joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067a9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x63370
call fcn.0050c890
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x6336c], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
mov edi, ecx
push eax
mov dword [ebp - 0x63370], edi
mov byte [ebp - 0x63365], 0
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x103
call dword [0x52b168]
xor eax, eax
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00506540
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.DownLoad.cab
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
xor eax, eax
push esi
push eax
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x640]
call fcn.004069bc
cmp dword [eax + 0x14], 8
jb 0x40686e
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x624]
push eax
call ebx
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x640]
call fcn.004021a4
lea edi, [ebp - 0x63364]
call fcn.0042f249
call fcn.0042f743
mov eax, dword [ebp - 0x6336c]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x60efc], ebx
jb 0x4068b4
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x63364]
call fcn.00406497
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x63364]
mov dword [ebp - 0x60cbc], 0x493e0
call fcn.004064c6
lea esi, [ebp - 0x63364]
call fcn.0042f6bc
mov eax, esi
call fcn.0042f9ff
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40699c
lea eax, [ebp - 0x41c]
push eax
lea esi, [ebp - 0x640]
call fcn.0040204f
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x65c]
call fcn.0040204f
lea eax, [ebp - 0x640]
mov ecx, esi
call fcn.00406a00
push ebx
xor edi, edi
mov dword [ebp - 0x6336c], eax
call fcn.004021a4
push ebx
lea esi, [ebp - 0x640]
call fcn.004021a4
cmp dword [ebp - 0x6336c], edi
je 0x40698f
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40698f
mov eax, dword [ebp - 0x63370]
cmp dword [eax + 0x14], 8
jb 0x406975
mov eax, dword [eax]
push 3
push eax
lea eax, [ebp - 0x624]
push eax
call dword [0x52b120]
test eax, eax
je 0x40698f
mov byte [ebp - 0x63365], bl
lea eax, [ebp - 0x214]
push eax
call dword [0x52b288]
lea ecx, [ebp - 0x63364]
call fcn.0042f4f7
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x63365]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
Function at 0x406a54
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x4ec]
mov eax, 0x1474
call fcn.0050c890
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x4e8], eax
push esi
push edi
mov esi, ecx
push 0x543da0
mov dword [ebp + 0x78], esi
mov edi, edx
call fcn.0040204f
push dword [edi]
xor esi, esi
push esi
push 0x410
call dword [0x52b144]
mov edi, eax
mov dword [ebp + 0x7c], edi
cmp edi, esi
je 0x406c50
push 0xffc
lea eax, [ebp - 0xf84]
push esi
push eax
mov dword [ebp - 0xf88], esi
call fcn.00506540
add esp, 0xc
lea eax, [ebp + 0x80]
push eax
push 0x400
lea eax, [ebp - 0xf88]
push eax
push edi
mov dword [ebp + 0x80], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x406c50
push ebx
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp + 0xd8], ax
lea eax, [ebp + 0xda]
push esi
push eax
call fcn.00506540
add esp, 0xc
push 0x104
lea eax, [ebp + 0xd8]
push eax
push dword [ebp - 0xf88]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [ebp + 0xd8]
push eax
lea esi, [ebp + 0xa0]
call fcn.0040204f
lea eax, [ebp + 0xbc]
push eax
mov edi, esi
call fcn.00407067
pop ecx
push eax
mov eax, esi
call fcn.00402a57
push 1
xor edi, edi
lea esi, [ebp + 0xbc]
call fcn.004021a4
xor eax, eax
push ebx
mov word [ebp + 0x2e0], ax
xor ebx, ebx
lea eax, [ebp + 0x2e2]
push ebx
push eax
call fcn.00506540
add esp, 0xc
cmp dword [ebp + 0x80], ebx
jbe 0x406c24
push 0x104
lea eax, [ebp + 0x2e0]
push eax
push dword [ebp + ebx*4 - 0xf88]
push dword [ebp + 0x7c]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
lea eax, [ebp + 0x2e0]
push eax
lea esi, [ebp + 0xbc]
call fcn.0040204f
lea eax, [ebp + 0x84]
push eax
mov edi, esi
call fcn.00407067
pop ecx
push eax
mov eax, esi
call fcn.00402a57
push 1
xor edi, edi
lea esi, [ebp + 0x84]
call fcn.004021a4
cmp dword [ebp + 0xb4], 8
mov eax, dword [ebp + 0xa0]
jae 0x406be8
lea eax, [ebp + 0xa0]
push dword [ebp + 0xb0]
lea ecx, [ebp + 0xbc]
push eax
xor eax, eax
call fcn.0040b42d
xor edi, edi
push 1
lea esi, [ebp + 0xbc]
cmp eax, 0xffffffff
jne 0x406c1f
call fcn.004021a4
inc ebx
cmp ebx, dword [ebp + 0x80]
jb 0x406b7f
jmp 0x406c24
call fcn.004021a4
lea eax, [ebp + 0x2e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp + 0x2e0]
push eax
push dword [ebp + 0x78]
call fcn.00402178
push 1
xor edi, edi
lea esi, [ebp + 0xa0]
call fcn.004021a4
pop ebx
push dword [ebp + 0x7c]
call dword [0x52b17c]
mov ecx, dword [ebp + 0x4e8]
mov eax, dword [ebp + 0x78]
pop edi
xor ecx, ebp
pop esi
call fcn.004fe191
add ebp, 0x4ec
leave
ret
Function at 0x406ea5
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x11a4]
mov eax, 0x1224
call fcn.0050c890
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x11a0], eax
mov eax, dword [ebp + 0x11ac]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x11b0]
xor esi, esi
push 0xffc
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 0x68], esi
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x1000
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x70], esi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x406fd6
mov ecx, dword [ebp - 0x70]
shr ecx, 2
mov eax, 0x400
cmp ecx, eax
ja 0x406f1d
mov eax, ecx
cmp eax, esi
jle 0x406fd6
push ebx
push edi
lea ebx, [ebp - 0x68]
mov dword [ebp - 0x6c], eax
jmp 0x406f31
xor esi, esi
push 0x208
lea eax, [ebp + 0xf98]
push esi
push eax
call fcn.00506540
mov eax, dword [ebx]
add esp, 0xc
push eax
push esi
push 0x410
call dword [0x52b144]
mov edi, eax
test edi, edi
je 0x406f95
and dword [ebp - 0x74], 0
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x406f95
push 0x103
lea eax, [ebp + 0xf98]
push eax
push dword [ebp - 0x74]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x406f95
xor esi, esi
inc esi
push edi
call dword [0x52b17c]
test esi, esi
je 0x406fc8
mov eax, dword [ebp - 0x7c]
cmp dword [eax + 0x14], 8
jb 0x406fab
mov eax, dword [eax]
lea ecx, [ebp + 0xf98]
push ecx
push eax
call fcn.004ff138
pop ecx
pop ecx
test eax, eax
jne 0x406fc8
mov esi, dword [ebp - 0x80]
mov eax, ebx
call fcn.00436c97
add ebx, 4
dec dword [ebp - 0x6c]
jne 0x406f2f
pop edi
pop ebx
mov ecx, dword [ebp + 0x11a0]
xor ecx, ebp
pop esi
call fcn.004fe191
add ebp, 0x11a4
leave
ret
Function at 0x407138
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov esi, ecx
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x407159
mov eax, dword [esi]
jmp 0x40715b
mov eax, esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x40716c
mov al, 1
jmp 0x4071eb
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x21], 1
call fcn.004071fa
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x407183
lea eax, [ebp - 0x20]
cmp dword [esi + 0x14], ebx
jb 0x40718a
mov esi, dword [esi]
push 3
push eax
push esi
mov esi, dword [0x52b120]
call esi
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x4071a1
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
je 0x4071d8
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x4071b3
lea eax, [ebp - 0x20]
push eax
call dword [0x52b288]
test eax, eax
jne 0x4071dc
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jae 0x4071c9
lea eax, [ebp - 0x20]
push 4
push 0
push eax
call esi
test eax, eax
setne byte [ebp - 0x21]
jmp 0x4071dc
mov byte [ebp - 0x21], 0
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret

Function at 0x407693
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x4198]
mov eax, 0x4218
call fcn.0050c890
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x4194], eax
push ebx
mov ebx, dword [ebp + 0x41a0]
push esi
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
mov esi, ecx
call fcn.00506540
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4076de
mov eax, dword [esi]
jmp 0x4076e0
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4077ab
cmp dword [esi + 0x14], 8
jb 0x4076f9
mov eax, dword [esi]
jmp 0x4076fb
mov eax, esi
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x4077ab
cmp eax, 0x3fff
ja 0x4077ab
cmp dword [esi + 0x14], 8
jb 0x407721
mov esi, dword [esi]
lea ecx, [ebp - 0x74]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4077ab
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x5448bc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4077ab
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x3f8c], ax
lea eax, [ebp + 0x3f8e]
push eax
call fcn.00506540
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x5448c0
lea eax, [ebp + 0x3f8c]
push 0x103
push eax
call fcn.004ff336
add esp, 0x28
lea eax, [ebp + 0x3f8c]
push eax
push ebx
call fcn.00402178
xor eax, eax
inc eax
jmp 0x4077ad
xor eax, eax
mov ecx, dword [ebp + 0x4194]
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
add ebp, 0x4198
leave
ret
Function at 0x408631
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
mov esi, ecx
call fcn.00506540
xor eax, eax
push edi
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x208
call fcn.00506540
add esp, 0x18
push 0
push 0x26
lea eax, [ebp - 0x78]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x78]
push eax
push str._sInternet_Exploreriexplore.exe
lea eax, [ebp + 0x190]
push 0x103
push eax
call fcn.004ff336
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x190]
push eax
call edi
test eax, eax
jne 0x408706
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x543da0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp + 0x190]
push eax
call edi
test eax, eax
jne 0x408706
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x190]
push eax
call fcn.0040204f
mov ecx, dword [ebp + 0x398]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fe191
add ebp, 0x39c
leave
ret

Function at 0x40872b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00408631
cmp dword [ebp - 0x10], 0
je 0x40880c
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x408762
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40880c
lea edi, [ebp - 0x7c]
call fcn.0044cb53
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
call fcn.0044a559
push dword [ebp - 0x7c]
mov ecx, eax
call fcn.0044e735
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x58]
call fcn.004021a4
push ebx
lea esi, [ebp - 0x58]
call fcn.0040204f
mov eax, esi
push eax
lea edi, [ebp - 0x7c]
call fcn.0040b15a
push 1
xor edi, edi
call fcn.004021a4
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0044ccfe
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x4087d2
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c73
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x3c]
mov ebx, eax
call fcn.004021a4
lea eax, [ebp - 0x7c]
call fcn.0044cba8
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
xor ebx, ebx
jmp 0x4087ef
Function at 0x408810
Capabilities:
Check if file exists
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x20]
call fcn.00408631
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x40888e
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x408840
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40888e
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x408857
lea eax, [ebp - 0x20]
push 0xa
push ebx
push esi
push eax
push str.open
call dword [0x52b4e0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
lea eax, [ebp - 0x24]
push eax
push 0x52b84c
push 0x15
push ebx
push 0x52b83c
mov dword [ebp - 0x24], ebx
call dword [0x52b698]
test eax, eax
js 0x408871
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x40886e
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x28], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 0x28], ebx
je 0x4088dc
push dword [ebp - 0x28]
call dword [0x52b4d0]
push 1
push dword [ebp - 0x28]
call dword [0x52b4e4]
push esi
call dword [0x52b430]
push 8
mov esi, eax
xor eax, eax
mov word [ebp - 0x38], ax
pop eax
lea edx, [ebp - 0x38]
push edx
push edx
push edx
push edx
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x40], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [0x52b414]
jmp 0x40886e
Function at 0x408995
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x26
pop ecx
mov esi, str.softwaremicrosoftwindows_shellAssociationsUrlAssociations_lsUserChoice
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xfc], str.http
mov dword [ebp - 0xf8], str.https
mov dword [ebp - 0xf4], 0x545070
movsw word es:[edi], word [esi]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov ebx, str.Progid
mov eax, dword [ebp - 0xe8]
push dword [ebp + eax*4 - 0xfc]
lea eax, [ebp - 0xa8]
push eax
lea esi, [ebp - 0xe0]
call fcn.00450222
cmp dword [ebp - 0xcc], 8
mov edi, dword [ebp - 0xe0]
pop ecx
pop ecx
jae 0x408a2c
mov edi, esi
test byte [ebp - 0xe4], 1
je 0x408a47
and dword [ebp - 0xe4], 0xfffffffe
lea esi, [ebp - 0x1b0]
call fcn.0044dd6a
lea esi, [ebp - 0xf0]
call fcn.0044effe
mov eax, esi
push eax
push 0xf003f
push 0
push edi
push 0x80000001
call dword [0x52b010]
test eax, eax
jne 0x408af2
and dword [ebp - 0xb4], eax
mov word [ebp - 0xc4], ax
lea eax, [ebp - 0xc4]
push eax
mov eax, esi
push eax
mov ecx, ebx
mov dword [ebp - 0xb0], 7
call fcn.0044f09d
test eax, eax
jne 0x408ad8
push str.360seURL
lea ecx, [ebp - 0xc4]
call fcn.0040c540
test eax, eax
jne 0x408ad8
test byte [ebp - 0xe4], 2
je 0x408acb
and dword [ebp - 0xe4], 0xfffffffd
lea esi, [ebp - 0x1b0]
call fcn.0044dd6a
push ebx
push dword [ebp - 0xf0]
call dword [0x52b00c]
lea esi, [ebp - 0xf0]
call fcn.0044effe
push 1
xor edi, edi
lea esi, [ebp - 0xc4]
call fcn.004021a4
push 1
xor edi, edi
lea esi, [ebp - 0xe0]
call fcn.004021a4
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 3
jb 0x4089fa
lea esi, [ebp - 0xf0]
call fcn.0044effe
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret

Function at 0x408c9a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], edi
call fcn.0044a559
push 0xf003f
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call fcn.0044ef31
cmp dword [esi + 0x14], 8
jb 0x408ce3
mov eax, dword [esi]
jmp 0x408ce5
mov eax, esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044f021
test al, al
je 0x408d05
cmp dword [esi + 0x14], 8
jb 0x408cfb
mov esi, dword [esi]
push esi
push dword [ebp - 0x28]
call dword [0x52b00c]
lea esi, [ebp - 0x28]
call fcn.0044effe
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fe191
leave
ret
Function at 0x4097ca
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push esi
push edi
push 0x542e0c
lea esi, [ebp - 0x20]
call fcn.0040204f
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x4097f8
mov eax, esi
push 0xf003f
push eax
push 0x80000001
lea esi, [ebp - 0x28]
call fcn.0044eefb
push 0x542ecc
push dword [ebp - 0x28]
call dword [0x52b00c]
call fcn.0044effe
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fe191
leave
ret

Function at 0x40a0a9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [edi], esi
mov dword [ebx], esi
mov dword [ebp - 0x10], 1
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
cmp eax, esi
je 0x40a192
add eax, 2
mov dword [ebp - 4], eax
add eax, eax
cmp eax, esi
je 0x40a192
push eax
call fcn.004fd727
pop ecx
mov dword [ebp + 0x14], eax
cmp eax, esi
je 0x40a192
mov eax, dword [ebp - 4]
add eax, eax
push eax
push esi
push dword [ebp + 0x14]
call fcn.00506540
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40a189
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x5448bc
push dword [ebp + 0x14]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40a189
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x40a189
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0xc], ecx
jae 0x40a189
mov ecx, dword [eax + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push dword [ebp + 0x14]
mov edx, ecx
shr edx, 0x10
movzx ecx, cx
mov dword [esi], edx
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov ecx, eax
movzx eax, ax
shr ecx, 0x10
mov dword [ebx], ecx
mov dword [edi], eax
call fcn.004fe78e
xor eax, eax
pop ecx
inc eax
jmp 0x40a194
push dword [ebp + 0x14]
call fcn.004fe78e
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x40eaa5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], 0
push esi
mov esi, ecx
jne 0x40eaff
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00506540
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00402178
push edi
call fcn.0040202c
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fe191
leave
ret
Function at 0x40f2df
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x58569c]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea esi, [esp + 0x1c]
call fcn.0040202c
mov eax, esi
push eax
call fcn.00408d27
pop ecx
test al, al
jne 0x40f33f
xor ebx, ebx
inc ebx
push 1
xor edi, edi
lea esi, [esp + 0x1c]
call fcn.004021a4
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004fe191
mov esp, ebp
pop ebp
ret 8
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x40f34e
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40f3f4
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x70]
call fcn.0040202c
push 0x5448bc
lea esi, [esp + 0x38]
call fcn.0040204f
mov ecx, esi
lea edx, [esp + 0x6c]
call fcn.0044e641
push 1
xor edi, edi
mov bl, al
call fcn.004021a4
test bl, bl
je 0x40f3bd
mov eax, dword [esp + 0x7c]
dec eax
push eax
push edi
lea eax, [esp + 0x74]
push eax
lea esi, [esp + 0x40]
call fcn.00405746
push eax
lea eax, [esp + 0x70]
call fcn.00402a57
push 1
call fcn.004021a4
cmp dword [esp + 0x80], 8
mov eax, dword [esp + 0x6c]
jae 0x40f3cf
lea eax, [esp + 0x6c]
push eax
call fcn.00435ee1
pop ecx
xor edi, edi
push 1
lea esi, [esp + 0x70]
test eax, eax
jne 0x40f3ef
call fcn.004021a4
push 2
pop ebx
jmp 0x40f319
call fcn.004021a4
call fcn.00452c1a
cmp dword [eax], 3
setge al
mov byte [esp + 0x10], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
call fcn.0044a559
mov ebx, 0x543728
push ebx
lea esi, [esp + 0x38]
call fcn.0040204f
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x54]
push eax
mov ecx, esi
call fcn.0044abc8
call fcn.00449a3d
push 1
xor edi, edi
lea esi, [esp + 0x8c]
mov byte [esp + 0x13], al
call fcn.004021a4
push 1
lea esi, [esp + 0x38]
call fcn.004021a4
cmp byte [esp + 0xf], 0
je 0x40f4a1
push ebx
lea esi, [esp + 0x38]
call fcn.0040204f
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x54]
push eax
mov ecx, esi
call fcn.0044abc8
push eax
lea eax, [esp + 0x54]
push eax
call fcn.0044a59f
push 1
lea esi, [esp + 0x8c]
call fcn.004021a4
push 1
lea esi, [esp + 0x38]
call fcn.004021a4
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x40f4b0
lea eax, [esp + 0x50]
push dword [esp + 0x10]
push eax
call fcn.004360d2
pop ecx
pop ecx
test al, al
jne 0x40f4f1
cmp dword [esp + 0x14], 0
jne 0x40f4dd
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x40f4d6
lea eax, [esp + 0x18]
push eax
call fcn.0043698e
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x54]
call fcn.004021a4
push 3
jmp 0x40f3e9
cmp dword [ebp + 0xc], 0
je 0x40f53a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x8c]
call fcn.0044a559
mov ecx, eax
mov eax, dword [ebp + 0xc]
call fcn.00408c77
push 1
xor edi, edi
lea esi, [esp + 0x8c]
mov bl, al
call fcn.004021a4
test bl, bl
jne 0x40f53a
push 1
lea esi, [esp + 0x54]
call fcn.004021a4
push 4
jmp 0x40f3e9
push 1
xor edi, edi
lea esi, [esp + 0x54]
call fcn.004021a4
xor ebx, ebx
jmp 0x40f319