joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf70
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40cad5
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x413040]
xor eax, ebp
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], eax
mov esi, ecx
mov eax, dword [esi]
mov ebx, dword [eax - 8]
push edi
lea eax, [ebp - 0x14]
push eax
lea edi, [ebp - 0x18]
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x29
mov byte [ebp - 0xb], 0x25
mov byte [ebp - 0xa], 0x21
mov byte [ebp - 9], 0x24
mov byte [ebp - 8], 0
call fcn.00405e2d
jmp 0x40cb44
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406073
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], ebx
jl 0x40cb37
mov eax, ebx
lea ecx, [ebp - 0x18]
call fcn.00406917
mov eax, dword [0x413050]
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x20], eax
jne 0x40cb72
lea ecx, [ebp - 0x1c]
jmp 0x40cbda
mov edx, dword [esi]
lea eax, [ebx - 1]
test eax, eax
jl 0x40cb9b
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
sub esi, eax
add ecx, eax
sub edx, dword [ebp - 0x18]
lea esi, [esi + ebx - 1]
lea edi, [eax + 1]
mov al, byte [edx + ecx]
xor al, byte [ecx]
dec ecx
mov byte [esi], al
inc esi
dec edi
jne 0x40cb8f
lea ecx, [ebp - 0x28]
lea eax, [ebx + ebx + 1]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
call fcn.0040697e
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov edx, ebx
call fcn.0040ca78
mov eax, dword [ebp - 0x28]
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00406917
push dword [ebp - 0x20]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
lea eax, [ebp - 0x1c]
call fcn.0040cc1b
mov ecx, eax
mov esi, dword [ebp - 0x24]
call fcn.004068ee
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff4
cmp eax, dword [0x413054]
je 0x40cbf6
push eax
call fcn.004018e7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
cmp eax, dword [0x413054]
je 0x40cc0a
push eax
call fcn.004018e7
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f143
leave
ret
Function at 0x40d67d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov ebx, eax
je 0x40d699
push dword [ebp + 8]
lea eax, [ebx + 0x14]
call fcn.00404e5b
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x40d6bd
xor al, al
jmp 0x40d724
mov esi, 0x410fd4
push 0x2000
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 8], 0x2000
call dword [eax + 8]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret 8
Function at 0x40f206
Capabilities:
Terminate process

Disassembly:
push 0x11c
push 0x410548
call fcn.0040f154
mov eax, dword [0x413040]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x413194]
test eax, eax
je 0x40f249
and dword [ebp - 4], 0
push ecx
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x40f353
mov eax, dword [ebp + 8]
dec eax
je 0x40f265
mov ebx, str.Unknown_security_failure_detected_
mov dword [ebp - 0x12c], str.A_security_error_of_unknown_cause_has_been_detected_which_has_ncorrupted_the_programs_internal_state.__The_program_cannot_safely_ncontinue_execution_and_must_now_be_terminated._n
mov edi, 0xd4
jmp 0x40f279
mov ebx, str.Buffer_overrun_detected_
mov dword [ebp - 0x12c], str.A_buffer_overrun_has_been_detected_which_has_corrupted_the_programs_ninternal_state.__The_program_cannot_safely_continue_execution_and_must_nnow_be_terminated._n
mov edi, 0xb9
mov byte [ebp - 0x20], 0
push 0x104
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f2a8
push str._program_name_unknown_
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], eax
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 0xb
cmp eax, 0x3c
jbe 0x40f2ef
lea eax, [ebp - 0x124]
push eax
call esi
lea ecx, [ebp - 0x124]
sub ecx, 0x31
add eax, ecx
mov dword [ebp - 0x128], eax
push 3
push 0x410394
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0x128]
call esi
lea eax, [eax + edi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.0040f370
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x410390
push ebx
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push str.Program:
push edi
call esi
push dword [ebp - 0x128]
push edi
call esi
push ebx
push edi
call esi
push dword [ebp - 0x12c]
push edi
call esi
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401bc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x425508
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.004012b0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401c16
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00401590
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.004012b0
cmp dword [esp + 0x24], 8
jb 0x401c5f
mov edx, dword [esp + 0x10]
push edx
call fcn.004178bc
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x402c10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x425b32
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x433174]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, str.99999999991
shr ecx, 0x10
mov dword [esp + 0x20], esi
mov dword [esi], eax
test ecx, ecx
jne 0x402c88
mov edx, str.99999999991
movzx ecx, dx
mov edx, esi
call fcn.00401f90
jmp 0x402cc0
push str.99999999991
call ebp
mov edi, eax
cmp edi, ebx
je 0x402cc0
mov ecx, edi
mov edx, esi
call fcn.00402150
test eax, eax
je 0x402cc0
mov ecx, dword [esi]
lea eax, [edi + edi]
push eax
push str.99999999991
add eax, 2
push eax
push ecx
call fcn.00417bf9
push eax
call fcn.00401e70
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 1
push ebx
mov dword [esp + 0x244], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.SOFTWAREumaster
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 1
call edi
cmp eax, ebx
je 0x402d08
lea ecx, [esp + 0x14]
push ecx
push 0x101
push ebx
push str.SOFTWAREumaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, ebx
jne 0x402d66
push 0x206
lea eax, [esp + 0x2a]
xor edx, edx
push ebx
push eax
mov dword [esp + 0x24], 0x208
mov word [esp + 0x30], dx
call fcn.0041a210
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push str.FntId
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x402d5b
lea ecx, [esp + 0x24]
push ecx
mov edx, ecx
push edx
call ebp
mov ebx, eax
call fcn.004021f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004178c7
add esp, 0x228
ret
Function at 0x402e10
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x425ae8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x402f13
lea eax, [esp + 0xc]
push eax
push 0x42a078
push 1
push 0
push 0x42a088
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x402f0d
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x42a098
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x402ef5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push 0
push ebx
push eax
call edx
test eax, eax
jge 0x402ef5
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push str.Internet_Explorer
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
lea esi, [esp + 0x14]
call fcn.00401f30
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov dword [esp + 0x20], 0xffffffff
call fcn.00402120
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x403750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
jne 0x403790
cmp ecx, 0x433164
je 0x40378d
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40378d
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00417bee
add esp, 4
xor eax, eax
ret
cmp ecx, 0x433164
je 0x4037b6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4037b6
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00417bee
add esp, 4
mov eax, 1
ret

