joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409577
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.0059fbd0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
lea eax, [ebp - 0x618]
call fcn.004016d4
mov eax, dword [ebx]
push 0
push str.Sox
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebx]
push 1
lea ecx, [ebp - 0x618]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], 2
lea eax, [ebp - 0x820]
push eax
push str.soxdec
push ebx
call fcn.00402374
test al, al
je 0x409689
lea eax, [ebp - 0x208]
push eax
call fcn.00401b1f
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call fcn.00401a8b
mov ecx, dword [esi]
lea eax, [ebp - 0xa28]
call fcn.0040171e
lea eax, [ebp - 0xa28]
push eax
lea edx, [ebp - 0x208]
lea edi, [ebp - 0x410]
call fcn.004a2d01
mov eax, edi
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [esi + 4]
lea eax, [ebp - 0x820]
push dword [esi]
mov esi, 0x400
push eax
push str.__s____s____s_
lea edi, [ebp - 0x1228]
call fcn.004a9039
mov eax, dword [ebx]
add esp, 0x10
mov ecx, ebx
call dword [eax + 0x28]
push 0xffffffffffffffff
mov eax, edi
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
call fcn.004b3385
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41c6ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push edi
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and word [esi], 0
xor ebx, ebx
inc ebx
mov edi, str.Temp_d.wav
jmp 0x41c72a
push esi
call fcn.004a29dc
test al, al
jne 0x41c729
push esi
call fcn.00401a5f
test al, al
jne 0x41c759
inc ebx
push ebx
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00401000
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push esi
call fcn.00401f2d
push esi
call fcn.00401b98
test al, al
jne 0x41c715
xor eax, eax
cmp word [esi], ax
pop edi
setne al
pop ebx
leave
ret

Function at 0x41dcbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0xc4]
push 0x104
push 0x5b07d8
push dword [ebp + 8]
add eax, 4
mov dword [ebp - 4], eax
call fcn.00436f6c
mov edx, eax
lea esi, [ebp - 0x218]
call fcn.004a8ff7
mov ebx, 0x5c461c
mov ecx, ebx
mov eax, esi
call fcn.0040106a
test eax, eax
jne 0x41de14
mov ecx, dword [ebp + 8]
mov eax, str.DATE
call fcn.0040106a
test eax, eax
jne 0x41dd4c
mov eax, dword [ebp - 4]
push 0x104
push 0x5b07d8
push 0x5afd20
call fcn.00436f6c
mov edx, eax
call fcn.004a8ff7
mov ecx, ebx
mov eax, esi
call fcn.0040106a
test eax, eax
jne 0x41de14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor esi, esi
mov eax, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], esi
call fcn.00465752
push esi
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
push 4
pop ecx
call fcn.00465331
mov esi, dword [ebp + 8]
sub esi, eax
mov dword [ebp + 8], esi
fild dword [ebp + 8]
fmul dword [0x60d840]
call fcn.005a6560
push 0
push 0x50000201
push str.Static
push dword [ebp + 0x10]
mov edx, ebx
mov dword [ebp + 8], eax
call fcn.0046951c
push dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
push edi
call fcn.0046562d
push 0
push 0x50010300
push str.Button
push dword [ebp + 0x14]
mov edx, 0x5c47e4
call fcn.0046951c
push dword [edi + 4]
push 4
pop ecx
call fcn.00465331
push dword [ebp - 0xc]
sub esi, ebx
push esi
push dword [ebp - 8]
add eax, ebx
add eax, dword [ebp - 4]
push eax
push dword [ebp + 0x14]
push edi
call fcn.0046562d
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4284d3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
cmp byte [0x623a28], 0
je 0x4284e9
mov al, 1
leave
ret
push esi
push 0x104
mov edx, str.unrar.dll
lea esi, [ebp - 0x410]
call fcn.004a8ff7
lea eax, [ebp - 0x618]
push eax
call fcn.004a5c16
push 0x5b07d8
mov eax, esi
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004a2dab
lea eax, [ebp - 0x208]
push eax
call fcn.00401b98
test al, al
jne 0x428549
lea esi, [ebp - 0x208]
call fcn.0042847e
test al, al
je 0x4285d5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
lea eax, [ebp - 0x208]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x428572
lea eax, [ebp - 0x410]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x428572
xor al, al
jmp 0x4285d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RAROpenArchiveEx
push edi
call esi
test eax, eax
mov dword [0x6228cc], eax
je 0x4285d2
push str.RARCloseArchive
push edi
call esi
test eax, eax
mov dword [0x622ad8], eax
je 0x4285d2
push str.RARReadHeaderEx
push edi
call esi
test eax, eax
mov dword [0x622adc], eax
je 0x4285d2
push str.RARProcessFileW
push edi
call esi
test eax, eax
mov dword [0x6228c0], eax
je 0x4285d2
push str.RARSetPassword
push edi
call esi
test eax, eax
mov dword [0x6228c4], eax
je 0x4285d2
xor eax, eax
inc eax
jmp 0x4285d4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x43b08c
Capabilities:
Hide graphical window

Disassembly:
cmp byte [edi + 0x1d], 0
je 0x43b0c8
push ebx
push esi
mov esi, dword [edi + 0x15]
push 0
mov ebx, 0x257f
push ebx
mov byte [edi + 0x1d], 0
call fcn.00465469
mov eax, dword [edi + 0x15]
push 0
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x15]
call fcn.00409e7a
pop esi
pop ebx
ret

Function at 0x446aee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x446b4a
mov eax, dword [ebp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x446b18
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x446b4c
xor al, al
pop ebx
pop ebp
ret 0x10

Function at 0x446b51
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallSwitch
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x446b94
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push str.EstimatedSize
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 8

Function at 0x446bf9
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp + 0xc]
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x446c5e
push ebx
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
call ebx
cmp eax, 2
jne 0x446c54
push esi
push edi
push dword [ebp + 0x10]
mov esi, 0x104
push 0x5e8de8
lea edi, [ebp - 0x208]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp + 0xc]
call ebx
pop edi
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 0xc
Function at 0x44bc2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea edx, [ecx + 0x28]
mov dword [ebp - 0x30], edx
movzx dx, byte [eax + 2]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
imul eax, eax, 0x41
push esi
mov word [ebp - 0x1e], dx
cdq
mov esi, 0x140
idiv esi
and word [ebp - 0x12], 0
push 0x30
mov dword [ebp - 0x34], 0x46464952
mov dword [ebp - 0x2c], 0x45564157
mov dword [ebp - 0x28], 0x20746d66
mov dword [ebp - 0x24], 0x14
mov word [ebp - 0x20], 0x31
mov word [ebp - 0x14], 0x41
mov word [ebp - 0x10], 2
mov word [ebp - 0xe], si
mov dword [ebp - 0xc], 0x61746164
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call fcn.00402005
pop esi
leave
ret 4

Function at 0x44bcac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, eax
movzx ecx, word [esi + 0x10]
movzx eax, cx
lea ebx, [eax + edx + 0x26]
add eax, 0x12
mov dword [ebp - 0x20], eax
mov ax, word [esi]
mov word [ebp - 0x1c], ax
mov ax, word [esi + 2]
mov word [ebp - 0x1a], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
mov ax, word [esi + 0xc]
mov word [ebp - 0x10], ax
mov ax, word [esi + 0xe]
push 0
mov word [ebp - 0xe], ax
push 0
mov eax, edi
mov dword [ebp - 0x30], 0x46464952
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x45564157
mov dword [ebp - 0x24], 0x20746d66
mov dword [ebp - 8], 0x61746164
mov dword [ebp - 4], edx
mov word [ebp - 0xc], cx
call fcn.00401976
push 0x14
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00402005
push 0x12
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00402005
movzx eax, word [esi + 0x10]
test ax, ax
jbe 0x44bd52
movzx eax, ax
push eax
add esi, 0x12
push esi
push edi
call fcn.00402005
push 8
lea eax, [ebp - 8]
push eax
push edi
call fcn.00402005
pop esi
pop ebx
leave
ret

