joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ae0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414a29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
mov eax, dword [0x41c260]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x401c62
call fcn.004017b0
push 0
push 0x20000080
push 3
push 0
push 3
push bind
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c62
mov eax, dword [ebp + 8]
lea ebx, [esi + 0x50]
push eax
mov ecx, ebx
call dword [0x416570]
lea ecx, [esi + 0x74]
push ecx
push 0
lea edx, [esi + 0x6c]
push edx
push edi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
mov ecx, esi
je 0x401b76
call fcn.004012a0
test eax, eax
jne 0x401b82
mov ecx, esi
call fcn.004017b0
xor eax, eax
jmp 0x401c73
mov eax, dword [ebx + 0x18]
mov edi, 0x10
cmp eax, edi
jb 0x401b93
mov ebx, dword [ebx + 4]
jmp 0x401b96
add ebx, 4
push 0
push 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x40]
push ecx
push ebx
call dword [sym.imp.MSVCR71.dll__splitpath]
add esp, 0x14
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x2c]
jae 0x401bde
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x254]
push edx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x24c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp eax, 1
jne 0x401c20
mov eax, dword [esi + 0x7c]
mov ecx, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
je 0x401c20
xor edx, edx
mov eax, 0x1000
div ecx
imul eax, ecx
mov dword [esi + 0x7c], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [esi + 0x7c]
push 4
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x80], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x401c6e
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004019b0
test eax, eax
jne 0x401c6e
xor eax, eax
jmp 0x401c73
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004140fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401c90
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp eax, 0x100a
ja 0x401d8e
je case.0x401cd6.1034
cmp eax, 0x80a
ja 0x401d1a
je case.0x401cd6.1034
cmp eax, 0x411
ja 0x401ce3
je 0x401cdd
lea ecx, [eax - 0x404]
cmp ecx, 0xc
ja case.0x401cd6.1029
movzx ecx, byte [ecx + 0x401e6c]
jmp dword [ecx*4 + 0x401e54]
mov eax, 0x411
ret
cmp eax, 0x804
ja 0x401d09
je 0x401d80
mov ecx, eax
sub ecx, 0x413
je 0x401d45
sub ecx, 3
jne case.0x401cd6.1029
mov eax, 0x816
ret
cmp eax, 0x807
jne case.0x401cd6.1029
mov eax, 0x407
ret
cmp eax, 0xc07
ja 0x401d5a
je case.0x401cd6.1031
cmp eax, 0x813
ja 0x401d4b
je 0x401d45
mov ecx, eax
sub ecx, 0x80c
je case.0x401cd6.1036
sub ecx, 4
jne case.0x401cd6.1029
mov eax, 0x410
ret
mov eax, 0x413
ret
cmp eax, 0x816
je 0x401d03
cmp eax, 0xc04
je case.0x401cd6.1028
ret
cmp eax, 0x1004
ja 0x401d86
je 0x401d80
mov ecx, eax
sub ecx, 0xc0a
je case.0x401cd6.1034
sub ecx, 2
jne case.0x401cd6.1029
mov eax, 0x40c
ret
mov eax, 0x804
ret
cmp eax, 0x1007
je case.0x401cd6.1031
ret
cmp eax, 0x280a
ja 0x401dfd
je case.0x401cd6.1034
cmp eax, 0x180a
ja 0x401ddd
je case.0x401cd6.1034
cmp eax, 0x1407
ja 0x401dcd
je case.0x401cd6.1031
cmp eax, 0x100c
je case.0x401cd6.1036
cmp eax, 0x1404
jne case.0x401cd6.1029
mov eax, 0x404
ret
mov ecx, eax
sub ecx, 0x140a
je case.0x401cd6.1034
sub ecx, 2
je case.0x401cd6.1036
ret
cmp eax, 0x200a
ja 0x401df5
je case.0x401cd6.1034
cmp eax, 0x180c
je case.0x401cd6.1036
cmp eax, 0x1c0a
je case.0x401cd6.1034
ret
cmp eax, 0x240a
je case.0x401cd6.1034
ret
cmp eax, 0x400a
ja 0x401e2d
je case.0x401cd6.1034
cmp eax, 0x340a
ja 0x401e1e
je case.0x401cd6.1034
cmp eax, 0x2c0a
je case.0x401cd6.1034
cmp eax, 0x300a
je case.0x401cd6.1034
ret
cmp eax, 0x380a
je case.0x401cd6.1034
cmp eax, 0x3c0a
je case.0x401cd6.1034
ret
cmp eax, 0x4c0a
ja 0x401e45
je case.0x401cd6.1034
cmp eax, 0x440a
je case.0x401cd6.1034
cmp eax, 0x480a
je case.0x401cd6.1034
ret
cmp eax, 0x500a
jne case.0x401cd6.1029
mov eax, 0x40a
ret
Function at 0x401e90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
push 0x104
mov byte [ebp - 4], 1
call sub.MFC71.DLL_operator_new
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
cmp esi, edi
mov byte [ebp - 4], 2
jne 0x401f0c
mov esi, dword [ebp + 8]
push 0x416951
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push edi
call sub.MFC71.DLL_operator_delete_1
push edi
call sub.MFC71.DLL_operator_delete_1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov dword [ebp - 0x14], esi
call sub.MFC71.DLL_operator_delete_1
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x104
push esi
push 3
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
mov edi, dword [ebp + 8]
mov ecx, edi
jne 0x401f5d
push 0x416951
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push esi
call sub.MFC71.DLL_operator_delete_1
mov eax, edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push esi
call sub.MFC71.DLL_operator_delete_1
mov eax, edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402080
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40208f
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x38]
push ecx
mov dword [esi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x58]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4020c9
mov eax, dword [esi + 0x58]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x58], 0
pop esi
ret
Function at 0x4020d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4020f1
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov edx, dword [edi + 0x18]
test edx, edx
je 0x402139
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 8], 1
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402110
lea ecx, [esp + 8]
push ecx
push edx
sub eax, edi
push 0x4a
inc eax
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
add esp, 0xc
ret 4
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret 4

Function at 0x4022f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x414a97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x41c260]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
push ebx
push eax
lea ecx, [esp + 8]
call dword [0x416138]
xor ebx, ebx
push str..index
lea ecx, [esp + 8]
mov dword [esp + 0xa8], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4023b0
lea ecx, [esp + 8]
call fcn.00401920
push 1
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 1
mov dword [esp + 0x94], ebx
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x10]
call fcn.00401ae0
test eax, eax
lea ecx, [esp + 8]
mov byte [esp + 0xa4], bl
je 0x4023ab
call fcn.004018b0
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, 1
jmp 0x4023bc
call fcn.004018b0
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x98]
pop ebx
call fcn.004140fd
add esp, 0xa4
ret 4
Function at 0x4023e0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x414a69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 0x104
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea ecx, [esp]
jne 0x402440
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0xffffffffffffffff
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
mov eax, dword [str.EDWATCH.Tmp]
push eax
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4029e0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x402810
push 0
push 0
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
push 0xfffffffffffffff1
push eax
mov dword [esi + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x7c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x402a20
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7c], 0
mov eax, 1
pop esi
ret
Function at 0x402ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ebp, [edi + 0x1c]
push ebp
xor ebx, ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
je 0x402f29
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esi + 4]
mov eax, 1
cmp ecx, eax
jne 0x402f1b
cmp dword [esi + 8], eax
jne 0x402f1b
mov eax, dword [esi]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x402f06
cmp dword [esi + 0x10], 4
jne 0x402f1b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402f1a
mov eax, dword [esi + 0x10]
test eax, eax
je 0x402f1a
cmp eax, 3
jne 0x402f1b
inc ebx
mov eax, dword [edi + 0x10]
add esi, 0x28
cmp esi, eax
jne 0x402ee5
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 4
Function at 0x4046e7
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x414bb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x4169ec
mov ecx, dword [esi + 4]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x14], 5
je 0x40470a
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x38]
push ebp
push edi
push ecx
mov dword [esi + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x58]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push edx
call ebp
cmp eax, 0x102
jne 0x40473f
mov eax, dword [esi + 0x58]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x58], ebx
mov ecx, dword [esi + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
cmp dword [0x41c49c], ebx
mov ecx, esi
je 0x40475c
call fcn.00402b20
jmp 0x404761
call fcn.004023e0
mov ecx, esi
call fcn.004044d0
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x404778
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 4], ebx
cmp dword [esi + 0x74], ebx
je 0x4047b8
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x40479c
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x7c]
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [esi + 0x78]
push ecx
call edi
mov dword [esi + 0x78], ebx
mov edx, dword [esi + 0x74]
push edx
lea ecx, [esi + 0x6c]
call fcn.00410710
mov eax, dword [esi + 0x7c]
cmp eax, ebx
mov dword [esi + 0x74], ebx
je 0x4047b8
push eax
call edi
mov dword [esi + 0x7c], ebx
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x94]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esi + 0x80]
call fcn.004036b0
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 2
call fcn.00410850
lea ecx, [esi + 0x44]
mov byte [esp + 0x1c], 1
call fcn.004110a0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], bl
call fcn.004110a0
mov eax, dword [esi + 0xc]
cmp eax, ebx
pop edi
pop ebp
je 0x404811
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405060
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x405050
push 0
push 0
mov dword [esi + 0x34], 1
call dword [sym.imp.MSVCR71.dll__beginthreadex]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x9c]
add esp, 0x18
cmp eax, 2
je 0x405098
cmp eax, 3
jne 0x4050a4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4050a4
mov edx, dword [ecx]
call dword [edx + 0x10]
pop esi
pop ecx
ret
Function at 0x406530
Capabilities:
Find taskbar

Disassembly:
push ecx
push ebx
push 0
push str.Shell_TrayWnd
mov ebx, ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x406665
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push str.TrayNotifyWnd
push 0
push eax
call edi
mov esi, eax
test esi, esi
je 0x406663
push 0
push str.SysPager
push 0
push esi
call edi
test eax, eax
jne 0x406579
mov eax, esi
push 0
push str.ToolbarWindow32
push 0
push eax
call edi
mov esi, eax
test esi, esi
je 0x406663
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], 2
push 0
push 0
push 0x20
push esi
call edi
push 0
push 0
push 0x84
push esi
call edi
push 0
push 0
push 0xf
push esi
call edi
push 0
push 0
push 0x200
push esi
call edi
push 0xa
call ebp
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
dec dword [esp + 0x10]
jne 0x4065a4
mov eax, dword [ebx + 0x20]
lea esi, [ebx + 0xf8]
mov dword [esi], 0x58
mov dword [ebx + 0xfc], eax
mov dword [ebx + 0x100], 0x3ea
mov dword [ebx + 0x104], 7
mov dword [ebx + 0x108], 0x8064
call sub.MFC71.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push 0
push 0x10
push 0x10
push 1
push 0x81
push ecx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebx + 0x10c], eax
mov eax, dword [str.EDIUS_Watch]
sub ebx, eax
add ebx, 0x110
pop ebp
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x406650
push esi
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x408230
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x414e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
mov eax, dword [0x41c260]
push esi
push str.SOFTWARECanopusEDIUS5.00AppResource
lea ecx, [esp + 8]
mov dword [esp + 0x430], eax
call dword [0x416138]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x444], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4082ed
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.Language
push eax
mov dword [esp + 0x24], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4082ed
mov ecx, dword [esp + 0x440]
lea edx, [esp + 0x2c]
push edx
call dword [0x416570]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
jmp 0x408350
call fcn.00401c90
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00401e90
add esp, 8
mov esi, dword [esp + 0x440]
push eax
mov ecx, esi
mov byte [esp + 0x43c], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::max_size_void_const]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
lea ecx, [esp + 4]
add esi, 0x80004005
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, esi
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
pop esi
call fcn.004140fd
add esp, 0x438
ret 4
Function at 0x4083e0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x414ea2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 1
push 7
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4084ae
push 0xffffffffffffffff
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 0x6b
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::LoadStringA]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 4]
push eax
call fcn.00410210
add esp, 8
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [esp + 4]
je 0x4084a8
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 8]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4084d0
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x414ea2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 1
push 7
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
lea ecx, [esp]
je 0x408591
push esi
push 0xffffffffffffffff
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 0x6b
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::LoadStringA]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 8]
push eax
call fcn.00410210
add esp, 8
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
mov esi, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 8]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4085b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x214
mov eax, dword [0x41c260]
push esi
push 0
mov dword [esp + 0x218], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x4187e4
push 1
push 0
push 0x4187f4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x408662
mov edx, dword [esp + 0x220]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x418804
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x408658
mov ecx, dword [esp + 0x21c]
push 0x104
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
mov edx, dword [eax]
push 1
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
call fcn.004140fd
add esp, 0x214
ret 8

Function at 0x408880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x41c260]
push esi
mov dword [esp + 0x108], eax
push 0x103
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push 0x2e
push ecx
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
test eax, eax
jne 0x4088d5
mov dword [esi + 0xe0], eax
pop esi
mov ecx, dword [esp + 0x104]
call fcn.004140fd
add esp, 0x108
ret
mov edx, dword [str..chm]
mov dword [eax], edx
mov cl, byte [0x4172f0]
lea edx, [esp + 4]
push edx
mov byte [eax + 4], cl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40891a
lea eax, [esp + 4]
lea edx, [esi + 0x14e]
mov ecx, eax
mov dword [esi + 0xe0], 1
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x408910
mov ecx, dword [esp + 0x108]
pop esi
call fcn.004140fd
add esp, 0x108
ret