joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f459
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x411fc2
call fcn.0040f8dd
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x228], esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0x22c], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x413664
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push ebx
push 0x1a
lea eax, [ebp - 0x218]
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f4e6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
test al, al
je 0x40f540
push 0x415210
lea ecx, [ebp - 0x224]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], bl
call esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call esi
mov eax, edi
jmp 0x40f5cb
push ebx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_]
mov edi, 0x414b70
push edi
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.Common.dll_bool___cdecl_operator__class_CTXStringW_const___wchar_t_const__]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop ecx
pop ecx
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x21d], al
mov byte [ebp - 4], 2
call esi
cmp byte [ebp - 0x21d], 0
je 0x40f595
push edi
lea ecx, [ebp - 0x21c]
call dword [0x41307c]
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], bl
call esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call esi
mov eax, dword [ebp - 0x22c]
call fcn.0040f927
ret

Function at 0x40f859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419144]
jne 0x40f863
repz ret
jmp fcn.0040fe8e
Function at 0x100030b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x10009de8
call fcn.100099f0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.10003ce5
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x100030dc
push edi
call esi
cmp eax, 0xffffffff
jne 0x1000311e
test ebx, ebx
je 0x1000311b
lea ecx, [ebp - 0x18]
call fcn.10001d15
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.10003dee
test al, al
push dword [ebp - 0x18]
je 0x10003115
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.10002447
pop ecx
mov eax, esi
jmp 0x1000311e
call fcn.10002447
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100036ce
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100036f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100036f8
xor al, al
jmp 0x10003718
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.10009a40
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4

Function at 0x100045a8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x10009ef0
call fcn.100099f0
sub esp, 0x84
push ebx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi]
cmp eax, esi
je 0x100045d4
push eax
call ebx
test eax, eax
je 0x100045d4
mov dword [edi], esi
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.10001d58
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], esi
call fcn.100046bb
push 0x20
mov edx, eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.100046a0
push dword [ebp + 0xc]
mov edx, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.10001c7d
push dword [ebp - 0x40]
call fcn.10002447
push dword [ebp - 0x4c]
call fcn.10002447
push dword [ebp - 0x24]
call fcn.10002447
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x90], 0x44
mov dword [ebp - 0x8c], esi
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x88], esi
push dword [ebp + 0x10]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x64], esi
mov word [ebp - 0x5e], si
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x5c], esi
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000467a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10004684
push dword [ebp - 0x30]
call ebx
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
push dword [ebp - 0x18]
call fcn.10002447
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x100047f1
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x1000658d
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1000a194
call fcn.100099f0
sub esp, 0x1c
push esi
push edi
push str.CLSID_
lea ecx, [ebp - 0x1c]
call fcn.10001d9b
push dword [0x1000b9b0]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10002034
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push str.InprocServer32
call fcn.10001ca1
push dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, 0x80000000
push edi
call esi
push dword [ebp - 0x28]
call fcn.10002447
pop ecx
push dword [ebp - 0x1c]
push edi
call esi
call fcn.10006269
test al, al
pop edi
pop esi
je 0x1000662a
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push dword [0x1000b9ac]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000662a
push dword [0x1000b9b0]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1c]
call fcn.10002447
pop ecx
mov ecx, dword [ebp - 0xc]
push 1
pop eax
mov dword fs:[0], ecx
leave
ret

Function at 0x100092ab
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10009585
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp bx, ax
jne 0x100092e4
movzx ecx, ax
mov eax, ecx
mov edx, edi
shr eax, 0xa
and ecx, 0x3ff
mov dword [esi], eax
call fcn.100092e8
pop edi
pop esi
pop ebx
ret
Function at 0x401b3c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor edi, edi
lea eax, [ebp - 0x41a]
push edi
push eax
call fcn.00406dd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00406dd0
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call fcn.00406dd0
xor eax, eax
push esi
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push edi
push eax
call fcn.00406dd0
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00401792
xor esi, esi
inc esi
xor eax, eax
add esp, 0x30
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x838], edi
cmp ax, word [ebp - 0x210]
je 0x401c46
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x210]
call fcn.00401ab0
add esp, 0xc
test eax, eax
jne 0x401c46
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x838], edi
push dword [ebp - 0x838]
push dword [ebp - 0x83c]
push dword [ebp - 0x840]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea edx, [ebp - 0x41c]
lea ecx, [ebp - 0x628]
call fcn.004010d4
add esp, 0x10
call fcn.004016bc
mov eax, dword [0x414d0c]
cmp eax, edi
je 0x401c88
mov dword [eax + 0x1c], 0x2710
call fcn.004016bc
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004042c0
leave
ret
Function at 0x401f60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x218], eax
cmp eax, edi
je 0x402013
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x210], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, edi
je 0x402013
cmp dword [ebp - 0x210], edi
jle 0x401ffd
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebx + edi*4]
test eax, eax
je 0x401fca
push str._qqpcmgr
push eax
call esi
mov eax, dword [ebx + edi*4]
test eax, eax
je 0x401fdd
push str._fromsupdate
push eax
call esi
test eax, eax
je 0x401ff6
push str._nochksupdate
push dword [ebx + edi*4]
call esi
test eax, eax
je 0x401ff6
inc edi
cmp edi, dword [ebp - 0x210]
jl 0x401fbb
jmp 0x401ffd
and dword [ebp - 0x214], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x214], 0
jne 0x402011
xor eax, eax
jmp 0x402079
xor edi, edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00406dd0
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
call fcn.00402088
mov esi, eax
add esp, 0x10
cmp esi, edi
je 0x402077
mov edx, dword [ebp - 0x218]
lea ecx, [ebp - 0x20c]
call fcn.00402247
mov esi, eax
push edi
push esi
call fcn.00402466
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret
Function at 0x402088
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], ebx
cmp eax, edi
je 0x402236
lea eax, [ebp - 0x214]
push eax
push 1
push edi
push str.SoftwareTencentQQPhoneManager
push 0x80000001
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4021f1
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [ebp - 0x210], esi
call fcn.00406dd0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push str.UpdatedPath
push dword [ebp - 0x214]
call ebx
test eax, eax
jne 0x402151
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push str.UpdatedVersion
push dword [ebp - 0x214]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x210], 4
call ebx
test eax, eax
jne 0x40218e
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [ebp - 0x210], esi
call fcn.00406dd0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push str.InstalledVersion
push dword [ebp - 0x214]
call ebx
test eax, eax
jne 0x4021d9
lea eax, [ebp - 0x20c]
push eax
call fcn.0040486e
pop ecx
mov dword [ebp - 0x218], eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x22c]
mov ebx, dword [ebp - 0x228]
cmp esi, edi
je 0x4021fd
mov eax, dword [ebp - 0x21c]
mov dword [esi], eax
cmp ebx, edi
je 0x402209
mov eax, dword [ebp - 0x218]
mov dword [ebx], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x21c], eax
jbe 0x402236
mov ebx, dword [ebp - 0x224]
call fcn.00402385
mov esi, eax
cmp esi, edi
jne 0x402232
push 1
push edi
call fcn.00402466
pop ecx
pop ecx
mov eax, esi
jmp 0x402238
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret
Function at 0x402247
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, ecx
mov esi, edx
call fcn.00406dd0
add esp, 0xc
push 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x41150c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x210], esi
test esi, esi
jne 0x4022b8
mov dword [ebp - 0x210], 0x411278
push dword [ebp - 0x210]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov ebx, str.__fromsupdate
push ebx
mov edi, eax
call esi
lea esi, [edi + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404953
mov edi, eax
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.00406dd0
add esp, 0x10
push esi
push dword [ebp - 0x210]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x38
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00406dd0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], eax
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x24c], 0x3c
mov dword [ebp - 0x248], 0x500
mov dword [ebp - 0x240], str.open
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x230], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
mov esi, eax
call fcn.00404444
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret

Function at 0x402385
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00406dd0
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00406dd0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
add esp, 0x18
mov edi, 0x104
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x414]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x41150c
lea eax, [ebp - 0x20c]
push eax
call esi
push str.QQPMExternal.exe
lea eax, [ebp - 0x414]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x402456
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x402456
lea eax, [ebp - 0x20c]
call fcn.00401f47
test eax, eax
je 0x402456
lea eax, [ebp - 0x414]
call fcn.00401f47
test eax, eax
je 0x402456
xor eax, eax
inc eax
jmp 0x402458
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004042c0
leave
ret
Function at 0x402466
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push 3
xor edi, edi
push edi
push str.SoftwareTencentQQPhoneManager
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40251f
cmp dword [ebp + 8], edi
je 0x4024a6
push str.UpdatedStartFailed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x402516
push esi
cmp dword [ebp + 0xc], edi
je 0x4024b3
push str.UpdatedStartFailed
jmp 0x4024dd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
mov esi, str.UpdatedStartFailed
push esi
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 3
jb 0x4024fe
push esi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call esi
push str.UpdatedVersion
push dword [ebp - 4]
call esi
push str.UpdatedPath
push dword [ebp - 4]
call esi
jmp 0x402515
push dword [ebp - 0xc]
inc dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 4
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
leave
ret
Function at 0x402583
Capabilities:
Check mutex on windows

