joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008c10
Capabilities:
Enumerate processes

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 2
call dword [0x1000defc]
push 0x128
mov edi, eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10008c8a
mov ebp, dword [esp + 0x14]
lea ebx, [esi + 0x24]
push ebp
push ebx
call fcn.10008bd0
add esp, 8
test eax, eax
jne 0x10008c68
mov edi, dword [esi + 8]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10008c8a
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10008c55
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10008c73
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10008d80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x414
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.wininet.dll
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
mov ebp, 1
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenA
push esi
call edi
push ebx
push ebx
push ebx
push ebx
push str.MSIE_6.0
call eax
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
je 0x10008df2
push str.InternetOpenUrlA
push esi
call edi
mov ecx, dword [esp + 0x428]
push 0
push bind
push 0
push 0
push ecx
push ebx
call eax
mov ebx, eax
test ebx, ebx
jne 0x10008e0a
test esi, esi
je 0x10008dfd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x414
ret
mov edx, dword [esp + 0x42c]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x10008ea3
push 0x400
lea eax, [esp + 0x28]
push 0
push eax
call dword [0x1000df8c]
add esp, 0xc
push str.InternetReadFile
push esi
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push 0x400
push edx
push ebx
call eax
test ebp, ebp
je 0x10008e6c
cmp word [esp + 0x24], 0x5a4d
jne 0x10008e93
mov ecx, dword [esp + 0x14]
xor ebp, ebp
lea eax, [esp + 0x20]
push ebp
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x10008e98
jmp 0x10008e30
mov byte [esp + 0x13], 0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push esi
call edi
mov edi, eax
push ebx
call edi
mov edx, dword [esp + 0x1c]
push edx
call edi
test esi, esi
je 0x10008eca
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x414
ret
Function at 0x10008ee0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x10008f4e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10008fa5
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10008fbd
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10008fc8
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret
Function at 0x402170
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0xc]
push ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwarePythonPythonCore
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021a2
xor eax, eax
jmp 0x4022cf
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 8], 0x50
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4022c3
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
cmp eax, ebx
mov dword [ebp - 8], 0x50
je 0x4021f8
cmp byte [eax], bl
je 0x4021f8
lea ecx, [ebp - 0x64]
push ecx
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4022a1
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x104]
push str.Python_Version__s__found_in_registry_
push eax
call esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xb4]
push str.SoftwarePythonPythonCore_sInstallPath
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0xb4]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022a1
push 0x10c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x14], 0x105
je 0x402298
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402298
lea eax, [ebp - 0x104]
push eax
push ebx
push 0x180
push dword [ebp + 8]
call edi
mov ecx, dword [ebp + 0xc]
push esi
push eax
push 0x19a
push dword [ebp + 8]
mov dword [esi + 0x108], ecx
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4021cf
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop ebx
leave
ret
Function at 0x4025f7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PySys_GetObject
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_OptimizeFlag
push edi
mov dword [ebp - 0xc], eax
call esi
xor esi, esi
cmp dword [0x40c43c], esi
jne 0x402655
xor eax, eax
jmp 0x40269f
cmp ebx, esi
je 0x40269c
cmp dword [ebp + 8], esi
je 0x40269c
cmp dword [ebp - 8], esi
je 0x40269c
cmp dword [ebp - 4], esi
je 0x40269c
cmp dword [ebp - 0xc], esi
je 0x40269c
cmp eax, esi
je 0x40269c
xor ecx, ecx
cmp dword [ebp + 0xc], esi
push 0x40c460
setne cl
mov dword [eax], ecx
call dword [ebp + 8]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004026a4
add esp, 0xc
mov esi, eax
call dword [ebp - 8]
mov eax, esi
jmp 0x40269f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x40d920
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll__putenv]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40287b
push dword [0x40d890]
lea eax, [ebp - 0x54]
push dword [0x40da24]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call esi
add esp, 0x10
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call esi
test eax, eax
je 0x40284f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000002
call esi
test eax, eax
je 0x40284f
xor eax, eax
jmp 0x40287b
lea eax, [ebp - 0x158]
push 0x40b5c8
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call edi
pop edi
pop esi
leave
ret
Function at 0x40287f
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__tempnam]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_freopen]
add ecx, 0x40
mov edi, 0x40b9d4
push ecx
push edi
push eax
mov dword [ebp - 4], eax
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
push edi
push dword [ebp - 4]
call esi
push 0x40d720
call fcn.004027a9
mov esi, eax
add esp, 0x24
cmp esi, ebx
jne 0x402903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x8c]
push str.Cant_load_Python_for_pre_install_script___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x8c]
push eax
call fcn.004025ce
add esp, 0x10
or eax, 0xffffffff
jmp 0x402a05
push dword [ebp + 8]
push esi
call fcn.00402a0a
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, dword [sym.imp.MSVCRT.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
add eax, 0x40
push eax
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0xc], ebx
je 0x4029f8
push str.Running_the_pre_installation_script_failed_r_n
call sub.MSVCRT.dll_strlen
mov dword [esp], 0x40b970
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fopen]
push 2
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push eax
mov dword [ebp + 8], eax
call ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
call ebx
mov eax, dword [ebp - 8]
lea eax, [eax + edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 0x28
test ebx, ebx
je 0x4029ed
push str.Running_the_pre_installation_script_failed_r_n
push ebx
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
lea eax, [ebx + edi]
push dword [ebp - 8]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push dword [ebp + 8]
add eax, ebx
and byte [eax + edi], 0
call esi
push ebx
call fcn.004025ce
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x24
jmp 0x4029f8
push str.Out_of_memory_
call fcn.004025ce
pop ecx
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_remove]
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a0a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 4], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x402a91
cmp dword [ebp + 8], eax
je 0x402a91
cmp dword [ebp - 8], eax
je 0x402a91
cmp dword [ebp - 4], eax
je 0x402a91
cmp esi, eax
je 0x402a91
push 0x40c460
call dword [ebp + 8]
call ebx
push edi
call fcn.00402a99
push dword [ebp + 0xc]
call dword [ebp - 4]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402a8a
call esi
call dword [ebp - 8]
mov eax, edi
jmp 0x402a94
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402a99
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.PyImport_ImportModule
push edi
call esi
push str.PyObject_SetAttrString
push edi
mov ebx, eax
call esi
push str.PyObject_GetAttrString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp + 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 4], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
push str.PyLong_FromVoidPtr
push edi
mov dword [ebp - 0x14], eax
call esi
xor esi, esi
mov dword [ebp - 0x18], eax
cmp ebx, esi
je 0x402ba7
cmp dword [ebp + 8], esi
je 0x402ba7
cmp dword [ebp - 8], esi
je 0x402ba7
cmp dword [ebp - 4], esi
je 0x402ba7
cmp dword [ebp - 0xc], esi
je 0x402ba7
cmp dword [ebp - 0x10], esi
je 0x402ba7
cmp dword [ebp - 0x14], esi
je 0x402ba7
push str.__builtin__
call ebx
mov edi, eax
pop ecx
cmp edi, esi
je 0x402b83
push str.ValueError
push edi
call dword [ebp + 8]
push str.OSError
push edi
mov dword [0x40d894], eax
call dword [ebp + 8]
add esp, 0x10
mov dword [0x40da2c], eax
mov esi, 0x40b0c8
push 0
push esi
call dword [ebp - 4]
push eax
push dword [esi]
push edi
call dword [ebp - 8]
add esi, 0x10
add esp, 0x14
cmp esi, 0x40b128
jb 0x402b68
mov eax, dword [ebp - 0xc]
mov dword [0x40d908], eax
mov eax, dword [ebp - 0x10]
mov dword [0x40d90c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x40d704], eax
mov eax, dword [ebp - 0x18]
mov dword [0x40da50], eax
xor eax, eax
jmp 0x402baa
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031f4
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov ebx, eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40336b
cmp dword [ebp - 4], ecx
je 0x40336b
cmp dword [ebp - 8], ecx
je 0x40336b
cmp dword [ebp - 0xc], ecx
je 0x40336b
cmp ebx, ecx
je 0x40336b
cmp dword [ebp - 0x10], ecx
je 0x40336b
cmp eax, ecx
je 0x40336b
cmp dword [ebp - 0x14], ecx
je 0x40336b
mov esi, dword [ebp + 0xc]
cmp esi, ecx
je 0x403367
cmp byte [esi], cl
je 0x403367
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__open]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
pop ecx
jne 0x4032e5
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
add eax, 0x40
push str.Could_not_open_postinstall_script__s_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 3
jmp 0x40336d
push str.Running_Script...
push 0x3ec
push dword [0x40d910]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call dword [ebp + 8]
push edi
call fcn.00402a99
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp - 4]
push 3
lea eax, [ebp - 0x38]
pop esi
push eax
push ebx
mov dword [ebp + 8], esi
call dword [sym.imp.MSVCRT.dll__fstat]
add esp, 0x14
test eax, eax
jne 0x403357
mov edi, dword [ebp - 0x24]
lea eax, [edi + 5]
add eax, esi
and al, 0xfc
call fcn.00406cb0
mov esi, esp
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x403357
add eax, esi
push esi
mov byte [eax], 0xa
and byte [eax + 1], 0
call dword [ebp - 8]
pop ecx
mov dword [ebp + 8], eax
call dword [ebp - 0xc]
push ebx
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [ebp + 8]
pop ecx
jmp 0x40336e
push 2
jmp 0x40336d
push 1
pop eax
lea esp, [ebp - 0x44]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403590
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push 1
push 0
push 0x40c444
push 0x40c460
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4035df
push eax
lea eax, [ebp - 0x80]
push str.Failed_to_start_elevated_process__ShellExecute_returned__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x10
push str.Setup
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x4035e1
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406cb0
push ebx
push ebp
push esi
push edi
push dword [0x40da28]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40c444
push eax
push ebx
mov esi, str.Setup
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40c580
call fcn.004037d6
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40da28]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40c700
call fcn.004037d6
add esp, 0xc
push dword [0x40da28]
push 0x50
push 0x40d8a0
push ebx
push str.build_info
push esi
call edi
push dword [0x40da28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40da28]
mov dword [0x40c458], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40da28]
mov dword [0x40d898], eax
push 0xa
push 0x40d8f0
push ebx
push str.target_version
push esi
call edi
push dword [0x40da28]
push 0x50
push 0x40d840
push ebx
push str.name
push str.metadata
call edi
push dword [0x40da28]
push 0x104
push 0x40c5e0
push ebx
push str.install_script
push esi
call edi
push dword [0x40da28]
push 0xa
mov ebp, 0x40da40
push ebp
push ebx
push str.user_access_control
push esi
call edi
push str.force
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403720
call fcn.00403552
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
jmp 0x40374c
push str.auto
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403753
call fcn.00403552
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
call fcn.004034fc
test eax, eax
je 0x403786
call fcn.00403590
jmp 0x4037c9
cmp byte [0x40da40], 0
je 0x403786
push str.none
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403786
push 0
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40c580
call fcn.0040385b
push eax
mov dword [0x40d900], eax
call fcn.004033de
pop ecx
pop ecx
push dword [0x40c564]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x40da28]
test eax, eax
je 0x4037b9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x40da4c]
test eax, eax
je 0x4037c9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x403938
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
lea eax, [ebp - 0x15c]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push str._s.bat
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x260]
push 0x40bfd4
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
push str.:Repeat_n
push eax
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x15c]
mov edi, str.del___s__n
push eax
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x15c]
push eax
push str.if_exist___s__goto_Repeat_n
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x260]
push eax
push edi
push dword [ebp - 4]
call esi
add esp, 0x40
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
push 0x44
lea eax, [ebp - 0x58]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x58]
push eax
push 0x40b5c8
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x260]
push ebx
push eax
push ebx
mov word [ebp - 0x28], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403a57
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x10]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret