, eax
jne 0x412db2
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push str.InstallerUninst.exe
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallC5E2255C_66FA_4187_8EB6_5176247C4723
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, 0x4297bc
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push str.DisplayName
push esi
push ebx
call edi
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp + 0x90]
test ecx, ecx
jne 0x412e08
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push str.DisplayIcon
push esi
push ebx
call edi
mov eax, dword [ebp + 0x50]
mov ebp, dword [ebp + 0x4c]
test ebp, ebp
jne 0x412e27
mov ebp, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebp
push 1
push str.DisplayVersion
push esi
push ebx
call edi
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x429af8
call ebp
pop ecx
shl eax, 1
push eax
push 0x429af8
push 1
push str.Publisher
push esi
push ebx
call edi
push str.http:__www.123juzi.com_
call ebp
pop ecx
shl eax, 1
push eax
push str.http:__www.123juzi.com_
push 1
push str.HelpLink
push esi
push ebx
call edi
lea eax, [esp + 0x10]
push eax
call ebp
pop ecx
shl eax, 1
push eax
lea eax, [esp + 0x14]
push eax
push 1
push str.UninstallString
push esi
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret