joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa6a7d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4f9000]
push edi
or ebp, 0xffffffff
jmp 0xa6a7f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa6a7f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa6a7e8
mov eax, 1
add ebx, ebx
jne 0xa6a80b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa6a81c
jne 0xa6a83b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa6a83b
dec eax
add ebx, ebx
jne 0xa6a828
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa6a800
add ebx, ebx
jne 0xa6a837
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa6a88d
xor ecx, ecx
sub eax, 3
jb 0xa6a853
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa6a8c2
sar eax, 1
mov ebp, eax
jmp 0xa6a85e
add ebx, ebx
jne 0xa6a85e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa6a82c
inc ecx
add ebx, ebx
jne 0xa6a86c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa6a82c
add ebx, ebx
jne 0xa6a879
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa6a86e
jne 0xa6a88a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa6a86e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa6a8ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa6a89e
jmp 0xa6a7ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa6a8ac
add edi, ecx
jmp 0xa6a7ee
pop esi
mov edi, esi
mov ecx, 0x317c27
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xa6a8e7
cmp byte [edi], 0x2a
jne 0xa6a8cc
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xa6a8ca
lea edi, [esi + 0x665000]
mov eax, dword [edi]
or eax, eax
je 0xa6a92f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x670528]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x670654]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa6a8ed
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x670658]
or eax, eax
je 0xa6a929
mov dword [ebx], eax
add ebx, 4
jmp 0xa6a90a
call dword [esi + 0x670668]
mov ebp, dword [esi + 0x67065c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa6a963
sub esp, 0xffffff80
jmp 0x7479dc
Function at 0x8914e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1da000]
push edi
or ebp, 0xffffffff
jmp 0x891502
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x891509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8914f8
mov eax, 1
add ebx, ebx
jne 0x89151b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x89152c
jne 0x89154b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89154b
dec eax
add ebx, ebx
jne 0x891538
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x891510
add ebx, ebx
jne 0x891547
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x89159d
xor ecx, ecx
sub eax, 3
jb 0x891563
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8915d2
sar eax, 1
mov ebp, eax
jmp 0x89156e
add ebx, ebx
jne 0x89156e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89153c
inc ecx
add ebx, ebx
jne 0x89157c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89153c
add ebx, ebx
jne 0x891589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x89157e
jne 0x89159a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x89157e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8915bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8915ae
jmp 0x8914fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8915bc
add edi, ecx
jmp 0x8914fe
pop esi
mov edi, esi
mov ecx, 0x69d5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8915da
cmp byte [edi], 0x2c
jne 0x8915da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8915df
lea edi, [esi + 0x488000]
mov eax, dword [edi]
or eax, eax
je 0x891657
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x495b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x495cd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x89160c
mov ecx, edi
jns 0x89163b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x495cd8]
or eax, eax
je 0x891651
mov dword [ebx], eax
add ebx, 4
jmp 0x891629
call dword [esi + 0x495ce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x891688
cmp al, 0xef
ja 0x89167b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x89165d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x89166a
mov ebp, dword [esi + 0x495cdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8916bc
sub esp, 0xffffff80
jmp 0x4aee20
Function at 0x401548
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x498], 2
jne 0x4015b0
lea ebx, [edi + 0x4a8]
lea eax, [edi + 0x4a4]
push ebx
push eax
call fcn.00410e4d
mov esi, eax
test esi, esi
jns 0x401587
push str.Failed_to_create_implicit_elevated_connection_name_and_secret.
jmp 0x4016fa
push dword [edi + 0x4d8]
push dword [ebx]
push dword [edi + 0x4a4]
push dword [edi + 0x2c]
push dword [ebp + 0xc]
call fcn.0041125f
mov esi, eax
test esi, esi
jns 0x4015b0
push str.Failed_to_launch_unelevated_process.
jmp 0x4016fa
push 1
lea eax, [edi + 0x4a4]
push eax
call fcn.00410bea
mov esi, eax
test esi, esi
jns 0x4015ce
push str.Failed_to_connect_to_unelevated_process.
jmp 0x4016fa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0x49c], eax
cmp eax, 0xffffffff
jne 0x401617
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1d0
push str.engine.cpp
call fcn.00436473
push str.Failed_to_allocate_thread_local_storage_for_logging.
jmp 0x4016fa
push dword [edi + 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x401660
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1d5
push str.engine.cpp
call fcn.00436473
push str.Failed_to_set_elevated_pipe_into_thread_local_storage_for_logging.
jmp 0x4016fa
push edi
push dword [ebp + 8]
call fcn.0041a3c4
mov esi, eax
test esi, esi
jns 0x401679
push str.Failed_to_create_the_message_window.
jmp 0x4016fa
push 1
call fcn.00439abf
push edi
push 0x4011ab
call fcn.004376aa
lea eax, [edi + 0x18]
push eax
lea eax, [edi + 0xf8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xb8]
push eax
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0x88]
push eax
lea eax, [edi + 0x2b8]
push eax
lea eax, [edi + 0x2c0]
push eax
lea eax, [edi + 0x2a8]
push eax
lea eax, [edi + 0x3d8]
push eax
push dword [edi + 0x4b8]
push dword [edi + 0x4b4]
push dword [edi + 0x49c]
call fcn.00418c23
push 0
push 0
mov esi, eax
call fcn.004376aa
test esi, esi
jns 0x401702
push str.Failed_to_pump_messages_from_parent_process.
push esi
call fcn.00437258
pop ecx
pop ecx
push 0
push 0
call fcn.004376aa
push edi
call fcn.0041a385
cmp dword [ebp - 8], 0
je 0x40171c
call fcn.00418d5f
cmp dword [ebp - 4], 0
je 0x401734
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4061d3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x406200
push str.Failed_to_format_variable_string.
jmp 0x406274
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406236
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x406232
cmp esi, 0x80070003
jne 0x40623e
xor esi, esi
jmp 0x40623e
test al, 0x10
push 1
pop eax
cmovne edi, eax
test esi, esi
jns 0x406257
push dword [ebp - 4]
push dword [ebx]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00437258
add esp, 0x10
jmp 0x40627c
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404986
mov esi, eax
test esi, esi
jns 0x40627c
push str.Failed_to_set_variable.
push esi
call fcn.00437258
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0043b084
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40628f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x4062ba
push str.Failed_to_format_variable_string.
jmp 0x4062fd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4062de
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x40630c
test al, 0x10
je 0x406307
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004049c8
mov esi, eax
test esi, esi
jns 0x40630c
push str.Failed_to_set_directory_search_path_variable.
push esi
call fcn.00437258
pop ecx
pop ecx
jmp 0x40634c
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x406335
cmp esi, 0x80070003
je 0x406335
test esi, esi
jns 0x40634c
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00437258
add esp, 0x10
jmp 0x40634c
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.00437731
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.0043b084
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40635e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x40638e
push str.Failed_to_format_variable_string.
jmp 0x406426
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406401
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4063eb
cmp eax, 3
je 0x4063eb
test eax, eax
je 0x406409
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x296
push str.search.cpp
call fcn.00436473
push dword [ebx + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.00437258
add esp, 0xc
jmp 0x40642e
push dword [ebp - 4]
push dword [ebx]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00437731
add esp, 0x10
jmp 0x406409
test al, 0x10
push 1
pop eax
cmove edi, eax
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404986
mov esi, eax
test esi, esi
jns 0x40642e
push str.Failed_to_set_variable.
push esi
call fcn.00437258
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0043b084
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406441
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x40646c
push str.Failed_to_format_variable_string.
jmp 0x4064d6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4064b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x4064e0
cmp esi, 0x80070003
je 0x4064e0
test esi, esi
jns 0x4064f6
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.00437258
add esp, 0x10
jmp 0x4064f6
test al, 0x10
jne 0x4064e0
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004049c8
mov esi, eax
test esi, esi
jns 0x40648e
push str.Failed_to_set_variable_to_file_search_path.
push esi
call fcn.00437258
pop ecx
pop ecx
jmp 0x4064f6
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00437731
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.0043b084
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x406964
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
inc edi
mov dword [ebp - 8], edx
cmp dword [ebx + 0x24], edx
mov ecx, 0x101
mov eax, edi
mov dword [ebp - 0xc], edx
cmovne eax, ecx
mov dword [ebp - 0x10], edx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x4069b1
push str.Failed_to_format_key_string.
jmp 0x406a47
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.00438da4
mov esi, eax
test esi, esi
js 0x406a68
cmp dword [ebx + 0x20], 0
je 0x406a84
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.00403cad
mov esi, eax
test esi, esi
jns 0x4069f5
push str.Failed_to_format_value_string.
jmp 0x406a47
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, 0
je 0x406a84
dec ecx
dec ecx
je 0x406a51
test eax, eax
je 0x406a84
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x32d
push str.search.cpp
call fcn.00436473
push str.Failed_to_query_registry_key_value.
push esi
call fcn.00437258
pop ecx
pop ecx
jmp 0x406ab1
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.00437731
add esp, 0x10
jmp 0x406a82
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x406aa3
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00437731
add esp, 0xc
xor edi, edi
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404986
mov esi, eax
test esi, esi
jns 0x406ac8
push str.Failed_to_set_variable.
jmp 0x406a47
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.00437258
add esp, 0xc
test esi, esi
jns 0x406ac8
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00437731
add esp, 0x10
push dword [ebp - 4]
call fcn.0043b084
push dword [ebp - 8]
call fcn.0043b084
cmp dword [ebp - 0xc], 0
je 0x406ae7
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b352
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push edi
push eax
push 0x1c
pop eax
xor edi, edi
test ebx, ebx
push 0x23
pop ecx
cmovne eax, ecx
mov dword [ebp - 0xc], edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.004385c9
mov esi, eax
test esi, esi
jns 0x40b3a4
mov eax, str.per_user
test ebx, ebx
mov ecx, str.per_machine
cmove ecx, eax
push ecx
push str.Failed_to_find_local__hs_appdata_directory.
push esi
call fcn.00437258
add esp, 0xc
jmp 0x40b413
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], edi
jbe 0x40b413
mov eax, edi
mov dword [ebp + 8], edi
mov ecx, dword [ebx]
add ecx, eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 0xc], ecx
push dword [ecx + 4]
push dword [ebp - 0xc]
call fcn.00437d63
mov esi, eax
test esi, esi
js 0x40b406
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 4]
call fcn.00437d63
mov esi, eax
test esi, esi
js 0x40b406
push dword [ebp - 8]
call fcn.0043d810
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp + 8]
inc edi
add eax, 0xc
mov dword [ebp + 8], eax
cmp edi, dword [ebx + 4]
jb 0x40b3b1
jmp 0x40b413
push str.Failed_to_allocate_regid_folder_path.
push esi
call fcn.00437258
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x40b421
push dword [ebp - 8]
call fcn.0043af5b
cmp dword [ebp - 4], 0
je 0x40b42f
push dword [ebp - 4]
call fcn.0043af5b
cmp dword [ebp - 0xc], 0
je 0x40b43d
push dword [ebp - 0xc]
call fcn.0043af5b
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b5ec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043d1a8
cmp dword [ebp - 0xc], 5
mov eax, 0x44a520
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmovge eax, esi
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x40b66f
push dword [ebp + 0x10]
push str.Resume
push ebx
call fcn.0043929f
mov esi, eax
test esi, esi
jns 0x40b64c
push str.Failed_to_write_Resume_value.
jmp 0x40b7ce
cmp dword [ebp + 0x10], 3
jne 0x40b66f
push 1
push str.Installed
push ebx
call fcn.0043929f
mov esi, eax
test esi, esi
jns 0x40b675
push str.Failed_to_write_Installed_value.
jmp 0x40b7ce
cmp dword [ebp + 0x10], 1
je 0x40b67f
cmp dword [ebp + 0x14], 0
je 0x40b716
cmp dword [edi + 8], 0
jne 0x40b716
push str.burn.runonce
push dword [edi + 0x54]
lea eax, [ebp - 8]
push str.__ls____ls
push eax
call fcn.0043a845
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x40b6b2
push str.Failed_to_format_resume_command_line_for_RunOnce.
jmp 0x40b7ce
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0x10]
push dword [edi + 0x4c]
call fcn.004389f2
mov esi, eax
test esi, esi
jns 0x40b6d6
push str.Failed_to_create_run_key.
jmp 0x40b7ce
push dword [ebp - 8]
push dword [edi + 0x10]
push dword [ebp - 4]
call fcn.004392ed
mov esi, eax
test esi, esi
jns 0x40b6f4
push str.Failed_to_write_run_key_value.
jmp 0x40b7ce
push dword [edi + 0x58]
push str.BundleResumeCommandLine
push ebx
call fcn.004392ed
mov esi, eax
test esi, esi
jns 0x40b7d6
push str.Failed_to_write_resume_command_line_value.
jmp 0x40b7ce
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0x10]
push dword [edi + 0x4c]
call fcn.00438da4
mov esi, eax
cmp esi, 0x80070002
je 0x40b783
cmp esi, 0x80070003
je 0x40b783
push dword [edi + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
cmp eax, 2
cmove eax, ecx
test eax, eax
je 0x40b785
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x4ba
push str.registration.cpp
call fcn.00436473
push str.Failed_to_delete_run_key_value.
jmp 0x40b7ce
xor esi, esi
test ebx, ebx
je 0x40b7d6
push str.BundleResumeCommandLine
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
cmp eax, 2
cmove eax, ecx
test eax, eax
je 0x40b7d6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x4c4
push str.registration.cpp
call fcn.00436473
push str.Failed_to_delete_resume_command_line_value.
push esi
call fcn.00437258
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x40b7e4
push dword [ebp - 8]
call fcn.0043af5b
cmp dword [ebp - 4], 0
je 0x40b7f3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40fcbe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.004292a0
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40fd51
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x25d
push str.logging.cpp
call fcn.00436473
push str.Failed_to_get_temp_folder.
jmp 0x40fd70
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040fe71
mov esi, eax
test esi, esi
jns 0x40fd7d
push str.Failed_to_get_length_of_temp_folder.
push esi
call fcn.00437258
pop ecx
pop ecx
jmp 0x40fe49
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40fe21
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x44d7fc
push eax
call fcn.0043a845
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x40fdc1
push str.Failed_to_format_session_id_as_a_string.
jmp 0x40fe40
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.0040fe71
mov esi, eax
test esi, esi
jns 0x40fde5
push str.Failed_to_get_length_of_session_id_string.
jmp 0x40fe40
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x40fe27
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0043aa95
mov esi, eax
test esi, esi
jns 0x40fe48
push str.Failed_to_copy_temp_folder.
push esi
call fcn.00437258
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x40fe5d
push dword [ebp - 0x210]
call fcn.0043af5b
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042928d
mov esp, ebp
pop ebp
ret 4