joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421651
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x24
mov eax, 0x484733
call fcn.004445f1
mov ebx, dword [ebp + 0x238]
mov edi, dword [ebp + 0x230]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push esi
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
call fcn.00444cd0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 0x234]
cmp eax, 1
jne 0x4216c2
push str.projonepodlp
jmp 0x4216d8
cmp eax, 2
jne 0x4216ce
push str.projonepotcm
jmp 0x4216d8
cmp eax, 3
jne 0x4216fa
push str.gxsoftgxtcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ebx, esi
je 0x4216f1
push ebx
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
push eax
jmp 0x4217a3
cmp eax, esi
jne 0x42179e
push esi
lea eax, [ebp]
push 3
push eax
call fcn.00421651
add esp, 0xc
mov dword [ebp - 4], esi
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x421720
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x421744
push ebx
push 3
push edi
call fcn.00421651
add esp, 0xc
push esi
push 1
lea esi, [ebp]
call fcn.00403d0d
jmp 0x4217aa
push esi
lea eax, [ebp - 0x30]
push 2
push eax
call fcn.00421651
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.00403c60
push ebx
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00403d0d
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x42177e
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push dword [ebp - 0x10]
test eax, eax
je 0x42179a
push 2
push edi
call fcn.00421651
add esp, 0xc
push ebx
jmp 0x421738
push 1
jmp 0x42178e
push 0x48e56c
mov esi, edi
call fcn.004034dc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0044302b
add ebp, 0x228
leave
ret
Function at 0x4218a1
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x8c
mov eax, 0x485633
call fcn.0044465a
mov edi, ecx
lea eax, [ebp - 0x38]
xor ebx, ebx
push eax
mov edx, str.09bb0175
mov ecx, 0x48fa18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x70], ebx
call fcn.0041dd22
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], ebx
je 0x4218f3
lea eax, [ebp - 0x38]
push eax
mov esi, edi
call fcn.004034fc
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.00403d0d
mov eax, edi
jmp 0x421a7d
mov eax, dword [0x493520]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x493524]
xor edi, edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x50], ax
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x70]
xor eax, eax
inc eax
shl eax, cl
test edx, eax
je 0x4219b5
lea eax, [ebp - 0x1c]
add ecx, 0x61
push eax
mov word [ebp - 0x1c], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4219b5
mov byte [ebp - 0x55], bl
mov bl, byte [ebp - 0x60]
add bl, 0x61
lea esi, [ebp - 0x55]
call fcn.00439e93
test al, al
je 0x4219b3
cmp byte [ebp - 0x55], 0
jne 0x4219b3
xor eax, eax
push eax
push eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x78]
jb 0x4219b3
ja 0x42198e
cmp dword [ebp - 0x6c], edi
jbe 0x4219b3
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x42199a
sub eax, ecx
sar eax, 1
lea ecx, [ebp - 0x1c]
lea esi, [ebp - 0x54]
call fcn.00404506
xor ebx, ebx
mov ecx, dword [ebp - 0x60]
inc ecx
cmp ecx, 0x1a
mov dword [ebp - 0x60], ecx
jl 0x42192a
or edi, dword [ebp - 0x78]
jne 0x4219e8
mov esi, dword [ebp - 0x5c]
push 0x48e56c
call fcn.004034dc
push ebx
push 1
lea esi, [ebp - 0x54]
call fcn.00403d0d
push ebx
jmp 0x421a70
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x4219f4
lea eax, [ebp - 0x50]
push eax
push str._lsprojonecache
lea ecx, [ebp - 0x98]
call fcn.0041dbb7
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 3
call fcn.00403c60
push ebx
push 1
lea esi, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.00403d0d
cmp dword [ebp - 0x20], 8
mov esi, dword [ebp - 0x34]
jae 0x421a36
lea esi, [ebp - 0x34]
call fcn.0041baed
cmp dword [ebp - 0x20], 8
mov esi, dword [ebp - 0x34]
jae 0x421a47
lea esi, [ebp - 0x34]
mov ebx, str.09bb0175
mov edi, 0x48fa18
call fcn.0041dca5
