joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
xor edi, edi
mov word [ebp - 0x20c], ax
call fcn.0049eae0
add esp, 0xc
cmp byte [esi + 0xc14], 0
jne 0x43214f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push edi
call ebx
test eax, eax
je 0x432163
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x432010
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432010
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x20e], 0x5c
lea eax, [ebp + eax*2 - 0x20e]
je 0x432044
lea ecx, [ebp - 0x20c]
cmp eax, ecx
je 0x432044
sub eax, 2
cmp word [eax], 0x5c
jne 0x432031
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x20c]
lea edi, [esi + 0xc16]
mov edx, edi
mov ecx, eax
sub edx, ecx
jmp 0x432060
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x432060
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x432072
mov edx, dword [0x4d3378]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
mov dword [edi], edx
call ebx
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4320a0
sub eax, edx
sar eax, 1
je 0x4320cf
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0049ad10
add esp, 4
test eax, eax
je 0x4320cf
mov byte [esi + 0xc14], 1
xor ebx, ebx
jmp 0x4320d4
mov ebx, 2
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0xc04], eax
call edi
mov edx, dword [esi + 0xc04]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
mov dword [esi + 0xc08], eax
call edi
mov eax, dword [esi + 0xc08]
push eax
call edi
mov ecx, dword [ebp + 8]
lea edx, [esi + 0xc10]
push edx
push 0
push esi
push 0x431c30
push 0
push 0
mov dword [0x4fbb50], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc0c], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop ebx
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4
Function at 0x432c80
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebx], vtable.CPacker.0
cmp dword [ebx + 0xc0c], edi
je 0x432d05
mov eax, dword [ebx + 0xc08]
cmp eax, edi
je 0x432d05
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0xc0c]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x432cd2
mov ecx, dword [ebx + 0xc0c]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebx + 0xc0c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebx + 0xc04]
push eax
mov dword [ebx + 0xc0c], edi
call esi
mov ecx, dword [ebx + 0xc08]
push ecx
mov dword [ebx + 0xc04], edi
call esi
mov dword [ebx + 0xc08], edi
mov eax, dword [ebx + 0x1030]
mov edx, dword [ebx + 0x1034]
cmp eax, edx
je 0x432d47
mov dword [ebp - 4], eax
mov eax, edx
cmp edx, edx
je 0x432d3e
mov edi, edi
mov edi, dword [ebp - 4]
add dword [ebp - 4], 0x850
mov esi, eax
add eax, 0x850
mov ecx, 0x214
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
jne 0x432d20
xor edi, edi
mov edx, dword [ebp - 4]
mov dword [ebx + 0x1034], edx
lea eax, [ebx + 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x4fbb54]
dec eax
mov dword [0x4fbb54], eax
cmp eax, edi
jg 0x432d68
call fcn.0049ab60
mov eax, dword [ebx + 0x1030]
cmp eax, edi
je 0x432d7b
push eax
call fcn.0049eb5a
add esp, 4
mov dword [ebx + 0x1030], edi
mov dword [ebx + 0x1034], edi
mov dword [ebx + 0x1038], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4336f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbe52
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov edi, ecx
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp - 0x40e]
mov dword [ebp - 0x44c], 0
push edx
mov dword [ebp - 0x450], eax
mov word [ebp - 0x410], cx
call fcn.0049eae0
add esp, 0xc
push esi
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
cmp eax, 1
jne 0x433782
add edi, 4
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x410]
push eax
call edi
jmp 0x433788
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test esi, esi
je 0x4337ac
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433791
sub eax, edx
sar eax, 1
je 0x4337ac
push esi
lea ecx, [ebp - 0x410]
push ecx
call edi
mov edx, dword [ebp - 0x450]
push edx
lea eax, [ebp - 0x410]
push eax
call edi
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 3
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4338e9
push 2
push 0
push 0
push edi
mov dword [ebp - 0x450], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x43387d
lea ecx, [ebp - 0x448]
push ecx
mov ecx, ebx
call fcn.00433440
mov esi, eax
lea edx, [ebp - 0x42c]
push edx
mov ecx, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x44c], 1
call fcn.00433440
cmp dword [eax + 0x14], 8
mov esi, dword [esi + 0x10]
mov dword [ebp - 0x44c], 3
jb 0x433860
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x450]
push ecx
