joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410fa9
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 8], 0
jne 0x41100a
jmp 0x4110a6
cmp dword [ebp + 0xc], 0
jne 0x411015
jmp 0x4110a4
cmp dword [ebp + 0x10], 0
jne 0x411020
jmp 0x4110a2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x433bd4
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x433bdc
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x411074
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
jmp 0x4110a8
jmp 0x41109a
jmp 0x41109a
jmp 0x41109a
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411d4d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x411d6f
jmp 0x411e2f
cmp dword [ebp + 8], 0
jne 0x411d7a
jmp 0x411e2d
cmp dword [ebp + 0xc], 0
jne 0x411d85
jmp 0x411e2b
mov eax, dword [ebp + 8]
push eax
push 0x20
mov ecx, dword [ebp + 0x10]
add ecx, 0x32
push ecx
push 0x433fc4
push 0x433fc8
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x20
mov ecx, dword [ebp + 0x10]
add ecx, 0x66
push ecx
push 0x433fd0
push 0x433fd4
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x14
mov ecx, dword [ebp + 0x10]
add ecx, 0x52
push ecx
push 0x433fdc
push 0x433fe0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x433fe4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x88], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x411e31
jmp 0x411e26
jmp 0x411e26
jmp 0x411e26
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4133b2
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push edi
mov dword [ebp - 0x228], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0041a299
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x34], 0
je 0x4133e6
jmp 0x413546
call fcn.00406cce
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x413400
cmp dword [ebp - 4], 2
je 0x413400
cmp dword [ebp - 4], 0
jne 0x41340f
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x413534
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0x33
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea edx, [ebp - 0x10c]
push edx
push 0x34
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x224]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4134a4
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x413544
lea eax, [ebp - 0x21c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x214], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x220]
push ecx
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41350c
push 0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x413542
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x413534
push 0
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x413540
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x413548
jmp 0x41353b
jmp 0x41353b
jmp 0x41353b
jmp 0x41353b
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41354d
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push edi
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x12c], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x130], 0
cmp dword [ebp + 8], 0
jne 0x41359a
jmp 0x413661
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4135ad
jmp 0x41365f
push 0x1e
push 0
lea ecx, [ebp - 0x24]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x106
push 0
lea edx, [ebp - 0x12c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x130]
movsx edx, byte [ecx - 1]
cmp edx, 0x5c
jne 0x413617
mov eax, dword [ebp - 0x130]
sub eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
jmp 0x41362a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x12c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 3
mov word [ebp - 0x14], 0x14
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 0x134]
jmp 0x413663
jmp 0x41364d
jmp 0x413657
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x41390e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 5
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x434348
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jae 0x41398f
mov edx, dword [ebp + 8]
push edx
push str.Run__s_Failed.
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00410257
add esp, 8
jmp 0x4139cb
mov edx, dword [ebp + 8]
push edx
push str.Run__s_Success.
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00410257
add esp, 8
mov dword [ebp - 0x108], 1
mov eax, dword [ebp - 0x108]
jmp 0x4139cd
jmp 0x4139c3
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x41451b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push str.Start_RollBack.
call fcn.00410257
add esp, 8
push 0
push str.Init_Path.
call fcn.00410257
add esp, 8
push 0x104
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040ebfa
mov dword [ebp - 8], eax
push 0x104
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040ea68
add esp, 8
mov dword [ebp - 8], eax
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4145f0
push 0
push str.No_Exists_Backup_Files__Cant_Roll_Back.
