joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429907
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4e98d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
push dword [0x4eda14]
call ebx
lea eax, [ebp - 0x64]
push eax
push 0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push eax
push 0
call esi
push eax
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov ecx, edi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x68], 0x1e
mov dword [ebp - 0x70], eax
call fcn.004445bc
cmp dword [eax], 1
je 0x42997f
cmp dword [eax + 4], esi
je 0x4299d4
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4299d4
lea eax, [ebp - 0x34]
push eax
push esi
mov dword [ebp - 0x68], 0x46
call ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
sub esi, ecx
mov eax, esi
cdq
idiv dword [ebp - 0x68]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
sub ebx, edi
push 5
push 0
push 0
sub ecx, eax
mov eax, ebx
cdq
idiv dword [ebp - 0x68]
sub ecx, dword [ebp - 0x70]
add ecx, esi
push ecx
sub edi, eax
sub edi, dword [ebp - 0x6c]
add edi, ebx
push edi
push 0
push dword [0x4eda14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004526a3
leave
ret

Function at 0x429ffe
Capabilities:
Hide graphical window

Disassembly:
push dword [0x4eda14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42a02f
push 0
push dword [0x4eda14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4eda1c]
push 0
mov ecx, dword [ecx + 0x264]
call fcn.0044bda8
ret
Function at 0x42bea1
Capabilities:
Delete directory
Delete file

Disassembly:
push 4
mov eax, 0x4a25f5
call fcn.0045370f
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 1
mov esi, dword [edi + 0x30]
jmp 0x42bed6
cmp dword [esi + 0x18], 8
jb 0x42bec9
mov eax, dword [esi + 4]
jmp 0x42becc
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x30
cmp esi, dword [edi + 0x34]
jne 0x42bebe
lea eax, [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x42bee6
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [edi + 0x30]
call fcn.00417c1b
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00401b80
call fcn.004536dd
ret
Function at 0x42dea7
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x434
mov eax, 0x4a2eae
call fcn.00453742
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x43c]
call fcn.004018f0
test eax, eax
jne 0x42e00a
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
mov esi, ebx
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0x440]
push ebx
push ebx
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x430], 0x208
push ebx
jmp 0x42dfe3
inc esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov byte [ebp - 4], 1
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42df85
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436fd3
test eax, eax
jne 0x42dff9
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42dfbc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436fd3
test eax, eax
jne 0x42dff9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
push ebx
push ebx
lea eax, [ebp - 0x440]
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x42df37
jmp 0x42e00a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.004018c0
mov eax, ebx
call fcn.004536f1
ret 4
Function at 0x4302a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3754
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3034
call fcn.004549e0
mov eax, dword [0x4e98d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x3028], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x3028], edi
cmp edi, 0xffffffff
jne 0x430356
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp byte [ebp + 0x14], bl
je 0x43032e
cmp ecx, 0x20
je 0x430327
cmp ecx, 0x21
jne 0x43032e
xor eax, eax
jmp 0x4304d3
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x430356
mov dword [ebp - 0x3038], eax
push 0x4da0e8
lea eax, [ebp - 0x3038]
push eax
call fcn.00453682
push 0x2800
call fcn.00452087
pop ecx
mov esi, eax
mov dword [ebp - 0x3040], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x302c], ebx
mov dword [ebp - 0x3024], 0x2800
lea eax, [ebp - 0x3024]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.msi.dll_MsiRecordSetStringA
mov ebx, eax
mov dword [ebp - 0x3030], ebx
test ebx, ebx
je 0x4303cc
push 0x1004
push 0
push ebx
lea ecx, [ebp - 0x1018]
call fcn.0042bb58
push eax
lea eax, [ebp - 0x201c]
push eax
call fcn.004529d0
add esp, 0xc
push 0x4da0b4
lea eax, [ebp - 0x201c]
jmp 0x430350
mov eax, dword [ebp - 0x3024]
test eax, eax
je 0x430460
push 0
lea ecx, [ebp - 0x303c]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43041e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x43041e
mov dword [ebp - 0x3034], ecx
push 0x4da0e8
lea eax, [ebp - 0x3034]
jmp 0x430350
mov eax, dword [ebp - 0x3024]
cmp dword [ebp - 0x303c], eax
je 0x430460
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x43045a
mov dword [ebp - 0x3044], ecx
push 0x4da0e8
lea eax, [ebp - 0x3044]
jmp 0x430350
mov eax, dword [ebp - 0x3024]
add dword [ebp - 0x302c], eax
test eax, eax
jne 0x430373
mov byte [ebp - 4], al
push esi
call fcn.0045269e
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4304c5
cmp edi, 0xffffffff
je 0x4304d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004526a3
leave
ret
Function at 0x43059a
Capabilities:
Check os version

Disassembly:
push 0x1fc
mov eax, 0x4a3869
call fcn.00453742
mov ebx, ecx
mov dword [ebp - 0x1f8], ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1ec]
push eax
mov dword [ebp - 0x1ec], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1e8], 5
jne 0x43074a
cmp dword [ebp - 0x1e4], 2
jne 0x43074a
cmp byte [ebp - 0xd2], 1
je 0x43074a
push 0x4b40ac
push edi
call fcn.004546ef
pop ecx
pop ecx
test eax, eax
jne 0x430609
inc eax
jmp 0x4307e2
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x1ed]
push eax
push edi
lea ecx, [ebp - 0xa0]
call fcn.004115c6
mov dword [ebp - 4], 6
cmp dword [ebp - 0x8c], 0
je 0x430734
xor esi, esi
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x204], esi
mov dword [ebp - 0x200], esi
mov byte [ebp - 4], 7
push ebx
lea eax, [ebp - 0x208]
push eax
push esi
push 0x2c
lea ecx, [ebp - 0xa0]
call fcn.00418827
push esi
lea eax, [ebp - 0x1ed]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4c8e80
mov dword [ebp - 0x18], 0x4c8e20
call fcn.00403e30
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x204]
sub eax, ecx
push 0x30
mov dword [ebp - 0x1f4], ecx
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x1fc], eax
test eax, eax
je 0x430719
mov edi, dword [ebp - 0x1f8]
push ebx
lea eax, [ebp - 0x1ed]
push eax
push str.dotnetfxsp1.exe
lea ecx, [ebp - 0xd0]
call fcn.004115c6
mov byte [ebp - 4], 0xa
push eax
push dword [ebp - 0x1f4]
lea eax, [ebp - 0x70]
push eax
call fcn.0042729e
add esp, 0xc
mov byte [ebp - 4], 0xb
push esi
push esi
lea ecx, [ebp - 0x40]
push ecx
push eax
mov ecx, edi
call fcn.00432427
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x70]
call fcn.00401b80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd0]
call fcn.00401b80
add dword [ebp - 0x1f4], 0x30
dec dword [ebp - 0x1fc]
jne 0x4306ae
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x40]
call fcn.00401b80
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x208]
call fcn.00417c1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401b80
mov eax, ebx
jmp 0x4307e2
xor esi, esi
push esi
lea eax, [ebp - 0x1ed]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4c8e80
mov dword [ebp - 0x18], 0x4c8e20
call fcn.00403e30
mov dword [ebp - 4], 1
push 0x4b40ac
push edi
call fcn.004546ef
pop ecx
pop ecx
test eax, eax
jne 0x4307d1
push 1
lea eax, [ebp - 0x1ed]
push eax
push str.dotnetfxsp1.exe
lea ecx, [ebp - 0x70]
call fcn.004115c6
mov byte [ebp - 4], 2
push esi
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, ebx
call fcn.00432427
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00401b80
inc bl
je 0x4307d1
mov ecx, dword [ebp - 0x1f8]
call fcn.0042e0b7
jmp 0x4307d4
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401b80
mov eax, esi
call fcn.004536f1
ret 4
Function at 0x434c4a
Capabilities:
Set current directory

Disassembly:
push 0x45c
mov eax, 0x4a4e49
call fcn.00453742
mov esi, ecx
mov dword [ebp - 0x458], esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
push ecx
lea eax, [ebp - 0x216]
push eax
mov dword [ebx], ecx
mov byte [ebp - 0x451], cl
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0x459]
push 1
push eax
push edi
lea ecx, [ebp - 0x450]
call fcn.00402ca0
and dword [ebp - 4], 0
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x434cb3
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x464]
push str.Installing_MSI_engine__s
push eax
mov dword [ebp - 0x464], str.msiaction.cpp
mov dword [ebp - 0x460], 0x833
call fcn.004192e5
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00401ac0
push 4
lea eax, [ebp - 0x450]
push eax
mov ecx, esi
call fcn.0040f919
mov ecx, eax
call fcn.00419d63
mov dword [ebp - 4], 2
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x434d14
mov eax, dword [eax]
push eax
push str.2.0.2600.0
call fcn.00450cb8
pop ecx
pop ecx
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00401b80
test esi, esi
jns 0x434d50
push edi
lea eax, [ebp - 0x218]
push str.__s___q
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, 0x4b6938
jmp 0x434d98
mov ecx, dword [ebp - 0x458]
mov byte [ebp - 0x451], 1
call fcn.0040f919
mov ecx, eax
call fcn.00445d92
test eax, eax
push edi
lea eax, [ebp - 0x218]
je 0x434d87
push str.__s___quiet__norestart
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, str._quiet__norestart
jmp 0x434d98
push str.__s___c:_msiinst__delayrebootq_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, str._c:_msiinst__delayrebootq_
mov ecx, dword [ebp - 0x458]
add esp, 0xc
call fcn.0040f919
mov ecx, eax
call fcn.00445d92
test eax, eax
je 0x434dc8
mov ecx, dword [ebp - 0x458]
call fcn.0040f919
push eax
push 1
push esi
push edi
call fcn.0045066e
jmp 0x434dd6
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.004504e2
mov esi, eax
test esi, esi
je 0x434eb7
cmp esi, 0xbc2
je 0x434e03
push 0
push esi
mov dword [0x4ef824], 0x484
call fcn.00450773
pop ecx
pop ecx
mov eax, esi
jmp 0x434eb9
cmp byte [ebp - 0x451], 0
je 0x434eb1
mov dword [ebx], 2
xor ebx, ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 4], 4
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x468]
call fcn.004018f0
test eax, eax
jne 0x434ea0
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x420]
push eax
push str.InstallerLocation
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0x104
call fcn.004019e0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.004018c0
jmp 0x434eb7
mov dword [ebx], 1
xor eax, eax
call fcn.004536f1
ret 8
Function at 0x436e11
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push 0xaec
mov eax, 0x4a56ed
call fcn.00453742
mov edi, dword [ebp + 8]
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor ebx, ebx
lea eax, [ebp - 0x80e]
push ebx
push eax
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 1
lea eax, [ebp - 0xaf1]
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x870]
call fcn.00402ca0
mov dword [ebp - 4], ebx
push 1
lea eax, [ebp - 0xaf1]
push eax
push 0x4b6090
lea ecx, [ebp - 0x840]
call fcn.00402ca0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x870]
call fcn.00439356
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x840]
call fcn.00401ac0
or dword [ebp - 0xaf8], 0xffffffff
mov byte [ebp - 4], 3
cmp dword [ebp - 0x858], 8
lea ecx, [ebp - 0xaf0]
lea eax, [ebp - 0x86c]
cmovae eax, dword [ebp - 0x86c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x436fae
lea ecx, [ebp - 0xaf8]
call fcn.00438b70
mov dword [ebp - 0xaf8], esi
lea eax, [ebp - 0xae4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x436f98
push 1
lea eax, [ebp - 0xaf1]
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402ca0
mov byte [ebp - 4], 5
push 1
lea eax, [ebp - 0xaf1]
push eax
lea eax, [ebp - 0xac4]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.00402ca0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x840]
call fcn.00439356
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8a0]
call fcn.00401ac0
cmp dword [ebp - 0x828], 8
lea eax, [ebp - 0x83c]
cmovae eax, dword [ebp - 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x840]
call fcn.00401ac0
lea eax, [ebp - 0xaf0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x436ef9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xaf8]
call fcn.00438b70
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x870]
call fcn.00401ac0
call fcn.004536f1
ret 4
Function at 0x43e493
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x4e98d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x12c], 0
push esi
push edi
mov esi, ecx
call fcn.0040f912
xor edi, edi
lea eax, [ebp - 0x118]
inc edi
push eax
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], ecx
sub eax, 0
je 0x43e57a
dec eax
je 0x43e569
dec eax
jne 0x43e584
lea eax, [ebp - 0x154]
push eax
mov dword [ebp - 0x130], 2
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x154]
push 4
pop ecx
dec eax
je 0x43e553
dec eax
je 0x43e547
dec eax
jne 0x43e559
mov dword [ebp - 0x130], 5
jmp 0x43e559
mov dword [ebp - 0x130], 3
jmp 0x43e559
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x114], ecx
jb 0x43e584
mov dword [ebp - 0x12c], edi
jmp 0x43e584
movzx eax, cx
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x120], eax
jmp 0x43e584
mov dword [ebp - 0x130], 7
lea ecx, [ebp - 0x130]
push ecx
mov ecx, esi
call fcn.0040f919
mov ecx, eax
call fcn.004470d2
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004526a3
leave
ret

Function at 0x43e68b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43e6bb
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 0xd8]
mov ecx, dword [ebp + 0x10]
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc esi
dec edx
jne 0x43e6a3
pop edi
pop esi
jmp 0x43e6be
mov ecx, dword [ebp + 0x10]
mov eax, ecx
pop ebp
ret 0xc
Function at 0x4409dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x4a7f39
call fcn.004537ae
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
xor ebx, ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
push 0x60
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x440a59
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x440a59
call fcn.0043fed7
mov esi, eax
jmp 0x440b3a
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x440a7c
call fcn.0043fed7
jmp 0x440b2d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x440a72
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x440aaf
mov esi, 0x8007000e
jmp 0x440b2f
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x418]
call fcn.0043fc76
mov dword [ebp - 4], 1
jmp 0x440ae3
cmp dword [ebp - 0x418], 0
je 0x440aa5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x440a72
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.004408a3
mov esi, eax
test edi, edi
je 0x440b3a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x440b56
lea ecx, [ebp - 0x418]
call fcn.00440198
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00453700
ret 0x10
Function at 0x441b9b
Capabilities:
Read file on windows

Disassembly:
push 0x8c
mov eax, 0x4a81b5
call fcn.00453742
mov esi, ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x98], 0
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 8]
xor ebx, ebx
inc ebx
cmp eax, 0xffffffff
cmove eax, ebx
test ecx, ecx
je 0x441c0d
lea edi, [ebp - 0x98]
push edi
push eax
push edx
call fcn.00492703
test al, al
jne 0x441c56
push ebx
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004424f0
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x94]
call fcn.0044243e
push 0x4dea64
lea eax, [ebp - 0x94]
push eax
call fcn.00453682
push 0
lea ecx, [ebp - 0x98]
push ecx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441c56
push ebx
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004424f0
mov dword [ebp - 4], 2
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00442244
push 0x4de9f0
lea eax, [ebp - 0x90]
jmp 0x441c07
mov eax, dword [ebp - 0x98]
call fcn.004536f1
ret 8

Function at 0x441c64
Capabilities:
Read file on windows

Disassembly:
push 0x8c
mov eax, 0x4a81ed
call fcn.00453742
mov esi, ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x98], 0
mov edx, dword [ebp + 8]
push 8
pop ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x441cd8
lea edi, [ebp - 0x98]
push edi
push eax
push edx
call fcn.00492703
test al, al
jne 0x441d23
push 1
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004424f0
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x94]
call fcn.0044243e
push 0x4dea64
lea eax, [ebp - 0x94]
push eax
call fcn.00453682
push 0
lea ecx, [ebp - 0x98]
push ecx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441d23
push 1
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004424f0
mov dword [ebp - 4], 2
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00442244
push 0x4de9f0
lea eax, [ebp - 0x90]
jmp 0x441cd2
mov eax, dword [ebp - 0x98]
call fcn.004536f1
ret 8
Function at 0x446350
Capabilities:
Create process on windows

Disassembly:
push 0x8cc
mov eax, 0x4a9e69
call fcn.00453742
mov esi, ecx
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor edi, edi
lea eax, [ebp - 0x80e]
push edi
push eax
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x400
push eax
push 0x4c8c5c
push str.ClickOncePackage
push str.Startup
lea ecx, [esi + 0x10]
call fcn.0041284a
cmp word [ebp - 0x810], di
jne 0x4463b4
xor eax, eax
jmp 0x446511
lea eax, [ebp - 0x870]
push eax
mov ecx, esi
call fcn.00444404
mov dword [ebp - 4], edi
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x4463d0
mov eax, dword [eax]
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x8d1]
push ecx
push eax
lea ecx, [ebp - 0x840]
call fcn.00402ca0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.00401b80
push esi
lea eax, [ebp - 0x8d1]
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x870]
call fcn.00402ca0
mov byte [ebp - 4], 4
push edi
push edi
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0x840]
call fcn.00403330
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x870]
push ecx
lea ecx, [ebp - 0x8a0]
push ecx
mov ecx, eax
call fcn.00402da0
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x840]
call fcn.00402b50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8a0]
call fcn.00401ac0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8d0]
call fcn.00401ac0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.00401ac0
cmp dword [ebp - 0x828], 8
push 4
lea eax, [ebp - 0x83c]
cmovae eax, dword [ebp - 0x83c]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0x8d8], esp
push esi
lea edx, [ebp - 0x8d1]
push edx
push eax
call fcn.004115c6
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 2
call fcn.00482620
add esp, 0x34
test al, al
jne 0x4464d3
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x83c]
call fcn.004060d0
cmp dword [ebp - 0x828], 8
push esi
push edi
push edi
lea eax, [ebp - 0x83c]
cmovae eax, dword [ebp - 0x83c]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb esi, esi
neg esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00401ac0
mov eax, esi
call fcn.004536f1
ret