joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410900
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x452504]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [esp + 0x114], eax
lea eax, [esp + 8]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push SysReAllocString
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
je 0x410967
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push SysReAllocString
call edi
test eax, eax
jne 0x410ab1
push str.FB9E068B_C612_4FA8_BDB9_D728A716A421
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
lea eax, [esp + 0x1c]
push 0x446508
push eax
call fcn.004352bf
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x20]
push edx
push SysReAllocString
call esi
test eax, eax
je 0x4109ca
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
push SysReAllocString
call edi
test eax, eax
jne 0x410ab1
mov eax, dword [0x447ce8]
mov edx, dword [0x447cf0]
mov ecx, dword [0x447cec]
mov dword [esp + 0x14], eax
mov ax, word [0x447cf4]
mov word [esp + 0x20], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410a00
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
push str.AppName
push edx
call esi
test eax, eax
je 0x410a4c
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10c]
call fcn.00435083
add esp, 0x110
ret
lea ecx, [esp + 0x14]
push ecx
call fcn.0042fe50
lea eax, [esp + 0x18]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410a60
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 1
push 0
push str.AppPath
push eax
call esi
test eax, eax
jne 0x410aa6
push 4
lea edx, [esp + 0x14]
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push str.Policy
push eax
mov dword [esp + 0x28], 3
call esi
test eax, eax
je 0x410ac8
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10c]
call fcn.00435083
add esp, 0x110
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
pop edi
mov eax, 1
pop esi
call fcn.00435083
add esp, 0x110
ret
Function at 0x410b00
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
mov eax, dword [0x452504]
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x55fa]
push 0x447c08
push ebx
mov dword [esp + 0x34], eax
call fcn.00436190
add esp, 8
test eax, eax
jne 0x410b3a
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
mov ecx, ebx
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x410b40
sub ecx, edi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410b50
sub eax, edi
sub ecx, eax
add ecx, 2
mov edi, ecx
jne 0x410b75
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
push edi
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.00435f00
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + edi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edx, dword [esi + 0x12cb4]
mov eax, dword [esi + 0x12cc8]
mov ecx, dword [esi + 0x12ca0]
mov ebx, dword [esi + 0x12c8c]
mov edi, dword [esi + 0x12c78]
add eax, edx
mov edx, dword [esi + 0x12c64]
add eax, ecx
mov ecx, dword [esp + 0x10]
add eax, ebx
add eax, edi
add eax, edx
mov edx, dword [esp + 0xc]
shrd edx, ecx, 0xa
shr ecx, 0xa
xor esi, esi
shr eax, 0xa
cmp ecx, esi
ja 0x410c01
jb 0x410bef
cmp edx, eax
jae 0x410c01
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
call fcn.00435083
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.00435083
add esp, 0x28
ret
Function at 0x410c60
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x734
mov eax, dword [0x452504]
push esi
mov esi, dword [esp + 0x73c]
mov dword [esp + 0x734], eax
mov eax, dword [esi + 4]
test eax, eax
push edi
mov dword [esp + 8], ecx
je 0x410e4c
mov edi, dword [esi + 8]
sub edi, eax
sar edi, 2
test edi, edi
mov dword [esp + 0x10], edi
je 0x410e4c
call fcn.0041a4b0
test eax, eax
mov dword [esp + 0x14], eax
jne 0x410cd1
push 0x160002
call fcn.0041a6e0
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x730]
call fcn.00435083
add esp, 0x734
ret 4
push ebx
push 4
lea ecx, [esp + 0x20]
push ecx
push 6
push eax
mov dword [esp + 0x2c], 0x3e8
call dword [sym.imp.WININET.dll_InternetSetOptionA]
