joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x218
mov esi, dword [sym.imp.user32.dll_ShowWindow]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 8]
sub esp, 8
test byte [eax + 4], 0x10
jne 0x10001398
mov eax, dword [ebx + 0x14]
mov dword [esp + 4], 5
lea edi, [ebp - 0x214]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x18]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x30]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x24]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xf1
mov dword [esp], eax
call esi
mov eax, dword [section..bss]
sub esp, 0x10
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], edi
mov dword [esp + 4], 0x66
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x100013b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x28]
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
sub esp, 8
jmp 0x100012fa
mov eax, dword [ebx + 0x34]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
call esi
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100016c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x110]
push ebx
mov ebx, edx
sub esp, 0x18c
mov dword [ebp - 0x164], eax
mov eax, dword [edx]
mov dword [esp + 0xc], esi
mov edi, dword [sym.imp.user32.dll_SendMessageA]
mov dword [ebp - 0x168], 0x58
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0x10009000
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], eax
call edi
mov eax, dword [section..bss]
mov dword [ebp - 0x14c], esi
lea esi, [ebp - 0x188]
mov dword [ebp - 0x148], 0x104
sub esp, 0x10
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], esi
mov dword [esp + 4], 0x67
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringA]
lea eax, [ebp - 0x168]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], 0x281004
sub esp, 0x10
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [esp], eax
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
sub esp, 4
test eax, eax
jne 0x100017f8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x14c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001b90
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags
Hide graphical window
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov esi, dword [sym.imp.user32.dll_ShowWindow]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x28]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x14]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x18]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x30]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x2c]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xf1
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [ebx + 4]
sub esp, 0x10
test eax, eax
je 0x10001c60
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp sym._UIINSERTOBJECTDLG_PopulateObjectTypes

Function at 0x10002010
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov esi, dword [sym.imp.user32.dll_ShowWindow]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x18]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x2c]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x30]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 8]
sub esp, 8
test byte [eax + 4], 0x10
jne 0x100020e0
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
sub esp, 8
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x20]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xf1
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [ebx + 4]
sub esp, 0x10
test eax, eax
je 0x100020f8
lea esp, [ebp - 8]
lea edx, [ebx + 0x34]
lea eax, [ebx + 0x10]
pop ebx
pop esi
pop ebp
jmp sym._UIINSERTOBJECTDLG_SelChange.isra.0
mov eax, dword [ebx + 0x28]
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
sub esp, 8
jmp 0x10002075
mov eax, ebx
call sym._UIINSERTOBJECTDLG_PopulateObjectTypes
jmp 0x100020c9
Function at 0x10002450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x1c]
test edx, edx
je 0x10002548
test byte [0x10007018], 1
jne 0x10002518
mov eax, dword [section..bss]
mov dword [esp + 8], 5
mov dword [esp + 4], 0x81
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceA]
sub esp, 0xc
test eax, eax
je 0x10002570
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x10002560
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
sub esp, 4
test eax, eax
je 0x10002560
lea edx, [ebp - 0x3c]
mov dword [esp + 0xc], sym._UIInsertObjectDlgProc_16
mov dword [esp + 0x10], edx
mov edx, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxIndirectParamA]
mov edx, 0x70
mov ebx, dword [ebp - 4]
sub esp, 0x14
cmp eax, 0xffffffff
leave
cmove eax, edx
ret 4
mov dword [esp + 0xc], str.Customized_template_not_supported_n
mov dword [esp + 8], str.OleUIInsertObjectA
mov dword [esp + 4], 0x10007018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002472
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x10002465
jmp 0x10002472
mov ebx, dword [ebp - 4]
mov eax, 0x6f
leave
ret 4
mov ebx, dword [ebp - 4]
mov eax, 0x6e
leave
ret 4
Function at 0x100035c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38
mov ebx, dword [ebp + 0xc]
test byte [0x10007028], 8
jne 0x100036f0
test ebx, ebx
je 0x1000367a
mov dword [esp + 0x14], 0
