joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4144b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1f0], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CopyProgramFile_Enter.lpszSrcFile___s__lpszDstFile___s
push 0x4cee60
push 0x403
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4cee44
push 1
mov edx, dword [0x4fb18c]
push edx
call fcn.00406b40
add esp, 0x24
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414512
xor eax, eax
jmp 0x4146ef
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414682
lea ecx, [ebp - 0x1b0]
call fcn.00412720
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x90]
call fcn.0040fdb0
mov ecx, eax
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 0x1b0]
call fcn.004129d0
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00402a70
lea ecx, [ebp - 0x90]
call fcn.0040fde0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
call fcn.0040fdb0
mov ecx, eax
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 0x1b0]
call fcn.004129d0
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00402a70
lea ecx, [ebp - 0x118]
call fcn.0040fde0
lea ecx, [ebp - 0x1cc]
call fcn.00402bd0
mov dword [ebp - 0x1f4], eax
lea ecx, [ebp - 0x1e8]
call fcn.00402bd0
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1f8]
mov dl, byte [ecx]
mov byte [ebp - 0x1f9], dl
mov eax, dword [ebp - 0x1f4]
cmp dl, byte [eax]
jne 0x414621
cmp byte [ebp - 0x1f9], 0
je 0x414615
mov ecx, dword [ebp - 0x1f8]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1fa], dl
mov eax, dword [ebp - 0x1f4]
cmp dl, byte [eax + 1]
jne 0x414621
add dword [ebp - 0x1f8], 2
add dword [ebp - 0x1f4], 2
cmp byte [ebp - 0x1fa], 0
jne 0x4145c3
mov dword [ebp - 0x200], 0
jmp 0x41462c
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x200]
mov dword [ebp - 0x204], edx
cmp dword [ebp - 0x204], 0
jne 0x41466c
mov dword [ebp - 0x1ec], 0
lea ecx, [ebp - 0x1cc]
call fcn.00402b30
lea ecx, [ebp - 0x1e8]
call fcn.00402b30
mov eax, dword [ebp - 0x1ec]
jmp 0x4146ef
lea ecx, [ebp - 0x1cc]
call fcn.00402b30
lea ecx, [ebp - 0x1e8]
call fcn.00402b30
push str.CopyProgramFile_2
push str.CModuleAidManger::CopyProgramFile
push 0x413
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4cef0c
push 1
mov eax, dword [0x4fb18c]
push eax
call fcn.00406b40
add esp, 0x1c
call fcn.0040bd60
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
call fcn.00409280
test eax, eax
je 0x4146dc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1f0]
call fcn.00414ba0
jmp 0x4146ef
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1f0]
call fcn.004137f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 8
Function at 0x414700
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x220], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042efe0
add esp, 0xc
push 0x19
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x220]
call fcn.00413080
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dx, word [ecx + 2]
mov word [ebp - 0x226], dx
add dword [ebp - 0x224], 2
cmp word [ebp - 0x226], 0
jne 0x41475d
mov edi, dword [ebp - 0x224]
mov eax, dword [0x4cef28]
mov dword [edi], eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x220]
mov eax, dword [edx + 0x209c]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x220]
call fcn.00414a60
lea ecx, [ebp - 0x214]
call fcn.0040fc20
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x22c]
mov cx, word [eax]
mov word [ebp - 0x232], cx
add dword [ebp - 0x22c], 2
cmp word [ebp - 0x232], 0
jne 0x4147cf
mov edx, dword [ebp - 0x22c]
sub edx, dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], edx
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x240], ecx
mov edx, dword [ebp - 0x240]
mov ax, word [edx + 2]
mov word [ebp - 0x242], ax
add dword [ebp - 0x240], 2
cmp word [ebp - 0x242], 0
jne 0x41481d
mov edi, dword [ebp - 0x240]
mov esi, dword [ebp - 0x238]
mov edx, dword [ebp - 0x23c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
call fcn.0040fc60
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4148a7
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x218], 1
lea ecx, [ebp - 0x214]
call fcn.00405d40
mov eax, dword [ebp - 0x218]
jmp 0x4148c2
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x214]
call fcn.00405d40
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret
Function at 0x4148e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x420], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042efe0
add esp, 0xc
push 0x19
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x420]
call fcn.00413080
lea ecx, [ebp - 4]
call fcn.00405ce0
lea eax, [ebp - 0x210]
push eax
push 0x4cef2c
lea ecx, [ebp - 4]
push ecx
call fcn.004068d0
add esp, 0xc
lea ecx, [ebp - 4]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x210]
push edx
push 0x4cef48
lea eax, [ebp - 4]
push eax
call fcn.004068d0
add esp, 0xc
lea ecx, [ebp - 4]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x206
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.0042efe0
add esp, 0xc
push 0
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x420]
call fcn.00413080
test eax, eax
je 0x414a3d
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x209c]
push eax
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, dword [ebp - 0x420]
call fcn.00414a60
push 1
push 0x4cef60
push 0
push 0
lea ecx, [ebp - 0x41c]
call fcn.0040fc20
push eax
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x420]
add eax, 0x1040
push eax
mov ecx, dword [ebp - 0x420]
add ecx, 0x1040
push ecx
mov ecx, dword [ebp - 0x420]
call fcn.00413170
push 0xffffffffffffffff
lea ecx, [ebp - 0x41c]
call fcn.0040fc60
lea ecx, [ebp - 0x41c]
call fcn.00405d40
lea ecx, [ebp - 4]
call fcn.00405d40
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret

Function at 0x414a60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 8]
call fcn.00405ce0
lea ecx, [ebp - 4]
call fcn.00405ce0
cmp dword [ebp + 0xc], 0
je 0x414aa3
push str.GamePP.lnk
lea ecx, [ebp - 8]
call fcn.00405d60
mov eax, dword [ebp + 0x10]
push eax
push 0x4cef84
lea ecx, [ebp - 4]
push ecx
call fcn.004068d0
add esp, 0xc
jmp 0x414ac5
push 0x4cef9c
lea ecx, [ebp - 8]
call fcn.00405d60
mov edx, dword [ebp + 0x10]
push edx
push 0x4cefb0
lea eax, [ebp - 4]
push eax
call fcn.004068d0
add esp, 0xc
lea ecx, [ebp - 4]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407b70
lea ecx, [ebp - 4]
call fcn.00405d40
lea ecx, [ebp - 8]
call fcn.00405d40
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x414b00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 8]
call fcn.00405ce0
lea ecx, [ebp - 4]
call fcn.00405ce0
cmp dword [ebp + 0xc], 0
je 0x414b43
push str.Uninstall.lnk
lea ecx, [ebp - 8]
call fcn.00405d60
mov eax, dword [ebp + 0x10]
push eax
push 0x4cefe8
lea ecx, [ebp - 4]
push ecx
call fcn.004068d0
add esp, 0xc
jmp 0x414b65
push 0x4cf004
lea ecx, [ebp - 8]
call fcn.00405d60
mov edx, dword [ebp + 0x10]
push edx
push str._sUninstall.lnk
lea eax, [ebp - 4]
push eax
call fcn.004068d0
add esp, 0xc
lea ecx, [ebp - 4]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407b70
lea ecx, [ebp - 4]
call fcn.00405d40
lea ecx, [ebp - 8]
call fcn.00405d40
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x414ba0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
cmp dword [ebp + 8], 0
je 0x414bc5
cmp dword [ebp + 0xc], 0
jne 0x414bc9
xor eax, eax
jmp 0x414c42
push 1
lea ecx, [ebp - 0x808]
call fcn.004177c0
lea ecx, [ebp - 0x808]
call fcn.00417810
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x808]
call fcn.004177f0
push eax
call fcn.00428630
add esp, 0xc
lea ecx, [ebp - 0x808]
call fcn.004177f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x808]
call fcn.004177f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x80c]
mov byte [eax + 0x1e7c], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 8
Function at 0x414c60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x414c7b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jae 0x414d42
lea ecx, [ebp - 0xc]
call fcn.00405ce0
lea ecx, [ebp - 8]
call fcn.00405ce0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4f8340]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4cf0d0
lea ecx, [ebp - 0xc]
push ecx
call fcn.004068d0
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x4f8340]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s_s
lea eax, [ebp - 8]
push eax
call fcn.004068d0
add esp, 0x14
push 3
lea ecx, [ebp - 0xc]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 8]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push str.wDestFile___s_wSrcFile__s_Error___d
push str.CModuleAidManger::MoveLauncherFile
push 0x530
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4cf188
push 1
mov eax, dword [0x4fb18c]
push eax
call fcn.00406b40
add esp, 0x28
lea ecx, [ebp - 8]
call fcn.00405d40
lea ecx, [ebp - 0xc]
call fcn.00405d40
jmp 0x414c72
mov esp, ebp
pop ebp
ret 8

Function at 0x414ec0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], ecx
push 0x208
push 0
lea eax, [ebp - 0x238]
push eax
call fcn.0042efe0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x238]
push ecx
push 0x4cf250
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [ebp - 0x2c], dx
xor eax, eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea ecx, [ebp - 0x238]
push ecx
push 0x14
lea edx, [ebp - 0x2c]
push edx
push 0x4cf24c
push 0x4cf294
push 0x4cf2ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00405d00
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407b70
lea ecx, [ebp - 0x23c]
call fcn.00405d40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 4
Function at 0x4150d0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00415090
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push ecx
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x415113
xor eax, eax
jmp 0x415118
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 4

Function at 0x415490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 8]
call fcn.00405ce0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0042efe0
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 1
push 0
push 0x4cf5c4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41553f
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push str.ChannelID
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 8]
call fcn.00405d60
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00407b70
lea ecx, [ebp - 8]
call fcn.00405d40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 4

Function at 0x415570
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4155eb
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415630
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0042efe0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x218], ecx
lea edx, [ebp - 0x210]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x222], dx
mov eax, dword [ebp - 0x21c]
mov cx, word [ebp - 0x222]
mov word [eax], cx
mov edx, dword [ebp - 0x218]
add edx, 2
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
cmp word [ebp - 0x222], 0
jne 0x415681
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x214]
add edx, 0x208
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x228]
mov dx, word [ecx]
mov word [ebp - 0x232], dx
mov eax, dword [ebp - 0x22c]
mov cx, word [ebp - 0x232]
mov word [eax], cx
mov edx, dword [ebp - 0x228]
add edx, 2
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x22c]
add eax, 2
mov dword [ebp - 0x22c], eax
cmp word [ebp - 0x232], 0
jne 0x4156f0
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
mov ax, word [edx + 2]
mov word [ebp - 0x23a], ax
add dword [ebp - 0x238], 2
cmp word [ebp - 0x23a], 0
jne 0x415747
mov edi, dword [ebp - 0x238]
mov ecx, dword [str.program.7z]
mov dword [edi], ecx
mov edx, dword [0x4cf600]
mov dword [edi + 4], edx
mov eax, dword [0x4cf604]
mov dword [edi + 8], eax
mov ecx, dword [0x4cf608]
mov dword [edi + 0xc], ecx
mov edx, dword [0x4cf60c]
mov dword [edi + 0x10], edx
mov eax, dword [0x4cf610]
mov dword [edi + 0x14], eax
lea ecx, [ebp - 0x210]
push ecx
push str.szProgramFile_program_file___s
push str.CModuleAidManger::ReleaseProgramFile
push 0x65c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4cf614
push 1
mov edx, dword [0x4fb18c]
push edx
call fcn.00406b40
add esp, 0x20
push 0
mov eax, dword [ebp - 0x214]
add eax, 0x208
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00415570
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x41582e
push 1
mov edx, dword [ebp - 0x214]
add edx, 0x208
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00416850
jmp 0x41584f
push 1
mov ecx, dword [ebp - 0x214]
add ecx, 0x208
push ecx
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x214]
call fcn.00416850
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4159a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4159cb
xor eax, eax
jmp 0x4159d0
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x416320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042efe0
add esp, 0xc
mov dword [ebp - 0x224], 0x4cf6e0
lea edx, [ebp - 0x210]
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x224]
mov dx, word [ecx]
mov word [ebp - 0x22e], dx
mov eax, dword [ebp - 0x228]
mov cx, word [ebp - 0x22e]
mov word [eax], cx
mov edx, dword [ebp - 0x224]
add edx, 2
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x228]
add eax, 2
mov dword [ebp - 0x228], eax
cmp word [ebp - 0x22e], 0
jne 0x41637a
push 0x104
push 0
mov ecx, dword [ebp - 0x220]
add ecx, 0xa28
push ecx
call fcn.0042efe0
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
push 1
push 0
lea eax, [ebp - 0x210]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416456
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x21c], 0x104
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x220]
add edx, 0xa28
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4cf704
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x416458
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret

Function at 0x416470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042efe0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416510
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x220], 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push str.SetupPath
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.00405d00
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407b70
lea ecx, [ebp - 0x214]
call fcn.00405d40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 8
Function at 0x416550
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4f62a0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41665d
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0xc]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
push 0x4cf72c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x4cf730
mov eax, dword [ebp + 0xc]
push eax
call fcn.00410470
add esp, 0x18
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00425912
mov esp, ebp
pop ebp
ret 8