lea edx, [esi + esi]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43387d
xor bl, bl
jmp 0x43387f
mov bl, 1
test byte [ebp - 0x44c], 2
je 0x4338c4
and dword [ebp - 0x44c], 0xfffffffd
cmp dword [ebp - 0x418], 8
jb 0x4338a7
mov eax, dword [ebp - 0x42c]
push eax
call fcn.0049eb5a
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], 0
mov word [ebp - 0x42c], cx
test byte [ebp - 0x44c], 1
je 0x4338e5
cmp dword [ebp - 0x434], 8
jb 0x4338e5
mov edx, dword [ebp - 0x448]
push edx
call fcn.0049eb5a
add esp, 4
test bl, bl
je 0x4338f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x454], 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 1
push eax
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434210
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1780
call fcn.004a1410
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x860], 0
je 0x43439f
xor eax, eax
push 0x176e
push eax
lea ecx, [ebp - 0x1772]
push ecx
mov dword [ebp - 0x1778], 0
mov dword [ebp - 0x1780], 2
mov word [ebp - 0x1774], ax
call fcn.0049eae0
add esp, 0xc
lea edx, [ebp - 0x1778]
push edx
push 0xf003f
push 0
push str.Environment
push SysReAllocString
mov dword [ebp - 0x177c], 0xbb8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434375
lea eax, [ebp - 0x177c]
push eax
mov eax, dword [ebp - 0x1778]
lea ecx, [ebp - 0x1774]
push ecx
lea edx, [ebp - 0x1780]
push edx
push 0
push 0x4d47b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434375
mov edx, str._USERPROFILE_Local_SettingsTemp
lea ecx, [ebp - 0x1774]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4342fb
test ax, ax
je 0x4342f7
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4342fb
add ecx, 4
add edx, 4
test ax, ax
jne 0x4342d5
xor eax, eax
jmp 0x434300
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x434375
cmp dword [edi + 0x860], 1
jne 0x434321
mov ecx, dword [ebp - 0x1778]
push 0x4d47b4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x434361
mov edx, dword [edi + 0x864]
mov eax, edx
push esi
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434330
mov ecx, dword [edi + 0x868]
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [ebp - 0x1778]
push ecx
push 0
push 0x4d47b4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
push 0x4d4758
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x1778]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 0x864]
test eax, eax
je 0x43439f
push eax
call fcn.004a0a01
add esp, 4
mov dword [edi + 0x864], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049f71b
mov esp, ebp
pop ebp
ret
Function at 0x439970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x439992
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
test al, al
je 0x439992
mov eax, 9
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x439ace
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4399a3
sub ecx, esi
sar ecx, 1
je 0x439ace
mov edx, 0x4fbb58
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4399c0
mov eax, 0x4fbb58
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4399d7
sub eax, edx
sar eax, 1
cmp word [eax*2 + 0x4fbb56], 0x5c
push edi
je 0x439a13
mov edi, 0x4fbb58
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x439a00
mov eax, dword [0x4d3378]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [0x4fbf58], ecx
test edi, edi
je 0x439aac
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439a30
sub eax, edx
sar eax, 1
je 0x439aac
push 0x408
call fcn.0049eef7
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, edi
sub esi, edi
jmp 0x439a60
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x439a60
mov dword [eax + 0x400], ebx
mov edx, dword [ebx + 0x5c]
mov dword [eax + 0x404], edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebx + 0x44]
call fcn.00439210
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push edx
push 0x4369b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
lea eax, [ebx + 0x54]
push eax
push 0
push ebx
push 0x435470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [ebx + 0x58], eax
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
pop esi
mov eax, 8
pop ebx
pop ebp
ret 0xc
Function at 0x43c250
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
push eax
mov dword [esi], vtable.CWebUpdateCore.0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x18]
push 0xfa0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43c286
mov edx, dword [esi + 0x18]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 8]
test eax, eax
je 0x43c29b
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x10]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
pop edi
pop esi
ret
Function at 0x43d270
Capabilities:
Create http request
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
xor al, al
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x810], ecx
test ecx, ecx
je 0x43d38b
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43d38a
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x43d38a
push 0x200
mov dword [esi + 4], ebx
lea ebx, [esi + 0x24]
push 0
push ebx
mov byte [0x4fbf64], al
mov dword [esi + 0x424], ecx
mov dword [esi + 0x428], edx
call fcn.0049eae0
push 0x2d
push edi
call fcn.004a1462
add esp, 0x14
test eax, eax
je 0x43d2f4
sub eax, edi
sar eax, 1
mov ecx, 0x5f
mov word [edi + eax*2], cx
mov eax, edi
sub ebx, edi
jmp 0x43d300
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x43d300
mov ecx, dword [ebp - 0x810]
lea edx, [ebp - 0x80c]
push edx
call fcn.0040a730
test al, al
je 0x43d388
cmp byte [ebp - 0x80c], 0
je 0x43d388
push 0
push 0
push 0
push 0
push 0x4d3364
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x43d367
mov eax, dword [ebp - 8]
lea ecx, [esi + 0x1c]
push ecx
push 0
push esi
push 0x43cf70
push 0
push 0
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
cmp dword [esi + 8], 0
je 0x43d388
cmp dword [esi + 0x18], 0
je 0x43d388
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 0x10
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x440020
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x441050
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x444140
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
push eax
push 0x200
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4

Function at 0x444b10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x54]
push edi
mov edi, dword [esi + 0x30]
movzx edx, ax
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*4]
shr eax, 0x10
cmp edx, ecx
ja 0x444b57
cmp edx, edi
jb 0x444b57
cmp eax, dword [esi + 0x3c]
ja 0x444b57
cmp eax, dword [esi + 0x34]
jb 0x444b57
push 1
push 0
lea edx, [esi + 0x60]
push edx
mov dword [esi + 0x870], 1
push str.IEXPLORE.exe
jmp 0x444b8f
mov ecx, dword [esi + 0x50]
mov edi, dword [esi + 0x40]
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*4]
cmp edx, ecx
ja 0x444b9c
cmp edx, edi
jb 0x444b9c
cmp eax, dword [esi + 0x4c]
ja 0x444b9c
cmp eax, dword [esi + 0x44]
jb 0x444b9c
push 1
push 0
lea edx, [esi + 0x460]
push edx
mov dword [esi + 0x870], 0
push str.IEXPLORE.EXE
push 0x4d4e10
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
mov ecx, esi
call fcn.0043ff30
pop edi
pop esi
pop ebp
ret 8
Function at 0x4471c0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0xc40]
mov byte [esi + 0x428], 0
test ecx, ecx
je 0x4471e5
call fcn.0047f420
cmp dword [esi + 0xc44], 0
je 0x447209
cmp byte [0x4fcdcd], 0
je 0x447209
mov byte [0x4fcdcd], 0
mov ecx, dword [esi + 0xc44]
call fcn.00440020
mov ecx, 0x4d4fec
lea eax, [esi + 8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x447237
test dx, dx
je 0x447233
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x447237
add eax, 4
add ecx, 4
test dx, dx
jne 0x447211
xor eax, eax
jmp 0x44723c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x447247
mov byte [esi + 0xc4d], 1
pop esi
ret

Function at 0x449000
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp - 0x402]
push edx
mov dword [ebp - 0x40c], eax
mov word [ebp - 0x404], cx
call fcn.0049eae0
lea ebx, [edi + 0x88e]
mov eax, ebx
add esp, 0xc
mov byte [ebp - 0x405], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449050
sub eax, edx
sar eax, 1
jne 0x449144
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push 0x26
push 0
call esi
test eax, eax
jns 0x449095
lea ecx, [ebp - 0x404]
push ecx
push 1
push 0
push 0x8026
push 0
call esi
lea eax, [ebp - 0x404]
mov esi, ebx
mov edx, eax
sub esi, edx
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x4490a1
mov ecx, dword [edi + 0x10a4]
test ecx, ecx
je 0x449143
lea eax, [ebp - 0x405]
push eax
lea edx, [ebp - 0x404]
push edx
call fcn.0040a460
cmp byte [ebp - 0x405], 0
jne 0x44912e
lea edi, [ebx - 2]
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4490e0
mov eax, dword [0x4d3378]
mov dword [edi], eax
lea eax, [ebp - 0x404]
mov edx, eax
jmp 0x449100
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449100
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x449110
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x449143
lea eax, [ebp - 0x404]
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x449134
pop esi
mov edx, dword [ebp - 0x40c]
pop edi
mov eax, ebx
sub edx, ebx
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x449150
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4
Function at 0x449170
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov word [ebp - 0x404], ax
call fcn.0049eae0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
push 0
push 0
push 0x23
push 0
call esi
test eax, eax
jns 0x4491d9
lea eax, [ebp - 0x404]
push eax
push 1
push 0
push 0x8023
push 0
call esi
test eax, eax
js 0x449222
lea eax, [ebp - 0x404]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4491e5
push edi
lea edi, [ebx - 2]
jmp 0x449200
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x449200
push 0
mov ecx, 8
mov esi, str.Installations_
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4
Function at 0x449240
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14a8
call fcn.004a1410
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x3fe
mov edi, ecx
push eax
lea ecx, [ebp - 0x1002]
push ecx
mov word [ebp - 0x1004], ax
call fcn.0049eae0
add esp, 0xc
lea edx, [ebp - 0x1004]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [edi + 0x10a4]
xor ebx, ebx
call fcn.00410070
test eax, eax
je 0x4493fd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov word [ebp - 0x404], ax
call fcn.0049eae0
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0xc02]
push eax
mov word [ebp - 0xc04], dx
call fcn.0049eae0
add esp, 0x18
lea ecx, [ebp - 0x14a4]
push ecx
mov ecx, dword [edi + 0x10a4]
push ebx
call fcn.004139a0
test al, al
je 0x4493e8
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x14a4]
push eax
lea ecx, [ebp - 0x1456]
push ecx
mov ecx, dword [edi + 0x880]
call fcn.00404b40
test al, al
je 0x4493e8
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449330
sub eax, edx
sar eax, 1
je 0x4493e8
push 0x200
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0xc04]
push eax
call fcn.004a092d
lea ecx, [ebp - 0xc04]
push 0x5c
push ecx
call fcn.004a1462
add esp, 0x14
test eax, eax
je 0x4493e8
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x3fc
lea ecx, [ebp - 0x800]
push 0
push ecx
mov dword [ebp - 0x804], 0x22
call fcn.0049eae0
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x804]
push eax
call esi
push 0x4d5110
lea ecx, [ebp - 0x804]
push ecx
call esi
lea edx, [ebp - 0x1408]
push edx
lea eax, [ebp - 0x804]
push eax
call esi
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.00403200
add esp, 8
mov ecx, dword [edi + 0x10a4]
inc ebx
call fcn.00410070
cmp ebx, eax
jb 0x4492a7
pop esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049f71b
mov esp, ebp
pop ebp
ret
Function at 0x449ce0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4f6cdc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ecx
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x40c], esi
mov word [ebp - 0x404], ax
call fcn.0049eae0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
push edi
lea edx, [ebp - 0x404]
push edx
call ebx
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x404]
push eax
call fcn.00430de0
mov dword [ebp - 0x408], 0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
push 0xfffffffffffffff6
mov esi, eax
call edi
mov edi, eax
cmp esi, 0xffffffff
jne 0x449d67
xor esi, esi
cmp edi, 0xffffffff
jne 0x449d6e
xor edi, edi
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ecx + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
je 0x449db7
push str.Unpacking_started._Please_wait._n
lea eax, [ebp - 0x404]
push eax
call ebx
push 0
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ecx, dword [ebp - 0x40c]
mov ecx, dword [ecx + 0xc]
call fcn.00430870
add eax, 0xfffffffc
cmp eax, 5
ja case.0x449dd1.5
jmp dword [eax*4 + 0x449e74]
test esi, esi
je case.0x449dd1.5
test edi, edi
je case.0x449dd1.5
push str.Unpacking_failed._Path_not_found._Press_any_key_to_continue...
jmp 0x449e12
test esi, esi
je case.0x449dd1.5
test edi, edi
je case.0x449dd1.5
push str.Unpacking_failed._Unknown_error._Press_any_key_to_continue...
jmp 0x449e12
test esi, esi
je case.0x449dd1.5
test edi, edi
je case.0x449dd1.5
push str.Unpacking_failed._Writing_file_failed._Press_any_key_to_continue...
jmp 0x449e12
test esi, esi
je case.0x449dd1.5
test edi, edi
je case.0x449dd1.5
push str.Unpacking_failed._Nothing_to_unpack._Press_any_key_to_continue...
lea edx, [ebp - 0x404]
push edx
call ebx
push 0
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [ebp - 0x404]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
lea eax, [ebp - 0x408]
push eax
push 1
lea ecx, [ebp - 0x404]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f71b
mov esp, ebp
pop ebp
ret 4