joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f951
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
mov eax, dword [ebp + 0x3b4]
push ebx
push esi
mov esi, dword [ebp + 0x3bc]
push edi
xor edi, edi
push edi
push edi
push 2
push edi
push 1
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x3b8]
push 0x40000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x40f9aa
xor eax, eax
jmp 0x40fa47
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x5c]
mov ecx, ebx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
call fcn.0040e7a3
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x74]
jb 0x40f9e0
ja 0x40f9a3
cmp ecx, dword [ebp - 0x78]
ja 0x40f9a3
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
push ecx
push dword [ebp - 0x5c]
mov dword [ebp - 0x80], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40fa34
push edi
lea eax, [ebp - 0x64]
push eax
push 0x400
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fa3b
cmp dword [ebp - 0x64], edi
jbe 0x40fa3b
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x70]
add dword [esi], eax
adc dword [esi + 4], edi
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x40f9f7
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x3ac
leave
ret 0xc

Function at 0x412493
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
push 0x64
push str.Space
mov edi, str.SYSTEM
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x18]
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov esi, 0x400
push esi
call fcn.00412171
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebp
push esi
push eax
push 0x45d805
push str.Path
push edi
call ebx
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
call fcn.00405350
mov ecx, dword [esp + 0x20]
push esi
call fcn.00412171
push ebp
push esi
push eax
push str.Setup.exe
push 0x45e190
push edi
call ebx
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
call fcn.00405350
push ebp
push 1
push str.Delete
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ecx, dword [esp + 0x24]
push esi
call fcn.00412171
push ebp
push esi
push eax
push 0x45d805
push str.Param
push edi
call ebx
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
call fcn.00405350
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
Function at 0x4129ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0
push edi
je 0x412adf
cmp byte [esi + 0x42], 0
je 0x412adf
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
cmp di, ax
jne 0x412a09
xor al, al
jmp 0x412ae1
push 0
push 8
lea ecx, [ebp - 0x20]
call fcn.004129a4
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
add edi, ebx
push edi
push dword [ebp - 0x28]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x412a79
dec eax
je 0x412a7d
dec eax
dec eax
je 0x412adb
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004017e8
mov al, bl
pop ebx
jmp 0x412ae1
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0x24]
sub edi, eax
je 0x412abd
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00430820
add esp, 0x10
cmp edi, eax
jne 0x412a66
cmp byte [esi + 0x42], 0
je 0x412adb
test edi, edi
jne 0x412a16
push edi
push 8
lea ecx, [ebp - 0x20]
call fcn.004121f4
jmp 0x412a16
mov bl, 1
jmp 0x412a68
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
leave
ret
Function at 0x412aef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0
je 0x412c01
cmp byte [esi + 0x41], 0
je 0x412c01
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x412b29
xor al, al
jmp 0x412c03
push 0
push 8
lea ecx, [ebp - 0x20]
call fcn.004129a4
push ebx
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
add edi, ebx
push edi
push dword [ebp - 0x28]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x412b9b
dec eax
je 0x412b9f
dec eax
dec eax
je 0x412bfd
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004017e8
pop edi
mov al, bl
pop ebx
jmp 0x412c03
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0x24]
sub edi, eax
je 0x412bdf
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00430820
add esp, 0x10
cmp edi, eax
jne 0x412b87
cmp byte [esi + 0x41], 0
je 0x412bfd
test edi, edi
jne 0x412b37
push edi
push 8
lea ecx, [ebp - 0x20]
call fcn.004121f4
jmp 0x412b37
mov bl, 1
jmp 0x412b89
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429649
leave
ret
