joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531660
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, 0x7b0c7686
jb 0x531662
rdtsc
jmp 0x531664
jmp 0x53164a
rdtsc
lea esp, [esp + 0x14]
jmp 0x53166e
add bl, 0x55
sub esp, 0x12
jge 0x5316dc
xchg byte [esp + 7], dl
jmp 0x5316c6
xchg byte [esp + 7], dl
add esp, 3
mov byte [esp + 0xa], cl
push dword [esp]
lea esp, [esp + 3]

Function at 0x6106e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 5]
mov eax, 0x88fab4ef
xchg dword [esp + 9], eax
cld
lea esp, [esp + 3]
jmp 0x610698
sub esp, 0xf
lea esp, [esp + 3]
mov dword [esp + 0x13], eax
mov ax, word [esp]
jmp 0x6106ae

Function at 0x6107c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov dx, word [esp + 0x27]
bts eax, ebx
lea edi, [edx + esi]
cld
jmp 0x610813
lea edi, reloc.KERNEL32.dll_IsBadReadPtr
dec edi
rol edx, cl
mov edi, 0x49848684
jmp 0x610e5e
setns ah
rdtsc
mov edx, dword [esp + 0x16]
mov ax, 0x1317
neg al
pop edx
jmp 0x6107fd
xchg edi, edx
setge al
mov dh, 0x5c
rcl ax, cl
mov ah, 0x21
mov ax, word [esp + 0xb]
jmp 0x610896
mov word [esp + 5], sp
mov al, 0x8b
cld
mov edx, 0x15ce02cb
xchg dword [esp + 2], edi
push dword [esp]
jmp 0x610844
mov edx, 0x2c7d012d
mov al, 0x15
bswap eax
mov di, word [esp + 1]
jmp 0x6108bd
xchg dword [esp + 2], edi
sub edi, 0xe6fb6c67
mov dword [esp + 5], ebp
lea edi, [ecx + edx]
jmp 0x610880
inc edi
mov dh, 0xd2
add esp, 0xb
mov word [esp], bx
add esp, 0xd
cld
jmp 0x61086a
mov dword [esp + 2], esp
dec dx
xchg dword [esp + 5], edx
add esp, 5
push dword [esp + 3]
rdtsc
jmp 0x610d0c
pushal
lea esp, [esp + 0x5b]
mov edi, ecx
rcr edi, 0x13
pushal
bsf edi, edi
jmp 0x6108ad
rdtsc
push dword [esp + 2]
xchg al, ah
add esp, 4
pushfd
lea esp, [esp + 0xa]
jmp 0x610a3c
xchg word [esp + 3], ax
xchg dl, ah
lea edx, [ebp*4]
sub esp, 2
rdtsc
mov ax, dx
jmp 0x6108ec
inc ax
cld
lea esp, [esp + 9]
lea eax, [ebx + 0x95]
sete dl
jmp 0x610a03
xchg word [esp], dx
sub esp, 0x12
pop edi
xchg dword [esp], edi
add esp, 5
pop di
jmp 0x610929
mov byte [esp + 2], ah
mov dh, 0xa
pop word [esp]
mov edi, ebp
dec al
mov edi, eax
jmp 0x61093f
add esp, 4
bswap eax
mov eax, ebp
sub esp, 8
stc
rdtsc
jmp 0x6109cb
bsr edi, esp
xchg al, dl
mov di, sp
xchg dx, ax
push ecx
mov di, 0xa25e
jmp 0x61096e
rdtsc
setnp dh
sub esp, 2
xchg word [esp], dx
xchg edi, edx
inc eax
jmp 0x610984
rcr edx, 0xb
call fcn.006109e6
and dword [edx + reloc.KERNEL32.dll_IsBadReadPtr], edi
add dword [edi + reloc.KERNEL32.dll_IsBadReadPtr], ebx
jb 0x610a38
mov al, ah
lea esp, [esp + 8]
mov byte [esp + 1], ch
mov di, cx
lea edx, [ebx - 0xc9]
lea eax, reloc.KERNEL32.dll_IsBadReadPtr
jmp 0x6109b5
bswap edx
mov dl, 0xa0
lea edx, reloc.KERNEL32.dll_IsBadReadPtr
stc
xchg edi, eax
mov dh, cl
jmp 0x6109a4
sub al, 0xdf
cmp al, 0xc4
xchg edi, edx
mov edi, dword [esp + 2]
shr edx, 3
xchg di, dx
add esp, 0
bswap eax
jmp 0x61095c
adc di, 0xc22a
xchg dh, al
bswap edx
xchg dh, dl
rdtsc
lea edi, [edx + edi]
jmp 0x610911
pop di
bt di, bp
setno dh
mov dh, 0x69
rdtsc
mov dx, 0x4a48
jmp 0x610a8c
mov edx, 0xa2266320
sub esp, 0x16
mov ah, byte [esp + 0x15]
pop ax
mov dx, 0xf3d9
bsr dx, si
jmp 0x6108dc
Function at 0x6114e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 1]
jmp 0x61158e
xchg word [esp + 3], di
pop eax
xchg di, ax
xchg word [esp + 4], di
adc ah, bh
mov ah, 3
lea eax, reloc.KERNEL32.dll_IsBadReadPtr
cmp edi, 0x9092a32c
mov dx, 0x259e
shl dl, 0
jmp 0x61152e
neg eax
rdtsc
xchg di, ax
mov di, 0x70fd
push dword [esp + 3]
mov word [esp + 7], ax
jmp 0x611544

Function at 0x6156ef
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
push esi
lea esp, [esp + 1]
mov dword [esp + 4], esi
call fcn.00615710
mov dword [reloc.KERNEL32.dll_IsBadReadPtr], eax
xchg ebp, eax
mov eax, dword [reloc.KERNEL32.dll_IsBadReadPtr]
invalid
invalid
je 0x615717
mov word [esp + 1], si
lea esp, [esp + 3]
jmp 0x6156d8
add dword [ebp - reloc.KERNEL32.dll_IsBadReadPtr], ecx
fimul word [ecx - 0x72d7db84]
and al, 0x28
and al, 0xe

Function at 0x615710
Capabilities:
Access peb ldr_data
Get number of processors
Packed with generic packer

Disassembly:
jmp 0x61110a
call fcn.0061110f
call 0x61506c
jmp 0x615750
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x615742
pushal
push dword [esp + 0x23]
mov dword [esp + 0xe], esi
jmp 0x6156fa
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x615788
pop eax
sub eax, 0x21506c
jmp 0x615772
push eax
jmp 0x610f88
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x615067

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x751679ac
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x24f325a8
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x404290
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fb6f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x56a434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x40430b
cmp dword [esi + 4], 0
je 0x4042ef
mov eax, dword [esi + 4]
test eax, eax
je 0x4042ef
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x40430b
mov ecx, esi
call fcn.00423050
push 0x50
push esi
call fcn.004dc48b
add esp, 8
push 0x50
call fcn.004dc4bc
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.0048a4d0
sub esp, 0x18
mov ecx, 0x404380
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40434d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x404380
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.00422e00
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40436e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fc9a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004c6e64
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4051c0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0048954e
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5674c4
push eax
call fcn.0048aa00
push edi
push esi
call fcn.004c71da
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4
Function at 0x40c040
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520515
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x56a434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c150
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x40c0b6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40c08f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004017f0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40c0a7
mov eax, dword [esi]
jmp 0x40c0a9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004034f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40c0d2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004017f0
push 0x50
call fcn.004dc4bc
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0048a4d0
sub esp, 0x18
mov ecx, 0x40d4c0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40c114
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x40d4c0
mov dword [eax + 0x24], eax
push 0x555158
push edi
mov ecx, esi
call fcn.00422e00
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40c132
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414dc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5210b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56a434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x414e11
mov eax, dword [esi]
jmp 0x414e13
mov eax, esi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x414e34
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e25
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004031a0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
cmp word [edi], ax
jne 0x414e64
xor ecx, ecx
jmp 0x414e7f
mov ecx, edi
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e70
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x18]
call fcn.004031a0
mov eax, dword [ebp + 0x14]
movsd xmm0, qword [0x557728]
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x38], 0x4047b0
movsd qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [esi + 0x58], 0
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], 0
mov word [esi + 0x5c], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c360
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521f5d
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
call fcn.0048a4d0
mov dword [esi + 0x10], 0
lea ecx, [edi + 0x758]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41c3ec
mov eax, dword [esi]
jmp 0x41c3ee
mov eax, esi
xor edx, edx
push 0xffffffffffffffff
push edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.004032a0
xor eax, eax
mov dword [ebp - 0x234], 1
mov byte [edi + 0x7b9], 1
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.004240c0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
call fcn.00423fb0
test eax, eax
mov dword [ebp - 0x238], eax
mov byte [edi + 0x7ba], 1
setne al
mov byte [edi + 0x7b9], al
call fcn.00423f30
mov ebx, eax
test ebx, ebx
setne al
mov byte [edi + 0x7ba], al
cmp dword [edi + 0x768], 0
je 0x41c4aa
cmp dword [edi + 0x754], 8
lea eax, [edi + 0x740]
jb 0x41c49b
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c56f
cmp dword [ebp - 0x238], 0
je 0x41c4f2
test ebx, ebx
je 0x41c4f2
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
lea eax, [ebp - 0x218]
push 0
je 0x41c4fa
push str.xieli
push eax
push 0
push 0x104
push eax
call fcn.00503e13
add esp, 0x18
jmp 0x41c519
push 0
lea eax, [ebp - 0x218]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x2a
push eax
push 0
call edi
test eax, eax
jne 0x41c519
push eax
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call edi
push 0x5547bc
push 0x554960
lea eax, [ebp - 0x218]
push eax
push 0
push 0x104
push eax
call fcn.00503e13
add esp, 0x18
cmp word [ebp - 0x218], 0
jne 0x41c548
xor ecx, ecx
jmp 0x41c560
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c551
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004031a0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41c58d
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.004017f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4
Function at 0x41c710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push 0x208
push 0
push eax
mov esi, ecx
call fcn.0048a4d0
add esi, 0x758
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x41c74e
mov esi, dword [esi]
push 0x10
push edi
push 0x10
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
mov ecx, 0x5551f8
lea eax, [ebp - 0x234]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c796
test dx, dx
je 0x41c792
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c796
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c770
xor eax, eax
jmp 0x41c79b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41c84f
push eax
push str.set.ini
push edi
push eax
lea esi, [eax + 1]
lea eax, [ebp - 0x234]
push 0x104
push eax
call fcn.00503e13
add esp, 0x18
lea eax, [ebp - 0x234]
push eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
push str.true
push str.IsOverride
push str.Uninstall
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, str.false
lea eax, [ebp - 0x2c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c82f
test dx, dx
je 0x41c812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c82f
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c7f0
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4
sbb eax, eax
xor ecx, ecx
or eax, 1
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4