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test edi, edi
mov dword [esp + 0x10], ebx
jle 0x410e4b
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x410d18
mov esi, dword [esp + 0x748]
push ebx
mov ecx, esi
call fcn.00430290
mov esi, eax
test esi, esi
je 0x410e3d
lea ebx, [esi + 0x11d]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x540]
push 0x4475b0
push ecx
call ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x13c]
push 0x4475b0
push eax
call ebp
lea ecx, [esp + 0x144]
push ecx
call fcn.0042fd00
add esp, 0x20
lea edx, [esp + 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [esi], 0
je 0x410e30
xor eax, eax
mov cl, byte [eax + 0x454091]
mov byte [esp + eax + 0x330], cl
inc eax
test cl, cl
jne 0x410d82
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 0xc]
add edi, 0x12590
push eax
mov ecx, edi
call fcn.004035d0
push 1
mov ecx, edi
call fcn.004035f0
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
test eax, eax
je 0x410e00
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x410e00
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
mov edx, dword [eax + 4]
push ebx
push 0
push 0xc
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
add eax, 0x12560
push eax
mov eax, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x338]
push ecx
lea edx, [esp + 0x544]
push edx
push eax
call fcn.004039f0
add esp, 0x14
test eax, eax
je 0x410e4a
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
cmp dword [ecx], 0
jne 0x410e4a
mov ebx, dword [esp + 0x14]
inc ebx
cmp ebx, edi
mov dword [esp + 0x14], ebx
jl 0x410d11
pop ebp
pop ebx
mov ecx, dword [esp + 0x738]
pop edi
mov eax, 1
pop esi
call fcn.00435083
add esp, 0x734
ret 4
Function at 0x410ef0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x20]
call fcn.0040cf50
test eax, eax
jne 0x410f01
pop esi
ret
push ebx
push edi
push 0xca
lea edi, [esi + 0xbcf7]
lea ebx, [esi + 0x8163]
push edi
push ebx
call fcn.0041c2d0
add esp, 0xc
lea ecx, [esi + 0x1c]
call fcn.0040e070
test eax, eax
je 0x410f4f
push 0xcc
push edi
push ebx
call fcn.0041c2d0
add esp, 0xc
lea eax, [esi + 0x6160]
push eax
lea ecx, [esi + 0x51f0]
call fcn.0040f230
test eax, eax
jne 0x410f55
pop edi
pop ebx
xor eax, eax
pop esi
ret
push 0xce
push edi
push ebx
call fcn.0041c2d0
add esp, 0xc
call sym.hgstarter.exe_int___cdecl_NSNETSTATCheckSinkHole_void_
test eax, eax
je 0x410f85
push 1
push 0
push 0
push str.http:__member.hangame.com_customer_vaccineinfo.nhn
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
mov eax, 1
pop esi
ret
Function at 0x412780
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x443a2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
mov eax, dword [0x452504]
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1cc], eax
call fcn.00431370
mov ebx, dword [esp + 0x1e0]
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x1dc], 0
call fcn.00432290
test eax, eax
jne 0x4127e9
push eax
lea eax, [esp + 0xcc]
push eax
push 0x110001
call fcn.0041a8e0
jmp 0x412853
lea edx, [esi + 0x55fa]
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4127f5
sub eax, edi
mov dword [esp + 0xc], eax
pop edi
je 0x412842
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x412842
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004113c0
test eax, eax
je 0x412856
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1d8], 0xffffffff
call fcn.004319a0
mov eax, 1
jmp 0x41286c
push 0
push 0xc3
push 0x110005
call fcn.0041a7d0
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x1d8], 0xffffffff
call fcn.004319a0
xor eax, eax
mov ecx, dword [esp + 0x1d0]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1c8]
pop ebx
call fcn.00435083
add esp, 0x1d4
ret 4
Function at 0x412d40
Capabilities:
Check if file exists
Delete file
Delete registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x452504]
push esi
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
mov esi, ecx
push eax
lea ecx, [esi + 0x55fa]
push ecx
lea edx, [esp + 0x10]
push str._s_s.hul
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412df9
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00412780
test eax, eax
jne 0x412df9
lea edx, [esp + 4]
push edx
push 0x20006
push eax
mov eax, dword [esp + 0x128]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412dd6
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 4]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10c]
call fcn.00435083
add esp, 0x110
ret 0xc
mov ecx, dword [esp + 0x110]
mov eax, 1
pop esi
call fcn.00435083
add esp, 0x110
ret 0xc
Function at 0x412e20
Capabilities:
Get common file path

Disassembly:
mov eax, 0x154c
call fcn.00435d80
mov eax, dword [0x452504]
mov dword [esp + 0x1548], eax
push ebx
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push esi
mov dword [esp + 0x24], eax
push edi
mov edi, ecx
mov dword [esp + 0x2c], eax
lea esi, [edi + 0x8172]
mov dword [esp + 0x30], eax
mov eax, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412e72
sub eax, edx
mov dword [esp + 0x34], eax
jne 0x412e9d
push 0x400
lea ecx, [esp + 0x144]
push ecx
push 0xa9
call fcn.0041a480
add esp, 0xc
jmp 0x412eb2
lea edx, [esp + 0x140]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x412ea8
push 0x400
lea edx, [esp + 0xd50]
push edx
push 0x86
call fcn.0041a480
lea eax, [esp + 0x14c]
push eax
lea ecx, [esp + 0xd5c]
push ecx
lea edx, [esp + 0x558]
push edx
call fcn.004352bf
mov ecx, dword [0x468284]
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x11
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x412fd6
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [0x468284]
mov esi, dword [edi + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp esi, 0x50000
sbb eax, eax
and eax, 0xffffffc0
lea edx, [esp + 0x544]
mov dword [esp + 0x20], edx
add eax, 0x40
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1560]
lea edx, [esp + 0x14]
or eax, 5
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x410250
mov dword [esp + 0x30], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
je 0x412fd6
lea edx, [esp + 0x38]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x412ff0
push 0x400
lea eax, [esp + 0x94c]
push eax
push 0xa9
call fcn.0041a480
push 0x400
lea ecx, [esp + 0x1160]
push ecx
push 0xb8
call fcn.0041a480
mov ecx, dword [0x468284]
add esp, 0x18
push 0x40
lea edx, [esp + 0x94c]
push edx
lea eax, [esp + 0x1158]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1548]
call fcn.00435083
add esp, 0x154c
ret 8
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412ff7
mov ecx, dword [esp + 0x155c]
sub eax, edx
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.00402c70
mov ecx, dword [esp + 0x1554]
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.00435083
add esp, 0x154c
ret 8
Function at 0x416060
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb34
mov eax, dword [0x452504]
push ebx
mov dword [esp + 0xb34], eax
mov eax, dword [ecx + 0x5918]
test eax, eax
push esi
push edi
je 0x416226
cmp eax, 3
mov bl, 0x6e
mov byte [esp + 0xc], bl
mov byte [esp + 0x10], bl
jne 0x4161cf
call fcn.0041a4b0
mov esi, eax
test esi, esi
je 0x416183
push 4
lea eax, [esp + 0x18]
push eax
push 6
push esi
mov dword [esp + 0x24], 0x7530
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov ecx, dword [str.hangametetris.exe]
mov edx, dword [0x4483ec]
mov eax, dword [0x4483f0]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x4483f4]
mov dword [esp + 0x1c], edx
mov dx, word [0x4483f8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
xor eax, eax
mov word [esp + 0x28], dx
mov ecx, 0x3c
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x120]
push ecx
call fcn.0042fd00
push 0x800
lea edx, [esp + 0x338]
push str.http:__cdn.naver.com_naver_toolbar_theme_1_1_hangametetris.exe
push edx
call fcn.00436348
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x134]
push ecx
lea edx, [esp + 0x240]
push 0x4475b0
push edx
call fcn.004352bf
push 0
push 0
lea eax, [esp + 0x358]
push eax
lea ecx, [esp + 0x254]
push ecx
push esi
call fcn.004039f0
add esp, 0x34
