joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407db9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407e30
mov eax, dword [ebp + 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.Path
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004281cf
pop ecx
test eax, eax
je 0x407e32
lea ecx, [esi + eax*2]
cmp word [ecx - 2], 0x5c
je 0x407e32
push 0x5c
pop edx
mov word [ecx], dx
leave
ret
xor eax, eax
leave
ret

Function at 0x408357
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
and dword [0x461a40], 0
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x461a40], eax
test eax, eax
je 0x4083bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4083bc
push esi
push 0
push 0x44b8bc
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x4083b7
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4083a7
push 9
jmp 0x4083a9
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
ret

Function at 0x408944
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x408967
xor eax, eax
jmp 0x4089a1
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004270e0
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
push edi
call fcn.00407edb
add esp, 0x1c
test eax, eax
je 0x408963
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00427096
leave
ret

Function at 0x408f46
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x408f97
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x408fa8
push 0xd
pop eax
jmp 0x408fd5
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x408fab
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x4094c9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.00408f05
mov ebx, eax
cmp ebx, esi
je 0x409539
lea ecx, [ebp - 0x70]
call fcn.00408e90
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427096
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x409551
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.004094c9
cmp eax, esi
jne 0x409583
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x409541
lea ecx, [ebp - 0x70]
call fcn.00408e90
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00408e35
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00408e90
mov eax, esi
jmp 0x40951f
Function at 0x40abd0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0x788], eax
push edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.004270e0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.Path
xor edi, edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
inc edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ac7d
push str.360ver.dll
lea eax, [ebp - 0x78]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ac7d
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00409d8b
mov esi, eax
pop ecx
test esi, esi
je 0x40ac7c
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [ebp + 0x788]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00427096
add ebp, 0x78c
leave
ret

Function at 0x40ac95
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004270b0
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004270e0
add esp, 0xc
push 0x44bd1c
mov esi, 0x800
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push 0x44bcf0
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push str.vL
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040886e
push 0x44bcac
push esi
lea eax, [ebp - 0x1004]
push eax
call fcn.0040886e
push 0x14
push edi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x40ad92
call fcn.00407d9c
test eax, eax
je 0x40ad7d
call fcn.0040abd0
test eax, eax
je 0x40ad7d
push 5
push ebx
push ebx
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x40ad86
push 5
push ebx
push ebx
push str.http:__down.360safe.com_setup.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], ebx
je 0x40ad9d
push ebx
call fcn.00428e93
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427096
leave
ret
Function at 0x40adae
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00409d0b
pop ecx
test eax, eax
je 0x40adc3
xor eax, eax
inc eax
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40adde
push 1
push 0x45e028
push esi
call fcn.0040ac95
add esp, 0xc
xor eax, eax
pop esi
ret

