joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407750
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
add esi, 0x10
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
push 0x420918
push 0x100
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x407830
mov ebx, 1
cmp dword [ebp - 0xc], ebx
jle 0x407830
mov dword [ebp - 8], 2
jmp 0x4077b3
mov edi, dword [ebp - 0x10]
push 0x200
call fcn.0040fa6a
mov ecx, dword [edi + ebx*4]
push ecx
push 0x420918
push eax
mov dword [ebp - 0x14], eax
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 8]
add esp, 0x10
cmp edx, dword [ebp - 0xc]
jge 0x407807
mov eax, dword [edi + ebx*4 + 4]
cmp word [eax], 0x2f
je 0x407807
inc dword [ebp - 8]
push 0x20
inc ebx
call fcn.0040fa6a
mov ecx, dword [edi + ebx*4]
push ecx
mov esi, eax
push 0x420918
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
call fcn.004089f0
push eax
mov eax, esi
push eax
lea esi, [ebp - 0x24]
call fcn.004086a0
inc dword [ebp - 8]
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4077b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407c60
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x131c]
push ebx
push edi
push 0x421610
push 0x4208f8
call fcn.004038b0
mov eax, dword [esi]
mov edx, dword [eax + 4]
push 0x104
lea ebx, [esi + 0x2858]
push ebx
mov ecx, esi
call edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x407cca
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407cc1
test al, 0x10
jne 0x407cc1
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edi, dword [esi + 0x131c]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040a690
lea edx, [ebp - 0x214]
push edx
lea edx, [ebp - 0x218]
mov ecx, eax
mov dword [esi + 0x1320], eax
call fcn.0040ab80
mov edi, eax
test edi, edi
je 0x407d62
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
push ebx
push eax
push ecx
mov ecx, dword [esi + 0x131c]
mov edx, edi
call fcn.004075e0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx edx, byte [esi + 0x1324]
push esi
push edx
lea eax, [esi + 0x10c]
push eax
lea edx, [esi + 0x1534]
push ebx
push edx
mov edx, dword [esi + 0x131c]
lea ecx, [esi + 0x8a]
call fcn.00407030
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x407d80
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x208
mov dword [ebp - 0x218], ebx
call fcn.0040fa6a
lea esi, [ebx + 0x8a]
push esi
push str.Software_s
push 0x104
push eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edx, dword [ebp - 0x210]
add esp, 0x14
lea ecx, [ebp - 0x214]
push ecx
push edx
xor eax, eax
lea edi, [ebx + 0x1326]
push SysReAllocString
mov word [edi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x407e0f
push str.exec
lea ecx, [ebp - 0x214]
mov ebx, 0x104
call fcn.00404440
mov ebx, dword [ebp - 0x218]
add esp, 4
cmp word [edi], 0
je 0x407e5c
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407e20
sub eax, edx
sar eax, 1
test eax, eax
jle 0x407ea2
lea ecx, [ebx + eax*2 + 0x1324]
lea ebx, [ebx]
cmp word [ecx], 0x5c
je 0x407e50
dec eax
sub ecx, 2
test eax, eax
jg 0x407e40
jmp 0x407ea2
xor ecx, ecx
mov word [ebx + eax*2 + 0x1324], cx
jmp 0x407ea2
xor edx, edx
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push 0x26
push edx
mov word [ebp - 0x20c], dx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea ecx, [ebp - 0x20c]
push ecx
push 0x421048
mov edx, ecx
push 0x104
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea edi, [ebp - 0x20c]
mov ecx, ebx
call fcn.00407ed0
mov eax, dword [ebp - 0x210]
push eax
call fcn.0040fa9f
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret

Function at 0x407ed0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push edi
mov esi, ecx
push 0x420918
lea eax, [esi + 0x1326]
push 0x104
push eax
call ebx
add esi, 0x8a
push esi
push edi
push str._s_s.exe
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call ebx
push esi
push str.Software_s
lea edx, [ebp - 0x414]
push 0x104
push edx
call ebx
add esp, 0x34
push 0
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
pop ebx
test eax, eax
jne 0x407fae
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407f70
mov ecx, dword [ebp - 0x418]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.exec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x408540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push esi
push eax
push eax
push 0x1a
push eax
mov edi, ecx
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add edi, 0x8a
push edi
push esi
push 0x421048
push 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
pop edi
pop esi
pop ebp
ret 8

Function at 0x408ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test al, al
je 0x408f21
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
mov byte [ebx + 0xc], 1
call edx
mov ecx, dword [ebx + 8]
mov byte [ebx + 0xd], 1
test ecx, ecx
je 0x408f11
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [ebx + 0x10], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
push edi
mov edi, dword [eax + 0x131c]
call fcn.00404cd0
pop edi
test al, al
jne 0x408f50
mov ecx, dword [ebx + 8]
mov byte [ebx + 0xe], 1
test ecx, ecx
je 0x408f47
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov eax, 2
mov esp, ebp
pop ebp
ret
push esi
push 8
call fcn.0040fafb
mov esi, eax
add esp, 4
test esi, esi
je 0x408f71
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x131c]
call fcn.00403660
jmp 0x408f73
xor eax, eax
mov edx, dword [ebx + 4]
mov dword [edx + 0x1530], eax
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x408e90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebx + 0x10], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408fa0
Capabilities:
Check if file exists
Get file attributes
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x310
mov eax, dword [0x42701c]
xor eax, esp
mov dword [esp + 0x30c], eax
push ebx
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409059
test al, 0x10
jne 0x409059
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409121
push 0
lea eax, [esp + 0xc]
push eax
push 0x100
lea ecx, [esp + 0x21c]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 8]
push 0x100
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x21c]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
xor edx, edx
push ecx
mov word [esp + eax*2 + 0x14], dx
call fcn.0041034f
add esp, 4
test eax, eax
jne 0x40908d
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0xc]
xor eax, eax
xor esi, esi
add eax, dword [esp + 8]
push esi
push 0x2710
adc ecx, esi
push ecx
push eax
call fcn.0041bd20
push edx
push eax
lea ebx, [esp + 0x18]
call fcn.00405390
add esp, 8
push 0x208
call fcn.0040fa6a
push edi
push str.Software_s
mov esi, eax
push 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409118
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4090e0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push 1
push 0
push 0x421a1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040fa9f
add esp, 4
mov ecx, dword [esp + 0x314]
pop esi
pop ebx
xor ecx, esp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x4091a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x80000
mov ebx, eax
call fcn.0040fa6a
add esp, 4
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebx]
push 0x40000
mov dword [ebp - 4], eax
push eax
mov eax, dword [edx + 0x20]
mov ecx, ebx
call eax
push 8
call fcn.0040fafb
add esp, 4
test eax, eax
je 0x4091e6
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov edi, eax
jmp 0x4091e8
xor edi, edi
push 0x208
mov dword [edi], ebx
call fcn.0040fa6a
add esp, 4
mov esi, eax
push esi
push 0x104
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push esi
push 0
push 0x421024
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov ebx, dword [ebx + 0x131c]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
push ebx
push 0
push 0x409140
push eax
push ecx
push str.startInstallDownloadId
push edi
call fcn.0040e5f0
add esp, 0x1c
call fcn.0040e540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x80000
mov ebx, eax
call fcn.0040fa6a
mov edi, eax
xor eax, eax
add esp, 4
mov word [edi], ax
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
push eax
push 0x40000
push edi
mov ecx, ebx
call edx
push 0x208
call fcn.0040fa6a
add esp, 4
mov esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push esi
push 0
push 0x421024
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov ebx, dword [ebx + 0x131c]
push ebx
push 0
push 0
push esi
push edi
push str.finishInstallDownloadId
push 0
call fcn.0040e5f0
add esp, 0x1c
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0040e420

Function at 0x409480
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x104
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push edi
push 0x104
push esi
call fcn.0040fffd
lea eax, [ebx + 0x2650]
add esp, 0xc
cmp word [eax], 0
jne 0x4094cc
mov edx, dword [ebx]
mov eax, dword [edx + 0x38]
mov ecx, ebx
call eax
push edi
push eax
push 0x420978
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edx, dword [ebp - 0x210]
push edx
push 0x4093e0
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
push str.partnerUtilId
push 0
call fcn.0040e5f0
add esp, 0x30
call fcn.0040e420
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40951f
test al, 0x10
je 0x409524
xor ecx, ecx
mov word [esi], cx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x40a270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41cdbb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x42701c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov eax, dword [0x42701c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x18], 0
mov dword [ebx], edi
mov dword [ebx + 4], esi
call fcn.0040a200
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edi, [eax + ecx - 0x12c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + ecx - 0x12c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc]
add eax, 0x264
push eax
mov esi, str.USER_LICENSE
call fcn.00404060
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push esi
push 0
push ecx
push 0x258
push 0x258
push edx
push edi
push 0xc80000
push eax
push str.ZonaDlgClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x18
mov dword [ebx + 8], eax
call fcn.0040fafb
add esp, 4
test eax, eax
je 0x40a378
mov ecx, dword [ebx + 8]
mov edi, dword [esp + 0xc]
push ecx
push esi
add edi, 8
mov esi, eax
call fcn.0040f0f0
mov esi, eax
jmp 0x40a37a
xor esi, esi
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x10], esi
mov edx, dword [ecx]
mov eax, dword [edx]
push 0x421de8
call eax
movzx ecx, ax
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x40a3af
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x18
call fcn.0040fafb
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x40], 0
test eax, eax
je 0x40a3f4
mov eax, dword [esp + 0xc]
add eax, 0x264
push eax
mov esi, str.CLOSE
call fcn.00404060
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [ebx + 8]
add edi, 8
call fcn.00403c60
jmp 0x40a3f6
xor eax, eax
mov edx, dword [ebx + 8]
push ebx
push 0xffffffffffffffeb
push edx
mov dword [ebx + 0x14], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 8
Function at 0x40a490
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0
push ecx
push 0x19
push 0x190
push eax
push 0xbd
push 0x50000000
push 0
mov esi, edx
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0x190
mov dword [edi + 0x10], 0x19
mov dword [edi + 0x14], 0xbd
mov dword [edi + 0x18], eax
push str.Static
push 0
mov dword [edi], vtable.StageItemUIImpl.0
mov dword [edi + 0x1c], ecx
mov byte [edi + 0x28], 1
call ebx
push 0
push 0
push 0
push eax
push 0x19
push 0x17c
push 0
push 0x14
push 0x50000000
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str.Static
push 0
call ebx
push 1
mov dword [edi + 0x20], eax
mov ecx, dword [esi]
push ecx
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x34
call fcn.0040fafb
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40a550
mov edx, dword [ebp + 8]
mov eax, dword [edi + 4]
push 4
push esi
push edx
push eax
mov eax, 0xb
lea ecx, [eax - 2]
lea edx, [eax - 7]
mov esi, ebx
call fcn.0040d050
jmp 0x40a552
xor eax, eax
mov dword [edi + 0x24], eax
mov eax, dword [eax + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x24]
mov esi, dword [eax + 0x1c]
push 0x421318
push 0x82
push esi
lea ebx, [eax + 0x28]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x40a58a
push ebx
mov ecx, esi
call fcn.0040ceb0
add esp, 4
pop esi
mov eax, edi
mov dword [edi + 0x2c], 0
pop ebx
pop ebp
ret 8

Function at 0x40a750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x40000
xor esi, esi
call fcn.0040fa6a
add esp, 4
push esi
push esi
mov edi, eax
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x40000
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40a7d8
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40a7d8
xor eax, eax
test ecx, ecx
je 0x40a7be
lea ecx, [ecx]
movzx edx, byte [eax + edi]
cmp word [esi*2 + 0x4297c8], dx
jne 0x40a7b6
cmp esi, 0x19
je 0x40a7ec
inc esi
jmp 0x40a7b8
xor esi, esi
inc eax
inc ebx
cmp eax, ecx
jb 0x40a7a0
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push 0x40000
push edi
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40a790
push edi
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b270
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push 0x42076c
push ecx
push eax
call ebx
add esp, 0xc
push 0
add esi, 4
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push esi
push str._sutils.jar
lea edx, [ebp - 0x414]
push 0x104
push edx
call ebx
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b2dc
test al, 0x10
je 0x40b307
push str.utils.jar_is_not_found__extract_him
push 0x4208f8
mov ecx, edi
call fcn.004038b0
push 0x4220f0
push 0xae
lea eax, [ebp - 0x414]