test eax, eax
jne 0x416198
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xb3c]
call fcn.00435083
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 5
push 0x4483a4
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x130]
push ecx
call fcn.0041a9a0
add esp, 0x14
mov byte [esp + 0xc], bl
mov byte [esp + 0x10], 0x79
jmp 0x4161ed
cmp eax, 2
jne 0x4161de
mov byte [esp + 0xc], bl
mov byte [esp + 0x10], bl
jmp 0x4161ed
cmp eax, 1
jne 0x4161ed
mov al, 0x79
mov byte [esp + 0xc], al
mov byte [esp + 0x10], al
call fcn.00415f40
mov esi, eax
call fcn.00415f40
mov edx, dword [esp + 0x10]
mov edi, eax
mov eax, dword [esp + 0xc]
push edx
push eax
add esi, 0x5f50
push esi
call fcn.00415f40
add eax, 0x8163
push eax
add edi, 0xbcf7
push edi
call fcn.0041c220
add esp, 0x14
mov ecx, dword [esp + 0xb3c]
mov eax, 1
call fcn.00435083
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416630
Capabilities:
Get common file path

Disassembly:
sub esp, 0x520
mov eax, dword [0x452504]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x524], eax
lea eax, [edi + 0x8163]
push eax
call fcn.00411580
mov esi, eax
test esi, esi
je 0x4167ee
call fcn.00415f40
add esi, 0x10d
push esi
add eax, 0x8377
push eax
lea ecx, [esp + 0x324]
push str._s__s
push ecx
call fcn.004352bf
lea edx, [esp + 0x32c]
push 0x2f
push edx
call fcn.004366e3
add esp, 0x18
test eax, eax
je 0x4166ac
inc eax
lea edx, [esp + 0x10]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4166a0
jmp 0x4166d4
mov eax, dword [str.DxInstall.exe]
mov ecx, dword [0x44841c]
mov edx, dword [0x448420]
mov dword [esp + 0x10], eax
mov ax, word [0x448424]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov word [esp + 0x1c], ax
lea esi, [edi + 0x55fa]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4166e0
sub eax, edx
mov dword [esp + 0xc], eax
je 0x416724
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x220]
push 0x446508
push edx
call fcn.004352bf
lea edx, [esp + 0x430]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x416715
jmp 0x4167a3
lea eax, [esp + 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x41675f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x220]
push 0x4475b0
push eax
call fcn.004352bf
add esp, 0x10
jmp 0x41678e
lea ecx, [esp + 0x114]
push ecx
call fcn.0042fe50
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x224]
push 0x446508
push ecx
call fcn.004352bf
add esp, 0x14
xor eax, eax
mov cl, byte [esp + eax + 0x114]
mov byte [esp + eax + 0x420], cl
inc eax
test cl, cl
jne 0x416790
call fcn.0041a4b0
mov esi, eax
test esi, esi
je 0x4167ee
push 4
lea edx, [esp + 0xc]
push edx
push 6
push esi
mov dword [esp + 0x18], 0x3e8
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
lea eax, [esp + 0x324]
push eax
lea ecx, [esp + 0x224]
push ecx
push esi
call fcn.004039f0
add esp, 0x14
test eax, eax
jne 0x416805
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x51c]
call fcn.00435083
add esp, 0x520
ret
push 0
push 5
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x430]
push eax
call fcn.0041a9a0
add esp, 0x14
test eax, eax
push esi
je 0x4167e8
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x524]
pop edi
mov eax, 1
pop esi
call fcn.00435083
add esp, 0x520
ret
Function at 0x416c40
Capabilities:
Set current directory

Disassembly:
sub esp, 0x624
mov eax, dword [0x452504]
push ebx
push ebp
mov ebp, dword [esp + 0x634]
mov edx, dword [ebp + 4]
xor ebx, ebx
cmp edx, ebx
mov dword [esp + 0x628], eax
push edi
mov edi, ecx
mov eax, 1
jne 0x416c72
mov dword [esp + 0xc], ebx
jmp 0x416c7e
mov ecx, dword [ebp + 8]
sub ecx, edx
sar ecx, 2
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
jle 0x416e0e
push esi
lea ecx, [ecx]
push ebx
mov ecx, ebp
call fcn.00430290
mov esi, eax
test esi, esi
je 0x416dee
lea eax, [esp + 0x220]
push eax
push esi
mov ecx, edi
call fcn.00416240
lea ecx, [esp + 0x18]
push ecx
push esi
mov ecx, edi
call fcn.00416330
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x416cdb
lea eax, [esp + 0x18]
push eax