Function at 0x413168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x413198
lea eax, [ebp + 8]
push eax
call fcn.00411a7a
pop ecx
jmp 0x413312
mov ecx, dword [esi + 0x24]
xor edx, edx
push ebx
cmp dword [ecx], edx
je 0x4131c7
mov eax, dword [esi + 0x34]
mov ecx, dword [ecx]
mov ebx, dword [eax]
lea ebx, [ecx + ebx*2]
cmp ecx, ebx
jae 0x4131c7
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x413311
mov eax, dword [esi + 0x4c]
cmp eax, edx
je 0x41330c
cmp dword [esi + 0x3c], edx
jne 0x4131f0
push eax
push edi
call fcn.00411ac8
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x413311
jmp 0x41330c
movzx eax, di
push edx
push 8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.004129a4
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
lea edx, [ebp - 0x2c]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4132de
cmp eax, 1
jg 0x413322
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0x2c]
sub edi, eax
je 0x413283
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00430820
add esp, 0x10
cmp edi, eax
jne 0x413300
lea eax, [ebp - 0x24]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x30], eax
jne 0x413352
test edi, edi
ja 0x4132a9
cmp dword [ebp - 0xc], 0x20
push 0
lea ecx, [ebp - 0x20]
jae 0x413305
push 8
call fcn.004121f4
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x34]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x22]
push edx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x41323a
push 0
lea ecx, [ebp - 0x20]
push 1
call fcn.004017e8
mov eax, 0xffff
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
leave
ret 4
cmp eax, 3
jne 0x413300
push dword [esi + 0x4c]
push dword [ebp - 0x24]
call fcn.00411ac8
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x413341
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004017e8
mov ax, si
jmp 0x413311
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004017e8
mov ax, word [ebp + 8]
jmp 0x413311
Function at 0x4134e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x413505
xor eax, eax
jmp 0x41352d
mov ecx, dword [esi + 0x24]
xor edx, edx
push edi
cmp dword [ecx], edx
je 0x41353d
mov eax, dword [esi + 0x34]
mov ecx, dword [ecx]
mov edi, dword [eax]
add edi, ecx
cmp ecx, edi
jae 0x41353d
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00429649
leave
ret 4
mov eax, dword [esi + 0x4c]
cmp eax, edx
je 0x413556
cmp dword [esi + 0x3c], edx
jne 0x41355b
push eax
push ebx
call fcn.00411130
pop ecx
pop ecx
test al, al
jne 0x41352a
or eax, 0xffffffff
jmp 0x41352c
push edx
push 8
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x24], bl
call fcn.004129a4
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
lea edx, [ebp - 0x2c]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x41364a
cmp eax, 1
jg 0x41366e
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0x2c]
sub edi, eax
je 0x4135ef
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00430820
add esp, 0x10
cmp edi, eax
jne 0x413684
lea eax, [ebp - 0x24]
mov byte [esi + 0x41], 1
cmp dword [ebp - 0x30], eax
jne 0x41369a
test edi, edi
ja 0x413615
cmp dword [ebp - 0xc], 0x20
jae 0x413684
push 0
push 8
lea ecx, [ebp - 0x20]
call fcn.004121f4
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411a39
mov ecx, eax
call fcn.0040ef84
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x34]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x23]
push edx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x4135a2
jmp 0x413684
cmp eax, 3
jne 0x413684
push dword [esi + 0x4c]
push dword [ebp - 0x24]
call fcn.00411130
pop ecx
pop ecx
test al, al
jne 0x41369a
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004017e8
mov eax, esi
jmp 0x41352c
mov esi, dword [ebp + 8]
jmp 0x413687
Function at 0x414245
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push 0x46d5d8
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.0040537a
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_rse
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.0040a8a2
test eax, eax
jne 0x4142c2
lea eax, [ebp - 8]
push eax
push edi
mov esi, str.InstallLocation
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], edi
call fcn.0040dd25
test eax, eax
jne 0x4142c2
mov eax, dword [ebp - 8]
cmp eax, edi
jbe 0x4142c2
lea ecx, [ebp - 8]
push ecx
dec eax
push eax
lea ecx, [ebp - 4]