call fcn.00404e90
add esp, 8
jmp 0x40b318
push str.utils.jar_is_found
push 0x4208f8
mov ecx, edi
call fcn.004038b0
push esi
push str._sLicense_ru.rtf
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call ebx
push 0x421de8
push 0x6a
lea eax, [ebp - 0x20c]
call fcn.00404e90
push esi
push str._sLicense_uk.rtf
lea edx, [ebp - 0x20c]
push 0x104
push edx
call ebx
push 0x421de8
push 0x6c
lea eax, [ebp - 0x20c]
call fcn.00404e90
push esi
push str._sLicense_en.rtf
lea eax, [ebp - 0x20c]
push 0x104
push eax
call ebx
add esp, 0x40
push 0x421de8
push 0x6b
lea eax, [ebp - 0x20c]
call fcn.00404e90
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ba20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push edi
push 0x208
mov ebx, eax
call fcn.0040fa6a
lea ecx, [esi + 0x1326]
add esp, 4
push ecx
mov edi, eax
mov dword [esp + 0x10], eax
call fcn.00405550
mov edx, edi
add esp, 4
cmp word [edx], 0
je 0x40ba77
mov ebx, dword [ebx + 8]
mov eax, dword [ebx]
mov edx, dword [eax]
push 0x64
push 0
mov ecx, ebx
call edx
mov ecx, edi
push ecx
call fcn.0040fa9f
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x208
call fcn.0040fa6a
add esp, 4
mov edi, eax
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push edi
push str._sjavaSetup.exe
push 0x104
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x131c]
push eax
push 0x40b7b0
push 0x40b770
push edi
push str.http:__dl.zona.ru_jre_latest.exe
lea eax, [esp + 0x34]
push 0x42251c
push eax
mov dword [esp + 0x48], 1
mov dword [esp + 0x40], ebx
call fcn.0040e5f0
add esp, 0x2c
call fcn.0040e420
cmp word [edi], 0
je 0x40bb24
mov edx, dword [esi + 0x131c]
push edi
mov ecx, esi
call fcn.0040b880
add esp, 4
test al, al
jne 0x40bb24
mov ecx, dword [esi + 0x131c]
push str.Coldt_install_java
push str.ERROR
call fcn.004038b0
mov ebx, str.jre_not_installed
mov eax, esi
call fcn.00407bf0
push edi
call fcn.0040fa9f
mov ecx, dword [esp + 0x10]
add esp, 4
push ecx
call fcn.0040fa9f
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bc90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x634
mov eax, dword [0x42701c]
xor eax, esp
mov dword [esp + 0x630], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + 8]
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push edi
mov ecx, esi
mov dword [esp + 0x10], esi
call edx
test al, al
je 0x40bcfa
mov eax, dword [ebx]
mov edx, dword [eax]
push 0x64
push 1
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax]
push 0x64
push 2
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 8
push 0x20c
call fcn.0040fafb
mov edi, eax
add esp, 4
xor ecx, ecx
test edi, edi
je 0x40bd38
lea edx, [esi + 0x1326]
push edx
lea eax, [edi + 4]
push 0x104
push eax
mov dword [edi], vtable.CommandWithOneArg.0
mov word [eax], cx
call fcn.0040fe56
add esp, 0xc
mov dword [edi], vtable.ExtractUtilsJarCommand.0
mov ecx, edi
mov esi, dword [esi + 0x1530]
lea edi, [esp + 0x438]
call fcn.004036c0
mov esi, dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [esp + 0x28]
push eax
push 0x104
call esi
lea ecx, [esp + 0x230]
push ecx
push 0x104
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea edx, [esp + 0x28]
push edx
push str._sZona.7z
mov eax, edx
push 0x104
push eax
call esi
lea ecx, [esp + 0x240]
push ecx
push str._sappdata.7z
mov edx, ecx
push 0x104
push edx
call esi
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x131c]
push eax
push 0x40b7b0
push 0x40b770
lea ecx, [esp + 0x54]
push ecx
push str.http:__dl.zona.ru_Zona.7z
lea edx, [esp + 0x4c]
push str.core
push edx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 2
call fcn.0040e5f0
add esp, 0x3c
mov edi, eax
mov eax, dword [esi + 0x131c]
push eax
push 0x40b7b0
push 0x40b770
lea eax, [esp + 0x23c]
push eax
push str.http:__dl.zona.ru_appdata.7z
lea ecx, [esp + 0x2c]
push str.plugin
push ecx
call fcn.0040e5f0
mov dword [esp + 0x2c], eax
add esp, 0x1c
mov eax, edi
call fcn.0040e420
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0x32
call fcn.0040e420
mov edx, dword [ebx]
mov eax, dword [edx]
push 0x64
push 1
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
push 2
mov ecx, ebx
call eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esi + 0x1326]
push esi
mov edx, str.core
call fcn.0040bb40
mov eax, dword [ebx]
mov edx, dword [eax]
add esp, 8
push 0x32
push 2
mov ecx, ebx
call edx
lea eax, [esp + 0x230]
push eax
lea ecx, [esi + 0x2858]
push esi
mov edx, str.plugin
call fcn.0040bb40
mov edx, dword [ebx]
mov eax, dword [edx]
add esp, 8
push 0x64
push 2
mov ecx, ebx
call eax
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 8