joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x834
mov eax, dword [0x46c3ac]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x838], eax
push edi
je 0x415083
push str.ItemSelect
mov ecx, ebx
call fcn.0041e570
push str.true
push eax
call fcn.00432272
add esp, 8
test eax, eax
jne 0x415083
mov word [esp + 0x18], si
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], si
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], si
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x428], si
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
push str.ItemSoft
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0041e570
push str.ItemSysMbStructVer
mov ecx, ebx
mov dword [esp + 0x14], eax
call fcn.0041e570
push str.ItemSysMbNewVer
mov ecx, ebx
mov edi, eax
call fcn.0041e570
push str.ItemSysMbMinVer
mov ecx, ebx
mov dword [esp + 0x10], eax
call fcn.0041e570
mov ecx, dword [0x46d488]
mov dword [esp + 0x14], eax
call fcn.0040c720
mov esi, eax
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
cmp ecx, 1
jle 0x414f77
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032c0
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
push edx
lea eax, [esp + 0x20]
push str._s_smbmb.ini
push eax
call fcn.004322a4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
push 0x104
lea edx, [esp + 0x430]
push edx
push 0x457084
push str.SysMbVer
push str.Struct
call esi
lea eax, [esp + 0x18]
push eax
push 0x104
lea ecx, [esp + 0x228]
push ecx
push 0x457084
push str.NewVer
push str.Globals
call esi
lea edx, [esp + 0x18]
push edx
push 0x104
lea eax, [esp + 0x638]
push eax
push 0x457084
push 0x45906c
push str.Globals
call esi
test edi, edi
je 0x415031
lea ecx, [esp + 0x428]
push edi
push ecx
call fcn.00432272
add esp, 8
test eax, eax
mov ecx, ebx
jne 0x415022
push str.false
jmp 0x415027
push str.true
push str.ItemModifySysMbStruct
call fcn.0041e950
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415083
mov esi, dword [esp + 0x14]
test esi, esi
je 0x415083
push eax
lea edx, [esp + 0x224]
push edx
call fcn.00432272
add esp, 8
test eax, eax
jne 0x41506b
lea eax, [esp + 0x630]
push esi
push eax
call fcn.00432272
add esp, 8
test eax, eax
je 0x415072
push str.true
jmp 0x415077
push str.false
mov ecx, ebx
push str.ItemModifySysMbVer
call fcn.0041e950
mov ecx, dword [esp + 0x83c]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416ae0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x46c3ac]
push esi
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416b6d
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push 0x45975c
push eax
mov dword [esp + 0x24], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416b5e
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x416b81
xor eax, eax
mov ecx, dword [esp + 0x21c]
call fcn.00431d98
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x21c]
neg eax
sbb eax, eax
neg eax
call fcn.00431d98
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417520
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46c3ac]
push edi
mov dword [esp + 0x214], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41759f
push 0x104
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 8]
push eax
push str._.8X
push ecx
call fcn.004322a4
add esp, 0xc
mov ecx, dword [esp + 0x214]
call fcn.00431d98
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x417fd0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x46c3ac]
mov dword [esp + 0xa38], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov esi, ecx
mov word [esp + 0x838], bx
mov ecx, 0x81
lea edi, [esp + 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x428], bx
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], bx
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], bx
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x18], bx
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1a
lea eax, [esp + 0x840]
push eax
push ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call edi
lea ecx, [esp + 0x838]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004323fb
lea eax, [esp + 0x20]
push eax
call fcn.00432636
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.004329eb
add esp, 0x14
cmp eax, ebx
je 0x4181cf
lea edx, [esp + 0x18]
mov word [eax], bx
push edx
lea eax, [esp + 0x42c]
push eax
call fcn.004323fb
lea ecx, [esp + 0x430]
push str.Local
push ecx
call fcn.004323d1
add esp, 0x10
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418102
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push ecx
call fcn.004323fb
lea edx, [esp + 0x228]
push str.LocalLow
push edx
call fcn.004323d1
add esp, 0x10
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418143
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.004323fb
lea eax, [esp + 0x638]
push str.Roaming
push eax
call fcn.004323d1
add esp, 0x10
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 1
jne 0x418185
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ebx
je 0x4181cf
cmp dword [esp + 0xc], ebx
je 0x4181cf
cmp eax, ebx
je 0x4181cf
mov ecx, esi
call fcn.00403f70
test eax, eax
je 0x4181cf
lea edx, [esp + 0x220]
push edx
push esi
call fcn.004323fb
push 0x4570f8
push esi
call fcn.004323d1
add esp, 0x10
mov ecx, dword [esp + 0xa44]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x1a
push esi
push ebx
call edi
push 0x4570f8
push esi
call fcn.004323d1
mov ecx, dword [esp + 0xa4c]
add esp, 8
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418200
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454ac6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
mov eax, dword [0x46c3ac]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
mov dword [esp + 0x14], ecx
call fcn.0044b872
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 0x43c], edi
call fcn.0044b872
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov word [esp + 0x18], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x20]
push eax
push 0
mov byte [esp + 0x44c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41832a
lea ecx, [esp + 0x18]
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.004323d1
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push 0x457ae0
push eax
call fcn.00403960
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41832a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x14]
push str.__sProgram_FilesInternet_Exploreriexplore.exe_
push eax
mov word [esp + 0x232], 0
call fcn.00403960
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push str._HOMEDRIVE__HOMEPATH_
push 0
push 1
push 0x457a18
push ebx
push esi
call fcn.0040ba40
add ebx, 0xfffffff0
mov byte [esp + 0x43c], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41834c
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x43c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418371
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
mov eax, 1
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4183a0
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4183cb
xor eax, eax
pop edi
pop ecx
ret 4
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.00432636
mov ecx, dword [esp + 0xc]
add esp, 4
shl eax, 1
push eax
push esi
push 1
push 0
push 0x4578f8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00418200
pop esi
mov eax, 1
pop edi
pop ecx
ret 4
Function at 0x418a20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x630
mov eax, dword [0x46c3ac]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [esp + 0x634], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
je 0x418a77
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x418adf
mov edx, dword [ebp + 0x14]
push edx
lea eax, [esp + 0x1c]
push 0x456f48
push eax
call fcn.004322a4
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x24]
push edx
push eax
call esi
test eax, eax
jne 0x418abf
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0xc]
jmp 0x418bac
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call edi
test eax, eax
je 0x418af5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x634]
call fcn.00431d98
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
xor eax, eax
mov word [esp + 0x220], 0
mov ecx, 0x103
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
push ecx
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x228]
push 0x45706c
push eax
mov dword [esp + 0x24], 3
call fcn.004322a4
mov esi, dword [ebp + 0x10]
push esi
call fcn.00432636
mov ecx, dword [esp + 0x20]
add esp, 0x14
shl eax, 1
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.AppName
push ecx
call esi
lea edx, [esp + 0x220]
push edx
call fcn.00432636
mov ecx, dword [esp + 0x10]
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x224]
push eax
push 1
push 0
push str.AppPath
push ecx
call esi
mov eax, dword [esp + 0xc]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Policy
push eax
call esi
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x634]
mov eax, 1
call fcn.00431d98
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418bd0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x418bf0
xor eax, eax
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418bea
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x418d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x46c3ac]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
lea eax, [esp + 0x10]
push eax
push str.WnSkinFile
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x418f1e
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push str.WnSkinFile
push 1
push 0x457084
push ecx
call ebx
mov edx, dword [0x46d488]
mov word [esp + 0x220], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [edx + 8]
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
cmp ecx, 1
jle 0x418e29
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032c0
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x224]
push str._swnimeWnSkinReg.exe
push edx
call fcn.004322a4
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x104
lea eax, [esp + 0x224]
push eax
push 1
push str.DefaultIcon
push ecx
call ebx
mov edx, dword [0x46d488]
mov word [esp + 0x18], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [edx + 8]
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
cmp ecx, 1
jle 0x418e9d
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032c0
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x1c]
push str.__swnimeWnSkinReg.exe___install
push edx
call fcn.004322a4
lea eax, [esp + 0x24]
push 0x45a1c4
push eax
call fcn.004323d1
mov edx, dword [esp + 0x24]
add esp, 0x14
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 1
push str.shellopencommand_
push edx
call ebx
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
push str..wnpf
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x418f1e
mov edx, dword [esp + 0x14]
push 0x104
push str.WnSkinFile
push 1
push 0x457084
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x42c]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418f40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x46c3ac]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
lea eax, [esp + 0x10]
push eax
push str.WgSkinFile
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4190ce
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push str.WgSkinFile
push 1
push 0x457084
push ecx
call ebx
mov edx, dword [0x46d488]
mov word [esp + 0x220], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [edx + 8]
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
cmp ecx, 1
jle 0x418fd9
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032c0
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x224]
push str._swnwgWgSkinReg.exe
push edx
call fcn.004322a4
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x104
lea eax, [esp + 0x224]
push eax
push 1
push str.DefaultIcon
push ecx
call ebx
mov edx, dword [0x46d488]
mov word [esp + 0x18], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [edx + 8]
mov eax, dword [esi + 0x278]
mov ecx, dword [eax - 4]
add esi, 0x278
sub eax, 0x10
cmp ecx, 1
jle 0x41904d
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004032c0
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x1c]
push str.__swnwgWgSkinReg.exe_
push edx
call fcn.004322a4
lea eax, [esp + 0x24]
push 0x45a1c4
push eax
call fcn.004323d1
mov edx, dword [esp + 0x24]
add esp, 0x14
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 1
push str.shellopencommand_
push edx
call ebx
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
push str..wgpf
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4190ce
mov edx, dword [esp + 0x14]
push 0x104
push str.WgSkinFile
push 1
push 0x457084
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x42c]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4194f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
mov eax, dword [0x46c3ac]
push ebx
mov dword [esp + 0x624], eax
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
xor edx, edx
mov word [esp + 0x218], dx
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x420], dx
mov ecx, 0x81
lea edi, [esp + 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x10], dx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
push str.ItemInstallPath
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0041e570
push eax
lea eax, [esp + 0x21c]
push eax
call fcn.004323fb
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x42c]
push edx
call fcn.004323fb
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + 4]
mov ecx, dword [eax + 8]
add esp, 0x10
cmp esi, ecx
je 0x4195da
jmp 0x4195a0
mov edi, dword [esi]
lea eax, [esp + 0x420]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004323fb
lea edx, [esp + 0x18]
push edi
push edx
call fcn.004323d1
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 8]
add esi, 4
cmp esi, eax
jne 0x4195a0
mov ecx, dword [esp + 0x62c]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4195f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x46c3ac]
push ebx
push esi
push edi
mov dword [esp + 0x844], eax
lea eax, [esp + 0x1c]
push eax
push 0xf003f
xor esi, esi
push esi
push str.software
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4197ea
mov edx, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x1c]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push str.ShiQiang
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4197ea
mov word [esp + 0x20], si
mov ecx, 0x81
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x430], si
mov ecx, 0x81
lea edi, [esp + 0x432]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x228], si
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x46d488]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x28c]
mov edi, dword [eax + 8]
cmp edi, dword [eax + 0xc]
mov dword [esp + 0x10], edi
je 0x4197ea
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [edi + 0x1c]
lea edx, [esp + 0x20]
push edx
push str.ItemSelect
mov ecx, esi
call fcn.0041e490
test eax, eax
je 0x4197c9
lea eax, [esp + 0x20]
push str.false
push eax
call fcn.00432272
add esp, 8
test eax, eax
je 0x4197c9
lea ecx, [esp + 0x430]
push ecx
push str.ItemSoft
mov ecx, esi
call fcn.0041e490
test eax, eax
je 0x4197c9
lea edx, [esp + 0x228]
push edx
push str.ItemSoftPath
mov ecx, esi
call fcn.0041e490
test eax, eax
je 0x4197c9
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [esp + 0x44c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4197c9
mov word [esp + 0x638], ax
mov ecx, 0x81
lea edi, [esp + 0x63a]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46d488]
stosw word es:[edi], ax
lea eax, [esp + 0x228]
push eax
call fcn.0040c720
mov ecx, eax
add ecx, 0x278
call fcn.0040bc30
push eax
lea ecx, [esp + 0x640]
push str._s_s_
push ecx
call fcn.004322a4
mov eax, dword [esp + 0x24]
add esp, 0x10
push 0x104
lea edx, [esp + 0x63c]
push edx
push 1
push 0
push str.InstallPath
push eax
call ebx
mov edi, dword [esp + 0x10]
mov ecx, dword [0x46d488]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x28c]
mov ecx, dword [eax + 0xc]
add edi, 0x20
cmp edi, ecx
mov dword [esp + 0x10], edi
jne 0x4196c1
mov ecx, dword [esp + 0x844]
call fcn.00431d98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret