joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42542b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x208], ax
xor edi, edi
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.004127f0
add esp, 0xc
cmp dword [ebp + 0xc], edi
je 0x4254be
mov ecx, dword [ebp + 0xc]
call fcn.004078bb
cmp eax, 1
jb 0x4254be
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4254be
mov edi, 0x208
push 0x442888
mov edx, edi
lea ecx, [ebp - 0x208]
call fcn.00409f71
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [ebp - 0x208]
call fcn.00409f71
push 1
push 1
push 0x442880
lea eax, [ebp - 0x208]
push eax
mov ecx, 0x44f56c
call fcn.00424c62
pop edi
leave
ret 8

Function at 0x4254ee
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x410
push ebp
push esi
mov esi, dword [esp + 0x41c]
mov ebp, ecx
test esi, esi
jne 0x425507
xor eax, eax
jmp 0x425586
push esi
mov edx, 0x410
lea ecx, [esp + 0xc]
call fcn.00409fab
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + eax*2 + 6]
jmp 0x425530
cmp word [eax], 0x5c
je 0x42553a
sub eax, 2
lea ecx, [esp + 8]
cmp eax, ecx
ja 0x425527
jmp 0x42556c
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42556c
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42556c
lea eax, [esp + 8]
push eax
mov ecx, ebp
call fcn.004254ee
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425583
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x425586
xor eax, eax
inc eax
pop esi
pop ebp
add esp, 0x410
ret 4
Function at 0x429787
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
mov eax, dword [edi + 0x2c]
sub esi, dword [edi + 0x74]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
cmp dword [edi + 0x6c], eax
jb 0x429821
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00413310
mov ecx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [esp + 0x14], ecx
lea ebp, [eax + ecx*2]
mov edi, ecx
lea ebp, [ebp - 2]
xor ecx, ecx
movzx edx, word [ebp]
mov eax, edx
sub eax, ebx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [ebp], cx
dec edi
jne 0x4297d7
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea ebp, [eax + ebx*2]
lea ebp, [ebp - 2]
xor ecx, ecx
movzx edx, word [ebp]
mov eax, edx
sub eax, ebx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [ebp], cx
dec edi
jne 0x4297ff
mov edi, dword [esp + 0x10]
add esi, ebx
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x429876
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
push esi
add edx, dword [edi + 0x38]
call fcn.0042987d
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
pop ecx
jb 0x429861
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movsx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movsx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x429876
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x429796
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x42afb7
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x274
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [esp + 0x28]
push ebx
push eax
mov ebp, ecx
mov dword [esp + 0x2c], ebx
call fcn.004127f0
mov dword [esp + 0x1c], ebx
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x68]
stosd dword es:[edi], eax
call fcn.00405a58
mov ecx, dword [ebp + 0x54]
lea eax, [ecx + 0x41e]
push eax
lea eax, [ecx + 0x216]
push eax
lea eax, [esp + 0x70]
push str.__s_s___install
push eax
call fcn.00409413
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [esp + 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42b064
lea esi, [ebp + 0x1ac7]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.startprograminstall_u
push 0x80
push esi
call fcn.0040a8c7
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42b12a
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebx
je 0x42b085
push 0xea60
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call esi
cmp dword [esp + 0x14], ebx
je 0x42b091
push dword [esp + 0x14]
call esi
mov eax, dword [ebp + 0x54]
cmp dword [eax + 8], 3
jne 0x42b128
push dword [esp + 0x74]
push dword [esp + 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x68]
call fcn.004059ee
push 0x2e
lea ecx, [esp + 0x6c]
call fcn.004059bf
test eax, eax
jle 0x42b0cf
push eax
lea ecx, [esp + 0x6c]
call fcn.004059a3
push 0x5c
lea ecx, [esp + 0x6c]
call fcn.004059bf
test eax, eax
jle 0x42b0ea
inc eax
push eax
push ecx
lea ecx, [esp + 0x70]
call fcn.0040a66e
lea ecx, [esp + 0x68]
call fcn.0040967a
test al, al
jne 0x42b128
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x42b10f
push dword [esp + 0x74]
push eax
call fcn.00410572
mov eax, dword [esp + 0x74]
pop ecx
pop ecx
push eax
push ecx
push 0x444244
mov edx, str.SoftwareMetaQuotes_SoftwareMetaTrader_5Settings
mov ecx, SysReAllocStringLen
call fcn.00409d55
add esp, 0xc
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x274
ret
Function at 0x42b3d6
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00405a58
lea ecx, [ebp - 0x430]
call fcn.00405a58
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.004059ee
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.00409413
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x42b45d
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
mov bl, 1
call fcn.0042b137
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x42b463
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x430]
call fcn.00405a58
lea ecx, [ebp - 0x648]
call fcn.00405a58
lea ecx, [ebp - 0x218]
call fcn.00405a58
mov eax, dword [esi + 0x54]
xor ebx, ebx
cmp dword [eax + 8], 6
je 0x42b4a8
cmp dword [eax + 8], 7
je 0x42b4a8
cmp dword [eax + 8], 3
jne 0x42b4e8
add eax, 0x216
push eax
lea eax, [ebp - 0x218]
push str._s_terminal.ico
push eax
call fcn.00409413
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42b4e8
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x42b4e8
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x54]
lea eax, [ecx + 0x41e]
push eax
lea eax, [ecx + 0x216]
push eax
lea eax, [ebp - 0x648]
push 0x442874
push eax
call fcn.00409413
mov ecx, dword [esi + 0x54]
add esp, 0x10
lea eax, [ecx + 0xe]
push dword [ebp - 0x214]
push dword [ebp - 0x424]
push dword [ebp - 0x42c]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x216]
push eax
call fcn.0042522a
test eax, eax
je 0x42b55a
lea ecx, [ebp - 0x430]
call fcn.004059ee
push dword [ebp - 0x42c]
lea ecx, [esi + 0x1600]
call fcn.0040ac90
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x42b695
Capabilities:
Check if file exists
Delete file
Get file attributes
Print debug messages
Set file attributes

Disassembly:
sub esp, 0x9c
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb4]
push edi
mov ebp, ecx
test esi, esi
jne 0x42b6b3
xor al, al
jmp 0x42b877
mov edi, dword [esp + 0xb0]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x42b754
lea ecx, [esp + 0x38]
call fcn.00424b64
push edi
lea ecx, [esp + 0x3c]
call fcn.004249d2
lea ecx, [esp + 0x38]
call fcn.00424961
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.0042494b
call fcn.00424b19
push dword [esp + 0xbc]
push esi
call fcn.00424a61
lea ecx, [esp + 0x38]
call fcn.00424961
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
call fcn.0042494b
mov ecx, ebx
lea edx, [esp + 0x18]
mov ebx, eax
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4]
jne 0x42b74b
inc ecx
cmp ecx, 4
jne 0x42b72d
lea ecx, [esp + 0x38]
call fcn.00424b40
mov al, 1
jmp 0x42b877
lea ecx, [esp + 0x38]
call fcn.00424b40
or dword [esp + 0x1c], 0xffffffff
push ecx
push 2
push ecx
push 0x40000000
push dword [edi + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x442514
call fcn.00409510
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x42b7ec
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42b79c
push 0x80
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ecx
push 2
push ecx
push 0x40000000
push dword [edi + 4]
lea ecx, [esp + 0x2c]
call fcn.00409510
test al, al
jne 0x42b7ec
mov eax, dword [esp + 0xb4]
lea esi, [ebp + 0x1ac7]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.openfailed_u_S
push 0x80
push esi
call fcn.0040a8c7
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [esp + 0x1c]
jmp 0x42b86b
push dword [esp + 0xbc]
lea ecx, [esp + 0x1c]
push esi
call fcn.004093db
cmp eax, dword [esp + 0xbc]
je 0x42b851
mov eax, dword [esp + 0xb4]
lea esi, [ebp + 0x1ac7]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.writefailed_u_S
push 0x80
push esi
call fcn.0040a8c7
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x42b846
push esi
call ebx
or esi, 0xffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42b86b
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x42b866
push esi
call ebx
or esi, 0xffffffff
mov byte [esp + 0x14], 1
cmp esi, 0xffffffff
je 0x42b873
push esi
call ebx
mov al, byte [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x42bb9f
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
sub esp, 0x448
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ebp, 0x206
push ebp
mov word [esp + 0x254], ax
xor ebx, ebx
lea eax, [esp + 0x256]
push ebx
push eax
mov esi, ecx
call fcn.004127f0
add esp, 0xc
lea eax, [esp + 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x42bc0a
add esi, 0x1ac7
push str.temppathnotfound
mov edx, 0x80
mov ecx, esi
call fcn.0040aa8f
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x42bde3
lea ecx, [esp + 0x2c]
call fcn.0040ac4f
xor eax, eax
push ebp
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push ebx
or edi, 0xffffffff
push eax
mov dword [esp + 0x30], 0x442514
mov dword [esp + 0x34], edi
call fcn.004127f0
mov ecx, dword [esp + 0x468]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
push 0
mov bl, 1
call fcn.0040a92c
test al, al
je 0x42bdd0
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x42bdc8
inc dword [esp + 0x1c]
cmp dword [esp + 0x14], 5
je 0x42bcad
mov eax, dword [esi + 0x54]
cmp dword [eax + 4], 1
jne 0x42bc9c
cmp dword [esp + 0x14], 8
jne 0x42bd5a
cmp dword [eax + 4], 2
jne 0x42bcad
cmp dword [esp + 0x14], 9
jne 0x42bd5a
lea eax, [esp + 0x48]
push eax
push 0
push 0x443db0
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x42bda8
push ecx
push 2
push ecx
push 0x40000000
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.00409510
test al, al
je 0x42bd84
push dword [esp + 0x18]
lea ecx, [esp + 0x28]
push dword [esp + 0x24]
call fcn.004093db
cmp eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
sete bl
cmp edi, 0xffffffff
je 0x42bd19
push edi
call ebp
or edi, 0xffffffff
mov dword [esp + 0x28], edi
test bl, bl
je 0x42bd4f
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.0042b884
mov bl, al
test bl, bl
je 0x42bd4f
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x1600]
call fcn.0040a63b
mov bl, al
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x45c]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0040a92c
test al, al
jne 0x42bc75
jmp 0x42bdc8
add esi, 0x1ac7
push str.tempwritefailed
mov edx, 0x80
mov ecx, esi
call fcn.0040aa8f
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [esp + 0x28]
jmp 0x42bdc6
add esi, 0x1ac7
push str.tempfilenotfound
mov edx, 0x80
mov ecx, esi
call fcn.0040aa8f
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
cmp edi, 0xffffffff
je 0x42bdd0
push edi
call ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x44251c
call fcn.00409706
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret 4
Function at 0x42be36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa7c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x870]
call fcn.00405a58
lea ecx, [esp + 0x658]
call fcn.00405a58
lea ecx, [esp + 0x440]
call fcn.00405a58
lea ecx, [esp + 0x228]
call fcn.00405a58
lea ecx, [esp + 0x10]
call fcn.00405a58
push dword [esi + 0x18b8]
mov eax, dword [esi + 0x54]
push dword [esi + 0x18b0]
add eax, 0x626
push eax
call fcn.004253de
test eax, eax
je 0x42c09d
lea ecx, [esi + 0x18ac]
call fcn.004059ee
xor ebx, ebx
push 0x23
lea edi, [ebx + 1]
mov ebp, 0x442874
pop ebx
push edi
lea eax, [esp + 0x22c]
push str.link_name__u
push eax
call fcn.00409413
mov ecx, dword [esi + 0x58]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.0043148b
test al, al
je 0x42c098
mov ecx, dword [esp + 0x14]
mov edx, str.PROGRAM
call fcn.00401153
test eax, eax
jne 0x42bf21
mov ecx, dword [esi + 0x58]
lea eax, [esp + 0x10]
push eax
push str.company_program_brief
call fcn.0043148b
test al, al
je 0x42c098
push str..lnk
lea ecx, [esp + 0x14]
call fcn.0040aa34
push dword [esp + 0x14]
lea eax, [esp + 0x874]
push dword [esi + 0x18b0]
push ebp
push eax
call fcn.00409413
push edi
lea eax, [esp + 0x23c]
push str.file_name__u
push eax
call fcn.00409413
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.0043148b
test al, al
je 0x42c098
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x42bf90
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x54]
mov edx, eax
call fcn.0042ae68
pop ecx
test al, al
je 0x42c098
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x448]
push ebp
push eax
call fcn.00409413
push edi
lea eax, [esp + 0x23c]
push str.icon_file__u
push eax
call fcn.00409413
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.0043148b
test al, al
je 0x42c098
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x42bfff
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x54]
mov edx, eax
call fcn.0042ae68
pop ecx
test al, al
je 0x42c098
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x660]
push ebp
push eax
call fcn.00409413
push edi
lea eax, [esp + 0x23c]
push str.icon_index__u
push eax
call fcn.00409413
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.0043148b
test al, al
je 0x42c098
push dword [esp + 0x14]
call fcn.004102a7
pop ecx
push dword [esp + 0x444]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c089
mov eax, dword [esi + 0x54]
push ebp
push dword [esp + 0x660]
add eax, 0x216
push ecx
push ecx
push dword [esp + 0x884]
push dword [esp + 0x458]
push eax
call fcn.00424feb
inc edi
mov ebp, 0x442874
cmp edi, 0x40
jb 0x42beb5
xor ebx, ebx
inc ebx
jmp 0x42c0b4
push str.creategroup
lea ecx, [esi + 0x1ac7]
mov edx, 0x80
call fcn.0040aa8f
xor bl, bl
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xa7c
ret
Function at 0x42c699
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi + 0x54]
mov edi, 0x216
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c6df
mov eax, dword [esi + 0x54]
add eax, edi
push eax
mov ecx, 0x44f56c
call fcn.004254ee
test eax, eax
jne 0x42c6df
push str.createfolder
jmp 0x42c6ef
mov ecx, esi
call fcn.0042be2b
test al, al
jne 0x42c72d
push 0x443910
lea ecx, [esi + 0x1ac7]
mov edx, 0x80
call fcn.0040aa8f
push 2
lea eax, [esi + 0x1bf4]
push eax
call fcn.0042ca7f
push ebx
push 7
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0042b560
test al, al
je 0x42c6ff
mov ecx, esi
call fcn.0042be36
mov byte [esi + 0x1ac6], al
test al, al
je 0x42c6ff
mov ecx, esi
call fcn.0042bdf0
test al, al
je 0x42c6ff
mov eax, dword [esi + 0x54]
mov edi, 0x80
test byte [eax], 1
je 0x42c77e
mov ecx, esi
call fcn.0042b463
test al, al
jne 0x42c77e
push str.createdesktop
lea ecx, [esi + 0x1ac7]
mov edx, edi
call fcn.0040aa8f
mov ecx, esi
call fcn.0042b3d6
test al, al
jne 0x42c79b
push str.createuninstall
lea ecx, [esi + 0x1ac7]
mov edx, edi
call fcn.0040aa8f
mov ecx, esi
call fcn.0042afb7
test al, al
je 0x42c6ff
mov ecx, esi
call fcn.0042c31a
mov bl, 1
jmp 0x42c71e

Function at 0x42ca7f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
jne 0x42caad
push 0xc8
push 7
push 0
mov ecx, esi
call fcn.004207fa
mov ecx, esi
call fcn.0042077c
cmp dword [esp + 0xc], 1
jne 0x42cac8
mov ecx, esi
call fcn.00420761
push 0
push 8
push 8
mov ecx, esi
call fcn.004207fa
cmp dword [esp + 0xc], 2
jne 0x42cae3
mov ecx, esi
call fcn.00420761
push 0
push 9
push 9
mov ecx, esi
call fcn.004207fa
pop esi
ret 8
Function at 0x42cae7
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, ecx
push esi
cmp byte [ebp + 0x1ac5], 0
push edi
jne 0x42cc02
cmp byte [ebp + 0x1ac4], 0
je 0x42cc02
mov eax, dword [ebp + 0x54]
test byte [eax], 2
je 0x42cc42
xor ebx, ebx
push ebx
lea eax, [esp + 0x20]
push eax
push 1
push 0x20000
push 2
mov byte [esp + 0x2b], bl
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
test eax, eax
je 0x42cbe0
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_SaferComputeTokenFromLevel]
test eax, eax
je 0x42cbd0
push 0x40
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.004127f0
mov ecx, dword [ebp + 0x54]
xor eax, eax
mov dword [esp + 0x2c], ebx
add esp, 0xc
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [ecx + 0x216]
push eax
push ebx
push 0x20
push 1
push ebx
push ebx
lea eax, [ecx + 0x41e]
push eax
push ebx
push dword [esp + 0x40]
mov dword [esp + 0x64], str.winsta0default
mov dword [esp + 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
test eax, eax
setne byte [esp + 0x1b]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
cmp byte [esp + 0x17], bl
jne 0x42cc42
mov ecx, dword [ebp + 0x54]
push 1
lea eax, [ecx + 0x216]
push eax
push ebx
lea eax, [ecx + 0x41e]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42cc42
cmp byte [ebp + 0x1ac6], 0
je 0x42cc19
mov eax, dword [ebp + 0x54]
add eax, 0x626
push eax
call fcn.004254c3
xor ebx, ebx
cmp dword [ebp + 0x1608], ebx
jbe 0x42cc42
mov eax, dword [ebp + 0x1610]
imul eax, ebx
add eax, dword [ebp + 0x1604]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc ebx
cmp ebx, dword [ebp + 0x1608]
jb 0x42cc23
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6c
ret
Function at 0x42d4ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
movzx eax, word [esp + 8]
push ebp
push esi
push edi
push 0x44445c
push eax
push dword [0x44dfc8]
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x42d589
push esi
push dword [0x44dfc4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 0x32
jbe 0x42d589
push esi
push dword [0x44dfc4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42d589
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x42d589
push ebx
push 0x44e088
mov eax, edi
shr eax, 1
mov dword [esp + 0x1c], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004100d6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42d54a
xor bl, bl
jmp 0x42d57d
lea eax, [edi - 2]
push eax
lea eax, [ebp + 2]
push eax
push ebx
call fcn.00413310
mov eax, dword [esp + 0x24]
add esp, 0xc
xor ecx, ecx
mov word [ebx + eax*2 - 4], cx
mov eax, dword [esp + 0x10]
push ebx
push dword [eax + 0x60]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.004100d1
pop ecx
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
pop ebx
jmp 0x42d58b
xor al, al
pop edi
pop esi
pop ebp
pop ecx
ret 4