joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401412
Capabilities:
Get file size

Disassembly:
mov eax, 0x474c18
call fcn.004461a8
sub esp, 0x134
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014df
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4014d8
push edi
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4014ce
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x3c]
push dword [ebp + 0xc]
call fcn.00401764
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00401992
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00445cc0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.00401bc7
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x14]
push edi
call fcn.004013b4
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4015a1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
je 0x4015fe
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4015f6
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.00401504
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x401604
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.004461c7
mov esi, eax
pop ecx
test esi, esi
je 0x401652
xor edx, edx
test ebx, ebx
jbe 0x401652
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x40163c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4040bc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4041d8
cmp byte [ebp + 0xc], bl
jne 0x404170
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 1]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4041d8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x4041ce
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004468d0
mov eax, esp
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov word [eax], bx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 8]
call fcn.004468ff
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00405098
push dword [ebp + 0xc]
jmp 0x4041c0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 3]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4041d8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x4041ce
call fcn.004468ff
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00405098
push dword [ebp + 0xc]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x4041da
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x404ed9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 1], bl
je 0x404f48
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 2
jb 0x404f2b
movzx eax, byte [ebp - 0x408]
cmp eax, 0xffffffff
jne 0x404f2b
movzx eax, byte [ebp - 0x407]
cmp eax, 0xfffffffe
jne 0x404f2b
mov byte [ebp - 1], 1
jmp 0x404f48
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x404f48
cmp byte [ebp - 1], bl
jne 0x404f48
cmp byte [ebp + eax - 0x408], bl
sete byte [ebp - 1]
inc eax
cmp eax, dword [ebp - 8]
jb 0x404f32
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x407232
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040104a
mov ecx, eax
call fcn.0042e81d
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x407273
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.004072c8
test eax, eax
jne 0x4072bf
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jle 0x40728f
push esi
push edi
mov ecx, ebx
call fcn.004072c8
test eax, eax
jne 0x4072bf
push 0x49cc4c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
push esi
push 3
call fcn.00441703
add esp, 0xc
test eax, eax
jge 0x4072bf
push edi
push esi
push 4
call fcn.00441703
add esp, 0xc
test eax, eax
jge 0x4072bf
xor eax, eax
jmp 0x4072c2
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x409e54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x409e7a
push ebx
push ebx
call fcn.004472fc
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x409e92
push ebx
push ebx
call fcn.004472fc
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jne 0x409ea9
push ebx
push ebx
call fcn.004472fc
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [esi], eax
jne 0x409ebf
push ebx
push ebx
call fcn.004472fc
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.00446cd0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40a2a2
Capabilities:
Copy file
Create thread

Disassembly:
mov eax, 0x4756d2
call fcn.004461a8
sub esp, 0x828
push ebx
push esi
push dword [ebp + 8]
mov ebx, ecx
call fcn.0040a49b
test al, al
je 0x40a2d5
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x40a444
push edi
xor esi, esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x832]
mov word [ebp - 0x834], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x834]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.0040a4c5
lea eax, [ebp - 0x834]
lea edi, [ebx + 0x90]
test eax, eax
lea eax, [ebp - 0x834]
jne 0x40a31c
mov eax, 0x49cc4c
push eax
mov ecx, edi
call fcn.00401969
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + 0xb8]
cmp eax, esi
jne 0x40a336
mov eax, 0x49cc4c
push eax
call fcn.00401969
push 0x2c
call fcn.004461c7
pop ecx
mov dword [ebp + 8], eax
cmp eax, esi
mov dword [ebp - 4], esi
je 0x40a365
mov ecx, edi
call fcn.00408ddf
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
push 4
push ebx
push eax
call fcn.0040a454
jmp 0x40a367
xor eax, eax
mov dword [ebx + 0xe0], eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
push esi
push ebx
push 0x40a24c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 4
mov dword [ebp - 0x10], edi
call fcn.004461c7
pop ecx
mov dword [eax], edi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
push esi
push eax
mov dword [ebp + 8], eax
push 1
call edi
cmp eax, 1
mov dword [ebp + 0xc], eax
jne 0x40a3f6
push 1
push esi
push esi
lea eax, [ebp - 0x34]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a3e7
cmp dword [ebp - 0x30], 0x8032
jne 0x40a3db
mov ecx, dword [ebx + 0xe0]
call fcn.0040a82a
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a3b4
push 0xff
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push 1
jmp 0x40a3aa
push dword [ebp + 8]
call fcn.004454c4
mov ebx, dword [ebx + 0xe0]
pop ecx
cmp ebx, esi
pop edi
je 0x40a419
lea ecx, [ebx + 8]
call fcn.0040a62d
push ebx
call fcn.004454c4
pop ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40a423
xor eax, eax
jmp 0x40a444
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x14], esi
setge al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40a800
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
xor edi, edi
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a825
call esi
call esi
inc edi
cmp edi, 0x64
jl 0x40a80a
pop edi
xor eax, eax
pop esi
ret
Function at 0x40b421
Capabilities:
Get common file path

Disassembly:
mov eax, 0x475853
call fcn.004461a8
sub esp, 0x45c
push ebx
push esi
lea eax, [ebp - 0x260]
push edi
xor ebx, ebx
push eax
mov esi, ecx
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x58]
lea ecx, [esi + 8]
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040b932
mov eax, dword [eax + 0x10]
lea ecx, [ebp - 0x468]
push ecx
push ebx
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x58]
call fcn.0040a62d
lea eax, [ebp - 0x468]
push ebx
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x24], 0x47e664
mov dword [ebp - 0x1c], 0x47e65c
call fcn.0040a5a0
mov edi, 0x47e658
mov dword [ebp - 0x30], edi
cmp byte [esi + 0x28], bl
mov dword [ebp - 4], 1
je 0x40b50f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
call fcn.0040b932
push dword [eax + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x260]
push eax
call esi
lea ecx, [ebp - 0x58]
call fcn.0040a62d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.0040bb80
push dword [eax + 0x10]
lea eax, [ebp - 0x260]
push eax
call esi
lea ecx, [ebp - 0x58]
call fcn.0040a62d
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push ebx
push eax
mov ecx, esi
mov dword [esi + 0xc], 0x47e664
mov dword [esi + 0x14], 0x47e65c
call fcn.0040b60b
mov dword [esi], edi
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0040a62d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40f504
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f620
cmp byte [ebp + 0xc], bl
jne 0x40f5b8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 1]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40f620
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x40f616
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004468d0
mov eax, esp
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov word [eax], bx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 8]
call fcn.004468ff
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404d3c
push dword [ebp + 0xc]
jmp 0x40f608
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 3]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40f620
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x40f616
call fcn.004468ff
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00404d3c
push dword [ebp + 0xc]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x40f622
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40fc38
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 1], bl
je 0x40fca7
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 2
jb 0x40fc8a
movzx eax, byte [ebp - 0x408]
cmp eax, 0xffffffff
jne 0x40fc8a
movzx eax, byte [ebp - 0x407]
cmp eax, 0xfffffffe
jne 0x40fc8a
mov byte [ebp - 1], 1
jmp 0x40fca7
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x40fca7
cmp byte [ebp - 1], bl
jne 0x40fca7
cmp byte [ebp + eax - 0x408], bl
sete byte [ebp - 1]
inc eax
cmp eax, dword [ebp - 8]
jb 0x40fc91
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x4130db
Capabilities:
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
xor ebx, ebx
cmp dword [0x49cca4], ebx
push esi
push edi
mov esi, ecx
jne 0x4130ff
cmp byte [0x49cca9], bl
je 0x413225
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, esi
call fcn.004132b0
xor al, al
cmp dword [ebp - 0x110], 5
ja 0x413132
jne 0x41313d
cmp dword [ebp - 0x10c], ebx
jbe 0x41313d
cmp dword [ebp - 0x104], 2
jne 0x41313d
mov al, 1
cmp byte [0x49cca9], bl
je 0x413188
cmp al, bl
je 0x413188
mov ecx, esi
call fcn.00414511
mov edi, eax
cmp edi, ebx
je 0x413225
mov al, byte [ebp + 8]
push ebx
neg al
sbb eax, eax
add eax, 4
push eax
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x413225
push edi
