joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4129d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp eax, ebx
je 0x412b6d
cmp word [eax], bx
je 0x412b6d
cmp dword [ecx + 0x14], 8
jl 0x412b6d
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x38a]
mov word [ebp - 0x38c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x38c]
push 0x24
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x102]
mov word [ebp - 0x104], bx
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push 0x429814
lea eax, [ebp - 0x104]
push 0x3f
push eax
call esi
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x182]
mov word [ebp - 0x184], bx
push 0x1f
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push 0x4297e4
lea eax, [ebp - 0x184]
push 0x3f
push eax
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x592]
mov word [ebp - 0x594], bx
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x594]
push 0x28
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x82]
mov word [ebp - 0x84], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x594]
push eax
push 0x4260b8
lea eax, [ebp - 0x84]
push 0x3f
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x38c]
push edi
push eax
mov ecx, esi
call fcn.00412b74
test eax, eax
jne 0x412b64
lea eax, [ebp - 0x104]
push edi
push eax
mov ecx, esi
call fcn.00412b74
test eax, eax
jne 0x412b64
lea eax, [ebp - 0x184]
push edi
push eax
mov ecx, esi
call fcn.00412b74
test eax, eax
jne 0x412b64
lea eax, [ebp - 0x84]
push edi
push eax
mov ecx, esi
call fcn.00412b74
test eax, eax
je 0x412b67
lea eax, [ebp - 0x594]
push edi
push eax
mov ecx, esi
call fcn.00412b74
test eax, eax
jne 0x412b67
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
jmp 0x412b6f
xor eax, eax
pop ebx
leave
ret 4
Function at 0x412c22
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x208
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x81
mov ebx, dword [ebp + 0x20]
lea edi, [esp + 0x12]
neg ebx
sbb ebx, ebx
and word [esp + 0x10], 0
xor eax, eax
add ebx, reloc.OLEAUT32.dll_SysReAllocString
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x7c]
test eax, eax
jne 0x412c5c
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0x4294b8
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, 0x4298f8
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, 0x429554
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x4298e0
push esi
push ebx
call edi
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp + 0x90]
test ecx, ecx
jne 0x412cb2
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push 0x4298c8
push esi
push ebx
call edi
mov eax, dword [ebp + 0x50]
mov ebp, dword [ebp + 0x4c]
test ebp, ebp
jne 0x412cd1
mov ebp, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebp
push 1
push 0x4298a8
push esi
push ebx
call edi
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x429890
call ebp
pop ecx
shl eax, 1
push eax
push 0x429890
push 1
push 0x42987c
push esi
push ebx
call edi
push 0x42984c
call ebp
pop ecx
shl eax, 1
push eax
push 0x42984c
push 1
push 0x429838
push esi
push ebx
call edi
lea eax, [esp + 0x10]
push eax
call ebp
pop ecx
shl eax, 1
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0x4291ec
push esi
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x412d42
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, 0x427670
push ebx
mov esi, dword [edi + 0x20]
neg esi
sbb esi, esi
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [edi + 0x8c]
mov eax, dword [edi + 0x90]
test ecx, ecx
jne 0x412d78
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push ecx
push 1
push 0x42a2b0
push ebx
push esi
call ebp
mov eax, dword [edi + 0x80]
mov edi, dword [edi + 0x7c]
test edi, edi
jne 0x412da0
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push edi
push 1
push 0x42920c
push ebx
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x412fdd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push 1
cmp dword [esi + 0x24], edi
pop eax
je 0x412ffe
cmp dword [esi + 0x14], 9
mov dword [ebp - 4], eax
jge 0x413001
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
mov ebx, dword [esi + 0x28]
jne 0x41300f
cmp ebx, edi
jne 0x41302f
jmp 0x41308a
mov eax, dword [esi + 0x8c]
cmp eax, edi
jne 0x41301e
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push 0x429a30
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov word [ebp - 0x20c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push ebx
push dword [ebp - 4]
stosw word es:[edi], ax
push 0x4299e0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [esi + 0x8c]
add esp, 0x14
test eax, eax
jne 0x413074
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add esi, 0x10
lea ecx, [ebp - 0x20c]
push esi
push 0
push ecx
push eax
call fcn.00402231
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4130c0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x4130d2
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413106