mov edi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov edx, eax
sub esp, 0x18
lea esi, [edx + edx]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1000375c
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov ebx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0x18
mov eax, dword [ebp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.oledlg.dll_OleUIAddVerbMenuW
sub esp, 0x24
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov eax, ebx
call sym._wine_dbgstr_an.constprop.0
mov ecx, dword [ebp + 0x28]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0xc], str.__p___s___p___d___d___d___d___d___p__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0x24]
mov dword [esp + 0x24], edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 8], 0x100093bc
mov dword [esp + 0x18], ecx
mov dword [esp + 4], 0x10007028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100035d9
xor ebx, ebx
jmp 0x1000367a
Function at 0x10004490
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [ebp - 0x14], edx
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0x1fb
mov dword [esp], eax
call esi
sub esp, 8
mov edi, eax
mov dword [esp], ebx
mov dword [esp + 4], 0x1fa
call esi
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x1fc
call esi
mov edx, dword [ebp - 0x14]
sub esp, 8
mov esi, eax
and dword [edx], 0xfffffff7
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1fa
call dword [sym.imp.user32.dll_CheckDlgButton]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.user32.dll_EnableWindow]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], 0
call ebx
mov edx, dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
mov dword [ebp - 0x10], edx
mov dword [esp], edi
mov dword [esp + 4], 0
call edx
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0
call ebx
mov edx, dword [ebp - 0x10]
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0
call edx
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0
call ebx
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10005f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10005fd8
cmp byte [esi + ebx - 1], 0xa
je 0x10005fac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10006600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100067d8
mov edi, dword [0x1000b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100066e7
test byte [0x10007050], 8
jne 0x10006780
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10007060], 8
jne 0x10006740
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10006689
cmp esi, 3
jbe 0x100066f8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000669a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10009a28]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10006689
mov dword [esp], 0x10007060
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10006660
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10006660
mov dword [esp], 0x10007050
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000664b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10006653
mov eax, 0xffffffff
jmp 0x100066e7
Function at 0x4059c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4059d2
pop dword [ebp - 0x30]
mov eax, 0xbd30bd00
sub eax, 0xbcf0632e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x46d61aa1
add dword [ebp - 0x40], 0x77c2aaa
mov dword [ebp - 0x3c], 0x3e9be761
sub dword [ebp - 0x3c], 0xc689b1c
mov dword [ebp - 0x38], 0xe077c818
sub dword [ebp - 0x38], 0x942b83ea
mov dword [ebp - 0x34], 0x294fe747
add dword [ebp - 0x34], 0xd6b018b9
lea eax, [ebp - 0x40]
push eax
mov eax, 0xc368b00d
sub eax, 0xc324ede1
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4e22d780
sub dword [ebp - 0x40], 0xd9b06e2a
mov dword [ebp - 0x3c], 0x3d0c3e48
sub dword [ebp - 0x3c], 0xfb9fdcd3
mov dword [ebp - 0x38], 0x53b9298a
sub dword [ebp - 0x38], 0xf049bd1e
mov dword [ebp - 0x34], 0xdea20d10
sub dword [ebp - 0x34], 0xdea20d10
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x567535f2
sub eax, 0x56317302
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x48fb0
push 0
call eax
mov ecx, 0x59d4b4e2
add ecx, 0xa62b9f78
xor ebx, ebx
add ebx, eax
mov esi, 0x7f0e7c30
sub esi, 0x7ec72630
add esi, dword [ebp - 0x30]
mov edi, 0xe43b93e7
add edi, 0x811db51b
xor dword [ebp - 0x28], 0x7f8366d8
mov edx, dword [esi]
xor dword [ebp - 0x1c], edx
add edx, edi
mov dword [ebp - 0x18], 0x87ce8c73
mov dword [ebx], edx
mov dword [ebp - 0x10], 0xb9cfcb7b
add ebx, 0x62c58fef
sub ebx, 0x62c58feb
add esi, 4
loop 0x405af6
add eax, 0xee30264e
sub eax, 0xee2ee213
xor ebx, ebx
add ebx, eax
add eax, 0xe8744253
add eax, 0x178bbdb2
mov ecx, 0x66cfd4c2
add ecx, 0x99702b3e
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x405c41
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x43aa02
call fcn.00421920
mov esi, ecx
push 0
lea edi, [esi + 8]
push str.http:__
mov ecx, edi
call main
test eax, eax
je 0x405c7a
push 0
push str.ftp:__
mov ecx, edi
call main
test eax, eax
jne 0x405d0d
push 0x2f
push dword [edi]
call main
pop ecx
pop ecx
test eax, eax
jne 0x405c8e
or eax, 0xffffffff
jmp 0x405c92
sub eax, dword [edi]
sar eax, 1
lea ebx, [eax + 1]
mov eax, dword [edi]
cmp ebx, dword [eax - 0xc]
jne 0x405ca5
mov ecx, edi
call fcn.00401451
jmp 0x405d0d
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 1
push edi
call main
add esi, 0x14
push 0x104
mov ecx, esi
call main
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, esi
call main
push ebx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call main
mov eax, dword [eax]
mov ecx, esi
and dword [ebp - 4], 0
push dword [eax - 0xc]
push eax
call main
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401856
push esi
mov ecx, edi
call main
call fcn.004218ee
ret
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x407467
pop dword [ebp - 0x34]
mov eax, 0xaf6b89e1
sub eax, 0xaf2b157a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xb9c9c1bc
sub dword [ebp - 0x44], 0x6b777c71
mov dword [ebp - 0x40], 0xc6aa25d5
sub dword [ebp - 0x40], 0x9476d990
mov dword [ebp - 0x3c], 0xc43fb505
add dword [ebp - 0x3c], 0x880c8f29
mov dword [ebp - 0x38], 0xfe7f32f4
add dword [ebp - 0x38], 0x180cd0c
lea eax, [ebp - 0x44]
push eax
mov eax, 0x2f463bbe
sub eax, 0x2f05bb46
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xc296d54c
sub dword [ebp - 0x44], 0x4e246bf6
mov dword [ebp - 0x40], 0x60ed8ba0
sub dword [ebp - 0x40], 0x1f812a2b
mov dword [ebp - 0x3c], 0x6a9d8ae
add dword [ebp - 0x3c], 0x5cc593be
mov dword [ebp - 0x38], 0x3414987b
sub dword [ebp - 0x38], 0x3414987b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39ef8
push 0
call eax
mov ecx, 0x5b9e330c
sub ecx, 0x5b9ddfb6
xor esi, esi
add esi, eax
mov edx, 0x451400
add edx, dword [ebp - 0x34]
mov edi, 0x71c4bb15
sub dword [ebp - 0x24], 0x9de70c05
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0x9231a9af
add ebx, edi
xor dword [ebp - 0xc], 0xb58acff7
mov dword [esi], ebx
sub dword [ebp - 0x18], edi
add esi, 4
add edx, 4
loop 0x40757a
add eax, 0xda677fd4
sub eax, 0xda663fa9
mov ebx, eax
add eax, 0xc06c99d5
sub eax, 0xc06c99d0
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x402b78
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f50]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c0c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402bc9
cmp dword [ebp + 0x10], ebx
jne 0x402c00
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b78
test eax, eax
jne 0x402bdb
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48f2c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x402d67
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, 0x442800
push 0x400
add eax, 0x3e8
push esi
push ebx
mov dword [0x434eac], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 3
push 0x80000000
push esi
call fcn.00405a0d
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
mov dword [0x40a018], edi
jne 0x402dc1
mov eax, str.Error_launching_installer
jmp 0x402f99
push esi
mov esi, 0x440800
push esi
call fcn.00405da1
push esi
call fcn.00405838
push eax
push 0x443000
call fcn.00405da1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [0x42a9b0], eax
mov esi, eax
jle 0x402edc
mov ebx, 0x4229b0
mov eax, dword [0x434eb4]
mov edi, esi
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
jl 0x402e15
mov edi, eax
push edi
push ebx
call fcn.004031c8
test eax, eax
je 0x402f46
cmp dword [0x434eb4], 0
jne 0x402ea7
push 0x1c
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.004059c8
mov eax, dword [ebp - 0x28]
test eax, 0xfffffff0
jne 0x402eb5
cmp dword [ebp - 0x24], 0xdeadbeef
jne 0x402eb5
cmp dword [ebp - 0x18], 0x74736e49
jne 0x402eb5
cmp dword [ebp - 0x1c], 0x74666f73
jne 0x402eb5
cmp dword [ebp - 0x20], 0x6c6c754e
jne 0x402eb5
or dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x4169a0]
and eax, 2
or dword [0x434f40], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
jmp 0x491200
test byte [ebp + 8], 2
jne 0x402eb5
push 0
call fcn.00402d03
pop ecx
cmp esi, dword [0x42a9b0]
jge 0x402eca
push edi
push ebx
push dword [ebp - 8]
call fcn.004061b9
mov dword [ebp - 8], eax
add dword [0x4169a0], edi
sub esi, edi
test esi, esi
jg 0x402dfa
xor ebx, ebx
push 1
call fcn.00402d03
cmp dword [0x434eb4], ebx
pop ecx
je 0x402f3f
cmp dword [ebp - 4], ebx
je 0x402f13
push dword [0x4169a0]
call fcn.004031de
lea eax, [ebp + 8]
push 4
push eax
call fcn.004031c8
test eax, eax
je 0x402f3f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x402f3f
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov eax, dword [0x434eb4]
add eax, 0x1c
push eax
call fcn.004031de
push dword [ebp - 0x14]
push esi
push ebx
push 0xffffffffffffffff
call fcn.00402fa0
cmp eax, dword [ebp - 0x14]
je 0x402f50
mov eax, str.Installer_integrity_check_has_failed._Common_causes_include_nincomplete_download_and_damaged_media._Contact_the_ninstallers_author_to_obtain_a_new_copy._n_nMore_information_at:_nhttp:__nsis.sf.net_NSIS_Error
jmp 0x402f99
push 1
call fcn.00402d03
pop ecx
jmp 0x402f3f
test byte [ebp - 0x28], 1
mov dword [0x434eb0], esi
mov eax, dword [esi]
mov dword [0x434eb8], eax
je 0x402f69
inc dword [0x434ebc]
push 8
lea eax, [esi + 0x44]
pop ecx
sub eax, 8
add dword [eax], esi
dec ecx
jne 0x402f6f
push 1
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
add esi, 4
push 0x40
push esi
push 0x434ec0
call fcn.004059c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4