call fcn.00412171
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.0040dd25
test eax, eax
jne 0x4142c2
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], edi
jne 0x4142dd
xor esi, esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00404f7d
lea ecx, [ebp - 0x10]
call fcn.0040a82d
pop edi
mov eax, esi
pop esi
leave
ret
mov eax, dword [ebp - 8]
add eax, 0xfffffffe
push eax
lea ecx, [ebp - 4]
call fcn.004056b5
push 0x45d730
lea ecx, [ebp - 4]
call fcn.00405c24
push str.rsbrowser.exe
lea ecx, [ebp - 4]
call fcn.00405c24
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4142c2
xor esi, esi
inc esi
jmp 0x4142c4

Function at 0x41432d
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, ecx
mov edi, 0x400
push edi
mov ecx, esi
call fcn.00412171
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x414365
push 0xffffffffffffffff
mov ecx, esi
call fcn.00405350
push str.C:Temp
mov ecx, esi
call fcn.00405cbc
push 0xffffffffffffffff
mov ecx, esi
call fcn.00405350
push dword [esi]
mov ecx, ebp
call fcn.0040e786
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x414393
mov edi, dword [esi]
call fcn.0040e3af
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
je 0x414406
mov edi, 0x45d730
push edi
mov ecx, esi
call fcn.0041254f
push edi
mov ecx, esi
call fcn.00405c24
push 0x45e2b8
mov ecx, esi
call fcn.00405c24
push 0x45e2b4
mov ecx, esi
call fcn.00405c24
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4143ea
push dword [esi]
call fcn.0040e243
pop ecx
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esi]
call fcn.0040e3af
push 0
push dword [esi]
call ebx
push dword [esi]
mov ecx, ebp
call fcn.0040e786
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41440d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push 0x46d5d8
lea ecx, [ebp - 4]
call fcn.0040537a
mov esi, 0x400
push esi
lea ecx, [ebp - 4]
call fcn.00412171
push esi
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00405350
push 0x5c
lea ecx, [ebp - 4]
call fcn.0040524c
cmp eax, esi
jge 0x414466
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00404f7d
xor eax, eax
pop esi
pop ebx
leave
ret 8
push edi
inc eax
push eax
lea ecx, [ebp - 4]
call fcn.00412192
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.00405c24
mov edi, dword [ebp - 4]
call fcn.0040e3af
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov ecx, ebx
call fcn.0040e786
test eax, eax
jne 0x4144a5
lea ecx, [edi - 0x10]
call fcn.00404f7d
mov eax, esi
pop edi
jmp 0x414460
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00405bd7
xor esi, esi
inc esi
jmp 0x414498
Function at 0x414be2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov eax, 0x208
push eax
lea edi, [esi + 0x78]
push eax
mov ecx, edi
call fcn.00405759
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00405350
lea edi, [esi + 0x84]
mov ebx, 0x104
push ebx
mov ecx, edi
call fcn.00405759
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00405350
push str.RSEDown
mov ecx, edi
call fcn.00405c24
push str._rse.exe
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004125e6
add esp, 0xc
push eax
lea ecx, [esi + 0x7c]
call fcn.00405bd7
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00404f7d
push str.InstalledLog.dat
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004125e6
add esp, 0xc
push eax
lea ecx, [esi + 0x88]
call fcn.00405bd7
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00404f7d
push 0
push dword [edi]
call fcn.0041dac3
pop ecx
pop ecx
push dword [esi + 0x68]
lea ecx, [esi + 4]
call fcn.00404d32
xor edi, edi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], vtable.CCommandLine.0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.0040d878
push 0x45e2f0
lea ecx, [ebp - 0x28]
call fcn.0040d7b2
cmp eax, 0xffffffff
je 0x414cdf
mov dword [esi + 0x8c], edi
push 0x45e2ec
lea ecx, [ebp - 0x28]
call fcn.0040d7b2
cmp eax, 0xffffffff
je 0x414cf7
mov dword [esi + 0x90], edi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], str.ProcID
call fcn.0040f830
push eax
push 0x45f7fc
call fcn.0040d5d6
pop ecx
pop ecx
test eax, eax
jne 0x414d42
push ebx
lea ecx, [esi + 0xa4]
push 0x105
call fcn.00405759
push eax
lea ecx, [ebp - 0x18]
call fcn.0040def9
push 0xffffffffffffffff
lea ecx, [esi + 0xa4]
call fcn.00405350
mov ecx, esi
call fcn.00414319
call fcn.0040e44b
cmp eax, edi
lea ecx, [esi + 0xac]
push 0x64
mov dword [ecx], eax
pop ebx
jle 0x414d61
cmp eax, ebx
jle 0x414d63
mov dword [ecx], ebx
call fcn.0040e530
add esi, 0xb0
cmp eax, edi
mov dword [esi], eax
jle 0x414d78
cmp eax, ebx
jle 0x414d7a
mov dword [esi], ebx
lea ecx, [ebp - 0x28]
call fcn.0040d623
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00429649
leave
ret
Function at 0x414d94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push 0x46d5d8
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.0040537a
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 8]
call fcn.00406052
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.00405c24
mov ebx, dword [ebp - 8]
push 0x2001f
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.0040a8a2
test eax, eax
jne 0x414e29
lea eax, [ebp + 8]
push eax
push edi
mov esi, str.InstallLocation
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], edi
call fcn.0040dd25
test eax, eax
jne 0x414e29
mov eax, dword [ebp + 8]
cmp eax, edi
jbe 0x414e29
lea ecx, [ebp + 8]
push ecx
dec eax
push eax
lea ecx, [ebp - 4]
call fcn.00412171
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.0040dd25
test eax, eax
jne 0x414e29
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], edi
jne 0x414e4f
xor esi, esi
lea ecx, [ebx - 0x10]
call fcn.00404f7d
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00404f7d
lea ecx, [ebp - 0x10]
call fcn.0040a82d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
push eax
lea ecx, [ebp - 4]
call fcn.004056b5
push 0x45d730
lea ecx, [ebp - 4]
call fcn.00405c24
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.00405c24
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x414e29
xor esi, esi
inc esi
jmp 0x414e2b

Function at 0x414e89
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x74], eax
push str.tray.exe
push 0x45e354
call fcn.00414d94
test eax, eax
jne 0x414ee4
push 0x90
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0x94
call fcn.00429d40
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], 5
ja 0x414ee6
jne 0x414ee4
cmp dword [ebp - 0x18], eax
jae 0x414ee6
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00429649
add ebp, 0x78
leave
ret
Function at 0x414ef5
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb8
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x7c]
push edi
push eax
lea ecx, [ebp - 0x2c]
xor edi, edi
call fcn.00406052
push edi
push 0x45d730
lea ecx, [ebp - 0x2c]
call fcn.0040567f
cmp eax, 0xffffffff
jne 0x414f50
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00404f7d
mov ecx, dword [ebp + 0x6c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
add ebp, 0x70
leave
ret 8
inc eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00412138
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405bd7
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00404f7d
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x414f30
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x414f30
cmp dword [ebp - 0x24], 4
jne 0x414ff4
cmp dword [ebp - 0x20], edi
jne 0x414ff4
push 0x45e378
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414f30
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x414f30
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x30]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x41502c
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x414f30
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x2c]
call eax
test eax, eax
je 0x414f30
mov eax, dword [ebp - 0x40]
mov dword [esi], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 4], eax
xor edi, edi
inc edi
jmp 0x414f30

Function at 0x415034
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp + 8]
call fcn.00406052
xor esi, esi
push esi
push esi
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41507a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404f7d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
lea ecx, [edi + 0xa8]
mov eax, dword [ecx]
push esi
lea edx, [ebp - 4]
mov dword [ebp - 4], esi
mov eax, dword [eax - 0xc]
push edx
push eax
call fcn.0040fa61
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4150b5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404f7d
mov eax, esi
jmp 0x415073
xor esi, esi
inc esi
jmp 0x41509f