joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e40
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4431f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.00417a00
lea ecx, [esp + 0x2c]
push ecx
mov ebx, str.iconAnimate.exe
lea esi, [esp + 0x14]
mov dword [esp + 0x58], 0
call fcn.00413280
add esp, 8
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.00405100
mov esi, 8
cmp dword [esp + 0x24], esi
jb 0x410ec2
mov edx, dword [esp + 0x10]
push edx
call fcn.00428b9c
add esp, 4
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x410ed0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410efa
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x410ee9
lea eax, [esp + 0x2c]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x40], esi
jb 0x410f0d
mov eax, dword [esp + 0x2c]
push eax
call fcn.00428b9c
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00428ba7
add esp, 0x48
ret

Function at 0x410f90
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410fc2
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.004051f0
push str._uninstallsucc
mov ebx, 0xe
xor eax, eax
mov edx, esi
call fcn.00404f10
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x411008
mov edx, dword [esp + 0xc]
push edx
call fcn.00428b9c
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00428ba7
add esp, 0x20
ret

Function at 0x411020
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x411052
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.004051f0
push str._setupsucc
mov ebx, 0xa
xor eax, eax
mov edx, esi
call fcn.00404f10
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x411098
mov edx, dword [esp + 0xc]
push edx
call fcn.00428b9c
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00428ba7
add esp, 0x20
ret
Function at 0x411310
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x411342
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.004051f0
push str._ShowDeskTop
mov ebx, 0xc
xor eax, eax
mov edx, esi
call fcn.00404f10
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x411388
mov edx, dword [esp + 0xc]
push edx
call fcn.00428b9c
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00428ba7
add esp, 0x20
ret

Function at 0x411850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x443c92
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x448edc
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00412770
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00412f00
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x457c4c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov ebx, esi
mov byte [esp + 0x24], 2
call fcn.00412810
test eax, eax
jne 0x411955
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x411943
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x411955
push 0
call fcn.004148a0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x412f00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x441b2b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00427881
push 4
mov dword [esp + 0x20], 0
call fcn.00429000
mov edi, eax
add esp, 4
test edi, edi
je 0x412f7e
call fcn.00427beb
mov dword [edi], eax
call fcn.00427a19
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00427842
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x412f73
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042786a
jmp 0x412f80
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x413280
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4424f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00405100
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4132d6
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x14]
call fcn.00413710
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00405100
cmp dword [esp + 0x24], 8
jb 0x41331e
mov edx, dword [esp + 0x10]
push edx
call fcn.00428b9c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4161d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x4161e0
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4161f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4166e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x41675a
xor eax, eax
cmp ecx, ebp
je 0x416742
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x416768
cmp ecx, ebp
je 0x4167fb
push ecx
jmp 0x4167f5
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x4167ca
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.004166e0
mov ebx, eax
cmp ebx, ebp
jne 0x416818
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x416790
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4167dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.00416890
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4167fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00428ba7
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x416827
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4167fd
Function at 0x417310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x4430f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4531a0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x41738f
call fcn.0040af90
mov esi, eax
jmp 0x417471
mov eax, dword [ebp - 0x14]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4173ab
call fcn.0040af90
jmp 0x417468
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x4173c4
call fcn.0040af90
jmp 0x417468
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jae 0x4173f8
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x4173e6
lea eax, [ebp]
call fcn.00415ad0
lea esi, [ebp - 0x1c]
call fcn.00402230
mov eax, 0x8007000e
jmp 0x417483
mov eax, ecx
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.00415af0
mov dword [ebp - 4], 1
jmp 0x417421
mov ecx, dword [ebp]
cmp ecx, ebx
jne 0x41742f
mov esi, 0x8007000e
jmp 0x41746a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push eax
push edx
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x41744d
call fcn.0040af90
jmp 0x417468
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.004171c0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x417481
lea eax, [ebp]
call fcn.00415ad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00428ba7
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4179c0
Capabilities:
Create process on windows

Disassembly:
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push esi
push str.iexplore
push str.open
push 0
call edi
cmp eax, 0x20
jg 0x4179f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
push 0
push 0
push esi
push str.open
push 0
call edi
pop edi
ret
Function at 0x417a00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4430ac
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
xor ebx, ebx
mov eax, 1
mov dword [esp + 0x30], ebx
test byte [0x457e2c], al
jne 0x417a80
or dword [0x457e2c], eax
xor eax, eax
push 0x4447a0
mov dword [0x457e28], 7
mov dword [0x457e24], ebx
mov word [0x457e14], ax
call fcn.0042a253
add esp, 4
cmp dword [0x457e24], ebx
je 0x417aa0
xor ecx, ecx
push 0xffffffffffffffff
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], cx
push ebx
jmp 0x417c3d
push ebx
push 0x1a
lea edx, [esp + 0x58]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x50]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x417ab6
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x54]
mov esi, 0x457e10
call fcn.004051f0
mov edi, esi
lea eax, [esp + 0x14]
call fcn.004177a0
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov dword [esp + 0x26c], ebx
call fcn.00405100
mov edi, 8
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x417b13
mov eax, dword [esp + 0x18]
push eax
call fcn.00428b9c
add esp, 4
push 0x457e10
mov ebx, str.2345_
lea esi, [esp + 0x18]
call fcn.00413280
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457e10
mov dword [esp + 0x26c], 1
call fcn.00405100
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x417b60
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00428b9c
add esp, 4
push 0x457e10
mov ebx, 0x449660
lea esi, [esp + 0x18]
call fcn.00413280
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457e10
mov dword [esp + 0x26c], 2
call fcn.00405100
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x417bad
mov edx, dword [esp + 0x18]
push edx
call fcn.00428b9c
add esp, 4
push 0x457e10
mov ebx, 0x4495cc
lea esi, [esp + 0x38]
call fcn.00413280
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457e10
mov dword [esp + 0x26c], 3
call fcn.00405100
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x4c], edi
jb 0x417bfa
mov eax, dword [esp + 0x38]
push eax
call fcn.00428b9c
add esp, 4
xor ecx, ecx
cmp dword [0x457e28], edi
mov edi, dword [0x457e14]
mov esi, 7
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
mov word [esp + 0x38], cx
jae 0x417c25
mov edi, 0x457e14
call fcn.00417c80
xor edx, edx
push 0xffffffffffffffff
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], 0
mov word [ebp + 4], dx
push edx
mov eax, 0x457e10
mov ecx, ebp
call fcn.00405100
mov eax, ebp
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00428ba7
add esp, 0x254
ret
Function at 0x417c80
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x442478
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
cmp edi, ebx
je 0x417d3d
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebp
xor eax, eax
mov word [esp + 0x30], ax
mov eax, edi
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x417ce0
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x30]
call fcn.004051f0
mov dword [esp + 0x54], ebx
push 0x4495cc
mov ebx, 1
xor eax, eax
mov edx, esi
call fcn.00404f10
mov esi, eax
cmp esi, 0xffffffff
jne 0x417d44
push edi
call ebp
test eax, eax
jne 0x417dd0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417dd0
lea esi, [esp + 0x2c]
call fcn.00404a40
xor al, al
jmp 0x417dfd
lea ecx, [esp + 0x2c]
lea ebp, [esi + 1]
push ecx
mov ecx, ebp
xor edx, edx
lea esi, [esp + 0x14]
call fcn.0040e1f0
mov eax, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x417d6c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417d96
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x417d85
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x417e1b
push 0x4495cc
mov ebx, 1
mov eax, ebp
lea edx, [esp + 0x30]
call fcn.00404f10
cmp dword [esp + 0x28], 8
mov esi, eax
jb 0x417dc1
mov edx, dword [esp + 0x14]
push edx
call fcn.00428b9c
add esp, 4
cmp esi, 0xffffffff
jne 0x417d44
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebp
test eax, eax
jne 0x417de7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x417d34
cmp dword [esp + 0x44], 8
jb 0x417dfb
mov eax, dword [esp + 0x30]
push eax
call fcn.00428b9c
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00428ba7
add esp, 0x48
ret
cmp dword [esp + 0x28], esi
jb 0x417e2e
mov eax, dword [esp + 0x14]
push eax
call fcn.00428b9c
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp dword [esp + 0x44], esi
jb 0x417e58
mov edx, dword [esp + 0x30]
push edx
call fcn.00428b9c
add esp, 4
xor al, al
jmp 0x417dfd
Function at 0x417ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443731
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
call fcn.00417e60
mov dword [esp + 0x38], 0
push edi
mov ebx, str.LastUpgrade.ini
lea esi, [esp + 0x18]
mov dword [esp + 0x10], 1
call fcn.00413280
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.00405100
cmp dword [esp + 0x2c], 8
jb 0x417f69
mov eax, dword [esp + 0x18]
push eax
call fcn.00428b9c
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x417f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443731
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
call fcn.00417e60
mov dword [esp + 0x38], 0
push edi
mov ebx, str.2345LanderUpgrade.exe
lea esi, [esp + 0x18]
mov dword [esp + 0x10], 1
call fcn.00413280
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.00405100
cmp dword [esp + 0x2c], 8
jb 0x418009
mov eax, dword [esp + 0x18]
push eax
call fcn.00428b9c
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x418090
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4436db
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x10], ebp
mov ebx, 3
mov dword [esp + 0x244], ebx
cmp dword [esp + 0x2b4], ebp
jne 0x418126
lea esi, [esp + 0x14]
call fcn.00418020
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x2a8]
mov byte [esp + 0x24c], 4
call fcn.00405100
mov byte [esp + 0x244], bl
mov ebx, 8
cmp dword [esp + 0x2c], ebx
jb 0x41812b
mov eax, dword [esp + 0x18]
push eax
call fcn.00428b9c
add esp, 4
jmp 0x41812b
mov ebx, 8
push 0x206
lea edx, [esp + 0x36]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x3c], cx
call fcn.0042ccb0
mov esi, dword [esp + 0x2b0]
add esp, 0xc
cmp dword [esp + 0x2b8], ebx
jae 0x41815c
lea esi, [esp + 0x2a4]
mov edx, dword [esp + 0x288]
cmp dword [esp + 0x29c], ebx
jae 0x418173
lea edx, [esp + 0x288]
mov ecx, dword [esp + 0x26c]
cmp dword [esp + 0x280], ebx
jae 0x41818a
lea ecx, [esp + 0x26c]
mov eax, dword [esp + 0x250]
cmp dword [esp + 0x264], ebx
jae 0x4181a1
lea eax, [esp + 0x250]
push esi
push 0x104
lea esi, [esp + 0x38]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, 7
xor eax, eax
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebp
mov word [edi + 4], ax
mov eax, esi
lea edx, [eax + 2]
jmp 0x4181d0
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4181d0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x34]
mov esi, edi
call fcn.004051f0
mov esi, 8
cmp dword [esp + 0x264], esi
jb 0x418209
mov ecx, dword [esp + 0x250]
push ecx
call fcn.00428b9c
add esp, 4
xor edx, edx
mov dword [esp + 0x264], ebx
mov dword [esp + 0x260], ebp
mov word [esp + 0x250], dx
cmp dword [esp + 0x280], esi
jb 0x41823a
mov eax, dword [esp + 0x26c]
push eax
call fcn.00428b9c
add esp, 4
xor ecx, ecx
mov dword [esp + 0x280], ebx
mov dword [esp + 0x27c], ebp
mov word [esp + 0x26c], cx
cmp dword [esp + 0x29c], esi
jb 0x41826b
mov edx, dword [esp + 0x288]
push edx
call fcn.00428b9c
add esp, 4
xor eax, eax
mov dword [esp + 0x29c], ebx
mov dword [esp + 0x298], ebp
mov word [esp + 0x288], ax
cmp dword [esp + 0x2b8], esi
jb 0x41829c
mov ecx, dword [esp + 0x2a4]
push ecx
call fcn.00428b9c
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00428ba7
add esp, 0x238
ret