joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
lea eax, [esp + 0x10]
push 0x104
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov edi, 0xffffffd5
call fcn.004012c0
add esp, 8
test eax, eax
jne 0x401443
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push str.CLSID_sInprocServer32
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x12c]
push ecx
push 0x80000000
call fcn.00405860
add esp, 0x20
test eax, eax
jne 0x401443
lea edx, [esp + 0xc]
push edx
push esi
push eax
push eax
mov eax, dword [esp + 0x18]
push 0x44b3e2
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401443
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0042689f
add esp, 0x214
ret
mov ecx, dword [esp + 0x218]
mov ax, di
pop edi
pop esi
xor ecx, esp
call fcn.0042689f
add esp, 0x214
ret

Function at 0x4014e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push str.MIMEDatabaseContent_Type_video_quicktime
push 0x80000000
mov dword [esp + 0x20], esi
call fcn.00405860
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x14
test eax, eax
jne 0x40158f
mov eax, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push str.CLSID
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call ebp
test edi, edi
mov dword [esp + 0x10], esi
pop edi
je 0x40157d
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0042689f
add esp, 0x110
ret
lea edx, [esp + 0x14]
push ebx
push edx
call fcn.004269b6
add esp, 8
test eax, eax
je 0x401594
mov esi, 1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40159f
push eax
call ebp
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042689f
add esp, 0x110
ret

Function at 0x401ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareApple_Computer__Inc.QuickTimeActiveX
push 0x80000002
mov dword [esp + 0x14], 0
mov dword [esi], 0
call fcn.00405860
add esp, 0x14
test eax, eax
jne 0x401b1b
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push esi
push eax
push eax
push str.QTTaskRunFlags
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x401b20
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareApple_Computer__Inc.QuickTimeActiveX
push 0x80000002
mov dword [esp + 0x24], 0
call fcn.00405780
add esp, 0x24
test eax, eax
jne 0x401b76
mov edx, dword [esp]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.QTTaskRunFlags
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x401b80
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
mov esi, dword [esp + 0x218]
push 0
push esi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.SoftwareApple_Computer__Inc.QuickTimeInstalled_MIME_Types
push 0x80000002
mov ebx, 1
call fcn.00405780
add esp, 0x24
cmp dword [esi], 0
jne 0x401bce
xor ebx, ebx
push edi
push 0
lea edi, [esi + 4]
push edi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.MIMEDatabaseContent_Type_video_quicktime
push 0x80000000
call fcn.00405780
add esp, 0x24
cmp dword [edi], 0
jne 0x401bfe
xor ebx, ebx
push 0
lea edi, [esi + 8]
push edi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.MIMEDatabaseContent_Typeimage_x_quicktime
push 0x80000000
call fcn.00405780
add esp, 0x24
cmp dword [edi], 0
jne 0x401c2d
xor ebx, ebx
push 0
lea edi, [esi + 0xc]
push edi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.MIMEDatabaseContent_Typeimage_x_macpaint
push 0x80000000
call fcn.00405780
add esp, 0x24
cmp dword [edi], 0
jne 0x401c5c
xor ebx, ebx
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004012c0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push str.CLSID_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
lea edi, [esi + 0x18]
push edi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
lea eax, [esp + 0x140]
push eax
push 0x80000000
call fcn.00405780
add esp, 0x38
cmp dword [edi], 0
jne 0x401cb5
xor ebx, ebx
push 0
lea edi, [esi + 0x10]
push edi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.SoftwareApple_Computer__Inc.QuickTimeQuickTimeUpdateInProgress
push 0x80000002
call fcn.00405780
add esp, 0x24
cmp dword [edi], 0
pop edi
jne 0x401ce5
xor ebx, ebx
push 0
add esi, 0x14
push esi
push 0
push 0x20019
push 0
push 0x44b3e2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00405780
add esp, 0x24
cmp dword [esi], 0
jne 0x401d2b
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042689f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042689f
add esp, 0x20c
ret
Function at 0x401d50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push str.QuickTime.QuickTime
lea eax, [esp + 0x118]
push str._sCLSID
push eax
mov dword [esp + 0x14], 0
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push esi
lea edx, [esp + 0x12c]
push edx
push 0x80000000
call fcn.00405860
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x20
test eax, eax
jne 0x401e30
mov edx, dword [esp + 8]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push 0x44b3e2
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
call ebx
test edi, edi
mov dword [esp + 0xc], esi
pop edi
jne 0x401e3b
lea ecx, [esp + 0x10]
push ecx
push str.MIMEDatabaseContent_Type_video_quicktime
call fcn.004014e0
add esp, 8
test eax, eax
jne 0x401e2b
lea edx, [esp + 0x10]
push edx
push str.MIMEDatabaseContent_Typeimage_x_quicktime
call fcn.004014e0
add esp, 8
test eax, eax
jne 0x401e2b
lea eax, [esp + 0x10]
push eax
push str.MIMEDatabaseContent_Typeimage_x_macpaint
call fcn.004014e0
add esp, 8
test eax, eax
je 0x401e30
mov esi, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x401e3b
push eax
call ebx
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0042689f
add esp, 0x214
ret
Function at 0x401f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4502b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x402051
call fcn.004017b0
cmp eax, 1
jne 0x402051
xor ebx, ebx
cmp dword [0x451544], ebx
jne 0x401fea
push str._atboottime
push edi
call fcn.004258c0
mov esi, eax
add esp, 8
test esi, esi
je 0x401fe2
mov byte [esi], bl
mov al, byte [esi + 1]
add esi, 1
test al, al
je 0x401f9e
lea esp, [esp]
cmp al, 0x2d
je 0x401f9e
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x401f90
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401fa3
sub eax, edx
mov edx, eax
mov eax, esi
lea ebx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401fb5
sub eax, ebx
lea eax, [eax + edx + 1]
call fcn.00426d30
mov ebx, esp
test ebx, ebx
je 0x401ffb
push esi
push edi
push str._s_s
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x401ffb
cmp dword [0x451544], ebx
je 0x401ffb
push edi
push 0x44b690
push 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00426a40
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402051
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esp, [ebp - 0x64]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042689f
mov esp, ebp
pop ebp
ret
Function at 0x402190
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x62c
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x628], eax
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x14], 0
call fcn.00405860
add esp, 0x14
test eax, eax
jne 0x4022d3
mov edx, dword [esp]
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x14]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x104
mov dword [esp + 0x3c], 0x514
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4022c9
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x11c]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
sub eax, 1
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x4022c8
cmp dword [esp + 0xc], 0
jbe 0x402282
push 0x1b
lea ecx, [esp + 0x18]
push str.QuickTime_Update_Completion
push ecx
call fcn.00426e4c
add esp, 0xc
test eax, eax
jne 0x402282
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x402282
lea ecx, [esp + 0x118]
call fcn.00401f30
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x11c]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
sub eax, 1
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x30], 0x514
call esi
test eax, eax
je 0x402243
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.0042689f
add esp, 0x62c
ret