Function at 0x41c9f0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], 0
call fcn.0048a4d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x41ca54
push eax
push 0x2e
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x556970
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x104
push eax
call fcn.00503e13
push 0
push 0x554960
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x104
push eax
call fcn.00503e13
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0x30
mov word [esi], ax
cmp word [ebp - 0x20c], ax
jne 0x41caad
xor ecx, ecx
jmp 0x41cac5
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cab6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004031a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004dc47a
mov esp, ebp
pop ebp
ret 4
Function at 0x41ced0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
call fcn.0041d090
mov ecx, edi
call fcn.0041d1f0
cmp dword [edi + 0x788], 1
jne 0x41cf2d
cmp dword [edi + 0x70c], 8
lea esi, [edi + 0x6f8]
jb 0x41cf00
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cf2d
mov ecx, edi
call fcn.0043f1d0
mov ecx, eax
call fcn.004210a0
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi + 0x78c]
test eax, eax
je 0x41cf4b
push eax
push 0xa
lea ecx, [edi + 0x2c]
call fcn.0042ec50
push eax
lea ecx, [edi + 0x2c]
call fcn.00433200
mov eax, dword [edi + 0x790]
test eax, eax
je 0x41cf69
push eax
push 0xb
lea ecx, [edi + 0x2c]
call fcn.0042ec50
push eax
lea ecx, [edi + 0x2c]
call fcn.00433200
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d090
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522108
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x73c], 8
lea esi, [edi + 0x728]
jb 0x41d0d0
mov ebx, dword [esi]
jmp 0x41d0d2
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareXieLiSoftiRecorder
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d126
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d100
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push str.InstallPath
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x720], 0
jne 0x41d197
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004032a0
push 0xa
push str.uninst.ep
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004033c0
lea ecx, [edi + 0x710]
cmp ecx, eax
je 0x41d182
push 0xffffffffffffffff
push 0
push eax
call fcn.004032a0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x41d197
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004017f0
cmp dword [edi + 0x724], 8
lea esi, [edi + 0x710]
jb 0x41d1aa
mov eax, dword [esi]
jmp 0x41d1ac
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d1ce
cmp dword [esi + 0x14], 8
jb 0x41d1bf
mov esi, dword [esi]
push esi
push ecx
push str.UnInstallEp
call fcn.004270e0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret
Function at 0x421140
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5225bb
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x56a434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x4211aa
xor ecx, ecx
jmp 0x4211c2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4211b3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004031a0
push 0x1e
push 0x556ed0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.004033c0
xor ecx, ecx
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push ecx
mov word [ebp - 0x230], cx
lea ecx, [ebp - 0x230]
push eax
mov dword [ebp - 0x220], 0
call fcn.004032a0
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x421238
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004017f0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42127d
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42127d
lea esi, [eax + 1]
jmp 0x4212a2
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
push esi
call fcn.00508a15
add esp, 0xc
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x4212c0
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.004017f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc47a
mov esp, ebp
pop ebp
ret