Function at 0x44bf3e
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [ebx + 8]
mov eax, dword [esi]
test eax, eax
je 0x44bf57
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x44bfa5
and dword [ebp + 8], 0
push edi
lea eax, [ebp + 8]
push eax
push 0x5b0cd0
push 1
push 0
push 0x5b0b20
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, dword [ebp + 8]
test edi, edi
je 0x44bfa4
mov eax, dword [esi]
test eax, eax
je 0x44bf8a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
mov eax, dword [edi]
push 0
push esi
add ebx, 0xc
push ebx
push edi
call dword [eax + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x44bfa4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x44ce0f
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x624458], 0
jne 0x44ce34
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x624458], 1
add esp, 0x190
ret
Function at 0x44ce3b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov esi, 0x104
lea edi, [ebp - 0x104]
call fcn.00447030
mov eax, edi
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebx], eax
jne 0x44ce8d
mov eax, edi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44ce8a
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x44ce8a
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx], eax
jmp 0x44ce8d
and dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x44d99d
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
push str.UxTheme.dll
mov dword [esi], ebx
call edi
push str.dwmapi.dll
mov dword [esi + 4], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
je 0x44dac1
push str.OpenThemeData
push eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
push str.CloseThemeData
push eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
push str.DrawThemeBackground
push eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
push str.GetThemeColor
push eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push str.GetThemeSysColorBrush
push eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 4]
push str.GetThemePartSize
push eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 4]
push str.GetThemeBackgroundContentRect
push eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
push str.GetThemeFont
push eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push str.IsAppThemed
push eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push str.DrawThemeParentBackground
push eax
call edi
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
push str.SetWindowTheme
push eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 4]
push str.IsThemeBackgroundPartiallyTransparent
push eax
call edi
mov dword [esi + 0x40], eax
mov eax, dword [esi + 4]
push str.DrawThemeTextEx
push eax
call edi
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
push str.GetThemeSysFont
push eax
call edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 4]
push str.IsThemeActive
push eax
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 4]
push str.DrawThemeIcon
push eax
call edi
mov dword [esi + 0x50], eax
mov eax, dword [esi + 4]
push str.EnableThemeDialogTexture
push eax
call edi
mov dword [esi + 0x54], eax
jmp 0x44daf4
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x44db24
push str.DwmIsCompositionEnabled
push eax
call edi
mov dword [esi + 0x58], eax
mov eax, dword [esi + 8]
push str.DwmSetWindowAttribute
push eax
call edi
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 8]
push str.DwmExtendFrameIntoClientArea
push eax
call edi
mov dword [esi + 0x60], eax
jmp 0x44db2d
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
pop edi
mov eax, esi
pop ebx
ret
Function at 0x44e29a
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0x10]
push eax
mov ebx, 0xf003f
push ebx
push 0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x44e2de
push str.UninstallSwitch
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push edi
push SysReAllocString
call esi
test eax, eax
jne 0x44e307
push str.UninstallSwitch
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e30d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
call fcn.004012e4
test al, al
je 0x44e35a
push str._usermode
call fcn.004a92a9
test al, al
je 0x44e35a
call fcn.004a90ec
test al, al
je 0x44e35a
cmp byte [ebp + 8], 0
mov eax, str._uninstall__quiet
jne 0x44e346
mov eax, str._uninstall
push 1
push eax
mov eax, dword [0x623afc]
push dword [eax]
call fcn.004a894d
jmp 0x44e461
push esi
lea eax, [ebp - 0x244]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x5b07d8
push esi
push str.nchuninst
lea eax, [ebp - 0x244]
push eax
push eax
call fcn.004a2dab
lea ecx, [ebp - 0x244]
call fcn.004a32d9
lea ecx, [ebp - 0x244]
call fcn.004a311d
push esi
push str.uninst.exe
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.004a2dab
lea eax, [ebp - 0x44c]
push eax
mov eax, dword [0x623afc]
push dword [eax]
call fcn.00401a8b
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005970f0
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x2c], eax
add esp, 0xc
cmp byte [ebp + 8], 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], str._uninstall2__quiet
jne 0x44e409
mov dword [ebp - 0x28], str._uninstall2
mov dword [ebp - 0x20], 1
call fcn.004012e4
test al, al
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
je 0x44e453
mov eax, dword [0x623afc]
mov ecx, dword [eax]
lea eax, [ebp - 0x654]
call fcn.0040162b
lea eax, [ebp - 0x654]
push eax
call fcn.0040214c
test al, al
jne 0x44e453
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], str.runas
call esi
cmp eax, 1
je 0x44e460
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x5dadf8
call esi
pop esi
leave
ret 4
Function at 0x44e465
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push esi
je 0x44e493
call fcn.004ae0e2
test al, al
jne 0x44e522
call fcn.004ab7bc
test al, al
jne 0x44e522
jmp 0x44e49c
call fcn.004a878c
test al, al
je 0x44e4d5
push 0x6235e8
call fcn.004a6261
call fcn.00456f38
test al, al
je 0x44e4d5
cmp byte [ebp + 8], bl
jne 0x44e4d0
push 0x40
push 0xfffd
push 0x5dbbb4
push 0x5dbbc0
push ebx
mov ecx, 0x5db124
call fcn.0045aac8
call fcn.0044f42e
mov eax, dword [0x623afc]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push ebx
push dword [eax]
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x5b07d8
push str.nchuninst
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004a2dab
push 5
push ebx
lea eax, [ebp - 0x414]
push eax
call esi
pop esi
pop ebx
leave
ret 4

Function at 0x44e900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
push ebx
push esi
push edi
lea eax, [ebp - 0x24c]
push eax
mov edi, 0x5b07d8
push edi
push str.PreviousInstaller
push str.Software
call fcn.00457a1c
lea eax, [ebp - 0x24c]
push eax
call fcn.00401b98
xor ebx, ebx
test al, al
jne 0x44e941
mov word [ebp - 0x24c], bx
cmp word [ebp - 0x24c], bx
mov esi, 0x1388
mov dword [0x6a55d0], esi
mov dword [0x6a55d4], 0x5dc090
mov dword [0x6a55d8], 0x5dc0a0
mov dword [0x6a55dc], 0x1389
mov dword [0x6a55e0], 0x5dc0e4
mov dword [0x6a55e4], 0x5dc0fc
je 0x44e9b9
mov dword [0x6a55e8], 0x138a
mov dword [0x6a55ec], 0x5dc13c
mov dword [0x6a55f0], 0x5dc158
mov dword [0x6a55f4], ebx
mov dword [0x6a55f8], ebx
mov dword [0x6a55fc], ebx
jmp 0x44e9cb
mov dword [0x6a55e8], ebx
mov dword [0x6a55ec], ebx
mov dword [0x6a55f0], ebx
push ebx
push esi
push 0x6a55d0
push edi
push 0x5dc1a0
push str.Switch___v_11.19
push dword [ebp + 8]
lea eax, [ebp - 0x54c]
call fcn.004bf8b8
lea edi, [ebp - 0x54c]
call fcn.004c0124
sub eax, esi
je 0x44ea48
dec eax
je 0x44ea3e
dec eax
jne 0x44ea4d
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.005970f0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x30], eax
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x100
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x34], 0x5dadf8
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x44ea4d
mov edi, dword [ebp + 8]
call fcn.004bdf75
jmp 0x44ea4d
call fcn.0044e75c
lea esi, [ebp - 0x54c]
call fcn.00409cea
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4506c9
Capabilities:
Hide graphical window

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x4506e6
push 0
push dword [esi + 0xda]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45072f
push ebx
push edi
push 5
push dword [esi + 0xda]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
call edi
push 0x15
mov ebx, eax
call edi
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
push 0x104
push eax
sub ecx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
push ecx
sub eax, ebx
push eax
push 0
push dword [esi + 0xda]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
ret 8

Function at 0x450e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dx, 0x200
push ebx
mov ebx, dword [ebp + 8]
jg 0x450eb5
cmp word [ebp + 0xc], 0x5a0
jge 0x450eb5
movsx eax, word [ecx]
push esi
movsx esi, dx
cmp esi, eax
mov dword [ebp - 4], esi
jl 0x450e67
mov esi, eax
sub eax, esi
lea eax, [eax + ecx + 4]
push esi
push eax
lea ecx, [ebx + 4]
push ecx
call fcn.00590360
movsx eax, word [ebp + 0xc]
add esp, 0xc
push 0
lea edx, [ebp + 8]
push edx
mov edx, dword [edi]
push eax
lea ecx, [esi + ebx + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 8]
sub dword [edi + 0xc], eax
mov ecx, dword [ebp + 0xc]
lea edx, [esi + ecx]
sbb dword [edi + 0x10], 0
cmp esi, dword [ebp - 4]
pop esi
mov word [ebx], dx
setge al
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x451ee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
push esi
mov esi, edx
jbe 0x451f1a
push ebx
lea ebx, [ebx]
movzx ebx, byte [esi]
mov edx, eax
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
and edx, 0xff
sub ecx, 1
add esi, 1
xor bx, word [edx*2 + 0x5b11b0]
test ecx, ecx
movzx eax, bx
ja 0x451ef0
pop ebx
pop esi
ret
Function at 0x4567a7
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x456809
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x456800
cmp dword [ebp - 4], 1
sete bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, bl
pop ebx
leave
ret

Function at 0x45680e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
push ebx
push esi
push edi
call fcn.004567a7
neg al
sbb eax, eax
neg eax
push eax
push str.llinad
push str.UsageStatsChoice
call fcn.00402241
mov eax, dword [0x623a58]
mov esi, 0x623a58
jmp 0x456867
push eax
push 0x6235e8
lea eax, [ebp - 0x468]
push eax
call fcn.00401f2d
push 0
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x456841
call fcn.0044dee4
call fcn.00446cd0
test al, al
je 0x456955
lea eax, [ebp - 0x878]
call fcn.004a219a
lea eax, [ebp - 0x670]
call fcn.004a21ac
push 2
lea edi, [ebp - 0x878]
pop ebx
mov ecx, 0x5ddd3c
mov eax, edi
lea esi, [ebp - 0x260]
call fcn.00401d9a
jmp 0x45693b
push 0x10
lea eax, [ebp - 0x230]
push 0x5ddd48
push eax
mov dword [ebp - 4], eax
call fcn.0059091d
add esp, 0xc
test eax, eax
jne 0x4568d4
push 0x10
jmp 0x4568f0
push 7
lea eax, [ebp - 0x230]
push 0x5ddd6c
push eax
call fcn.0059091d
add esp, 0xc
test eax, eax
jne 0x456930
push 7
lea ecx, [ebp - 4]
call fcn.0055b3c1
push 0x28
lea eax, [ebp - 4]
call fcn.0055b3de
mov eax, dword [ebp - 4]
cmp word [eax], 0x28
jne 0x456930
lea eax, [ebp - 0x230]
push eax
push edi
lea eax, [ebp - 0x468]
push eax
call fcn.00401f2d
lea eax, [ebp - 0x468]
push eax
mov eax, 0xbb8
call fcn.004a1fa0
lea esi, [ebp - 0x260]
call fcn.00401dd7
cmp dword [ebp - 0x260], 0xffffffff
jne 0x4568b3
add edi, 0x208
dec ebx
jne 0x45689c
call fcn.0045fd4a
pop edi
pop esi
mov al, 1
pop ebx
leave
ret