Function at 0x40bfe1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x145c]
mov eax, 0x145c
call fcn.004270b0
push 0xffffffffffffffff
push 0x447350
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0x1458], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x24c
lea eax, [ebp + 4]
push ebx
push eax
mov edi, ecx
mov dword [ebp], ebx
call fcn.004270e0
mov eax, dword [0x45e024]
mov dword [ebp - 0x10], eax
xor eax, eax
push 0x206
mov word [ebp + 0x1250], ax
lea eax, [ebp + 0x1252]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004270e0
mov esi, 0x800
push esi
lea eax, [ebp + 0x250]
push ebx
push eax
call fcn.004270e0
push esi
lea eax, [ebp + 0xa50]
push ebx
push eax
call fcn.004270e0
push 0x400
lea eax, [ebp + 0x250]
push eax
push dword [edi + 4]
call fcn.00407e50
add esp, 0x3c
xor esi, esi
cmp dword [edi + 8], ebx
jle 0x40c0ab
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
inc esi
cmp esi, dword [edi + 8]
jl 0x40c098
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.config
lea eax, [ebp + 0x250]
push eax
lea eax, [ebp + 0x1250]
push eax
call esi
lea eax, [ebp + 0x1250]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b336
push 0x44bd80
lea ecx, [ebp - 0x10]
call fcn.00409b29
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40c160
test byte [ebp], 0x10
je 0x40c146
lea eax, [ebp + 0x2c]
push 0x44bd7c
push eax
call fcn.004280a4
pop ecx
pop ecx
test eax, eax
je 0x40c146
lea eax, [ebp + 0x2c]
push 0x44bd74
push eax
call fcn.004280a4
pop ecx
pop ecx
test eax, eax
je 0x40c146
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x1250]
push eax
lea eax, [ebp + 0xa50]
push eax
call esi
lea eax, [ebp + 0xa50]
push eax
mov ecx, edi
call fcn.0040be55
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c0f6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x10]
call fcn.0040869c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1458]
xor ecx, ebp
call fcn.00427096
add ebp, 0x145c
leave
ret
Function at 0x40d2e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xa08
lea ebp, [esp - 4]
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0xa08], eax
push 0x24
mov eax, 0x447548
call fcn.004288c3
mov eax, dword [ebp + 0xa14]
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 0x10], edi
xor eax, eax
push 0x206
mov word [ebp + 0x800], ax
xor ebx, ebx
lea eax, [ebp + 0x802]
push edi
inc ebx
push eax
mov esi, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0x104
call fcn.004270e0
add esp, 0xc
cmp dword [ebp + 0xa18], edi
jne 0x40d354
mov eax, dword [esi]
cmp dword [eax - 8], edi
jne 0x40d4d2
cmp dword [esi + 0xc], edi
je 0x40d38a
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp + 0x800]
push edx
lea edx, [ebp - 0x28]
push edx
push eax
push ecx
push dword [esi + 0x10]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp + 0x800]
push eax
call fcn.004281cf
pop ecx
test eax, eax
jne 0x40d39d
lea eax, [ebp + 0x800]
push str.configdefaultskin
push eax
call fcn.00429362
pop ecx
pop ecx
lea eax, [ebp + 0x800]
push eax
mov ecx, esi
call fcn.0040b336
push ebx
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.00409ad6
push 2
mov dword [ebp - 4], edi
pop edi
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov dword [ebp - 0x10], edi
call fcn.0040cb7f
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 6
call fcn.00408851
test al, al
jne 0x40d41d
push ebx
push 0x2f
lea ecx, [ebp - 0x1c]
call fcn.00409ad6
push ebx
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0xe
call fcn.0040cb7f
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x10], 0x1e
call fcn.00408851
mov byte [ebp - 0x11], 0
test al, al
je 0x40d420
mov byte [ebp - 0x11], bl
test byte [ebp - 0x10], 0x10
je 0x40d432
and dword [ebp - 0x10], 0xffffffef
lea ecx, [ebp - 0x30]
call fcn.0040869c
test byte [ebp - 0x10], 8
je 0x40d444
and dword [ebp - 0x10], 0xfffffff7
lea ecx, [ebp - 0x1c]
call fcn.0040869c
test byte [ebp - 0x10], 4
je 0x40d456
and dword [ebp - 0x10], 0xfffffffb
lea ecx, [ebp - 0x2c]
call fcn.0040869c
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x10], 2
je 0x40d468
lea ecx, [ebp - 0x20]
call fcn.0040869c
cmp byte [ebp - 0x11], 0
je 0x40d47d
mov eax, dword [esi]
mov eax, dword [eax - 8]
push ebx
dec eax
push eax
mov ecx, esi
call fcn.0040aaf7
push 0x400
lea eax, [ebp]
push eax
push dword [esi + 4]
call fcn.00407e50
xor edi, edi
add esp, 0xc
cmp dword [esi + 8], edi
jle 0x40d4a8
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
inc edi
cmp edi, dword [esi + 8]
jl 0x40d498
push dword [esi]
lea eax, [ebp]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
push 0
call fcn.00408944
pop ecx
pop ecx
test eax, eax
jne 0x40d4d2
push str.configdefaultskin
mov ecx, esi
call fcn.0040b336
mov ecx, dword [ebp - 0x18]
push esi
call fcn.0040caef
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.00427096
add ebp, 0xa0c
leave
ret 8
Function at 0x40d6b5
Capabilities:
Accept command line arguments