Disassembly:
push 0x368
push 0x412248
call fcn.0040ec90
mov edi, ecx
xor ebx, ebx
mov byte [ebp - 0x12c], bl
mov esi, 0x104
push esi
push ebx
lea eax, [ebp - 0x12b]
push eax
call fcn.00406dd0
mov dword [ebp - 0x340], 1
mov dword [ebp - 0x134], ebx
push 0xffffffffffffffff
push str.6BE417DD_264A_4678_A036_74D2173ECCEB
push esi
lea eax, [ebp - 0x33c]
push eax
call fcn.004042cf
add esp, 0x1c
cmp dword [ebp - 0x134], ebx
jne 0x402600
lea eax, [ebp - 0x33c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x134], eax
cmp eax, ebx
je 0x402600
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push ebx
push esi
lea eax, [ebp - 0x12c]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x30
push ebx
lea eax, [ebp - 0x378]
push eax
call fcn.00406dd0
add esp, 0xc
push 1
push ebx
lea eax, [ebp - 0x378]
push eax
push ebx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.imagehlp.dll_MapAndLoad]
cmp eax, ebx
je 0x40271f
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x357], bl
jne 0x4026f9
mov eax, dword [ebp - 0x36c]
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x402671
add eax, 0x98
jmp 0x402680
mov edx, 0x20b
cmp cx, dx
jne 0x4026f9
add eax, 0xa8
mov esi, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x34c]
add ecx, esi
mov dword [ebp - 0x348], ecx
lea edx, [eax + 8]
cmp edx, ecx
ja 0x4026f3
mov ecx, dword [eax + 4]
mov edx, dword [eax]
lea edi, [edx + ecx]
cmp edi, dword [ebp - 0x34c]
ja 0x4026f3
cmp edx, ebx
je 0x4026f3
cmp ecx, ebx
je 0x4026f3
lea eax, [esi + edx]
add ecx, eax
mov dword [ebp - 0x344], 0x100
cmp eax, ecx
jae 0x4026f9
cmp dword [ebp - 0x344], ebx
jle 0x4026f9
lea edx, [eax + 0xc]
cmp edx, dword [ebp - 0x348]
ja 0x4026f3
mov edx, dword [eax]
cmp edx, ebx
je 0x4026f3
cmp edx, 0xffffffff
je 0x4026f3
lea eax, [edx + eax + 7]
and eax, 0xfffffff8
dec dword [ebp - 0x344]
jmp 0x4026c2
mov dword [ebp - 0x340], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x402712
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.imagehlp.dll_UnMapAndLoad]
cmp dword [ebp - 0x134], ebx
je 0x40273f
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x340]
call fcn.0040ecd8
ret
Function at 0x4035dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x403605
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x403607
shr ecx, 1
dec edx
jne 0x4035f6
mov dword [ebp + eax*4 - 0x404], ecx
inc eax
cmp eax, 0x100
jl 0x4035f1
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x403646
push esi
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [ebp + edx*4 - 0x404]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x403624
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
not eax
call fcn.004042c0
leave
ret

Function at 0x403764
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x413054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x214], ebx
mov eax, str.AppLaunch.prf
cmp dword [esi + 0x468], ebx
jne 0x4037a7
push dword [esi + 0x480]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x480]
jmp 0x4038b1
cmp dword [esi + 4], ebx
je 0x4037c1
push eax
lea eax, [esi + 0x152]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp eax, 0xffffffff
jne 0x4037ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403871
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40386a
push ebx
push edi
push ebx
push 2
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x40386a
push edi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea ecx, [edi - 4]
push ecx
push eax
mov dword [ebp - 0x218], eax
mov dword [esi + 0x470], eax
call fcn.004035dc
pop ecx
pop ecx
mov ecx, dword [ebp - 0x218]
cmp eax, dword [ecx + edi - 4]
je 0x403854
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x403870
mov ecx, esi
call fcn.00403e91
test eax, eax
je 0x40386a
mov ecx, esi
call fcn.004038bf
test eax, eax
jne 0x403870
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, dword [esi + 0x470]
cmp eax, ebx
je 0x403888
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x470], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x214], ebx
je 0x40389e
push dword [ebp - 0x214]
call esi
cmp dword [ebp - 0x210], 0xffffffff
je 0x4038af
push dword [ebp - 0x210]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c0
leave
ret