joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f42
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4557ed
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x47606c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov esi, ecx
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403f9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x404143
cmp dword [esi + 0x14], 8
jb 0x403fa4
mov esi, dword [esi]
push 5
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x403fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov dword [ebp - 4], 2
jmp 0x404117
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x404010
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 4
jmp 0x404117
xor ecx, ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
push edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x404122
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4040ee
mov eax, dword [ebp - 0x10]
push 0x477c81
push eax
mov dword [ebp - 0x18], eax
call fcn.004361da
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
pop ecx
test esi, esi
jne 0x404074
push edi
mov dword [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 6
mov esi, 0x8007000e
jmp 0x404117
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x4040ba
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 4]
push esi
mov dword [ecx + 0x1c], eax
call fcn.00436197
pop ecx
push edi
mov dword [ebp - 4], 0xd
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
mov dword [ebp - 4], 0xe
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x404143
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x1c]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
call fcn.00436197
pop ecx
push edi
mov dword [ebp - 4], 7
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 8
jmp 0x404117
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push edi
mov dword [ebp - 4], 9
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xa
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x404143
push edi
mov dword [ebp - 4], 0xb
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
mov dword [ebp - 4], 0xc
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x8000ffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [edi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x405701
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov esi, 0x3ff
mov ecx, eax
cmp dword [edi], edx
je 0x405701
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x40562f
lea eax, [ecx + 0x2400]
cmp ax, si
ja 0x405710
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x40564c
mov dl, bl
xor eax, eax
jmp 0x40567c
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, si
ja 0x40561e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x405621
mov edx, ebx
cmp ebx, 0x800
jae 0x405661
shr edx, 6
xor eax, eax
or dl, 0xc0
inc eax
jmp 0x40567c
cmp ebx, 0x10000
jae 0x405673
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x40567b
shr edx, 0x12
or dl, 0xf0
push 3
pop eax
movzx esi, cl
mov ecx, dword [ebp - 0xc]
xor esi, 1
add esi, esi
mov dword [ebp - 8], eax
cmp eax, 3
cmovb esi, eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [edi]
inc esi
cmp eax, esi
jl 0x405701
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
jne 0x4056b2
cmp ecx, 3
jae 0x4056b9
mov eax, dword [edi]
mov byte [eax], dl
inc dword [edi]
dec esi
test esi, esi
jle 0x4056d8
imul ecx, ecx, 6
mov eax, dword [edi]
sub ecx, 6
mov edx, ebx
dec esi
shr edx, cl
and dl, 0x3f
or dl, 0x80
mov byte [eax], dl
inc dword [edi]
test esi, esi
jg 0x4056c0
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4055d9
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x405709
Function at 0x40be83
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x2f0
mov eax, 0x456064
call fcn.00436bf5
mov esi, ecx
mov dword [ebp - 0x238], esi
xor edi, edi
lea eax, [ebp - 0x21c]
push 0x20a
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x240], esi
push eax
mov dword [ebp - 0x23c], edi
call fcn.00438580
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40bf1d
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.004059e5
mov dword [ebp - 4], edi
mov ecx, esi
push str.NVIDIA_CorporationNvTelemetryNvTelemetryAPI
mov dword [ebp - 0x23c], 1
call fcn.00407d34
push 0x468b94
mov ecx, esi
call fcn.00407d34
push str..dll
mov ecx, esi
call fcn.00407d34
mov eax, esi
call fcn.00436b9f
ret
push 0xb0
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x238], 0xc4
push edi
push eax
call fcn.00438580
add esp, 0xc
lea ecx, [ebp - 0x2fc]
call fcn.0040be68
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
push ecx
push 0x468c30
lea ecx, [ebp - 0x238]
push ecx
push 0x468c2c
push str..._common_NvTelemetryClient.cpp
sub esp, 0xc
mov ecx, eax
call fcn.0041c6ad
mov ecx, eax
call fcn.0041c6c3
mov ecx, eax
call fcn.0041c6d9
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0041c6ef
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0040bbff
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x24c]
call fcn.004012c8
push 0x4745b0
lea eax, [ebp - 0x24c]
push eax
call fcn.00437a05
int3
Function at 0x41e02e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, ebx
mov edi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x41e04c
sub edx, ecx
sar edx, 1
lea eax, [edx + edi]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41e0dc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
push 0x5c
pop eax
cmp word [esi + edx*2 - 2], ax
je 0x41e08d
mov word [esi + edx*2], ax
inc edx
mov ecx, ebx
xor eax, eax
mov edi, eax
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x41e099
sub ecx, dword [ebp - 8]
sar ecx, 1
je 0x41e0da
lfence
lea edx, [esi + edx*2]
mov ax, word [ebx + edi*2]
mov ecx, ebx
mov word [edx], ax
inc edi
lea edx, [edx + 2]
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x41e0c5
sub ecx, dword [ebp - 8]
sar ecx, 1
cmp edi, ecx
jb 0x41e0b2
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e23f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e253
test al, 0x50
jne 0x41e253
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x450185
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0044fd59
push eax
push esi
push dword [ebp + 8]
call fcn.0044fd0e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0044fd49
mov ah, 0x91
pop ds
std
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0044fd49
mov edx, 0x8da28a79
invalid
invalid
Function at 0x401203
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
je 0x40129f
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call esi
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401227
sub eax, ecx
sar eax, 1
add eax, edi
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4012a1
push edi
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x5c
je 0x40125f
push 0x5c
pop ecx
mov word [ebx + eax*2], cx
inc eax
mov ecx, dword [ebp + 8]
xor edx, edx
lea edi, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x401267
sub ecx, edi
sar ecx, 1
je 0x40129f
lea ecx, [ebx + eax*2]
mov eax, dword [ebp + 8]
mov si, word [eax + edx*2]
mov word [ecx], si
inc edx
add ecx, 2
lea esi, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x40128c
sub eax, esi
sar eax, 1
cmp edx, eax
jb 0x40127b
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401425
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40143f
test al, 0x50
jne 0x40143f
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401443
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5f7350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ecx, ecx
xor esi, esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], 0x26
mov dword [ebp - 8], 0x2a
cmp dword [0x602648], ecx
jne 0x4014e4
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push 3
push 1
push 3
push 2
push ecx
push ecx
call edi
push edx
push eax
call edi
push edx
push eax
call edi
push edx
push eax
push 0x23
xor ecx, ecx
push 0x602648
mov dword [0x602648], 0x11c
mov dword [0x60264c], 6
mov dword [0x602650], 1
mov word [0x60275c], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
inc eax
mov dword [0x5f8adc], eax
xor ecx, ecx
jmp 0x4014e9
mov eax, dword [0x5f8adc]
cmp eax, ecx
je 0x4014f5
xor eax, eax
inc eax
jmp 0x40161f
cmp dword [ebp - 0x14], ecx
je 0x40160f
push ecx
push ecx
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
test edi, edi
je 0x40160f
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40160f
push 0
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, eax
jbe 0x40160f
and dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x10]
cmp eax, 0x26
