joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f0c9
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0xc]
jmp 0x40f0cb
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40f840
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40f865
mov eax, 1
jmp 0x40f8a4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40f87a
mov eax, 1
jmp 0x40f8a4
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f8a2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40f8a2
mov eax, 1
jmp 0x40f8a4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40ff60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ffa7
cmp dword [ebp - 4], 0x50
je 0x40ffa7
cmp dword [ebp - 4], 0xb7
je 0x40ffa7
push 0x30
push 0x4dd1c4
push str._rN_f_tgHe
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40ffb6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x410290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1f0], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4102be
xor eax, eax
jmp 0x41046d
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41042b
lea ecx, [ebp - 0x1b0]
call fcn.0040e5f0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x90]
call fcn.00415490
mov ecx, eax
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0040e8a0
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00402a70
lea ecx, [ebp - 0x90]
call fcn.004154c0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
call fcn.00415490
mov ecx, eax
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0040e8a0
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00402a70
lea ecx, [ebp - 0x118]
call fcn.004154c0
lea ecx, [ebp - 0x1cc]
call fcn.00402bd0
mov dword [ebp - 0x1f4], eax
lea ecx, [ebp - 0x1e8]
call fcn.00402bd0
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1f8]
mov dl, byte [ecx]
mov byte [ebp - 0x1f9], dl
mov eax, dword [ebp - 0x1f4]
cmp dl, byte [eax]
jne 0x4103cd
cmp byte [ebp - 0x1f9], 0
je 0x4103c1
mov ecx, dword [ebp - 0x1f8]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1fa], dl
mov eax, dword [ebp - 0x1f4]
cmp dl, byte [eax + 1]
jne 0x4103cd
add dword [ebp - 0x1f8], 2
add dword [ebp - 0x1f4], 2
cmp byte [ebp - 0x1fa], 0
jne 0x41036f
mov dword [ebp - 0x200], 0
jmp 0x4103d8
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x200]
mov dword [ebp - 0x204], edx
cmp dword [ebp - 0x204], 0
jne 0x410415
mov dword [ebp - 0x1ec], 0
lea ecx, [ebp - 0x1cc]
call fcn.00402b30
lea ecx, [ebp - 0x1e8]
call fcn.00402b30
mov eax, dword [ebp - 0x1ec]
jmp 0x41046d
lea ecx, [ebp - 0x1cc]
call fcn.00402b30
lea ecx, [ebp - 0x1e8]
call fcn.00402b30
call fcn.004086f0
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
call fcn.00406020
test eax, eax
je 0x41045a
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1f0]
call fcn.004120b0
jmp 0x41046d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1f0]
call fcn.0040f8b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 8
Function at 0x410480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0043ef50
add esp, 0xc
push 0
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x214]
call fcn.0040f080
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx + 2]
mov word [ebp - 0x21a], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21a], 0
jne 0x4104dd
mov edi, dword [ebp - 0x218]
mov eax, dword [0x4dd200]
mov dword [edi], eax
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
mov ax, word [edx + 2]
mov word [ebp - 0x222], ax
add dword [ebp - 0x220], 2
cmp word [ebp - 0x222], 0
jne 0x41051b
mov edi, dword [ebp - 0x220]
mov ecx, 6
mov esi, 0x4dd204
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410569
mov eax, 1
jmp 0x41056b
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret
Function at 0x410720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x224], ecx
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea eax, [ebp - 0x21f]
push eax
call fcn.0043ef50
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.0043ef50
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0xffffffffffffffff
call fcn.004086a0
add eax, 0x410
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x110]
add edx, 0xffffffff
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x228]
mov cl, byte [eax + 1]
mov byte [ebp - 0x229], cl
add dword [ebp - 0x228], 1
cmp byte [ebp - 0x229], 0
jne 0x4107ca
mov edi, dword [ebp - 0x228]
mov edx, dword [str.gamebufflik.txt]
mov dword [edi], edx
mov eax, dword [0x4dd230]
mov dword [edi + 4], eax
mov ecx, dword [0x4dd234]
mov dword [edi + 8], ecx
mov edx, dword [0x4dd238]
mov dword [edi + 0xc], edx
mov al, byte [0x4dd23c]
mov byte [edi + 0x10], al
push 0x4dd240
lea ecx, [ebp - 0x110]
push ecx
call fcn.00437a6b
add esp, 8
mov dword [ebp - 0x114], eax
lea edx, [ebp - 0x220]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
add eax, 1
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x230]
mov dl, byte [ecx]
mov byte [ebp - 0x235], dl
add dword [ebp - 0x230], 1
cmp byte [ebp - 0x235], 0
jne 0x41084e
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x234]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x114]
push ecx
push 1
mov edx, dword [ebp - 0x23c]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.00437fe0
add esp, 0x10
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.00437067
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 4
Function at 0x4111e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
push 0x4dbedb
lea ecx, [ebp - 0x2c]
call fcn.00402a70
push 0x4dd320
lea ecx, [ebp + 0xc]
call fcn.00402bd0
push eax
lea eax, [ebp - 8]
push eax
call fcn.00437a82
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x411242
push 0
mov ecx, dword [ebp + 8]
call fcn.00402a70
lea ecx, [ebp - 0x2c]
call fcn.00402b30
lea ecx, [ebp + 0xc]
call fcn.00402b30
mov eax, dword [ebp + 8]
jmp 0x4112f1
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004382dd
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.004381ee
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.004382dd
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
call fcn.00434264
add esp, 4
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00437e6c
add esp, 0x10
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00437067
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004151d0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004358d0
add esp, 4
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402ab0
lea ecx, [ebp - 0x2c]
call fcn.00402b30
lea ecx, [ebp + 0xc]
call fcn.00402b30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 0x20
Function at 0x411430
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0x4dd324
mov eax, dword [ebp + 8]
push eax
call fcn.00437a6b
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004382dd
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.004381ee
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004378a5
add esp, 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call fcn.00437811
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4114e8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00437e6c
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.00437067
add esp, 4
lea eax, [ebp - 0xc]
push eax
push str.GameBuff_123__
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004236f0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00437797
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x411542
push 0x4dd338
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00437a6b
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x411542
mov edx, dword [ebp - 0x18]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00437fe0
add esp, 0x10
mov edx, dword [ebp - 0x18]
push edx
call fcn.00435ff0
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
call fcn.00437067
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00437797
add esp, 4
mov esp, ebp
pop ebp
ret 8
Function at 0x4120b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
cmp dword [ebp + 8], 0
je 0x4120d5
cmp dword [ebp + 0xc], 0
jne 0x4120d9
xor eax, eax
jmp 0x412152
push 1
lea ecx, [ebp - 0x808]
call fcn.00415430
lea ecx, [ebp - 0x808]
call fcn.00415480
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x808]
call fcn.00415460
push eax
call fcn.00437963
add esp, 0xc
lea ecx, [ebp - 0x808]
call fcn.00415460
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x808]
call fcn.00415460
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x80c]
mov byte [eax + 0x2084], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 8

Function at 0x4122b0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00412270
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push ecx
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4122f3
xor eax, eax
jmp 0x4122f8
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 4
Function at 0x412310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
lea ecx, [ebp - 0x214]
call fcn.00404bb0
mov eax, dword [ebp - 0x218]
add eax, 0x208
push eax
push str._scommon.7z
lea ecx, [ebp - 0x214]
push ecx
call fcn.00405220
add esp, 0xc
push 1
mov edx, dword [ebp - 0x218]
add edx, 0x1c70
push edx
lea ecx, [ebp - 0x214]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
mov ecx, dword [ebp - 0x218]
call fcn.00413dc0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0043ef50
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push str._localappdata_GamePPSdkCommon
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 4]
call fcn.00404bb0
mov ecx, dword [ebp - 0x218]
add ecx, 0x208
push ecx
push str._scommonSdk.7z
lea edx, [ebp - 4]
push edx
call fcn.00405220
add esp, 0xc
push 1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
call sym.Setup.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
mov ecx, dword [ebp - 0x218]
call fcn.00413dc0
mov ecx, dword [ebp - 0x218]
call fcn.00415050
lea ecx, [ebp - 4]
call fcn.00403e20
lea ecx, [ebp - 0x214]
call fcn.00403e20
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret

Function at 0x4125b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 8]
call fcn.00404bb0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0043ef50
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 1
push 0
push 0x4dd614
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41265f
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push str.ChannelID
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 8]
call fcn.00403e40
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404bd0
lea ecx, [ebp - 8]
call fcn.00403e20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 4
Function at 0x412690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call fcn.004086a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2084]
test ecx, ecx
je 0x4126c3
mov edx, dword [ebp - 4]
add edx, 0x208
push edx
mov ecx, dword [ebp - 4]
call fcn.00414200
call fcn.004086a0
add eax, 0x1658
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004086a0
add eax, 0x1860
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret

Function at 0x4126f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41276b
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4128c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0043ef50
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x218], ecx
lea edx, [ebp - 0x210]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x222], dx
mov eax, dword [ebp - 0x21c]
mov cx, word [ebp - 0x222]
mov word [eax], cx
mov edx, dword [ebp - 0x218]
add edx, 2
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x21c], eax
cmp word [ebp - 0x222], 0
jne 0x412911
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x214]
add edx, 0x208
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x228]
mov dx, word [ecx]
mov word [ebp - 0x232], dx
mov eax, dword [ebp - 0x22c]
mov cx, word [ebp - 0x232]
mov word [eax], cx
mov edx, dword [ebp - 0x228]
add edx, 2
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x22c]
add eax, 2
mov dword [ebp - 0x22c], eax
cmp word [ebp - 0x232], 0
jne 0x412980
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
mov ax, word [edx + 2]
mov word [ebp - 0x23a], ax
add dword [ebp - 0x238], 2
cmp word [ebp - 0x23a], 0
jne 0x4129d7
mov edi, dword [ebp - 0x238]
mov ecx, dword [str.program.7z]
mov dword [edi], ecx
mov edx, dword [0x4dd66c]
mov dword [edi + 4], edx
mov eax, dword [0x4dd670]
mov dword [edi + 8], eax
mov ecx, dword [0x4dd674]
mov dword [edi + 0xc], ecx
mov edx, dword [0x4dd678]
mov dword [edi + 0x10], edx
mov eax, dword [0x4dd67c]
mov dword [edi + 0x14], eax
push 0
mov ecx, dword [ebp - 0x214]
add ecx, 0x208
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x214]
call fcn.004126f0
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x412a8b
push 1
mov eax, dword [ebp - 0x214]
add eax, 0x208
push eax
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
call fcn.00413dc0
jmp 0x412aac
push 1
mov edx, dword [ebp - 0x214]
add edx, 0x208
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00413dc0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 0x10

Function at 0x412ac0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x412aeb
xor eax, eax
jmp 0x412af0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4139c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0043ef50
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413a60
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x220], 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x4dd6a8
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403da0
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404bd0
lea ecx, [ebp - 0x214]
call fcn.00403e20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 8
Function at 0x413aa0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x413bad
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0xc]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
push 0x4dd6bc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x4dd6c0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040d470
add esp, 0x18
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 8