Function at 0x4037c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0041a210
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40382e
mov eax, dword [esp + 4]
cmp eax, 6
jbe 0x403821
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004178c7
add esp, 0x120
ret
jne 0x40382e
mov eax, 1
cmp dword [esp + 8], eax
jae 0x403830
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004178c7
add esp, 0x120
ret

Function at 0x403850
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0041a210
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4038a3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004178c7
add esp, 0x120
ret
cmp dword [esp + 4], 0xa
mov ecx, dword [esp + 0x11c]
sbb eax, eax
xor ecx, esp
inc eax
call fcn.004178c7
add esp, 0x120
ret
Function at 0x4043e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0041a210
add esp, 0xc
push 0x104
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4044d7
xor eax, eax
mov word [esp + 0x16], ax
movzx ecx, word [esp + eax + 0x10]
mov word [esp + eax + 0x218], cx
add eax, 2
test cx, cx
jne 0x404430
call fcn.004037c0
test eax, eax
je 0x404493
lea eax, [esp + 0x218]
add eax, 0xfffffffe
jmp 0x404460
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x404460
mov ecx, dword [str.users_]
mov edx, dword [0x42c3ec]
mov dword [eax], ecx
mov ecx, dword [0x42c3f0]
mov dword [eax + 4], edx
mov dx, word [0x42c3f4]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
jmp 0x4044b8
lea edi, [esp + 0x218]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4044a0
mov ecx, 0xc
mov esi, str.Documents_and_settings_
rep movsd dword es:[edi], dword [esi]
push ecx
lea ebx, [esp + 0x21c]
mov esi, esp
mov dword [esp + 0x10], esp
call fcn.00401f30
mov ecx, dword [esp + 0x42c]
call fcn.00403e00
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004178c7
add esp, 0x418
ret 4