jne 0x4015c2
push 0
push 0
push 0x584abc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x40160f
lea eax, [edi + edi + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40160f
push edi
push esi
push 0x584abc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp edi, eax
jne 0x40160f
push esi
push 0x584abc
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4015ab
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x26
jmp 0x4015c3
cmp word [esi + edi*2 - 4], 0x5c
je 0x4015cf
push 0x584ab8
inc edi
mov ebx, esi
call section..text
jmp 0x4015cf
push eax
call fcn.004012a6
mov esi, eax
pop ecx
test esi, esi
je 0x40160f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4015d4
sub eax, edx
sar eax, 1
push eax
push esi
push dword [ebp - 0x18]
call fcn.00514c3a
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0x40160f
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x401543
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x18]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051497f
leave
ret
Function at 0x4083e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x354
mov eax, 0x55caab
call fcn.00523c97
mov ebx, ecx
cmp dword [ebx + 0x10], 0
jne 0x408435
mov dword [ebp - 0x2bc], str.Path_cannot_be_empty
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00515200
push 0x5c9800
lea eax, [ebp - 0x2c8]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::invalid_argument.0
call fcn.0051ed55
push ebx
lea esi, [ebp - 0x48]
call fcn.0040d93e
and dword [ebp - 4], 0
mov eax, esi
call fcn.0048ea55
mov edi, dword [ebx + 0x10]
push 8
pop esi
cmp dword [ebx + 0x14], esi
jb 0x408458
mov eax, dword [ebx]
jmp 0x40845a
mov eax, ebx
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x48]
call fcn.00410731
test eax, eax
je 0x408476
mov dword [ebp - 0x2bc], str.Path_contains_invalid_separators
jmp 0x408408
mov edx, dword [ebx + 0x14]
cmp edx, esi
jb 0x408481
mov ecx, dword [ebx]
jmp 0x408483
mov ecx, ebx
mov eax, dword [ebx + 0x10]
lea ecx, [ecx + eax*2]
cmp word [ecx - 2], 0x5c
jne 0x40849f
mov dword [ebp - 0x2bc], str.Path_cannot_have_trailing_path_separator.
jmp 0x408408
cmp eax, 0x104
jbe 0x4084b5
mov dword [ebp - 0x2bc], str.Path_is_too_long
jmp 0x408408
cmp edx, esi
jb 0x4084bd
mov eax, dword [ebx]
jmp 0x4084bf
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40851a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x360]
push eax
call fcn.004036c8
mov esi, eax
push str.GetFileAttributes_failed_with
push esi
mov byte [ebp - 4], 1
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 2
push 0x224
mov ecx, str.srcApplicationDetector.cpp
lea eax, [ebp - 0x2c]
call fcn.004025fb
test al, 0x10
jne 0x408536
push str.Path_is_not_a_directory.
lea esi, [ebp - 0x2c]
call fcn.0040338f
mov byte [ebp - 4], 3
push 0x229
jmp 0x40850d
lea eax, [ebp - 0x64]
push 0x586ecc
push eax
call fcn.004100cb
push 0x24c
lea eax, [ebp - 0x2b4]
push 0
mov byte [ebp - 4], 4
and dword [ebp - 0x2b8], 0
push eax
call fcn.00517e90
mov eax, dword [ebp - 0x64]
add esp, 0x14
cmp dword [ebp - 0x50], esi
jae 0x408570
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x2b8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4085ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x360]
push eax
call fcn.004036c8
mov esi, eax
push str.FindFirstFile_failed_with
push esi
mov byte [ebp - 4], 5
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 6
push 0x239
jmp 0x40850d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.00404145
push 1
lea esi, [ebp - 0x48]
call fcn.00404145
call fcn.00523d1a
ret
Function at 0x40a58d
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push 0x59c
mov eax, 0x5704db
call fcn.00523ccd
xor eax, eax
push 0x206
mov word [ebp - 0x430], ax
xor ebx, ebx
lea eax, [ebp - 0x42e]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x470], edi
call fcn.00517e90
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40a6a3
lea eax, [ebp - 0x430]
push eax
lea esi, [ebp - 0x44c]
mov dword [ebp - 4], ebx
call fcn.0040338f
mov edx, esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004085ed
push 1
xor edi, edi
call fcn.00404145
or dword [ebp - 4], 0xffffffff
jmp 0x40a714
lea eax, [ebp - 0x510]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_get_CSIDL_PROGRAM_FILES_path.