Disassembly:
push 0xf0
mov eax, 0x4475ff
call fcn.0042892c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x40d6e1
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40d6e5
xor eax, eax
jmp 0x40d6fb
lea esi, [eax + eax]
mov eax, esi
call fcn.00429390
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00407873
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00414d80
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], edi
call fcn.00408357
add esp, 0xc
test eax, eax
je 0x40d72e
lea ecx, [ebp - 0x14]
call fcn.0040869c
xor eax, eax
lea esp, [ebp - 0x10c]
call fcn.00428976
ret
push str.013726BC_746C_4922_9D8C_8805D8198FB2
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
je 0x40d756
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d756
call fcn.00418dd7
mov ecx, eax
call fcn.00417d23
mov dword [ebp - 0x50], 0x44b90c
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x50]
mov ebx, 0x4626f8
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0040a9ed
call fcn.0040d5e3
mov esi, 0x462738
mov ecx, esi
mov dword [ebp - 0x18], edi
call fcn.00414186
test eax, eax
je 0x40d7a9
mov ecx, esi
call fcn.00413f46
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0xfc]
call fcn.004203b2
push edi
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 2
call fcn.0040b0da
test eax, eax
jne 0x40d7fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 1
call fcn.0041ff83
lea ecx, [ebp - 0x40]
call fcn.004079a0
lea ecx, [ebp - 0x4c]
call fcn.004079a0
lea ecx, [ebp - 0x14]
call fcn.0040869c
mov eax, edi
jmp 0x40d722
cmp dword [ebp - 0x18], edi
je 0x40d817
push 0xffffffffffffffff
push 1
push 0x3400
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0xc]
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x50]
call fcn.004084a7
mov ecx, ebx
mov edi, eax
call fcn.0040b278
jmp 0x40d7cf
Function at 0x40de03
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0040c320
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.00407a59
pop ecx
push esi
push dword [ebp + 8]
mov ecx, 0x4626f8
push esi
call fcn.00408529
push 1
push 1
push dword [0x462c8c]
lea ecx, [ebp - 0x1c]
call fcn.0040d272
lea ecx, [ebp - 0x1c]
call fcn.0040dcda
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x461a44], eax
call fcn.00408317
mov ecx, eax
call fcn.0042109e
mov ebx, str.32770
push ebx
mov edi, 0x44b8bc
push edi
push dword [0x462c8c]
call fcn.00407f92
add esp, 0xc
push edi
push ebx
call fcn.0040af14
push dword [ebp + 0x10]
call fcn.0040d671
pop ecx
xor edi, edi
call fcn.0040ae1e
cmp eax, esi
je 0x40df2d
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov edi, eax
cmp edi, esi
je 0x40deed
mov ecx, 0x462738
call fcn.00413c7d
test eax, eax
je 0x40dee2
push dword [0x46274c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dee2
push dword [0x46274c]
jmp 0x40dee7
push str.feedback.ui
mov eax, dword [edi]
push esi
push edi
call dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040d6b5
pop ecx
pop ecx
mov edi, eax
call fcn.0040ae1e
cmp eax, esi
je 0x40df0b
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, 0x4626f8
call fcn.0040b251
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [0x461a44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [ebp - 0x1c]
call fcn.004089af
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x411280
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x447aba
call fcn.004288c3
mov edi, ecx
mov esi, dword [ebp + 8]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
jne 0x4112ac
add esi, 4
push esi
push 1
call fcn.00421a7c
jmp 0x411306
push esi
call fcn.0040f640
test eax, eax
jne 0x4112c1
push esi
lea ecx, [edi + 0x30]
call fcn.0041122d
jmp 0x411306
push 0x9c70
lea ecx, [ebp - 0x10]
call fcn.0040cb22
mov esi, eax
xor edi, edi
push 0x9c9d
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0040cb22
push edi
push edi
push 0x30
push dword [esi]
mov byte [ebp - 4], 1
push dword [eax]
call fcn.0040f572
add esp, 0x14
lea ecx, [ebp + 8]
call fcn.0040869c
lea ecx, [ebp - 0x10]
call fcn.0040869c
call fcn.00428962
ret 4
Function at 0x411855
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0x64
push esi
mov esi, ecx
jne 0x411885
and dword [esi + 0x54], 0
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 0x64
push dword [esi + 4]
call edi
push 0x65
push dword [esi + 4]
call edi
push 0
push 0x14
push 0x65
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
jmp 0x4118eb
cmp dword [esp + 8], 0x65
jne 0x4118eb
cmp dword [esi + 0x54], 0
je 0x4118b2
add dword [esi + 0x50], 0xa
mov ecx, dword [esi + 0x50]
mov eax, 0xff
cmp ecx, eax
jl 0x4118d6
push 0x65
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4118d6
add dword [esi + 0x50], 0xfffffff6
cmp dword [esi + 0x50], 0
jg 0x4118d6
and dword [esi + 0x50], 0
push 0x65
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
movzx eax, byte [esi + 0x50]
push 3
push eax
push 0xff00ff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
pop esi
ret 4