mov ecx, esi
call fcn.0041464d
jmp 0x413225
cmp byte [ebp + 8], bl
je 0x4131df
cmp al, bl
je 0x4131c1
push 0xfffffffffffffff0
push dword [0x49cca4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x9c], eax
or al, 8
push eax
push 0xfffffffffffffff0
push dword [0x49cca4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x64
push 1
push 0x40a
jmp 0x413219
lea eax, [esi + 0x98]
push eax
push ebx
push esi
push 0x41322c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x94], eax
jmp 0x413225
cmp al, bl
je 0x413212
add esi, 0x9c
cmp dword [esi], ebx
je 0x413212
push ebx
push ebx
push 0x40a
push dword [0x49cca4]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi]
push 0xfffffffffffffff0
push dword [0x49cca4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x413225
push ebx
push ebx
push 0x402
push dword [0x49cca4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x414293
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x476457
call fcn.004461a8
mov eax, 0x10a0
call fcn.004468d0
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x21]
mov ebx, 0x47e5a0
mov edi, 0x47e598
push esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], edi
call fcn.004017e6
or dword [ebp - 0x20], 0xffffffff
push 1
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov eax, dword [eax + 8]
cmp eax, esi
jne 0x4142e9
mov eax, 0x47e5b8
push esi
push 0x80
push 3
push esi
push ecx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x2c], esi
je 0x4143e5
lea eax, [ebp - 0xac]
mov dword [ebp - 0x20], esi
push eax
call fcn.00463186
pop ecx
lea eax, [ebp + 0xc]
push 0
push eax
lea eax, [ebp - 0x10ac]
push 0x1000
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
call esi
test eax, eax
je 0x414372
push dword [ebp + 0xc]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.004631ae
add esp, 0xc
cmp dword [ebp + 0xc], 0
jbe 0x414372
lea eax, [ebp + 0xc]
push 0
push eax
lea eax, [ebp - 0x10ac]
push 0x1000
push eax
push dword [ebp - 0x2c]
jmp 0x414336
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0046324c
movzx eax, byte [ebp - 0xd]
pop ecx
pop ecx
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push str._02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call fcn.00414a68
add esp, 0x48
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x20], edi
call fcn.0040e384
mov dword [ebp - 0x28], 1
cmp dword [ebp - 0x20], 0xffffffff
je 0x414415
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x414415
push dword [ebp - 0x20]
call eax
and byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00401bc7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x415ab1
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x47668f
call fcn.004461a8
sub esp, 0x84
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0xc]
call fcn.0042f5a2
mov ecx, dword [ebx + 0xc]
push 0x13
call fcn.00408306
test al, al
je 0x415c0e
xor edi, edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], edi
push eax
push 0xf003f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysReAllocStringLen
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x415bfe
lea ecx, [ebp - 0x10]
call fcn.0040d2f9
mov ecx, dword [ebp - 0x18]
cmp eax, edi
mov dword [ebp - 0x10], ecx
jne 0x415bfe
lea eax, [ebp - 0x12]
mov edi, 0x47e5e0
mov esi, 0x47e5d8
push 0
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
call fcn.004029f5
mov dword [ebp - 0x40], edi
xor edi, edi
lea eax, [ebp - 0x11]
push edi
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], esi
call fcn.004029f5
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 2
call fcn.00433442
mov eax, dword [eax + 8]
mov byte [ebp - 4], 3
cmp eax, edi
mov esi, 0x47e608
jne 0x415b7f
mov eax, esi
push eax
lea eax, [ebp - 0x40]
push str.__IS_PREREQCMD____s
push eax
call fcn.00414bf6
add esp, 0xc
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.00401f6c
mov eax, dword [ebp - 0x38]
cmp eax, edi
jne 0x415ba9
mov eax, esi
lea ecx, [ebp - 0x68]
push 0x104
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00443512
add esp, 0x10
test eax, eax
jne 0x415be4
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x68]
push edi
push eax
push 0x15
call fcn.004082ae
cmp dword [ebp - 0x38], edi
je 0x415bda
mov esi, dword [ebp - 0x38]
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401f6c
and byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00401f6c
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x415c10
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x415c10
xor edi, edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0x13
mov dword [ebp - 4], 4
call fcn.00408306
mov ecx, dword [ebx + 0xc]
push eax
push dword [ebp + 8]
push 2
call fcn.00430376
cmp dword [ebp - 0x10], edi
mov esi, eax
je 0x415c45
push dword [ebp - 0x10]
call fcn.0044526c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x416998
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4169ef
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x49cd84
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4169e6
mov byte [0x49ed88], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret