joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508b9b
mov eax, dword fs:[0]
push eax
sub esp, 0x548
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0xd8
mov dword [ebp - 0x544], eax
lea eax, [ebp - 0xf0]
push 0
push eax
mov byte [ebp - 0x531], 0
call fcn.00492110
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
push 0x6c
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x53c], eax
cmp eax, 0x6c
jae 0x40dad1
xor esi, esi
test eax, eax
je 0x40dad1
nop
push 0x410
lea eax, [ebp - 0x500]
push 0
push eax
call fcn.00492110
mov eax, dword [0x5195ec]
add esp, 0xc
mov dword [ebp - 0x18], eax
movzx eax, word [0x5195f0]
mov word [ebp - 0x14], ax
movzx eax, word [ebp + esi*2 - 0xf0]
add esi, 4
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x500]
push 0x207
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x538], esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40dac5
lea esi, [ebp - 0x500]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40da91
sub esi, ecx
mov eax, edi
sar esi, 1
cmp dword [edi + 0x14], 8
jb 0x40daaa
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x500]
push ecx
push eax
call fcn.004bed62
add esp, 0xc
test eax, eax
je 0x40daf2
mov esi, dword [ebp - 0x538]
cmp esi, dword [ebp - 0x53c]
jb 0x40da30
mov al, byte [ebp - 0x531]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x520], 0
mov word [ebp - 0x530], ax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x51c], 7
cmp eax, esi
jb 0x40dc12
sub eax, esi
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [edi + 0x14], 8
jb 0x40db2d
mov edi, dword [edi]
push ecx
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp - 0x530]
call fcn.0040f640
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40db50
sub ecx, edx
lea eax, [ebp - 0x18]
sar ecx, 1
push ecx
push eax
push 0
lea ecx, [ebp - 0x530]
call fcn.0040f790
mov esi, dword [ebp - 0x544]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x554], xmm0
movups xmmword [ebp - 0x518], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x518]
movq qword [ebp - 0x540], xmm0
movq qword [ebp - 0x508], xmm0
cmp esi, eax
je 0x40dbf5
mov ecx, esi
call fcn.0040f090
movups xmm0, xmmword [ebp - 0x554]
xor eax, eax
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x504], 7
movups xmmword [esi], xmm0
mov word [ebp - 0x518], ax
movq xmm0, qword [ebp - 0x540]
movq qword [esi + 0x10], xmm0
lea ecx, [ebp - 0x518]
call fcn.0040cac0
lea ecx, [ebp - 0x530]
call fcn.0040cac0
mov al, 1
jmp 0x40dad7
call fcn.0040f210
int3
Function at 0x40e8b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e92b
test al, 0x10
je 0x40e92b
push esi
mov edi, 1
call fcn.00404a10
add esp, 4
test eax, eax
jne 0x40e94e
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40e94e
push esi
test edi, edi
jne 0x40e946
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40e94e
push esi
push str.DeleteFile:_s_suceesss
call fcn.00426020
add esp, 8
jmp 0x40e94e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40e8fc
push esi
push str.DeleteFile:_s_suceesss
call fcn.00426020
add esp, 8
jmp 0x40e94e
call fcn.00404a10
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e9cf
push esi
lea ecx, [ebp - 0x10]
call fcn.00403ff0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [esi + 4]
cmp dword [esi + 8], edi
je 0x40e98e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00404460
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [esi + 4], 4
jmp 0x40e99a
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edi
call fcn.0040c530
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e9bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5095ab
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x828], ebx
cmp word [0x55a478], 0
jne 0x41577a
push 0x20219
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.004192f0
mov edi, dword [ebp - 0x824]
test eax, eax
jne 0x41576f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0x518bcc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41576f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x41570c
cmp eax, 2
jne 0x41576f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x415729
test al, 1
jne 0x41576f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x415732
jmp 0x41576f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x55a478
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x415762
movzx eax, word [esi + ecx]
test ax, ax
je 0x415762
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x415744
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x41577a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x55a478
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x4157cb
mov ecx, 0x55a478
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x4157be
movzx eax, word [esi + ecx]
test ax, ax
je 0x4157be
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4157a0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.00415130
mov ecx, eax
test ecx, ecx
je 0x41583a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push 0x55a478
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00404320
test al, al
jne 0x41581c
mov ecx, 0x55a478
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415800
sub ecx, edx
sar ecx, 1
push ecx
push 0x55a478
mov ecx, ebx
call fcn.00405710
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404300
int3
Function at 0x416180
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509728
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.004150a0
mov edi, eax
cmp dword [edi], 0
jne 0x416217
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x416217
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51a034
push eax
call esi
push 0x51a040
push dword [edi]
mov dword [edi + 4], eax
call esi
push 0x51a04c
push dword [edi]
mov dword [edi + 8], eax
call esi
push 0x51a05c
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push 0x51a06c
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x416217
call eax
mov dword [edi + 0xc], eax
mov ecx, ebx
call fcn.00416e40
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416240
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a075
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], vtable.ILayerWindow.0
lea eax, [esi + 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.DisagreeWnd.0
mov dword [esi + 0x20], vtable.DisagreeWnd.1.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 1
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea edi, [eax - 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x41a6b4
cmp ecx, dword [edi]
jne 0x41a6b4
lock inc dword [eax]
jmp 0x41a6e2
mov eax, dword [ecx]
lea ebx, [edi + 4]
push 2
push dword [ebx]
call dword [eax]
mov edi, eax
test edi, edi
je 0x41a7c5
mov eax, dword [ebx]
mov dword [edi + 4], eax
mov eax, dword [ebx]
inc eax
push eax
push dword [ebp + 8]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004044f0
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
push 0xa4
mov byte [ebp - 4], 1
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
call fcn.0042dc90
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x41a7aa
mov ecx, eax
call fcn.0045cc00
test eax, eax
jne 0x41a7ac
xor eax, eax
mov dword [esi + 0x28], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00405bb0
int3
Function at 0x41cbe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a33e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], vtable.ILayerWindow.0
mov dword [edi], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.0
mov dword [edi + 0x24], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.1.0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], 0xff
mov ecx, esi
mov dword [edi + 0x40], 1
mov dword [edi + 0x44], 0
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411670
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
call fcn.00404f50
mov ecx, eax
test ecx, ecx
je 0x41cdd2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x54], eax
push 0xa4
mov byte [ebp - 4], 4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
call fcn.0042dc90
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x41cd14
mov ecx, eax
call fcn.0045cc00
test eax, eax
jne 0x41cd16
xor eax, eax
mov dword [edi + 0x44], eax
lea esi, [edi + 0x78]
mov dword [edi], vtable.CInputWnd.0
mov dword [edi + 0x24], vtable.CInputWnd.1.0
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
lea ebx, [esi + 0x24]
mov byte [ebp - 4], 7
mov dword [esi], vtable.CEditExImpl_class_CEditEx__class_WTL::CEditT_class_ATL::CWindow___class_ATL::CWinTraits_1442840576__0__.0
mov dword [ebp - 0x18], ebx
call fcn.00404f50
mov ecx, eax
test ecx, ecx
je 0x41cddc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x51a620
mov byte [ebp - 4], 8
mov ecx, ebx
test eax, 0xffff0000
jne 0x41cd94
movzx eax, ax
push eax
call fcn.0041b910
jmp 0x41cda0
push 0
push 0x51a620
call fcn.00405710
mov dword [esi + 0x28], 0
mov eax, edi
mov dword [esi + 0x54], 0
mov dword [esi], vtable.CEditEx.0
mov dword [edi + 0xd0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404300
push 0x80004005
call fcn.00404300
int3
Function at 0x41d8e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a44b
mov eax, dword fs:[0]
push eax
mov eax, 0x2008
call fcn.00463940
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
push 0x2000
push 0
push eax
mov dword [ebp - 0x2014], esi
call fcn.00492110
add esp, 0xc
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41d954
push 0x1000
lea eax, [ebp - 0x2010]
push eax
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.00404f50
mov ecx, eax
test ecx, ecx
je 0x41d9d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x41d98a
movzx eax, ax
mov ecx, esi
push eax
call fcn.0041b910
jmp 0x41d9b1
lea ecx, [ebp - 0x2010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d993
sub ecx, edx
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00405710
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00404300
int3
Function at 0x421140
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a960
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00431bc0
mov esi, eax
push str.SETUPDATA
push 0xd7
push dword [0x55ce04]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x10]
test eax, eax
jne 0x42122e
push str.InitPackInfo_failed__exit
call fcn.00426020
add esp, 4
push 4
push 0x51ad98
push 0
call fcn.0042cc90
cmp eax, 6
jne 0x4211c1
push 1
push 0
push 0
push str.http:__write.52toolbox.com
push 0x519374
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00404f50
mov ecx, eax
test ecx, ecx
je 0x4212e2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0
push str.055EE061_E6A1_4a97_BCA3_B47A227F452A
mov dword [ebp - 4], 0
push str._sInitPackInfo:_d
lea eax, [ebp - 0x10]
push eax
call fcn.00407e90
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42121c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push str.InitPackInfo_success
call fcn.00426020
mov eax, dword [esi]
add esp, 4
push str.SmartWriter.ldsprj
push str.SETUPCONFIG
push 0xd5
push dword [0x55ce04]
push esi
call dword [eax + 0xc]
test eax, eax
jne 0x4212c0
push str.InitConfig_failed__exit
call fcn.00426020
add esp, 4
push 4
push 0x51ad98
push 0
call fcn.0042cc90
cmp eax, 6
jne 0x421292
push 1
push 0
push 0
push str.http:__write.52toolbox.com
push 0x519374
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00404f50
mov ecx, eax
test ecx, ecx
je 0x4212ec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0
push str.055EE061_E6A1_4a97_BCA3_B47A227F452A
mov dword [ebp - 4], 1
push str._sInitConfig:_d
jmp 0x4211ee
push str.InitConfig_success
call fcn.00426020
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404300
push 0x80004005
call fcn.00404300
int3
Function at 0x421fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 1
push 0
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00492110
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Setup_Path
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret

Function at 0x4220b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 8]
push eax
push str.em_lds
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x422aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50aaf6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x422b4c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x422b4c
call fcn.0040cca0
mov edi, eax
jmp 0x422c6b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x422b6f
call fcn.0040cca0
jmp 0x422c5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x422b8d
call fcn.0040cca0
jmp 0x422c5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x422bae
mov edi, 0x8007000e
jmp 0x422c60
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x422ca4
jb 0x422bcc
cmp eax, 0xffffffff
ja 0x422ca4
cmp eax, 0x400
jbe 0x422be1
push eax
lea ecx, [ebp - 0x418]
call fcn.00420040
jmp 0x422c07
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x422c07
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x422c1e
mov edi, 0x8007000e
jmp 0x422c60
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x422c3e
call fcn.0040cca0
jmp 0x422c5e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00422900
mov edi, eax
test esi, esi
je 0x422c6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x422c84
lea ecx, [ebp - 0x418]
call fcn.00420a10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00404300
int3
Function at 0x4246a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5555ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push 0
push eax
call fcn.00492110
add esp, 0xc
mov dword [ebp - 0x41c], 1
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push str.Setup_Path
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4247a1
push esi
call fcn.0041ad90
mov ecx, eax
call fcn.00416260
call fcn.0041ad90
mov ecx, eax
call fcn.00415850
push eax
call fcn.00420b70
mov ecx, eax
call fcn.004093a0
push str.installpkg
call fcn.00420b70
mov ecx, eax
call fcn.004093b0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00492110
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x55ce04]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00420b70
mov ecx, eax
call fcn.00409310
mov eax, 0xf
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x55ce70
call fcn.00407200
test eax, eax
jne 0x4247c5
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463518
mov esp, ebp
pop ebp
ret 4
push 0
push 1
push esi
push 0
push dword [0x55ce04]
call fcn.00421530
add esp, 0x14
mov ecx, 0x55ce70
mov esi, eax
call fcn.00407820
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00463518
mov esp, ebp
pop ebp
ret 4