mov eax, dword [esi + 0x5c]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
test eax, eax
jne 0x4130ec
mov eax, ecx
mov esi, dword [esi + 0x8c]
test esi, esi
jne 0x4130f8
mov esi, ecx
push 0
push 0
push eax
push esi
call fcn.00402231
add esp, 0x10
pop esi
ret
Function at 0x41335f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
and word [ebp - 0x88], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x86]
mov esi, 0x42799c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov edi, 0x428e88
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4133c9
cmp word [ebp - 0x88], ax
jne 0x41345c
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x7e
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x413416
cmp word [ebp - 0x88], ax
jne 0x41345c
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x40]
test ecx, ecx
jne 0x413426
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebx + 0x40]
mov ebx, dword [ebx + 0x3c]
test ebx, ebx
jne 0x413449
mov ebx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebx
push 1
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413461
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 0x80]
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
jne 0x413474
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push 0x4294e4
push 0x42799c
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret
Function at 0x413a3c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12f4
call fcn.0041f6b0
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x413bc9
cmp dword [ebp + 0xc], esi
je 0x413bc9
cmp dword [ebp + 0x10], esi
je 0x413bc9
cmp dword [ebp + 0x14], esi
je 0x413bc9
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x429cd4
push 0x42799c
push 0x427880
lea eax, [ebp - 0x294]
push 0x103
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x294]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 4
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x413ad0
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 0x40
jae 0x413bc9
push edi
mov ecx, 0x417
xor eax, eax
lea edi, [ebp - 0x12f0]
push dword [ebp + 0x10]
mov esi, 0x1060
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
push 0x4260b8
mov dword [ebp - 0x12f0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x12ec], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x12e8], eax
lea eax, [ebp - 0x12e4]
push 0x823
push eax
mov dword [ebp - 0x12f4], esi
call ebx
and dword [ebp - 0x29c], 0
lea eax, [ebp - 0x12f4]
push esi
push eax
call fcn.00404aa9
mov dword [ebp - 0x298], eax
push 0x7bd3b105
lea eax, [ebp - 0x12f4]
push esi
push eax
call fcn.00413beb
and word [ebp - 0x8c], 0
add esp, 0x24
xor eax, eax
lea edi, [ebp - 0x8a]
push 0x1f
pop ecx
push dword [ebp - 4]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
push 0x429cc8
lea eax, [ebp - 0x8c]
push 0x3f
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x12f4]
mov edi, SysReAllocString
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
lea eax, [ebp - 0x8c]
push 3
push eax
lea eax, [ebp - 0x294]
push eax
push edi
call esi
lea eax, [ebp - 4]
push 4
inc dword [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x294]
push dword [ebp + 0xc]
push eax
push edi
call esi
push 1
pop eax
pop edi
jmp 0x413bcb
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x413beb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x413c75
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x413c75
mov eax, dword [ebp + 0x10]
push 4
mov dword [ebp - 8], eax
mov eax, ebx
cdq
pop esi
mov ecx, ebx
idiv esi
mov eax, ebx
and ecx, 0x1f
sub eax, edx
mov dword [ebp - 4], edx
test eax, eax
jle 0x413c58
mov dword [ebp + 0xc], ecx
lea esi, [eax + 3]
sub dword [ebp + 0xc], edi
shr esi, 2
lea eax, [ebp - 8]
push eax
call fcn.00413bcf
pop ecx
add eax, 0x67183d
mov ecx, dword [ebp + 0xc]
add ecx, edi
and ecx, 0x1f
xor eax, dword [ecx*4 + 0x429c30]
xor eax, dword [edi]
xor eax, 0xd6312bda
mov dword [edi], eax
add edi, 4
dec esi
jne 0x413c2b
xor esi, esi
cmp dword [ebp - 4], esi
jle 0x413c75
mov eax, esi
mov cl, byte [ebp + 0x10]
sub eax, dword [ebp - 4]
add eax, dword [ebp + 8]
xor byte [eax + ebx], cl
add eax, ebx
inc esi
cmp esi, dword [ebp - 4]
jl 0x413c5f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413d33
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x413d5e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x413d5c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x414677
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
dec eax
je 0x41468e
dec eax
jne 0x4146a5
push 1
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x4146a5
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041485f
mov ecx, eax
call fcn.0041145a
xor eax, eax
ret 0x10
Function at 0x414e69
Capabilities:
Delete directory
Set file attributes

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x4217a0
push dword [edi + 4]
mov ecx, esi
push dword [edi]
call fcn.0041514b
add edi, 8
cmp edi, 0x4217c0
jb 0x414e72
cmp dword [esi + 0x14], 0
jne 0x414ee0
push 1
push 0x429e74
mov ecx, esi
call fcn.0041514b
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x414ea9
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x414ee0
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x414ec0
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [esi + 0x30]
test esi, esi
jne 0x414ed9
mov esi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
ret
Function at 0x414ee3
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
push esi
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
mov esi, dword [ebp + 0x18]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
neg esi
sbb esi, esi
push 0x4298f8
add esi, edi
push esi
call ebx
push 0x427670
push esi
call ebx
mov esi, 0x42799c
push esi
push SysReAllocString
call ebx
push esi
push edi
call ebx
cmp dword [ebp + 0x14], 0
je 0x414f52
mov eax, dword [ebp + 0x34]
mov ebp, dword [ebp + 0x30]
test ebp, ebp
jne 0x414f37
mov ebp, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x4294e4
push esi
push SysReAllocString
call ebp
jmp 0x414f58
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [esp + 0x1c]
pop esi
and dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
mov ebx, 0x429eb4
push 0x429ea4
push ebx
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x414f93
cmp dword [esp + 0x14], esi
je 0x414f98
and dword [esp + 0x10], 0
inc dword [esp + 0x10]
lea eax, [esp + 0x10]
push esi
push eax
push esi
push 0x429ea4
push ebx
push edi
call ebp
push 0
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push esi
push eax
push esi
push 0x429e94
push ebx
push edi
call ebp
call fcn.0040e21d
mov esi, eax
add esi, 0x10
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
push esi
push 1
push 0x429e88
push ebx
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4150d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
xor edx, edx
cmp esi, edx
je 0x415143
cmp word [esi], dx
je 0x415143
cmp dword [ecx + 0x10], 8
jge 0x415143
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x28
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0x10
neg eax
sbb eax, eax
pop edi
inc eax
jmp 0x415146
push 1
pop eax
pop esi
leave
ret 4
Function at 0x4151dc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
and word [ebp - 0x62c], 0
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x62a]
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x62c]
push eax
call fcn.0040135e
pop ecx
test eax, eax
pop ecx
je 0x41533a
mov eax, dword [esi + 0xa0]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
test eax, eax
mov dword [ebp - 0x14], ecx
je 0x415233
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x80]
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x415243
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x60]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x415250
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x90]
mov dword [ebp - 8], ecx
test eax, eax
je 0x415260
mov dword [ebp - 8], eax
push ebx
lea ebx, [ebp - 0x14]
mov dword [ebp - 4], 4
and word [ebp - 0x21c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
push 0x429c04
push dword [ebx]
stosw word es:[edi], ax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41532d
and word [ebp - 0x424], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x424]
push 0x103
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00401dcd
add esp, 0xc
test eax, eax
je 0x41532d
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4152f1
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x41532d
lea eax, [ebp - 0x21c]
push eax
call fcn.00401a3c
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push 0
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.00401c99
add esp, 0x18
add ebx, 4
dec dword [ebp - 4]
jne 0x41526b
pop ebx
pop edi
pop esi
leave
ret
Function at 0x41743b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4174d0
lea ecx, [esi + 0x10]
push 0x429fec
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x4174d0
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4174c9
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4174c9
mov dword [esi + 0x230], eax
push 0x10
mov dword [esi + 0x22c], edi
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x4174c1
and dword [edi + 4], 0
lea eax, [edi + 4]
push eax
lea eax, [esi + 0x220]
push eax
mov dword [edi], 0x42197c
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [edi + 8], eax
jmp 0x4174c3
xor edi, edi
mov dword [esi + 0x21c], edi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esi + 0x21c]
lea edi, [esi + 0x21c]
xor ebx, ebx
cmp ecx, ebx
mov dword [esi + 0xc], ebx
mov word [esi + 0x10], bx
je 0x417505
call fcn.0041805d
mov ecx, dword [edi]
mov dword [esi + 4], eax
call fcn.00418081
mov dword [esi + 8], eax
xor eax, eax
cmp dword [esi + 4], ebx
setg al
jmp 0x417507
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret