joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2f74410
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x2f78450], ebx
jne 0x2f7445f
call esi
cmp eax, ebx
mov edi, eax
je 0x2f7443d
mov dword [0x2f78450], 1
jmp 0x2f7445f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x2f74455
mov dword [0x2f78450], 2
jmp 0x2f7445f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x2f78450], 1
jne 0x2f7450e
test edi, edi
jne 0x2f74482
call esi
mov edi, eax
test edi, edi
jne 0x2f74482
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x2f7449c
add esi, 2
cmp word [esi], 0
jne 0x2f7448a
add esi, 2
cmp word [esi], 0
jne 0x2f7448a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x2f744fd
push ebp
call fcn.02f74f30
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x2f744fd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x2f744ec
push ebx
call fcn.02f74ee0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x2f78450], 2
jne 0x2f74592
test ebx, ebx
jne 0x2f74531
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x2f74531
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x2f74546
inc ebp
cmp byte [ebp], 0
jne 0x2f74538
inc ebp
cmp byte [ebp], 0
jne 0x2f74538
sub ebp, ebx
inc ebp
push ebp
call fcn.02f74f30
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x2f7456b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x2f74bb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x2f78680
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x2f74bd7
add eax, 8
inc ecx
cmp eax, 0x2f78710
jb 0x2f74bc8
cmp dword [ecx*8 + 0x2f78680], edx
lea ebx, [ecx*8]
jne 0x2f74d9b
cmp dword [0x2f78140], 1
je 0x2f74d57
cmp dword [0x2f78140], 0
jne 0x2f74c0e
cmp dword [0x2f78144], 1
je 0x2f74d57
cmp edx, 0xfc
je 0x2f74d9b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x2f74c4b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x2f74c8f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x2f7679c
push ebp
call fcn.02f757e0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x2f7677c
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x2f78684]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.02f75740
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x2f79c80], 0
je 0x2f74d6d
mov eax, dword [0x2f79c80]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x2f74d77
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x2f78684]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10016f70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016f9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016f9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40730c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407328
shr eax, 1
xor eax, 0xedb88320
jmp 0x40732a
shr eax, 1
dec edx
jne 0x40731b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407314
pop esi
ret

Function at 0x407340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40b558], 0
jne 0x40735e
call fcn.0040730c
mov byte [0x40b558], 1
mov eax, edi
test esi, esi
je 0x407389
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407364
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x402403
Capabilities:
Enumerate files on windows
Get disk size
Get geographical location
Print debug messages
Query environment variable

Disassembly:
inc eax
add dl, bh
jbe 0x402397
add dl, ah
mov dword [0xa22759], eax
push 0x40c0cd
jmp [ebp - 0x1dbfc917]
daa
mov byte [0xc0cd6800], al
inc eax
add bh, bh
lodsd eax, dword [esi]
jmp 0xe92263e0
inc eax
loop 0x402392
popal
add dl, ah
add byte [ebx + 0x40bb6d], ah
push 0x402249
jecxz 0x4023ef
jmp 0xe840c5f5
and ah, byte [edx - 0x3417b000]
add byte [eax], al
add byte [edi], bh
popal
daa
inc eax
loop 0x402456
push 0x40bf32
push eax
cli
push es
add byte [eax], al
loop 0x4023ad
daa
mov byte [0x5955c300], al
in eax, 0x83
in al, dx
salc
mov edi, dword [ebp + 8]
jl 0x40239b
aas
dec ebp
mov byte [ebp + 0x65], dh
mov eax, ebp
add edx, dword [edi + 0x3c]
jl 0x4023a7
cmp dl, byte [eax - 0x63]
jne 0x402484
mov dword [ebp + 0x6a428bf4], ecx
add eax, dword [ebp + 8]
pop ecx
inc ebp
clc
mov esp, dword [edx - 0x25bafce0]
mov dword [ebp - 4], eax
mov cl, 0xc9
mov edx, dword [ebp - 0x16]
cmp ecx, dword [edx + 0x18]
cmp cl, byte gs:[ebx + 0x1c8be65d]
mov ebx, edi
pop ebp
or bh, bh
insd dword es:[edi], dx
or al, 0x53
push ebx
call fcn.0040220a
pop edi
clc
add dword [edi + ebx*8 + 0x41], esi
jmp 0x402442
mov cl, 0xc0
mov esp, ebp
test edx, eax
or byte [eax], al

Function at 0x4042a0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x402740]
call dword [sym.imp.pdh.dll_PdhValidatePathA]
and eax, 0xf
add eax, 0xb
xor edi, edi
xor esi, esi
cmp eax, 0x18
je 0x4042c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x403705], eax
ret
Function at 0x402835
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x45c0e2
call fcn.0043edd5
lea ecx, [ebp - 0x18]
call fcn.0042fdcb
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402aad
or dword [ebp - 4], 0xffffffff
call fcn.0042fde1
and dword [ebp - 0x14], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40295e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402955
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x40295e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x40295e
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, edi
je 0x4028fb
cmp word [esi], bx
jne 0x4028f7
cmp dword [ebp - 0x1c], ebx
je 0x4028f1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00402a15
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
jmp 0x4028f7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
inc esi
inc esi
jmp 0x4028c7
or dword [ebp - 4], 0xffffffff
jmp 0x40295c
mov dword [ebp - 0x14], 1
jmp 0x402966
call fcn.0040310b
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x40298f
call fcn.0043ee7a
ret 4
Function at 0x409cca
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45d343
call fcn.0043eda2
push 0x466648
mov ecx, 0x480160
call fcn.00402997
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x409d07
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040475e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
jmp 0x40f780
lea ecx, [ebp - 0x38]
call fcn.00435a41
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46665c
lea edi, [ebp - 0x38]
call fcn.00401513
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401513
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.004183cc
cmp dword [ebp - 0x30], ebx
pop ecx
pop ecx
jle 0x409e01
mov edi, 0x480134
push 0x466660
mov ecx, edi
call fcn.00424370
test eax, eax
je 0x409de6
push str.LI_SKIP_EULA
mov ecx, edi
call fcn.00424370
test eax, eax
je 0x409de6
cmp dword [ebp - 0x30], 1
jle 0x409de6
cmp dword [ebp - 0x30], ebx
jg 0x409d88
jmp fcn.0042fcc0
mov ecx, dword [ebp - 0x34]
push 0x466690
call fcn.00404409
test eax, eax
jne 0x409de6
cmp dword [ebp - 0x30], 1
jle 0x409d83
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
lea ecx, [esi + 0x98]
call fcn.0040adbd
push ebx
mov byte [esi + 0xac], 1
mov eax, dword [0x480074]
push ebx
push 0x401
push dword [eax + 0x30]
mov dword [eax + 0x58], ebx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [0x480130]
cmp eax, ebx
je 0x409de6
push ebx
push ebx
push 0x466608
push eax
call fcn.004168a3
cmp byte [esi + 0xac], bl
jne 0x409e01
cmp dword [ebp - 0x30], ebx
jle 0x409d83
push dword [ebp - 0x34]
lea ecx, [esi + 0x98]
call fcn.0040adbd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00435bf2
call fcn.0043ee7a
ret
Function at 0x409e13
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45d343
call fcn.0043eda2
push 0x466648
mov ecx, 0x480160
call fcn.00402997
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x409e4f
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040475e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
jmp 0x40f780
lea ecx, [ebp - 0x38]
call fcn.00435a41
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46665c
lea edi, [ebp - 0x38]
call fcn.00401513
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401513
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
call fcn.004183cc
cmp byte [esi + 0xac], 0
pop ecx
pop ecx
mov edi, ebx
je 0x409e9e
push 2
pop edi
mov ebx, dword [ebp - 0x30]
jmp 0x409ee9
test edi, edi
jl 0x409eff
cmp edi, dword [ebp - 0x30]
jge 0x409eff
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x409ee8
push str.CProgressPage
push eax
call fcn.0040aa44
test al, al
pop ecx
pop ecx
je 0x409ed1
push esi
call fcn.0040a048
cmp edi, dword [ebp - 0x30]
jge 0x409eff
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
push eax
lea ecx, [esi + 0x98]
call fcn.0040adbd
inc edi
cmp edi, ebx
jb 0x409ea3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00435bf2
call fcn.0043ee7a
ret
jmp fcn.0042fcc0
test ecx, ecx
je 0x40f78d
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x14]
push 1
call fcn.0043d3b3
int3
Function at 0x40cb70
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x45cb42
call fcn.0043eda2
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0x26
jne 0x40cd3e
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040524e
mov byte [ebp - 4], 1
mov esi, 0x464e5c
push esi
push 0x4670f0
lea eax, [ebp - 0x10]
push eax
call fcn.0040d1e7
push esi
push 0x4670f4
lea eax, [ebp - 0x10]
push eax
call fcn.0040d1e7
lea ecx, [ebp - 0x30]
call fcn.00435a41
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x465ea0
lea edi, [ebp - 0x30]
call fcn.00401513
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0040524e
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004183cc
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.0040164f
xor edi, edi
cmp dword [ebp - 0x28], ebx
jle 0x40cc8c
push edi
lea ecx, [ebp - 0x30]
call fcn.0040d3e4
push eax
lea ecx, [ebp - 0x14]
call fcn.0040524e
mov byte [ebp - 4], 5
cmp edi, 3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
jl 0x40cd6d
xor esi, esi
cmp eax, ebx
jle 0x40cc7a
lea ecx, [esi + 1]
cmp eax, ecx
jle 0x40cc58
lea eax, [ebp - 0x14]
call fcn.0040892d
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404007
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.0040892d
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404007
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
inc esi
inc esi
cmp esi, eax
jl 0x40cc3d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401b20
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x40cc12
lea ecx, [ebp - 0x18]
call fcn.004089d6
mov byte [ebp - 4], 6
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x4670f8
push eax
call fcn.00401ff7
add esp, 0xc
call fcn.00418385
neg al
mov dword [ebp - 0x14], ebx
sbb eax, eax
and eax, 0x200
add eax, 0x20006
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40cd0f
lea ecx, [ebp - 0x14]
call fcn.004091a0
cmp eax, ebx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jne 0x40cd0f
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push ebx
push str.DeploymentFlags
push ecx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14]
call fcn.004091a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00435bf2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401b20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401b20
call fcn.0043ee7a
ret 4
lea esi, [eax - 1]
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.0040892d
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404007
mov eax, esi
cmp eax, ebx
jg 0x40cd52
jmp 0x40cc7a
Function at 0x40d426
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x45de67
call fcn.0043edd5
lea ecx, [ebp - 0x2c]
call fcn.0042fdcb
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004089d6
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.00408a9d
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
push 0x4671c8
lea ecx, [ebp - 0x18]
call fcn.00417ecd
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x40d49f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.004137d1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401b20
or dword [ebp - 4], 0xffffffff
call fcn.0042fde1
mov eax, dword [ebp - 0x20]
jmp 0x40d522
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
call fcn.00426c40
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x40d475
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40d4c8
and dword [ebp - 0x18], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x1c]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401abb
push str..exe
mov ecx, esi
call fcn.00409370
push dword [esi]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40d475
call fcn.0040310b
mov dword [ebp - 0x20], eax
jmp 0x40d475
call fcn.0043ee7a
ret 0x14
Function at 0x40f0d0
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x47a030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x464e5c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f130
push 0x800
call eax
test eax, eax
jne 0x40f129
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40f135
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40f135
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40f2a9
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.0043db9a
add esp, 0xc
test eax, eax
jne 0x40f28d
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043eeb0
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043d0a9
push 0x4676f8
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043d0a9
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x430]
jmp 0x40f294
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40f1fd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043aa68
leave
ret
Function at 0x40f54a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00434c59
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40f56b
xor eax, eax
jmp 0x40f57e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f567
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x4104e7
Capabilities:
Terminate process

Disassembly:
push 0x40c
mov eax, 0x45df20
call fcn.0043ee0b
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
je 0x4105b0
mov eax, dword [0x480130]
cmp eax, ebx
je 0x410525
push ebx
push ebx
push eax
mov esi, edi
call fcn.00416b57
push 0x460510
mov ecx, edi
call fcn.00430ee3
test eax, eax
jne 0x410545
push 0x46543c
mov ecx, edi
call fcn.00430ee3
test eax, eax
je 0x4105b0
mov eax, dword [edi]
push ebx
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, edi
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x47ffb0
je 0x410582
call fcn.0040f2b6
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x410594
call fcn.0040f2b6
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00401b20
push esi
call fcn.0043d3b3
mov eax, dword [ebp - 0x414]
xor esi, esi
inc esi
mov dword [eax + 0xac], esi
mov dword [0x480060], esi
mov esi, dword [0x47ffd0]
call fcn.00409b72
cmp edi, ebx
je 0x4105e8
push dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push edi
call fcn.00436507
mov ebx, eax
mov eax, ebx
call fcn.0043ee8e
ret 8