Function at 0x402570
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x4022f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
Function at 0x402590
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x28
mov dword [esp], 0
call fcn.004010a0
push str.__QTTaskMutex__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4026bc
push ebp
push str._QTActiveXRegistryWatcherThreadEnded_
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebp, eax
mov dword [esp + 8], ebp
call fcn.00401110
call fcn.00403a90
cmp eax, 1
jne 0x4025ef
call fcn.00402520
push esi
lea esi, [esp + 8]
call fcn.00401ac0
mov al, byte [esp + 8]
test al, 2
jne 0x4026af
test al, 1
je 0x402616
cmp dword [0x451544], 0
je 0x4026af
push 0x490
call fcn.00426f06
add esp, 4
test eax, eax
je 0x4026af
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, eax
call fcn.00405600
mov esi, eax
test esi, esi
je 0x4026af
push ebx
push edi
push esi
call fcn.00402570
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
add esp, 4
push 0
push 0
push 0
lea edx, [esp + 0x28]
mov ebx, eax
push edx
mov dword [esp + 0x4c], ebx
call edi
test eax, eax
je 0x402698
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x1c]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
call ebp
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
call edi
test eax, eax
jne 0x402671
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x3c]
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
test ebx, ebx
je 0x4026ad
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
test ebp, ebp
pop esi
je 0x4026bb
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, dword [esp + 8]
test eax, eax
je 0x4026cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x28
ret 0x10

Function at 0x402720
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
push 1
push 0
push edx
push 0x80000002
mov dword [esp + 0x18], 0
mov dword [esp + 0x2c], eax
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027c7
mov eax, dword [esp + 4]
test eax, eax
je 0x4027d6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4027c7
cmp byte [esi], al
je 0x4027c7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402781
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x4027c7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402798
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x4027c7
add esi, 0xffffffff
lea ecx, [ecx]
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x4027b0
mov ax, word [0x44b724]
push edi
mov edi, esi
mov word [edi], ax
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x4027d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x402880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
test ebp, ebp
mov dword [esp + 0x10], 0
je 0x4029ad
push esi
push str.WintergreenSDKDir
call fcn.004275a9
add esp, 4
test eax, eax
je 0x4028e1
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4028b1
mov edx, dword [esp + 0x18]
sub ecx, esi
add edx, 0xfffffffc
cmp ecx, edx
jae 0x4028e1
push eax
push str._s_bin
push ebp
call fcn.0042723d
add esp, 0xc
pop esi
mov eax, 1
pop ebp
add esp, 8
ret
push ebx
push edi
push str.SoftwareApple_Inc.Apple_Application_Support
push 0x80000002
lea esi, [esp + 0x18]
mov edi, 0x20019
xor ebx, ebx
call fcn.004026e0
add esp, 8
test eax, eax
jne 0x402948
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push ebx
push ebx
push str.InstallDir
push edx
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402931
cmp dword [esp + 0x1c], ebx
lea esi, [ebx + 1]
jne 0x402933
mov esi, ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
push str.SoftwareApple_Inc.Apple_Software_Support
push 0x80000002
lea esi, [esp + 0x18]
xor ebx, ebx
call fcn.004026e0
add esp, 8
test eax, eax
jne 0x4029a8
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
push eax
mov eax, dword [esp + 0x20]
push str.InstallDir
push eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402991
cmp dword [esp + 0x1c], ebx
lea esi, [ebx + 1]
jne 0x402993
mov esi, ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x402ae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call fcn.00426a40
add esp, 0xc
push str.QTCF.dll
mov dword [esp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x402bd0
push esi
push edi
push str.SoftwareApple_Computer__Inc.QuickTime
push 0x80000002
lea esi, [esp + 0x18]
mov edi, 0x20019
call fcn.004026e0
add esp, 8
test eax, eax
jne 0x402bce
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.QTSysDir
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402bc3
cmp dword [esp + 0xc], ebx
je 0x402bc3
lea eax, [esp + 0x14]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402b80
sub eax, edx
push str.PATH
mov esi, eax
call fcn.004275a9
lea esi, [esp + esi + 0x17]
add esp, 4
cmp byte [esi], 0x5c
jne 0x402ba5
mov byte [esi], bl
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.004258c0
add esp, 8
test eax, eax
jne 0x402bc3
lea ebx, [esp + 0x14]
mov byte [esi], 0x5c
call fcn.004027e0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [esp + 0x110]
pop ebx
xor ecx, esp
call fcn.0042689f
add esp, 0x110
ret
Function at 0x402c10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x110]
xor eax, eax
test esi, esi
je 0x402d94
test ecx, ecx
mov byte [esi], al
je 0x402c45
mov dword [ecx], eax
push ebx
push edi
push str.QuickTime.qts
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov ebx, dword [esp + 0x11c]
je 0x402cb1
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x402cb1
lea eax, [esp + 0xc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402c80
sub eax, edx
lea edi, [eax - 0xd]
test edi, edi
jbe 0x402cb1
lea edx, [edi + 1]
cmp ebx, edx
jbe 0x402cb1
push edi
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00427890
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x402d38
cmp byte [esi], 0
jne 0x402d3d
push ebx
push esi
push str.QTSysDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402720
add esp, 0x10
cmp byte [esi], 0
je 0x402ce2
push 0
push esi
call fcn.00427871
add esp, 8
test eax, eax
je 0x402ce5
mov byte [esi], 0
cmp byte [esi], 0
jne 0x402d3d
push ebx
push esi
push str.QuickTime.qts_folder
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402720
add esp, 0x10
cmp byte [esi], 0
je 0x402d12
push 0
push esi
call fcn.00427871
add esp, 8
test eax, eax
je 0x402d15
mov byte [esi], 0
cmp byte [esi], 0
jne 0x402d3d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x402d35
push 0
push esi
call fcn.00427871
add esp, 8
test eax, eax
je 0x402d38
mov byte [esi], 0
cmp byte [esi], 0
je 0x402d8b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402d42
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x402d8b
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402d60
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x402d8b
mov edi, esi
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x402d77
mov cx, word [0x44b724]
mov word [edi], cx
xor eax, eax
cmp byte [esi], al
pop edi
setne al
pop ebx
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0042689f
add esp, 0x108
ret
Function at 0x402de0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push esi
mov esi, dword [esp + 0x21c]
push esi
push ebx
push str.QTExtDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00402720
add esp, 0x10
cmp byte [ebx], 0
jne 0x402f2f
add esi, 0xfffffff6
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10c]
push esi
push ecx
call fcn.00402db0
add esp, 8
cmp byte [esp + 0x10c], 0
je 0x402f2f
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402e56
sub eax, edx
cmp byte [esp + eax + 7], 0x5c
je 0x402ea5
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402e70
sub eax, edx
cmp byte [esp + eax + 7], 0x2f
je 0x402ea5
push edi
lea edi, [esp + 0xc]
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x402e90
mov dx, word [0x44b724]
mov word [edi], dx
pop edi
lea eax, [esp + 0x10c]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402eb2
lea edx, [esp + 0x10c]
lea ecx, [esp + 8]
lea esp, [esp]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402ef0
test al, al
je 0x402eec
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402ef0
add ecx, 2
add edx, 2
test al, al
jne 0x402ed0
xor eax, eax
jmp 0x402ef5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402f2f
mov eax, ebx
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x402f00
mov edx, dword [str.QuickTime_]
mov dword [eax], edx
mov ecx, dword [0x44b844]
mov dword [eax + 4], ecx
mov dx, word [0x44b848]
mov word [eax + 8], dx
mov cl, byte [0x44b84a]
mov byte [eax + 0xa], cl
mov eax, ebx
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402f36
mov ecx, dword [esp + 0x208]
xor ecx, esp
sub eax, edx
call fcn.0042689f
add esp, 0x20c
ret

Function at 0x4031e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4502b4]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push 0x90
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00426a40
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
cmp eax, 5
jbe 0x40322b
mov esi, 1
jne 0x403239
cmp dword [esp + 0xc], 1
mov eax, 1
jae 0x40323b
mov eax, esi
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
call fcn.0042689f
add esp, 0x98
ret