push esi
mov dword [ebp - 4], 5
call fcn.00405d7d
pop ecx
pop ecx
lea eax, [ebp - 0x44c]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 6
cmp dword [ebp - 0x438], 8
mov eax, dword [ebp - 0x44c]
jae 0x40a6ec
lea eax, [ebp - 0x44c]
push eax
push 2
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x44c]
call fcn.00404145
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x510]
call fcn.00402669
lea eax, [ebp - 0x46c]
push eax
mov dword [ebp - 0x46c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x40a738
mov dword [ebp - 0x46c], ebx
cmp dword [ebp - 0x46c], 1
jne 0x40a7ad
xor eax, eax
push 0x208
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push ebx
push eax
call fcn.00517e90
add esp, 0xc
push 0x105
lea eax, [ebp - 0x228]
push eax
push 0x584abc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40a7ad
lea eax, [ebp - 0x228]
push eax
lea esi, [ebp - 0x44c]
mov dword [ebp - 4], 7
call fcn.0040338f
mov ecx, dword [ebp - 0x470]
mov edx, esi
mov byte [ebp - 4], 8
call fcn.004085ed
push 1
xor edi, edi
call fcn.00404145
call fcn.00523d29
ret
Function at 0x412587
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c8b3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx]
mov esi, edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [esp + 0x98], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4125f4
cmp eax, 1
je 0x4125f4
xor al, al
jmp 0x4125f7
xor eax, eax
inc eax
push 0x49
push eax
mov edi, str.srcApplicationLaunchInfoCollector.cpp
call fcn.004922e6
pop ecx
pop ecx
xor eax, eax
push 7
pop ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x78], ecx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x58], eax
mov word [esp + 0x48], dx
mov dword [esp + 0x74], eax
mov word [esp + 0x64], cx
mov byte [esp + 0x98], 1
mov ecx, dword [esi + 0x20]
sub ecx, eax
je 0x4126f0
dec ecx
jne 0x412731
mov esi, dword [ebx + 0x24]
jmp 0x41267d
mov edi, dword [esp + 0x14]
lea ecx, [esi + 0x14]
mov eax, edi
call fcn.00410033
test al, al
je 0x41267a
mov eax, dword [esi + 0x10]
cmp eax, dword [edi + 0x1c]
jne 0x41267a
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x412687
add esi, 0x50
cmp esi, dword [ebx + 0x28]
jne 0x412658
jmp 0x412731
lea edi, [esp + 0x2c]
call fcn.004930b5
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
push esi
mov ecx, ebx
mov dword [esi + 0xc], eax
call fcn.00412772
mov eax, dword [ebx + 0x28]
lea edi, [esi + 0x50]
mov dword [esp + 0x18], eax
cmp edi, eax
je 0x4126ce
mov dword [esp + 0x14], esi
sub dword [esp + 0x14], edi
mov esi, dword [esp + 0x14]
lea esi, [esi + edi]
call fcn.00413398
add edi, 0x50
cmp edi, dword [esp + 0x18]
jne 0x4126b9
mov esi, dword [ebx + 0x28]
lea edi, [esi - 0x50]
cmp edi, esi
je 0x4126ea
mov ebx, edi
call fcn.004133d5
add edi, 0x50
cmp edi, esi
jne 0x4126d8
mov ebx, dword [esp + 0x1c]
add dword [ebx + 0x28], 0xffffffb0
jmp 0x412731
push 0xffffffffffffffff
push eax
mov eax, esi
lea ecx, [esp + 0x50]
call fcn.00404082
mov eax, dword [esi + 0x1c]
lea edi, [esp + 0x24]
mov dword [esp + 0x44], eax
call fcn.004930b5
mov ecx, dword [eax]
mov dword [esp + 0x34], ecx
mov eax, dword [eax + 4]
and dword [esp + 0x3c], 0
and dword [esp + 0x40], 0
lea esi, [ebx + 0x24]
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], eax
call fcn.00412f49
push 1
xor edi, edi
lea esi, [esp + 0x68]
call fcn.00404145
push 1
lea esi, [esp + 0x4c]
call fcn.00404145
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret
Function at 0x412e02
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56b754
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.00412dc0
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.004954de
test al, al
je 0x412f10
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x412e78
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412f10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_delete_ApplicationLaunchInfoStatistics_file:
push esi
mov byte [esp + 0x100], 1
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.00403732
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x412ee8
lea eax, [esp + 0xcc]
push eax
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.00404145
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.00402669
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.00404145
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret