joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f1e
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x201c]
test eax, eax
je 0x404f41
push eax
push 0x41a53e
lea eax, [esi + 0x14]
push 1

Function at 0x404f4d
Capabilities:
Get disk information

Disassembly:
sub esp, 0x41a1ac
mov dword [esp], eax
push dword [ebp - 8]
push dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push dword [esp + 0xc]
push 0xffffffffffffffd0
push 0x4004c9
push 0x40d23c
call fcn.00403930
add byte [eax], al
mov eax, 0x41a389
push esi
push 0
mov esi, ecx
call fcn.00411560
mov dword [esi], 0x10009380
push esi
push dword [esp - 0x21]
call 0x404f4d
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
test eax, eax
je 0x404edd
mov ecx, dword [eax]
push eax
lea esp, [esp + 8]
mov esi, dword [esp + 8]
push ecx
push edx
push dword [esp + 0x2e]
call 0x404f7c
push 0x41aba9
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [esp + 0x10]
add dword [esp + 4], esi
push 0xfffffffffffffffc
call 0x404f96
lea edx, [ebx + 0x14]
push edx
push str.ine_GetRegio
push edi
push eax
lea esp, [esp + 8]
pop esi
ret 4

Function at 0x405155
Capabilities:
Check internet connectivity via wininet

Disassembly:
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push 0x405600
push 0xffffffffffffffdf
push dword [esp - 0xc]
push dword [esp + 0x21]
push dword [esp - 0x9e]
call 0x405155
mov dword [esp + 0xb4], 0xffffffff
call fcn.00410e96
xor eax, eax
mov word [esp + 0x10], 0
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push 0x2c
push 0xfffffffffffffff5
push dword [esp + 0x2b]
call 0x40518a
mov dword [esp + 0x20], ebp
call fcn.0040da7a
mov ecx, dword [esp + 0x14]
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
lea esp, [esp + 0x10]
pop ebx
ret 0xc

Function at 0x40552d
Capabilities:
Get common file path

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
mov eax, dword [esp + 8]
mov dword [0x41b1f2], eax
mov eax, esi
pop esi
and ecx, dword [esp]
push ebp
push 0x400bb7
push dword [esp + 0xc]
push 0x40ace5
call fcn.00402f20
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
Function at 0x405569
Capabilities:
Get file system object information

Disassembly:
mov dword fs:[0], esp
push ecx
push esi
dec ebx
jne 0x408344
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x413c18
push 0x42
push dword [esp + 4]
push 0x400c53
push 0x40e638
call fcn.00402f20
cmp eax, 0xffffffff
je 0x4055c5
push edx
call edi
push esi
mov dword [esp + 0x470], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jne 0x405606
jmp dword [0xffffffff]
push ecx
push ebx
push esi
push eax
push 0x34
push 0x5d
push esi
push 0x3ff6f1
call fcn.0040335f
lea ecx, [ebp - 0x38]
mov eax, str.O:PyImag
lea ecx, [ebp - 0x24]
lea ecx, [ebp - 0x38]
mov eax, 0x41a6bd
lea ecx, [ebp - 0x23c]
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0xffffffffffffffdc
push 0xffffffffffffffe5
push sym.imp.WININET.dll_HttpAddRequestHeadersA
push 0xd52
call fcn.0040a59d
push 0x400cc8
push 0x61
push 0xffffffffffffff86
push 0x3fb1b8
call fcn.00403091
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
push eax
push 0x41b13d
push eax
push esi
call fcn.0040a886
push eax
push 0xffffffffffffff9d
push esp
push 0x3f1e43
call fcn.004034ec
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x24]
push eax
call ebx
push 0x12
push 0x1163
push edx
call fcn.0041018b
push 9
call fcn.004043bf
int3

Function at 0x40560f
Capabilities:
Read file on windows

Disassembly:
call fcn.00410190
mov ecx, eax
push eax
push dword [esp - 2]
push ebx
push dword [esp + 0xd]
push 0x45
push dword [esp - 0x9d]
call fcn.00405636
xor eax, eax
push esi
push edi

Function at 0x405636
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + 0x20], eax
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push dword [esp + 0x7f]
push ebx
push dword [esp + 0x2a]
call 0x405665
call edi
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x405681
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp + 0x73]
push 0xffffffffffffff9a
call 0x40568a
je 0x40564e
test eax, eax
je 0x4056b1
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
test eax, eax
je 0x4056a9
lea esp, [esp + 0xc]
pop eax
ret 8
jne 0x405632
xor eax, eax
mov eax, dword [esp + 4]
mov ecx, dword [0x41a926]
push 0
add eax, 0x202
call fcn.0040c7dc
push 5
push 0x4009c1
push dword [esp + 8]
push dword [esp + 8]
push 0x3ffe28
call fcn.00403650
call ebx
push 0x41a948
lea ecx, [esp + 0x2c]
push ecx
call esi
push 0x41ae60
Function at 0x405665
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + 0x20], eax
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push dword [esp + 0x7f]
push ebx
push dword [esp + 0x2a]
call 0x405665
call edi
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x405681
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp + 0x73]
push 0xffffffffffffff9a
call 0x40568a
je 0x40564e
test eax, eax
je 0x4056b1
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
test eax, eax
je 0x4056a9
lea esp, [esp + 0xc]
pop eax
ret 8
jne 0x405632
xor eax, eax
mov eax, dword [esp + 4]
mov ecx, dword [0x41a926]
push 0
add eax, 0x202
call fcn.0040c7dc
push 5
push 0x4009c1
push dword [esp + 8]
push dword [esp + 8]
push 0x3ffe28
call fcn.00403650
call ebx
push 0x41a948
lea ecx, [esp + 0x2c]
push ecx
call esi
push 0x41ae60

Function at 0x405efc
Capabilities:
Set registry value

Disassembly:
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
mov dword [esp], 0
push esi
push 0xffffffffffffffc8
push esi
call 0x405f11
test esi, esi
jl 0x405f5e
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0xca]
push dword [esp - 0x3d]
push dword [esp + 3]
push 0x402a58
call 0x405f39
cmp eax, 0xffffffff
jne 0x405ebb
xor eax, eax
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0xf2]
push dword [esp - 0x28]
push ecx
push dword [esp - 0xf7]
push 0x402e98
call 0x405f66
cmp eax, edi
je 0x405f37
mov edi, dword [esp + 0x18]
lea esp, [esp + 0x18]
pop esi
ret 4

Function at 0x405f11
Capabilities:
Set registry value

Disassembly:
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
mov dword [esp], 0
push esi
push 0xffffffffffffffc8
push esi
call 0x405f11
test esi, esi
jl 0x405f5e
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0xca]
push dword [esp - 0x3d]
push dword [esp + 3]
push 0x402a58
call 0x405f39
cmp eax, 0xffffffff
jne 0x405ebb
xor eax, eax
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0xf2]
push dword [esp - 0x28]
push ecx
push dword [esp - 0xf7]
push 0x402e98
call 0x405f66
cmp eax, edi
je 0x405f37
mov edi, dword [esp + 0x18]
lea esp, [esp + 0x18]
pop esi
ret 4
Function at 0x405f86
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xchg dword [esp], edx
push eax
push ebp
push 0x47
push 0x4064ea
call fcn.004031d1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test bl, 0x10
jne 0x405fef
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 5
call fcn.00409cea
test bl, 0x20
jne 0x405fb4
push eax
mov dword [esp], eax
push dword [esp + 4]
push dword [esp + 0xc]
push 0x12
push 0x407b92
call fcn.004034ec
push 1
mov ecx, esi
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je fcn.00405f7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
je 0x40605a
mov ecx, dword [esi + 0x14]
push 3
push ecx
call sub.KERNEL32.dll_GetProcessTimes
cmp dword [esi + 0x58], ebp
je 0x40601e
push eax
push ebx
push ecx
call 0x406035
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push eax
push 0x41b2d6
call dword [sym.imp.urlmon.dll_HlinkSimpleNavigateToMoniker]
push 0x41b2d0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push eax
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0x403db8
call 0x40605c
call dword [ecx + 8]
mov dword [esi + 0xb4], edi
mov eax, dword [esi + 0xb0]
cmp eax, edi
je 0x406029
mov edx, dword [eax]
lea esp, [esp + 8]
add dword [esp + 4], eax
push dword [esp - 0x76]
push ebx
push eax
push dword [esp - 0x80]
call 0x40609c
pop esi
mov ecx, dword [esp + 0x21c]
call fcn.004067a6
add esp, 0x41a797
mov ecx, dword [esp + 8]
push 0x41aa7b
lea eax, [esp + 0x20]
push eax
push 2
lea esp, [esp + 0x14]
pop eax
ret 8
Function at 0x405f92
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xchg dword [esp], edx
push eax
push ebp
push 0x47
push 0x4064ea
call fcn.004031d1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test bl, 0x10
jne 0x405fef
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 5
call fcn.00409cea
test bl, 0x20
jne 0x405fb4
push eax
mov dword [esp], eax
push dword [esp + 4]
push dword [esp + 0xc]
push 0x12
push 0x407b92
call fcn.004034ec
push 1
mov ecx, esi
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je fcn.00405f7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
je 0x40605a
mov ecx, dword [esi + 0x14]
push 3
push ecx
call sub.KERNEL32.dll_GetProcessTimes
cmp dword [esi + 0x58], ebp
je 0x40601e
push eax
push ebx
push ecx
call 0x406035
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push eax
push 0x41b2d6
call dword [sym.imp.urlmon.dll_HlinkSimpleNavigateToMoniker]
push 0x41b2d0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push eax
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0x403db8
call 0x40605c
call dword [ecx + 8]
mov dword [esi + 0xb4], edi
mov eax, dword [esi + 0xb0]
cmp eax, edi
je 0x406029
mov edx, dword [eax]
lea esp, [esp + 8]
add dword [esp + 4], eax
push dword [esp - 0x76]
push ebx
push eax
push dword [esp - 0x80]
call 0x40609c
pop esi
mov ecx, dword [esp + 0x21c]
call fcn.004067a6
add esp, 0x41a797
mov ecx, dword [esp + 8]
push 0x41aa7b
lea eax, [esp + 0x20]
push eax
push 2
lea esp, [esp + 0x14]
pop eax
ret 8

Function at 0x4064fc
Capabilities:
Create process on windows

Disassembly:
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push dword [esp - 0x9a]
push edx
push dword [esp - 0x51]
push dword [esp - 0x87]
push dword [esp + 0x22]
call 0x4064fc
push esi
mov eax, dword [esp + 0x14]
or eax, eax
jne 0x406546
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push ecx
push 0x22
push ebp
push dword [esp - 0x66]
push 0x403820
call 0x406536
add byte [eax], al
sub esp, 0xc
mov eax, dword [0x41a6bd]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 7
lea ecx, [esp + 8]
lea esp, [esp + 0x18]
pop edi
ret 0xc
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx

Function at 0x406729
Capabilities:
Get common file path
Get file system object information

Disassembly:
push 1
push edx
call fcn.0040afae
cmp eax, 0xffffffff
jne 0x406753
push dword [ebp - 8]
call fcn.00404606
mov edx, dword [ebp - 8]
push 0x5d
push dword [esp + 0xc]
push 0xffffffffffffffd2
push 0x40b230
call fcn.004034ec
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
push 0
push 0xffffffffffffffff
push 0x41a281
dec ecx
jne 0x40f894
push dword [ebp - 4]
push dword [esp + 4]
push 0x400a59
push dword [esp + 8]
push 0x407da0
call fcn.0040379d
mov ecx, dword [esp + 0xc]
call fcn.0040ff8c
cmp eax, 0xffffffff
jne 0x4067fe
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x406794
pop ecx
Function at 0x4067a6
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 8]
push 0x41a294
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
push eax
xor dword [esp], eax
add dword [esp], edx
sub edx, eax
mov edx, 1
push 0x15
push esp
push 0x40062a
push 0x40d4e4
call fcn.00403091
call fcn.0040cdf7
and dword [ebp - 0x1c], 0
mov esi, dword [ebp + 0xc]
mov dword [esp], eax
lea eax, [esp]

Function at 0x406a69
Capabilities:
Get graphical window text

Disassembly:
push edx
push eax
call dword [ecx + 0x74]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
push eax
push ecx
push 0x41b1bd

Function at 0x406aab
Capabilities:
Get graphical window text

Disassembly:
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
push dword [esp - 0x95]
push dword [esp - 0x82]
push 0x403c70
call fcn.00406aab
push eax
call dword [edx + 0x60]
test eax, eax
jl 0x406aa7
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x1c]
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push 0x39
push 0x7e
push 0xffffffffffffffdf
push 0x2c
push 0xfffffffffffffff5
call 0x406ad8
add eax, 2
dec edx
jne 0x406a7c
mov eax, dword [0x41b18f]
inc dword [eax]
mov eax, dword [0x41ada0]
pop esi
sub esp, 8
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push dword [esp - 0x13]
push esp
push dword [esp - 0x28]
push esi
push dword [esp + 0x66]
call 0x406b01
add byte [eax], al
mov eax, 0x41a46d
push esi
lea esp, [esp + 0x18]
pop ebx
ret 8

Function at 0x406b46
Capabilities:
Get common file path

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi]
dec eax
mov dword [esi], eax
push ecx
push dword [esp + 4]
push dword [esp + 4]
push ebp
push 0x40ca90
call fcn.00403091
push 0xffffffffffffffff
push 0x41afb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x41a806
call fcn.0040cd22
push 0x41ae6e
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_RaiseException]

Function at 0x406dfd
Capabilities:
Set thread local storage value

Disassembly:
push 0xa
push 0x41aca1
lea ecx, [esp + 0x50]
push ecx
call edi
test bl, 0x10
je 0x406e66
push 0x22
lea edx, [esp + 0x4c]
push esi
push ebp
call fcn.00406e24
mov dword [esp], eax
lea eax, [esp]
push eax

Function at 0x406e24
Capabilities:
Set thread local storage value

Disassembly:
lea esp, [esp + 8]
mov esi, dword [esp + 8]
push dword [esp - 0x80]
call 0x406e43
mov dword [eax], edi
mov dword [eax + 0xc], 1
mov dword [eax + 8], esi
pop edi
pop esi
lea esp, [esp + 8]
add dword [esp + 4], esi
push 0x404eb0
push 0xffffffffffffffdb
push 0x404a50
call 0x406e73
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea esp, [esp + 0x10]
pop esi
ret 8
Function at 0x406e43
Capabilities:
Set thread local storage value

Disassembly:
lea esp, [esp + 8]
mov esi, dword [esp + 8]
push dword [esp - 0x80]
call 0x406e43
mov dword [eax], edi
mov dword [eax + 0xc], 1
mov dword [eax + 8], esi
pop edi
pop esi
lea esp, [esp + 8]
add dword [esp + 4], esi
push 0x404eb0
push 0xffffffffffffffdb
push 0x404a50
call 0x406e73
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea esp, [esp + 0x10]
pop esi
ret 8

Function at 0x4072bb
Capabilities:
Write file on windows

Disassembly:
jg 0x40896d
je 0x405464
cmp eax, 0x8065
jg 0x4061c2
cmp eax, 0x8064
jge 0x4072f0
push 0
push 0x400b8f
push 0x1c
push dword [esp + 4]
push 0x3fcace
call fcn.0040379d
push eax
lea ecx, [esp + 4]
push ecx
push esi
mov eax, dword [esp + 0x14]
or eax, eax
je 0x41259c
push 1
push 3
push dword [esp + 4]
push 0xffffffffffffffab
push dword [esp + 4]
push 0x3fef7a
call fcn.004031d1
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
Function at 0x40751c
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [ebp + 0xc], 4
jne 0x40f41f
push dword [ebp + 8]
push edx
push 0x400b23
push eax
push 0x3fd821
call fcn.00403a9a
inc eax
cmp eax, 3
ja 0x4074e6
push 0x41acf3
push 0x41b314
call fcn.0041168c
push 0x41b05a
push 0x41a248
lea edx, [esp]
push edx
mov edx, dword [esp + 0xc]
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push ebx
push dword [esp - 0x26]
push edx
push 0x402a50
call 0x40751c
mov ebx, 0x41a692
mov dword [esp + 0xd4], edx
mov byte [esp + 0x4c], 1
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push edx
push dword [esp - 0x1f]
push dword [esp - 0x40]
push esp
push dword [esp + 0x27]
call 0x407550
dec dword [esi]
jne 0x407580
push esi
call dword [eax + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [esp + 0x1c]
push esi
mov dword [edx], eax
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push dword [esp + 0x3e]
push dword [esp - 0xc8]
push ebx
push ecx
call 0x407570
mov eax, dword [esi]
push 0
push 0x26
lea esp, [esp + 0x14]
pop ebx
ret 0xc
cmp eax, 0xffffffff
jne 0x40756c
xor eax, eax
mov ecx, dword [esp + 4]
and ecx, dword [esp]
add esp, 4
push edx
push 0x4c
push ebp
push 0x40b9a7
call fcn.004034ec
test edi, edi
je 0x40fe8b
test ebx, ebx
jne 0x407543
xor eax, eax
xor eax, eax
mov ecx, dword [esp + 0x854]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x84c]
call fcn.0040b1a2
pop edi
pop esi
push ecx
push dword [esp - 0xb5]
push dword [esp - 0xbd]
push edx
call 0x4075f2
push eax
mov eax, dword [0x41a571]
call fcn.0040540c
cmp eax, 0xffffffff
jne 0x40762b
xor eax, eax
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push dword [esp - 0x67]
push dword [esp - 0x7f]
call 0x407613
test eax, eax
je 0x4075ee
mov eax, dword [0x41a4e5]
lea esp, [esp + 0xc]
add dword [esp + 4], ecx
push ebp
call 0x407636
mov ecx, 0x41ac36
call fcn.0040c7dc
push 0x41a555
call fcn.0040f19c
pop ecx
lea esp, [esp + 8]
pop ecx
ret 8
mov dword fs:[0], ecx
push 0xffffffffffffffff
push 0x41b1d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], 3
jne 0x409ca6
push dword [ebp + 8]
call fcn.0040e856
push 0xffffffffffffffd7
push 0x4004c4
push 0x400fad
push 0x401455
call fcn.004034ec
pop ecx
sub esp, 0x10
mov ebx, dword [esp + 0x10]
mov edx, dword [edi + 0x14]
mov dword [esp + 0xc], 0
mov eax, dword [edx + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
cmp dword [ebp + 0xc], 1
jne 0x409cbd
push dword [ebp + 8]
call fcn.0040e856
jmp fcn.00409b32
cmp dword [ebp + 0xc], 5
jne 0x4074a5
push dword [esp + 8]
push dword [esp + 8]
push 0xffffffffffffff96
push 0x405d37
call fcn.00403a9a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov ecx, dword [ebp + 0x10]
Function at 0x407af0
Capabilities:
Get file version info
Read file on windows

Disassembly:
push eax
push 0x41aa9a
push ecx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
je 0x407ab8
mov eax, dword [0x41afcf]
call fcn.0040540c
test eax, eax
je 0x407b05
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esi + 0x14]
mov edx, dword [esp + 0x28]
mov eax, dword [ebp + 4]
je 0x407b05
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x407b35
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
test eax, eax
je 0x407ac7
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407b6a
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 8
push esi
push edx
push 0x4006f3
push 0x40b33e
call fcn.00403a9a
push ecx
lea edx, [esp + 0x14]
push 0x41a19e
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], edx
mov edx, dword [eax]

Function at 0x408537
Capabilities:
Get common file path
Set registry value

Disassembly:
and esp, 0xfffffff8
sub esp, 0x41aaa5
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x40f7ef
mov eax, dword [0x41a637]
push ecx
push ebx
call 0x408555
test eax, eax
jne 0x40851d
pop edi
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], 0x40
pop esi
mov eax, str.DVD_PT
pop ebx
pop edi
lea esp, [esp + 8]
mov ecx, dword [esp + 8]
push edx
call 0x40856b
mov eax, dword [esp + 0x1c]
push eax
call dword [edi + 8]
lea esp, [esp + 8]
add dword [esp + 4], ecx
push 0x403c20
call 0x4085a2
mov dword [esp + 0x24], 4
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
mov dword [0x41aa7a], eax
mov eax, esi
pop esi
lea esp, [esp + 8]
pop ecx
ret 0xc

Function at 0x408555
Capabilities:
Set registry value

Disassembly:
and esp, 0xfffffff8
sub esp, 0x41aaa5
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x40f7ef
mov eax, dword [0x41a637]
push ecx
push ebx
call 0x408555
test eax, eax
jne 0x40851d
pop edi
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], 0x40
pop esi
mov eax, str.DVD_PT
pop ebx
pop edi
lea esp, [esp + 8]
mov ecx, dword [esp + 8]
push edx
call 0x40856b
mov eax, dword [esp + 0x1c]
push eax
call dword [edi + 8]
lea esp, [esp + 8]
add dword [esp + 4], ecx
push 0x403c20
call 0x4085a2
mov dword [esp + 0x24], 4
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
mov dword [0x41aa7a], eax
mov eax, esi
pop esi
lea esp, [esp + 8]
pop ecx
ret 0xc
Function at 0x40856b
Capabilities:
Set registry value

Disassembly:
and esp, 0xfffffff8
sub esp, 0x41aaa5
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x40f7ef
mov eax, dword [0x41a637]
push ecx
push ebx
call 0x408555
test eax, eax
jne 0x40851d
pop edi
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], 0x40
pop esi
mov eax, str.DVD_PT
pop ebx
pop edi
lea esp, [esp + 8]
mov ecx, dword [esp + 8]
push edx
call 0x40856b
mov eax, dword [esp + 0x1c]
push eax
call dword [edi + 8]
lea esp, [esp + 8]
add dword [esp + 4], ecx
push 0x403c20
call 0x4085a2
mov dword [esp + 0x24], 4
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
mov dword [0x41aa7a], eax
mov eax, esi
pop esi
lea esp, [esp + 8]
pop ecx
ret 0xc

Function at 0x40879c
Capabilities:
Accept command line arguments
Move file

Disassembly:
push eax
lea ecx, [esp + 4]
push ecx
push 0x41a832
push ebx
push 0xffffffffffffff8a
call 0x40879c
jne 0x408812
xor eax, eax
mov eax, dword [esp + 4]
push eax
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push 0xfffffffffffffffb
push dword [esp - 0x8c]
push dword [esp - 0x1e]
call 0x4087c3
cmp eax, 0xffffffff
jne 0x40880d
lea edx, [esp + 8]
push edx
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x403848
push dword [esp - 0x39]
push 0x18
call 0x4087de
add eax, esi
pop esi
lea esp, [esp + 0x10]
pop ebx
ret 8

Function at 0x408dd7
Capabilities:
Get file version info

Disassembly:
je 0x408e48
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, eax
call dword [sym.imp.USER32.dll_RegisterClassW]
test eax, eax
je 0x408e13
push eax
push dword [esp + 0x11]
call fcn.00408e14
add byte [eax], al
mov eax, 0x41a800
push esi
push 0
mov esi, ecx
call fcn.0040886e
mov dword [esi], 0x100063e0
mov eax, esi
pop esi

Function at 0x408f8c
Capabilities:
Get common file path
Parse url

Disassembly:
push eax
push ecx
push esi
push dword [esp - 0x31]
call 0x408f8c
xor eax, eax
mov ecx, dword [esp + 0x21c]
call fcn.0040718a
lea esp, [esp + 8]
mov esi, dword [esp + 8]
push dword [esp - 0xe3]
push dword [esp - 0x3d]
push dword [esp + 1]
push edx
push dword [esp - 0xff]
call 0x408fc8
lea ecx, [esp + 4]
push ecx
push 0x41b133
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x409018
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push edx
push dword [esp - 0xe3]
call 0x409002
mov ecx, eax
call fcn.0040e54e
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, 0x41a00c
mov ecx, esi
call fcn.004045a8
mov eax, 0x41b146
lea esp, [esp + 0xc]
pop esi
ret 8
and ecx, 0x41a492
xor edx, edx
or ecx, edx
je 0x40903e
push str.wSec
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]