call fcn.0042fd00
add esp, 4
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [esp + 0x640]
push edx
lea eax, [esp + 0x42c]
push eax
push esi
mov ecx, edi
call fcn.004163c0
mov ecx, dword [esi + 0xc]
lea ebx, [edi + 0x12590]
push ecx
mov ecx, ebx
call fcn.00403cb0
push 1
mov ecx, ebx
call fcn.00403ce0
mov edx, dword [esi + 0xc]
lea ebp, [edi + 0x12560]
push edx
mov ecx, ebp
call fcn.004042e0
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
test eax, eax
je 0x416d7d
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416d7d
push str.STC_FILENAME_DISP
mov ecx, 0x4682d8
call fcn.00402ec0
mov ecx, dword [eax + 4]
add esi, 0x11d
push esi
push 0
push 0xc
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x638]
push ebp
push ebx
lea edx, [esp + 0x430]
push edx
lea eax, [esp + 0x22c]
push eax
push ecx
call fcn.00404320
add esp, 0x14
test eax, eax
je 0x416e0a
cmp dword [edi], 0
jne 0x416e06
mov ecx, ebp
call fcn.00404210
push 0x416c30
lea edx, [esp + 0x224]
push 0x416bf0
push edx
call fcn.0041a630
lea eax, [esp + 0x22c]
push eax
call fcn.0042fce0
mov eax, dword [edi]
add esp, 0x10
test eax, eax
jne 0x416e06
mov ecx, ebp
call fcn.00404280
mov ebp, dword [esp + 0x63c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x416c90
mov eax, 1
jmp 0x416e0d
xor eax, eax
jmp 0x416e0d
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x62c]
pop edi
pop ebp
pop ebx
call fcn.00435083
add esp, 0x624
ret 0xc
Function at 0x416e30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x31c
mov eax, dword [0x452504]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x320], eax
lea edi, [esi + 0x8163]
push edi
lea eax, [esi + 0x52f0]
push eax
push str.newbase
call fcn.00412d40
test eax, eax
je 0x416e76
lea ecx, [esi + 0x51f0]
push ecx
push str.SoftwareHanGame.Com
push edi
mov ecx, esi
call fcn.00412d40
push ebx
push ebp
lea edx, [esi + 0x12ba0]
push edx
lea edi, [esi + 0x51f0]
push edi
lea ebx, [esi + 0x6160]
lea ebp, [esi + 0x8c]
push ebx
mov ecx, ebp
call fcn.0040dbc0
test eax, eax
jne 0x416ea7
push edi
push ebx
mov ecx, ebp
call fcn.0040d870
push 0
mov ecx, esi
call fcn.004117c0
mov ecx, esi
call fcn.00416060
mov al, byte [esi + 0xbcf5]
test al, al
lea ebx, [esi + 0x55fa]
lea ecx, [esi + 0x20]
push ebx
je 0x416ed2
call fcn.0040ce70
jmp 0x416ed7
call fcn.0040cd90
cmp dword [0x468a34], 0x501
jb 0x416f77
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x416f6c
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esi + 0x8163]
push eax
push ebx
lea edx, [esp + 0x124]
push str._s_s.exe
push edx
call edi
lea eax, [esp + 0x28]
push str.DISABLECICERO
push eax
call edi
lea eax, [esp + 0x30]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416f45
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
lea edx, [esp + 0x12c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x8163]
push eax
push ebx
lea edx, [esp + 0x228]
push str._s_s.exe
push edx
call fcn.004352bf
lea eax, [esp + 0x230]
push 0
push eax
call fcn.00435d39
add esp, 0x18
cmp eax, 0xffffffff
pop ebp
pop ebx
jne 0x417033
call fcn.00415f40
push 0xf8
mov edi, eax
call fcn.00415f40
add eax, 0xbcf7
push eax
add edi, 0x8163
push edi
call fcn.0041c2d0
push 0x104
lea ecx, [esp + 0x124]
push ecx
push 0xee
call fcn.0041a480
lea edx, [esi + 0xa37b]
push edx
add esi, 0x8172
push esi
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004352bf
push 0
lea edx, [esp + 0x3c]
push edx
push 0x180007
call fcn.0041a8e0
add esp, 0x34
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x318]
call fcn.00435083
add esp, 0x31c
ret
lea eax, [esi + 0x12c40]
push eax
mov ecx, esi
call fcn.00410f90
test eax, eax
jne 0x417093
call fcn.00415f40
push 0xf6
mov esi, eax
call fcn.00415f40
add eax, 0xbcf7
push eax
add esi, 0x8163
push esi
call fcn.0041c2d0
push 0
push 0x119
push 0x18000e
call fcn.0041a7d0
add esp, 0x18
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x318]
call fcn.00435083
add esp, 0x31c
ret
mov ecx, dword [esp + 0x320]
pop edi
mov eax, 1
pop esi
call fcn.00435083
add esp, 0x31c
ret