joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x4096c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x450], dx
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x40974f
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.004062c0
push 0x40b3b4
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.00406310
jmp 0x40979e
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409780
push 0x40b3b8
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.00406310
jmp 0x40979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b3d8
push str.SHGetFolderPath_failed
call fcn.004080a0
add esp, 0xc
jmp 0x409874
lea ecx, [ebp - 0x450]
push ecx
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.004062c0
push str.AdobeARMHelper.exe
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00406310
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
push ecx
call fcn.004095f0
add esp, 8
test eax, eax
jne 0x4097fc
push 0x357
lea edx, [ebp - 0x248]
push edx
push str.Service_workflow_failed__file_not_valid:
call fcn.004080a0
add esp, 0xc
jmp 0x409874
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x20], 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x248]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40985b
push 0
push 0x40b48c
push str.ShellExecuteEx_succeeded
call fcn.004080a0
add esp, 0xc
jmp 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b4c4
push str.ShellExecuteEx_failed
call fcn.004080a0
add esp, 0xc
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x805df8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805dfe
pop ebp
sub ebp, 6
sub ebp, 0x405df8
jmp 0x805e5c
jmp 0x805e65
mov eax, 0x405df8
add eax, ebp
add eax, 0x93
mov ecx, 0x643
mov edx, 0x31f85ce4
xor byte [eax], dl
inc eax
dec ecx
jne 0x805e7c
jmp 0x805e8f
mov fs, word [esp + ecx*4 - 0x1b1b0b1c]
mov esp, fs
sub al, cl
in al, 0x65
adc al, 0xa8
mov esp, 0x146512f0
test al, 0xbc
invalid

Function at 0x408945
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040895b
add ebx, esi
xor dword [ecx], edx
add ebx, esi
inc ecx
cmp ecx, edi
jne fcn.00408945
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408923
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub ecx, ecx
call fcn.0040894d
mov ecx, 0x83a4b1ac
push 0xa17f2a9
pop edi
xor dword [esi], eax
inc esi
mov edi, edi
cmp esi, ebx
jne fcn.00408923
sub edi, 1
ret
Function at 0x4041b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x4041fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x4041cd
jmp 0x4041fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4041ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x404261
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.TestMaybe.exe_gMozillaPoisonSize]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x404299
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x1c]
jb 0x4042c3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x1c]
jb 0x4042c3
test edi, edi
je 0x404290
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404290
test edi, edi
je 0x4042cb
mov eax, edi
jmp 0x404292
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x404292
int3

Function at 0x4042fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [sym.TestMaybe.exe_gMozillaPoisonSize], eax
call fcn.00404261
mov ecx, dword [sym.TestMaybe.exe_gMozillaPoisonSize]
mov dword [sym.TestMaybe.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x404330
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMaybe.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x402ca9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x451dd4
call fcn.0043bf61
lea ecx, [ebp - 0x1c]
call fcn.0042c78d
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402ed5
or dword [ebp - 4], 0xffffffff
call fcn.0042c7a3
and dword [ebp - 0x18], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402dac
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402da3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x402dac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x402dac
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, edi
je 0x402d6f
cmp word [esi], bx
jne 0x402d6b
cmp dword [ebp - 0x20], ebx
je 0x402d65
push dword [ebp - 0x20]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
call fcn.00402e3f
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
jmp 0x402d6b
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x402d3b
or dword [ebp - 4], 0xffffffff
jmp 0x402daa
mov dword [ebp - 0x18], 1
jmp 0x402db4
call fcn.00403497
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x402dd7
call fcn.0043c006
ret 4
Function at 0x406833
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406896
cmp dword [ebp + 0xc], 1
je 0x40686f
cmp dword [ebp + 0xc], 2
je 0x40686f
push 0xd
pop eax
jmp 0x406896
test edi, edi
mov eax, dword [ebp - 4]
je 0x406890
test eax, eax
je 0x40688c
test al, 1
jne 0x40686a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x406890
jmp 0x40686a
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x409286
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x451a6f
call fcn.0043bf2e
and dword [ebp - 4], 0
mov edx, 0x45c64c
mov ecx, 0x473b58
call fcn.00402ddf
mov ebx, eax
test ebx, ebx
mov edi, 0xbdd
je 0x409467
mov esi, dword [ebp + 8]
push 0
push edi
call fcn.004096c5
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.0040154d
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
lea ebx, [ebp - 0x10]
call fcn.00414b84
pop ecx
mov byte [ebp - 4], 2
push 0x5c
mov esi, ebx
call fcn.0040994a
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00409aba
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040996b
mov byte [ebp - 4], 4
call fcn.0040978d
push 0x22
mov ecx, ebx
call fcn.00404315
push str.__installscan
mov ecx, ebx
call fcn.00409cf4
mov edx, str.LaunchAs
mov ecx, 0x473b58
xor esi, esi
xor ebx, ebx
call fcn.00402ddf
cmp eax, esi
je 0x409380
push str.AsInvoker
push eax
call fcn.00436bda
test eax, eax
pop ecx
pop ecx
je 0x409380
push 3
push 5
inc ebx
call fcn.00414b11
test al, al
pop ecx
pop ecx
je 0x409380
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.00415ca8
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x4093da
push 0x40
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.00436b60
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x14]
call fcn.004099c3
push eax
neg ebx
push esi
sbb ebx, ebx
and ebx, 0x1000000
push ebx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
call fcn.004099c3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x4093da
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x30]
call ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004055c6
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004055c6
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x1f40
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
jne 0x409443
mov dword [ebp - 0x18], esi
mov ebx, 0x1f4
jmp 0x409410
xor esi, esi
cmp dword [ebp - 0x1c], esi
jle 0x409443
add dword [ebp - 0x18], 7
push dword [ebp - 0x18]
mov esi, dword [ebp + 8]
push edi
call fcn.004096c5
sub dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x40940e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00401b87
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401b87
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401b87
mov esi, dword [ebp + 8]
push 0x5f
push edi
call fcn.004096c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401b87
xor eax, eax
inc eax
call fcn.0043c006
ret 8
Function at 0x40a077
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x4537a5
call fcn.0043bf2e
mov eax, dword [esi + 0xa0]
cmp eax, 1
jge 0x40a0ad
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.00404831
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x473988
jmp fcn.0040e898
lea edi, [esi + 0x98]
dec eax
mov ecx, edi
call fcn.00409b8a
mov ebx, str.CFinishedPage
push ebx
mov ecx, eax
call fcn.00401e8b
test eax, eax
je 0x40a0d7
push ebx
push dword [edi + 8]
mov ecx, edi
call fcn.00431659
mov eax, dword [esi + 0xa0]
dec eax
lea ecx, [esi + 0x90]
cmp dword [ecx], eax
je 0x40a10a
mov dword [ecx], eax
mov ecx, edi
call fcn.00409b8a
push dword [eax]
call fcn.00437584
pop ecx
push eax
push 0
push 0x8002
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043c006
ret

Function at 0x40a110
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x4537a5
call fcn.0043bf2e
lea esi, [edi + 0xa0]
mov eax, dword [esi]
cmp eax, 1
jne 0x40a138
cmp dword [edi + 0x90], 0
jne 0x40a138
push edi
call fcn.0040a285
mov esi, dword [esi]
cmp esi, 1
jge 0x40a15e
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.00404831
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x473988
jmp fcn.0040e898
dec esi
cmp dword [edi + 0x90], esi
je 0x40a179
push 0
push 0
push 0x8002
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043c006
ret
Function at 0x40d6bd
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x453672
call fcn.0043bf61
lea ecx, [ebp - 0x2c]
call fcn.0042c78d
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b4d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.0041608e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
push 0x45d7a0
lea ecx, [ebp - 0x14]
call fcn.00413fca
pop ecx
pop ecx
mov esi, eax
test esi, esi
jge 0x40d737
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.0041526a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b87
or dword [ebp - 4], 0xffffffff
call fcn.0042c7a3
mov eax, esi
call fcn.0043c006
ret 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
call fcn.004197b0
mov edi, eax
test edi, edi
jl 0x40d784
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40d75f
and dword [ebp - 0x14], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x18]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401ae8
push str..exe
mov ecx, esi
call fcn.00409cf4
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.0041526a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b87
or dword [ebp - 4], 0xffffffff
call fcn.0042c7a3
mov eax, edi
jmp 0x40d72f
Function at 0x40e4ce
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x453d76
call fcn.0043bf97
cmp byte [ebx + 0xcc], 0
jne 0x40e611
mov eax, dword [ebx + 0xa8]
xor esi, esi
cmp eax, esi
je 0x40e51a
cmp dword [ebx + 0xa4], esi
mov edx, dword [ebx + 0x19c]
push esi
je 0x40e509
push str.InstallBroken
jmp 0x40e50e
push str.InstallCancelled
call fcn.004062d4
pop ecx
pop ecx
jmp 0x40e60a
lea ecx, [ebp - 0x24]
call fcn.00401b4d
mov dword [ebp - 4], esi
push dword [ebx + 0xbc]
lea eax, [ebp - 0x24]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00402454
add esp, 0xc
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409b45
cmp eax, esi
jne 0x40e5c7
push str.LI_UPDATE
mov ecx, 0x473b2c
call fcn.00417850
test eax, eax
je 0x40e581
lea eax, [ebx + 0xe0]
push 0x45aa54
push eax
call fcn.0040f49a
test eax, eax
pop ecx
pop ecx
je 0x40e5c7
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 3
push esi
push str.InstallationID
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e5c7
lea eax, [ebx + 0xe0]
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x473b28]
test ecx, ecx
je 0x40e5dd
push eax
call fcn.004133d3
xor esi, esi
mov ecx, dword [0x473b28]
cmp ecx, esi
je 0x40e5df
push str.InstallerFinished
call fcn.00413471
jmp 0x40e5df
xor esi, esi
mov eax, dword [ebx + 0x19c]
push esi
push str.InstallFinished
call fcn.004062c1
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040689a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401b87
mov byte [ebx + 0xcc], 1
call fcn.0043c01a
ret

Function at 0x40e617
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00430621
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40e638
xor eax, eax
jmp 0x40e64b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e634
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8

Function at 0x40e898
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
test esi, esi
push edi
je 0x40e8cf
mov ebx, ecx
add ebx, 0x19c
mov edi, dword [ebx]
test edi, edi
je 0x40e8c4
call fcn.00409dda
mov edx, dword [ebx]
push 0
push str.InstallBroken
call fcn.004062d4
pop ecx
pop ecx
mov eax, dword [esi]
push 0
push 0
mov ecx, esi
call dword [eax + 0x14]
push 1
call fcn.004385ad
int3
Function at 0x40f581
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x453201
call fcn.0043bf2e
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x40f5c9
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.00409b8a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x40f5af
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.00430707
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.00430707
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.004314f2
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00410ccf
call fcn.0043c006
ret

Function at 0x40facc
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x450d36
call fcn.0043bf2e
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40fb0e
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40fb0e
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401b87
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043c006
ret