joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426190
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, eax
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x574], ebx
je 0x4261b7
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi + 0x574], ebx
mov eax, dword [esi + 0x57c]
cmp eax, ebx
je 0x426265
mov edi, eax
call fcn.00402930
mov edi, eax
cmp edi, ebx
je 0x42625f
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
push 2
push ebx
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x30]
mov ecx, edi
call edx
test eax, eax
je 0x4261f9
lea ebx, [esi + 0x18]
call fcn.00403670
xor ebx, ebx
mov eax, dword [esi + 0x57c]
cmp eax, dword [esi + 0x578]
jne 0x42625f
cmp edi, esi
je 0x42622c
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x38]
mov eax, dword [esp + 0x34]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push 0x202
mov ecx, edi
call fcn.00404eb0
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x42624e
cmp word [eax], bx
je 0x42624e
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42625f
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x42625f
mov dword [esp + 0x14], 1
mov ebp, eax
mov dword [esi + 0x57c], ebx
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esi + 0x128]
call fcn.004a5c90
cmp dword [esp + 0x14], ebx
je 0x4262c1
mov eax, dword [esi + 0x10]
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
mov dword [esp + 0x24], ebp
call edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ecx
push 0x4e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4279e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x510361
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x18], ebp
mov esi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], 2
mov byte [esi], al
xor ecx, ecx
mov dword [ebp + 0x14], eax
push 0xffffffffffffffff
mov dword [ebp + 0x18], 7
lea ebx, [ebp + 4]
mov word [ebx], cx
push eax
lea eax, [esp + 0x74]
mov ecx, ebp
call fcn.00408f70
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], 1
test edi, edi
jbe 0x427a6a
cmp dword [ebp + 0x18], 8
jb 0x427a58
mov ebx, dword [ebx]
mov eax, dword [esp + 0x64]
push ebx
lea ecx, [esp + 0x54]
call fcn.004087a0
test eax, eax
jne 0x427aac
lea edx, [esp + 0x50]
mov byte [esi], 1
push edx
mov ebx, str._tmp
lea esi, [esp + 0x24]
call fcn.00427b50
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, ebp
mov byte [esp + 0x4c], 3
call fcn.00408f70
mov byte [esp + 0x44], 2
cmp dword [esp + 0x38], 8
jb 0x427aac
mov eax, dword [esp + 0x24]
push eax
call fcn.004ea82f
add esp, 4
mov ebx, 8
cmp dword [ebp + 0x18], ebx
jb 0x427abb
mov eax, dword [ebp + 4]
jmp 0x427abe
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
xor esi, esi
push 0xffffffffffffffff
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], esi
push esi
mov eax, ebp
mov word [ecx + 4], dx
call fcn.00408f70
call fcn.00410100
add esp, 0x1c
cmp dword [esp + 0x68], ebx
jb 0x427b06
mov eax, dword [esp + 0x54]
push eax
call fcn.004ea82f
add esp, 4
xor ecx, ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], esi
mov word [esp + 0x54], cx
cmp dword [esp + 0x84], ebx
jb 0x427b2b
mov edx, dword [esp + 0x70]
push edx
call fcn.004ea82f
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret

Function at 0x427b50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50d188
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00408f70
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x427ba6
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x14]
call fcn.004182f0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00408f70
cmp dword [esp + 0x24], 8
jb 0x427bee
mov edx, dword [esp + 0x10]
push edx
call fcn.004ea82f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x42c2d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50c2b9
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
mov eax, dword [0x546fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x546fac
call edx
add eax, 0x10
mov dword [edi], eax
cmp ebp, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 1
mov edx, ebp
jge 0x42c32e
neg edx
cmp ebx, esi
mov esi, ebx
jge 0x42c336
neg esi
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jge 0x42c340
neg ecx
mov eax, dword [esp + 0x28]
test eax, eax
jge 0x42c34a
neg eax
push edx
xor edx, edx
test ebp, ebp
setl dl
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
xor edx, edx
test ebx, ebx
setl dl
push esi
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push ecx
xor ecx, ecx
cmp dword [esp + 0x40], ecx
setl cl
xor edx, edx
dec ecx
and ecx, 0xffffffd1
add ecx, 0x5f
cmp dword [esp + 0x3c], edx
push ecx
setl dl
push eax
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push str._c_d__c_d__c_d__c_d
call fcn.00401fc0
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x42f6b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x50f300
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
cmp dword [0x548360], 0
je 0x42f812
mov eax, dword [0x54883c]
add eax, 0xfffffff0
call fcn.00404fe0
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.00417f60
push eax
mov ecx, 0x51d370
call fcn.00418120
mov bl, al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f741
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42f756
push 1
push 0x51d374
lea ecx, [esp + 0x14]
push ecx
call fcn.00418e70
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x51d378
call fcn.00418040
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f798
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x42f7ea
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.qq_browser.exe
call fcn.00418040
mov byte [esp + 0x24], 1
mov eax, dword [eax]
push eax
mov ecx, 0x51d398
call fcn.004159d0
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f7ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f812
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x42f940
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x512458
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.StartInstall
mov ecx, 0x548980
call fcn.004dfa90
mov eax, dword [0x5487e8]
xor ebx, ebx
add esp, 4
mov dword [0x5487cc], esi
cmp dword [eax - 0xc], ebx
jne 0x42f9c1
cmp byte [0x548838], bl
je 0x42f9a3
push str.no_install_path
mov ecx, 0x548980
call fcn.004dfa90
add esp, 4
mov dword [0x544984], 0x3f2
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
cmp esi, ebx
je 0x42fb0b
add eax, 0xfffffff0
call fcn.00404fe0
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], ebx
cmp dword [eax - 0xc], ebx
jg 0x42fa23
add eax, 0xfffffff0
mov dword [0x544984], 0x3f2
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fa0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
mov eax, 3
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
call fcn.00417fd0
lea edi, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.00405050
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fa67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0xc]
call fcn.00434a00
push ebx
push 0x100000
push edx
push eax
call fcn.004fefd0
cmp eax, 0x3c
jge 0x42fafa
mov edx, 1
lea ecx, [edx + 0x63]
mov dword [0x544984], 0x3f3
call fcn.00421b60
push 0x517216
lea ecx, [esp + 0x18]
call fcn.00401900
push ebx
push ebx
push 1
push 0x5487c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 2
call fcn.004310c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call fcn.00401e10
push 0x51d428
mov ecx, 0x548980
call fcn.004dfa90
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00406e40
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00406e40
call fcn.004d90a0
mov edx, dword [0x548884]
mov ecx, dword [0x5487e8]
push eax
call fcn.004d86a0
cmp dword [0x5487cc], ebx
je 0x42fb36
mov ecx, 0x5487c0
call fcn.00432f40
jmp 0x42fb53
push ebx
push ebx
push 0x5487c0
push 0x432070
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5487e4], eax
cmp eax, ebx
je 0x42fb58
mov ebx, 1
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
Function at 0x431bf0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x50f2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x53c1a4]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x23
lea eax, [esp + 0x34]
push eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], cx
lea edx, [eax + 2]
jmp 0x431c60
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x431c60
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
lea esi, [esp + 0x14]
call fcn.00408a10
mov dword [esp + 0x240], edi
mov eax, dword [esp + 0x24]
cmp eax, edi
jne 0x431ca5
push ebx
mov ecx, 0x51d9c4
call fcn.00406d70
cmp dword [esp + 0x28], 8
jb 0x431d1b
mov edx, dword [esp + 0x14]
push edx
jmp 0x431d13
lea esi, [eax - 1]
cmp eax, esi
ja 0x431cb1
call fcn.004e94a3
mov eax, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x431cc4
lea eax, [esp + 0x14]
movzx eax, word [eax + esi*2]
cmp ax, 0x5c
je 0x431ce4
cmp ax, 0x2f
je 0x431ce4
push 1
push 0x51d9c8
lea eax, [esp + 0x18]
call fcn.004182f0
push 0x1b
push 0x51d9cc
lea eax, [esp + 0x18]
call fcn.004182f0
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x431d02
lea ecx, [esp + 0x14]
push ebx
call fcn.00406d70
cmp dword [esp + 0x28], edi
jb 0x431d1b
mov eax, dword [esp + 0x14]
push eax
call fcn.004ea82f
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004ea83a
add esp, 0x238
ret
Function at 0x431d50
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50fe76
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x53c1a4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor esi, esi
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push esi
push ecx
mov dword [esp + 0x24], esi
mov word [esp + 0x30], ax
call fcn.004f08c0
mov edx, dword [0x546fac]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x546fac
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x24]
push ecx
push 0x104
mov dword [esp + 0x240], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x431eed
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x431df3
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
mov eax, 0x5487ec
call fcn.004076e0
push 7
push 0x51da04
push 0x5487ec
call fcn.00418e70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._x_
lea edi, [esp + 0x24]
call fcn.004190d0
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp - 0xc]
add esp, 8
push eax
push ebp
push 0x5487ec
call fcn.00418e70
mov edx, dword [0x5487ec]
push edx
call fcn.004158d0
add esp, 4
test eax, eax
jne 0x431eb8
lea ebx, [esp + 0x20]
call fcn.00431bf0
mov edi, 0x5487ec
mov byte [esp + 0x238], 1
call fcn.00405050
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431ea5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x5487ec]
push ecx
call fcn.004158d0
add esp, 4
test eax, eax
je 0x431eed
mov edx, dword [0x5487ec]
push edx
push str.temp_:__ws
mov ecx, 0x548980
call fcn.004dfa90
add esp, 8
call fcn.004d90a0
mov edx, dword [0x5487ec]
mov ecx, eax
call fcn.004d8ce0
mov dword [esp + 0x18], 1
jmp 0x431ef7
mov esi, 0x5487ec
call fcn.00407550
add ebp, 0xfffffff0
mov dword [esp + 0x238], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x431f1f
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004ea83a
add esp, 0x228
ret
Function at 0x432080
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x511440
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov eax, dword [0x546fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x546fac
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
jge 0x4320ef
mov ecx, 0x105
lea eax, [esp + 0x2c]
call fcn.00407670
mov esi, dword [esp + 0x2c]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004ec7bd
add esp, 8
test eax, eax
jl 0x432222
cmp eax, dword [esi - 8]
jg 0x432222
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea edx, [esp + 0x2c]
lea eax, [ecx + 1]
push edx
lea ecx, [esp + 0x1c]
call fcn.00417f60
push eax
mov ecx, 0x51da2c
call fcn.00418120
mov bl, al
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432163
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43217c
push 1
push 0x51da30
lea ecx, [esp + 0x34]
push ecx
call fcn.00418e70
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov ebx, 0x51da34
call fcn.00418040
add esp, 8
lea edi, [ebp + 0x7c]
mov byte [esp + 0x24], 1
call fcn.00405050
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4321c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push 0
push eax
call fcn.00417370
mov edi, dword [edi]
add esp, 8
push edi
add ebp, 0x34
push ebp
mov ecx, 2
call fcn.004194c0
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432207
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push 0x80070057
call fcn.00402a90
int3
Function at 0x434390
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x50f1d2
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53c1a4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
mov eax, dword [0x53c1a4]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov dword [esp + 0x228], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x546fac]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, 0x546fac
mov dword [esp + 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
mov dword [esp + 0x230], 0
push ecx
mov dword [esp + 0x18], 1
mov word [esp + 0x20], ax
call fcn.004f08c0
add esp, 0xc
push 0
push 0x26
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4344b8
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x434459
jge 0x434451
push 0x80070057
call fcn.00402a90
mov ax, word [ecx]
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434460
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x14]
mov ebx, eax
push ecx
mov eax, edi
call fcn.004076e0
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4344ab
lea edx, [eax - 1]
test edx, edx
jl 0x434447
cmp edx, eax
jg 0x434447
movzx eax, word [ecx + edx*2]
cmp ax, 0x5c
je 0x4344ab
cmp ax, 0x2f
je 0x4344ab
mov edx, 0x51faf0
call fcn.00417f00
push 7
push 0x51e65c
push edi
call fcn.00418e70
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004ea83a
add esp, 0x220
ret
Function at 0x434a00
Capabilities:
Get disk size

Disassembly:
mov eax, dword [eax]
sub esp, 0x1c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x434a25
xor edx, edx
add esp, 0x1c
ret
mov ecx, dword [esp + 4]
mov eax, dword [esp]
mov edx, ecx
test ecx, ecx
jg 0x434a40
jl 0x434a38
test eax, eax
jae 0x434a40
or eax, 0xffffffff
mov edx, SysReAllocString
add esp, 0x1c
ret

Function at 0x434ff0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x548848]
test eax, eax
je 0x435024
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x435024
mov eax, dword [0x548848]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x548848], 0
ret
Function at 0x438190
Capabilities:
Set registry value

Disassembly:
mov edx, dword [eax]
push ebx
xor ebx, ebx
test edx, edx
je 0x4381cf
mov eax, edi
push esi
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4381a0
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push ecx
push edi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
mov eax, 1
je 0x4381d1
mov eax, ebx
pop ebx
ret 4
Function at 0x43fc60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x43fc70
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x43fc80
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x440150
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x53c1a4]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x4401ca
xor eax, eax
cmp ecx, ebp
je 0x4401b2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x4401d8
cmp ecx, ebp
je 0x44026b
push ecx
jmp 0x440265
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], pe_nt_image_headers32
call esi
test eax, eax
jne 0x44023a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00440150
mov ebx, eax
cmp ebx, ebp
jne 0x440288
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], pe_nt_image_headers32
call esi
test eax, eax
je 0x440200
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x44024d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.004402e0
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x44026b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ea83a
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x440297
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x44026d