call fcn.00410257
add esp, 8
jmp 0x4146ac
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0041366a
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.004146b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41462a
jmp 0x4146aa
push 0
push 1
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0041248d
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0041354d
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0xc], 0
je 0x414684
cmp dword [ebp - 4], 0
jne 0x414684
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.004132b2
cmp dword [ebp - 4], 0
je 0x4146a2
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x34], 0
mov ecx, dword [ebp - 0x21c]
call fcn.004133b2
mov eax, dword [ebp - 0x218]
jmp 0x4146ae
jmp 0x414666
jmp 0x414666
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x414a5d
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423e8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push esi
push edi
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
call fcn.004226f2
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.00418a10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x414acb
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x414bbb
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00418a50
mov esi, eax
mov ecx, 0x23
lea edi, [ebp - 0xac]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0042274c
lea edx, [ebp - 0xac]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00422710
lea ecx, [ebp - 0xbc]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004040f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x414ba7
push 0x80
lea ecx, [ebp - 0x1c]
call fcn.004040f0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x414b64
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.00422740
jmp 0x414bc2
push 0
push 2
lea ecx, [ebp - 0x1c]
call fcn.004040f0
push eax
lea ecx, [ebp - 0xbc]
call sub.MFC42.DLL_CFile::Open
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414b90
lea ecx, [ebp - 0xbc]
call sub.MFC42.DLL_CFile::Close
cmp dword [ebp - 0x10], 0
jne 0x414ba7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.00422740
jmp 0x414bc2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.00422740
jmp 0x414ac2
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x414d8d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push edi
mov dword [ebp - 0x12c], ecx
mov byte [ebp - 0x128], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x434564
mov eax, dword [ebp + 8]
push eax
push 0x434570
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x128]
push edx
push 0
push 0x434578
push 0x434580
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
or al, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0x434590
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0x434594
push str.Leave_Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x414f32
Capabilities:
Copy file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
push edi
mov dword [ebp - 0x728], ecx
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x724], 0
mov al, byte [0x439a28]
mov byte [ebp - 0x720], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x71f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x720]
push ecx
push 0x104
push 0x4345ac
call fcn.00405071
add esp, 0xc
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x414fa2
xor eax, eax
jmp 0x415126
lea edx, [ebp - 0x720]
push edx
push 0
push 0x4345b8
push str.ProductInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 5
je 0x414fd4
mov eax, 1
jmp 0x415126
mov al, byte [0x439a2c]
mov byte [ebp - 0x61c], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x208
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x415019
xor eax, eax
jmp 0x415126
mov byte [ebp - 0x619], 0
push str.Program_FilesCommon_FilesHuawei_3comSecure_ClientPluginsKS_Plugin_AVInstall_
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov al, byte [0x439a30]
mov byte [ebp - 0x410], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439a34]
mov byte [ebp - 0x208], cl
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
push 0x208
push 0x434624
call fcn.00405071
add esp, 0xc
push str.KHPlugIn.DLL
lea edx, [ebp - 0x410]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
push 0x208
push 0x434644
call fcn.00405071
add esp, 0xc
push str.av_plugin.inf
lea edx, [ebp - 0x410]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41512b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push edi
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], 0
mov dword [ebp - 8], 0
mov al, byte [0x439a38]
mov byte [ebp - 0x450], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x44f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x348], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x344]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0xffffffff
mov cl, byte [0x439a3c]
mov byte [ebp - 0x208], cl
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x34c], 0
lea edx, [ebp - 0x450]
push edx
push 0x104
push 0x439a40
call fcn.00405071
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4151d8
jmp 0x4152ec
lea eax, [ebp - 0x450]
push eax
push str._sPlugIn.DLL
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x415216
jmp 0x4152ea
cmp dword [ebp - 0x348], 0x10
je 0x415257
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x450]
push edx
push 0x434674
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x458]
call fcn.004152f3
mov dword [ebp - 8], eax
lea edx, [ebp - 0x348]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4152af
cmp dword [ebp - 0x348], 0x10
je 0x4152ad
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x450]
push edx
push 0x43467c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x458]
call fcn.004152f3
mov dword [ebp - 8], eax
jmp 0x415257
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x12
je 0x4152c6
jmp 0x4152e8
mov dword [ebp - 0x454], 1
cmp dword [ebp - 4], 0xffffffff
je 0x4152e0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x454]
jmp 0x4152ee
jmp 0x4152d0
jmp 0x4152d0
jmp 0x4152d0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41624e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423ec9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push edi
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x10], 0
mov al, byte [0x439a7c]
mov byte [ebp - 0x11c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x18]
call fcn.0041d630
mov dword [ebp - 4], 0
push 0x4350dc
push 0x80000002
lea ecx, [ebp - 0x18]
call fcn.0041d66d
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jne 0x4163bf
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
push 0x435104
lea ecx, [ebp - 0x18]
call fcn.0041d8b2
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x416332
push 0
push str.can_not_read_version_from_register__use_default_version2.5_
call fcn.00410257
add esp, 8
push 0x43514c
push 0x435150
lea ecx, [ebp - 0x18]
call fcn.0041d752
mov dword [ebp - 0x124], 4
lea edx, [ebp - 0x11c]
push edx
push 0x435158
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x416354
mov dword [ebp - 0x124], 1
lea eax, [ebp - 0x11c]
push eax
push 0x43515c
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x416376
mov dword [ebp - 0x124], 2
lea ecx, [ebp - 0x11c]
push ecx
push 0x435160
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x416398
mov dword [ebp - 0x124], 3
lea edx, [ebp - 0x11c]
push edx
push 0x435164
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4163ba
mov dword [ebp - 0x124], 4
jmp 0x416477
mov al, byte [0x439a80]
mov byte [ebp - 0x228], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439a84]
mov byte [ebp - 0x32c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x32b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x228]
push edx
call fcn.0040ea68
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x41642e
push 0
push str.GetSoftVersion_GetCurAppPath_fail_
call fcn.00410257
add esp, 8
jmp 0x416477
push 0x43518c
lea eax, [ebp - 0x228]
push eax
push 0x435198
lea ecx, [ebp - 0x32c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x32c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x41646d
mov dword [ebp - 0x124], 4
jmp 0x416477
mov dword [ebp - 0x124], 3
lea ecx, [ebp - 0x18]
call fcn.0041d6c6
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x124]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x330], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041d651
mov eax, dword [ebp - 0x330]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x416902
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push edi
mov dword [ebp - 0x564], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x55c], 0
mov al, byte [0x439a9c]
mov byte [ebp - 0x454], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x453]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439aa0]
mov byte [ebp - 0x350], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x34f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439aa4]
mov byte [ebp - 0x558], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x557]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x439aa8]
mov byte [ebp - 0x104], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x350]
push ecx
call fcn.0040ea68
add esp, 8
mov dword [ebp - 0x10c], eax
push 0x104
lea edx, [ebp - 0x454]
push edx
mov ecx, dword [ebp - 0x564]
call fcn.0041654d
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4169e9
jmp 0x416b6c
lea ecx, [ebp - 0x454]
push ecx
push str._s_.
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffff
jne 0x416a2d
jmp 0x416b6a
push 0x435254
lea edx, [ebp - 0x220]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x416b0d
push 0x435258
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x416b0d
mov ecx, dword [ebp - 0x24c]
and ecx, 0x10
test ecx, ecx
je 0x416a77
jmp 0x416b0d
mov dword [ebp - 0x560], 0
jmp 0x416a92
mov edx, dword [ebp - 0x560]
add edx, 1
mov dword [ebp - 0x560], edx
cmp dword [ebp - 0x560], 6
jge 0x416ac5
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x560]
imul ecx, ecx, 0x104
add ecx, 0x426ce8
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x416ac3
jmp 0x416a83
jmp 0x416a83
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x454]
push eax
push 0x43525c
lea ecx, [ebp - 0x558]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x80
lea edx, [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x558]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10c], eax
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416a2d
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x55c], 1
cmp dword [ebp - 0x55c], 0
jne 0x416b62
push 0
push str.KANUpdate2::VersionBackDelete___Fail
call fcn.00410257
add esp, 8
mov eax, dword [ebp - 0x55c]
jmp 0x416b6e
jmp 0x416b4a
jmp 0x416b40
pop edi
mov esp, ebp
pop ebp
ret