Function at 0x4118ef
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret 0xc

Function at 0x4118fd
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
ret 0x10
Function at 0x4120f8
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1a8
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x44c2f4
lea edi, [ebp + 0x58]
rep movsd dword es:[edi], dword [esi]
push 0xd3a
lea eax, [ebp + 0x58]
push 0x1a
mov ebx, 0x104
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
movsw word es:[edi], word [esi]
call fcn.004120ba
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push str.ExeString
lea eax, [ebp + 0x58]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41218d
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41218d
xor eax, eax
inc eax
jmp 0x41229e
push ebx
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004270e0
add esp, 0xc
push 0xf
pop ecx
lea eax, [ebp + 0x1c]
push 0xd3c
mov esi, 0x44c2ac
lea edi, [ebp + 0x1c]
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004297b0
pop ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004120ba
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x455cd1
lea eax, [ebp + 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41221a
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x412185
push ebx
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004270e0
push 0xf
pop ecx
mov esi, 0x44c26c
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0xd3c
lea eax, [ebp - 0x24]
push 0x3d
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
movsb byte es:[edi], byte [esi]
call fcn.004120ba
add esp, 0x18
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x455cd1
lea eax, [ebp - 0x24]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41229c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x412185
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427096
add ebp, 0x78
leave
ret
Function at 0x4122b0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.004270e0
add esp, 0xc
push 6
pop ecx
lea eax, [ebp + 0x8c]
push 0x237f
mov esi, 0x44c310
lea edi, [ebp + 0x8c]
push eax
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
rep movsd dword es:[edi], dword [esi]
call fcn.004297b0
pop ecx
push eax
lea eax, [ebp + 0x8c]
push eax
call fcn.004120ba
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x455cd1
lea eax, [ebp + 0x8c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
pop esi
test eax, eax
jne 0x412360
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412360
xor eax, eax
inc eax
jmp 0x412362
xor eax, eax
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
call fcn.00427096
add ebp, 0xa8
leave
ret

Function at 0x412377
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x45fe58]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x12f]
push 0
push eax
mov byte [ebp - 0x130], 0
call fcn.004270e0
add esp, 0xc
push 7
pop ecx
mov esi, 0x44c340
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x44c334
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push 0x837
push eax
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0x104
movsd dword es:[edi], dword [esi]
call fcn.004297b0
pop ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004120ba
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x844
push eax
call fcn.004297b0
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004120ba
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x138]
push eax
push str.ProgramPath
lea eax, [ebp - 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
pop esi
test eax, eax
jne 0x412468
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x130]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
test eax, eax
je 0x412468
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x412468
xor eax, eax
inc eax
jmp 0x41246a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427096
leave
ret