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x38]
push eax
call fcn.004034fc
push 0
push 1
lea esi, [ebp - 0x54]
call fcn.00403d0d
push 0
push 1
lea esi, [ebp - 0x38]
call fcn.00403d0d
mov eax, dword [ebp - 0x5c]
call fcn.004446dd
ret
Function at 0x423182
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
mov eax, dword [ebp + 0x3c4]
push ebx
push esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x3c8]
push edi
mov dword [ebp - 0x60], eax
xor eax, eax
mov ebx, 0x206
xor esi, esi
push ebx
mov word [ebp + 0x1b0], ax
lea eax, [ebp + 0x1b2]
push esi
push eax
mov dword [ebp - 0x64], esi
call fcn.00444cd0
add esp, 0xc
mov edi, str.addons
lea ecx, [ebp - 0x80]
call fcn.004217cf
cmp dword [eax + 0x18], 8
jb 0x4231ee
mov eax, dword [eax + 4]
jmp 0x4231f1
add eax, 4
push 0x104
push eax
lea eax, [ebp + 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
push 1
lea esi, [ebp - 0x80]
call fcn.00403d0d
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x14], 0
je 0x4232a5
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040121b
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x423233
mov eax, dword [eax + 4]
jmp 0x423236
add eax, 4
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp + 0x1b0]
push eax
call edi
push 0
push 1
lea esi, [ebp - 0x80]
call fcn.00403d0d
xor eax, eax
push ebx
push eax
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x56]
push eax
call fcn.00444cd0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str.addon_desc.json
lea eax, [ebp - 0x58]
push eax
call edi
cmp dword [ebp + 0x3cc], 0
je 0x4232a5
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4232a5
push 0x48e56c
jmp 0x4232ac
lea eax, [ebp + 0x1b0]
push eax
mov esi, dword [ebp - 0x5c]
call fcn.004034dc
mov ecx, dword [ebp + 0x3b8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
add ebp, 0x3bc
leave
ret
Function at 0x4244bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
test esi, esi
je 0x4244cc
and dword [esi], 0
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x1001
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
test eax, eax
je 0x4244f7
mov ecx, dword [ebp + 0x10]
push str.open_file_failed
call fcn.00403b0c
jmp 0x424548
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 8]
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00424196
pop ecx
pop ecx
mov byte [esp + 7], al
test esi, esi
je 0x424520
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [esp + 7], 0
je 0x42453f
cmp dword [esp + 0xc], 0xc8
jne 0x42453f
mov al, 1
jmp 0x42454a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4245b2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x484630
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4a3070]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
mov eax, dword [0x4a3070]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x42465e
push edi
lea ecx, [esp + 0x20]
call fcn.0040344e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xcc], esi
push eax
mov dword [esp + 0x18], ebx
call fcn.0040121b
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
mov dword [esp + 0x10], 3
jb 0x42464c
mov eax, dword [eax + 4]
jmp 0x42464f
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [esp + 0xf], bl
test eax, eax
je 0x424663
mov byte [esp + 0xf], 0
test byte [esp + 0x10], 2
je 0x42467a
and dword [esp + 0x10], 0xfffffffd
push esi
push ebx
lea esi, [esp + 0x40]
call fcn.00403d0d
or dword [esp + 0xc8], 0xffffffff
test byte [esp + 0x10], bl
je 0x424694
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.00403c15
cmp byte [esp + 0xf], 0
je 0x42469f
xor al, al
jmp 0x4246f9
lea esi, [esp + 0x58]
call fcn.0040343b
lea esi, [esp + 0x74]
call fcn.0040343b
lea esi, [esp + 0x90]
call fcn.0040343b
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
mov dword [esp + 0xcc], ebx
call fcn.00403b0c
push edi
mov ecx, esi
mov byte [esp + 0x58], bl
call fcn.00403b0c
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x54]
push eax
add esi, 0x3c
call fcn.0042530b
lea esi, [esp + 0x54]
call fcn.0042486f
mov al, bl
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.0044302b
mov esp, ebp
pop ebp
ret 8
Function at 0x431ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x47c], 0
push ebx
mov dword [ebp - 0x478], eax
push esi
lea eax, [ebp - 0x474]
call fcn.0043a5c7
push edi
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.00477060
add esp, 0x10
jmp 0x431f0f
lea ecx, [ebp - 0x41c]
push ecx
lea esi, [ebp - 0x474]
call fcn.0043a5eb
push edi
push ebx
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.00477060
add esp, 0x14
test eax, eax
jne 0x431eea
lea ecx, [ebp - 0x474]
lea ebx, [ebp - 0x18]
call fcn.0043a681
mov esi, dword [ebp - 0x478]
push 0x10
mov eax, ebx
push eax
call fcn.0041e230
mov ecx, dword [ebp - 8]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
leave
ret

Function at 0x432004
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x130
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
and dword [ebp - 0xc4], 0
push esi
push edi
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x78]
push 0x3f
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x3f]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x40], 0
call fcn.00444cd0
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x40]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x9c], dl
mov byte [ebp + eax], cl
inc eax
cmp eax, 0x40
jb 0x432053
lea eax, [ebp - 0x5c]
call fcn.0043b7cf
lea eax, [ebp - 0x9c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x5c]
call fcn.0043b7fa
push dword [ebp - 0xc0]
mov eax, dword [ebp + 0x7c]
call fcn.0043b7fa
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.0043b892
lea eax, [ebp - 0xb8]
call fcn.0043b7cf
lea eax, [ebp]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xb8]
call fcn.0043b7fa
lea eax, [ebp + 0x54]
push eax
push 0x14
pop eax
call fcn.0043b7fa
lea eax, [ebp + 0x40]
push eax
mov ecx, esi
call fcn.0043b892
mov esi, dword [ebp - 0xbc]
add esp, 0x18
push 0x14
lea eax, [ebp + 0x40]
push eax
call fcn.0041e230
mov ecx, dword [ebp + 0x68]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044302b
add ebp, 0x6c
leave
ret
Function at 0x4320fe
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x140], 0
push esi
push edi
push 0x3f
lea eax, [ebp - 0x4b]
push 0
push eax
mov esi, ecx
mov edi, edx
mov byte [ebp - 0x4c], 0
call fcn.00444cd0
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push edi
push eax
call fcn.00445840
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x4c]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x8c], dl
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x40
jb 0x432141
lea eax, [ebp - 0x13c]
call fcn.0043baf9
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.0043bb3d
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043bb3d
lea edi, [ebp - 0x6c]
call fcn.0043bb7b
lea eax, [ebp - 0x13c]
call fcn.0043baf9
lea eax, [ebp - 0xcc]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.0043bb3d
mov eax, edi
push 0x20
push eax
lea eax, [ebp - 0x13c]
call fcn.0043bb3d
add esp, 0x20
lea edi, [ebp - 0x2c]
call fcn.0043bb7b
push 0x20
mov eax, edi
push eax
call fcn.0041e230
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044302b
leave
ret

Function at 0x432591
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x4325e7
cmp eax, 0xffffffff
je 0x4325e7
push esi
lea ecx, [ebp - 4]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4325e7
cmp dword [ebp - 4], 4
jne 0x4325e7
cmp dword [ebp - 8], 0x21726152
jne 0x4325e7
inc esi
lea eax, [ebp - 0xc]
call fcn.00407285
mov eax, esi
pop esi
leave
ret

Function at 0x432802
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x14]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x14], eax
call fcn.00435277
test al, al
jne 0x4328a7
call fcn.0040f788
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x43284b
mov eax, dword [eax + 4]
jmp 0x43284e
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432896
lea esi, [ebp - 0xc]
call fcn.0040f788
cmp dword [eax + 0x18], 8
jb 0x43286c
mov edi, dword [eax + 4]
jmp 0x43286f
lea edi, [eax + 4]
lea esi, [ebp - 0xc]
call fcn.0040f788
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x432885
mov eax, dword [eax + 4]
jmp 0x432888
add eax, 4
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x43289a
and dword [ebp - 4], 0
lea esi, [ebp - 0xc]
call fcn.0040f7b3
jmp 0x43281e
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x4328ae
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x485920
call fcn.0044465a
mov esi, ecx
push esi
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4328d3
mov eax, 0x44f
jmp 0x432986
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4328e8
mov eax, 0x450
jmp 0x432986
push esi
call fcn.00432591
pop ecx
test eax, eax
je 0x432901
push edi
mov ecx, esi
call fcn.00432725
pop ecx
jmp 0x432986
lea eax, [ebp - 0x68]
push eax
call fcn.0041e460
push edi
push esi
push 0x4948c0
xor ebx, ebx
push str.__s__x___s___r__o__s___y
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041dbb7
add esp, 0x10
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.004043f6
mov byte [ebp - 4], 7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x432946
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.00432525
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.00403c15
cmp edi, ebx
je 0x43296b
lea ebx, [ebp - 0x68]
call fcn.00432802
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00403d0d
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.0041e496
mov eax, edi
call fcn.004446dd
ret

Function at 0x432b8a
Capabilities:
Delete file
Get file size

Disassembly:
push 0x2ac
mov eax, 0x48544b
call fcn.0044465a
xor edi, edi
push edi
push dword [0x4b7b08]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x432c07
push 0x2d
push edi
mov esi, 0x4b7b0c
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
xor ecx, ecx
mov word [eax], cx
inc dword [0x4b7d14]
push dword [0x4b7d14]
lea eax, [ebp - 0x90]
push str.__d.log
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [0x4b7b08]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x4b7b08], 0xffffffff
xor eax, eax
push 0x206
mov word [ebp - 0x298], ax
lea eax, [ebp - 0x296]
push edi
push eax
call fcn.00444cd0
add esp, 0xc
push 1
lea eax, [ebp - 0x298]
push eax
call fcn.0043298c
lea eax, [ebp - 0x2b0]
push eax
call fcn.00403912
push edi
push edi
lea eax, [ebp - 0x2b8]
push eax
push 0x432b16
push edi
lea eax, [ebp - 0x298]
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2b8], edi
mov dword [ebp - 0x2b4], edi
call fcn.0041b768
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x2a4]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 0x64
ja 0x432c94
cmp dword [ebp - 0x2b4], edi
ja 0x432c94
cmp dword [ebp - 0x2b8], 0x3200000
jbe 0x432ccf
cmp eax, 0x14
jbe 0x432c9e
push 0xa
pop ebx
jmp 0x432ca5
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, edi
jle 0x432ccf
push edi
lea esi, [ebp - 0x2b0]
call fcn.0041e277
cmp dword [eax + 0x18], 8
jb 0x432cc0
mov eax, dword [eax + 4]
jmp 0x432cc3
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, ebx
jl 0x432ca9
lea esi, [ebp - 0x2b0]
call fcn.00404199
push dword [ebp - 0x2b0]
call fcn.004437e4
pop ecx
call fcn.004446dd
ret
Function at 0x434c33
Capabilities:
Create thread
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x489b27
call fcn.004445f1
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x434c59
push 0x104
push dword [ebp + 8]
push 0x4b7d30
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.offlineMode
push 0x48eff0
mov edi, reloc.WS2_32.dll_bind
push edi
mov dword [ebp + 8], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x434c91
cmp dword [ebp - 0x10], 4
jne 0x434c91
mov eax, dword [ebp - 0x14]
jmp 0x434c93
xor eax, eax
cmp eax, ebx
je 0x434cfa
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.004043f6
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call fcn.00421f12
pop ecx
push ebx
cmp eax, 5
push 1
lea ecx, [ebp - 0x30]
sete byte [ebp + 0xb]
call fcn.00403c15
cmp byte [ebp + 0xb], bl
je 0x434ce9
push str.offline_license_expired
call fcn.00433453
pop ecx
push 1
push str._offlieLicExpired
push 0x48fa18
call fcn.0041dc6f
jmp 0x434d1f
push str._offlieLicExpired
push 0x48fa18
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [0x4b5aa8], ebx
je 0x434d1f
push ebx
push ebx
push ebx
push 0x434b6d
push ebx
push ebx
mov dword [0x4b5aa8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004446c9
ret 4

Function at 0x435ac5
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x4841b1
call fcn.004445f1
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 2
test byte [edi + 0x66c], 1
je 0x435af2
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x435af2
push eax
call fcn.00444a0d
pop ecx
test byte [edi + 0x66c], 2
je 0x435b05
lea eax, [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi + 0x670]
push eax
call fcn.0040f2d4
push 0
push 1
lea ecx, [edi + 0x40]
call fcn.00403c15
lea esi, [edi + 0x20]
mov byte [ebp - 4], 0
call fcn.0042966c
push 0
push 1
mov ecx, edi
call fcn.00403c15
call fcn.004446c9
ret 4
Function at 0x435eaa
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48416b
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.0044f6d0
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
lea edi, [ebx + 0x64]
xor esi, esi
push edi
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1024], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x435f0d
push esi
push str.file_not_found
push 0x194
jmp 0x4360fb
push edi
call fcn.0041bb05
mov dword [ebp - 0x102c], eax
or eax, edx
je 0x4360f0
cmp edx, esi
ja 0x4360f0
mov eax, closesocket
jb 0x435f3c
cmp dword [ebp - 0x102c], eax
ja 0x4360f0
push esi
push esi
push 3
push esi
push 7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x435f5d
cmp eax, 0xffffffff
jne 0x435f86
push esi
push str.file_open_failed
push 0x1f4
push dword [ebp - 0x1018]
call fcn.004587f0
add esp, 0x10
lea eax, [ebp - 0x1020]
call fcn.00407285
jmp 0x436109
push dword [ebp - 0x1018]
call fcn.004553d0
pop ecx
mov dword [ebp - 0x101c], eax
cmp eax, esi
jne 0x435fa4
push esi
push str.output_headers_not_found
jmp 0x435f63
push 0x494cac
push 0x494cb4
push eax
call fcn.00456560
push dword [ebp - 0x102c]
lea esi, [ebp - 0x1048]
push 0x493604
call fcn.0041dc15
add esp, 0x14
cmp dword [eax + 0x18], 0x10
jb 0x435fd8
mov eax, dword [eax + 4]
jmp 0x435fdb
add eax, 4
push eax
push 0x494cc0
push dword [ebp - 0x101c]
call fcn.00456560
add esp, 0xc
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x1048]
call fcn.00403c15
cmp dword [ebx + 0x54], esi
je 0x436014
cmp dword [ebx + 0x58], 0x10
jb 0x43600f
mov ebx, dword [ebx + 0x44]
jmp 0x436039
add ebx, 0x44
jmp 0x436039
push edi
lea ebx, [ebp - 0x1048]
call fcn.00435e4c
cmp dword [eax + 0x18], 0x10
pop ecx
mov dword [ebp - 0x1024], 1
jb 0x436036
mov ebx, dword [eax + 4]
jmp 0x436039
lea ebx, [eax + 4]
push ebx
push 0x494cd0
push dword [ebp - 0x101c]
call fcn.00456560
add esp, 0xc
test byte [ebp - 0x1024], 1
je 0x436064
push esi
push 1
lea ecx, [ebp - 0x1048]
call fcn.00403c15
push 0x494ce0
push 0xc8
push dword [ebp - 0x1018]
call fcn.00458820
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0x1000
jmp 0x4360c4
cmp dword [ebp - 0x101c], 0
je 0x4360df
call fcn.00461890
push dword [ebp - 0x101c]
mov edi, eax
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.00464800
push edi
push dword [ebp - 0x1018]
call fcn.00458990
push edi
call fcn.00461da0
add esp, 0x18
push 0
lea eax, [ebp - 0x101c]
push eax
push ebx
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x1020]
call esi
test eax, eax
jne 0x43608a
push dword [ebp - 0x1018]
call fcn.004589b0
pop ecx
jmp 0x435f76
push esi
push str.invalid_file_size
push 0x1f4
push dword [ebp - 0x1018]
call fcn.004587f0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044302b
leave
ret