Function at 0x404500
Capabilities:
Get file version info

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0041a210
add esp, 0xc
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x404576
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004178c7
add esp, 0x21c
ret
push edi
push esi
call fcn.004174e5
add esp, 4
mov edi, eax
push edi
push esi
push 0
lea edx, [esp + 0x20]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4045bd
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x42bcd4
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4045df
push edi
call fcn.00417bee
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004178c7
add esp, 0x21c
ret
mov edx, dword [esp + 8]
xor esi, esi
cmp word [edx + 0x12], 6
jne 0x4045f1
mov esi, 1
push edi
call fcn.00417bee
mov ecx, dword [esp + 0x224]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004178c7
add esp, 0x21c
ret
Function at 0x404c10
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x425ec6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.00404b40
mov dword [esp + 0x230], 0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 8], 0
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
je 0x404d28
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x26]
push eax
mov word [esp + 0x28], dx
call fcn.0041a210
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00401f30
push str.Icons.zip
push str.Icons.zip
mov byte [esp + 0x238], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edi, [esp + 0x1c]
call fcn.004067e0
push 0x42bea8
push 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, dword [esp + 0x18]
test eax, eax
je 0x404d04
push esi
call fcn.00411000
add esp, 4
test al, al
je 0x404d04
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.00410ac0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0xc]
cmp eax, 0x433164
je 0x404d28
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x404d28
push esi
call fcn.00417bee
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x433164
je 0x404d51
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x404d51
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00417bee
add esp, 4
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004178c7
add esp, 0x220
ret
Function at 0x405780
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x425931
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x52]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x58], ax
call fcn.0041a210
add esp, 0xc
lea edx, [esp + 0x4c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x433174]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x4c]
shr ecx, 0x10
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x405812
lea edx, [esp + 0x4c]
movzx ecx, dx
lea edx, [esp + 0x10]
call fcn.00401f90
jmp 0x40584e
lea eax, [esp + 0x4c]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x40584e
mov ecx, esi
lea edx, [esp + 0x10]
call fcn.00402150
test eax, eax
je 0x40584e
mov edx, dword [esp + 0x10]
lea eax, [esi + esi]
push eax
lea ecx, [esp + 0x50]
push ecx
add eax, 2
push eax
push edx
call fcn.00417bf9
push eax
call fcn.00401e70
add esp, 0x14
push str.umastershellext.exe
push str.umastershellext.exe
mov dword [esp + 0x268], ebx
call edi
mov esi, eax
lea edi, [esp + 0x14]
call fcn.004067e0
push 0x42bea8
push 0xa3
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, dword [esp + 0x10]
cmp eax, ebx
je 0x40594c
push edi
call fcn.00411000
add esp, 4
cmp al, bl
je 0x40594c
xor eax, eax
mov word [esp + 0x34], ax
push 2
mov eax, 0x42c43c
lea esi, [esp + 0x34]
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
call fcn.00401670
mov byte [esp + 0x260], 1
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4058e0
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x18]
call fcn.00401670
lea ecx, [esp + 0x30]
mov edx, esi
mov byte [esp + 0x260], 2
call fcn.00405bc0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x405926
mov edx, dword [esp + 0x18]
push edx
call fcn.004178bc
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp dword [esp + 0x48], esi
jb 0x40594c
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004178bc
add esp, 4
lea edx, [edi - 0xc]
cmp edx, 0x433164
je 0x40596e
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40596e
push esi
call fcn.00417bee
add esp, 4
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004178c7
add esp, 0x254
ret
Function at 0x4059a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x425931
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x52]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x58], ax
call fcn.0041a210
add esp, 0xc
lea edx, [esp + 0x4c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x433174]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x4c]
shr ecx, 0x10
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x405a32
lea edx, [esp + 0x4c]
movzx ecx, dx
lea edx, [esp + 0x10]
call fcn.00401f90
jmp 0x405a6e
lea eax, [esp + 0x4c]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x405a6e
mov ecx, esi
lea edx, [esp + 0x10]
call fcn.00402150
test eax, eax
je 0x405a6e
mov edx, dword [esp + 0x10]
lea eax, [esi + esi]
push eax
lea ecx, [esp + 0x50]
push ecx
add eax, 2
push eax
push edx
call fcn.00417bf9
push eax
call fcn.00401e70
add esp, 0x14
push str.qqpcmgr_v12.1.18202.223_92034_1.exe
push str.qqpcmgr_v12.1.18202.223_92034_1.exe
mov dword [esp + 0x268], ebx
call edi
mov esi, eax
lea edi, [esp + 0x14]
call fcn.004067e0
push 0x42bea8
push 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, dword [esp + 0x10]
cmp eax, ebx
je 0x405b6c
push edi
call fcn.00411000
add esp, 4
cmp al, bl
je 0x405b6c
xor eax, eax
mov word [esp + 0x34], ax
push ebx
mov eax, 0x42bccc
lea esi, [esp + 0x34]
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
call fcn.00401670
mov byte [esp + 0x260], 1
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405b00
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x18]
call fcn.00401670
lea ecx, [esp + 0x30]
mov edx, esi
mov byte [esp + 0x260], 2
call fcn.00405bc0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x405b46
mov edx, dword [esp + 0x18]
push edx
call fcn.004178bc
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp dword [esp + 0x48], esi
jb 0x405b6c
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004178bc
add esp, 4
lea edx, [edi - 0xc]
cmp edx, 0x433164
je 0x405b8e
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x405b8e
push esi
call fcn.00417bee
add esp, 4
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004178c7
add esp, 0x254
ret