joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ebe
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
push esi
push edi
lea eax, [ebp - 0x48]
push eax
push 0x26
xor edi, edi
push edi
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x412f43
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x412f50
push str.duowanyy
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x64]
call fcn.00406c07
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406c29
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.00406799
push edi
push 1
lea ecx, [ebp - 0x80]
call fcn.004064bb
push edi
push 1
lea ecx, [ebp - 0x64]
call fcn.004064bb
jmp 0x412f50
push 0x475548
lea ecx, [esi + 0x10]
call fcn.00406a49
push str.5eE
lea ecx, [ebp - 0x44]
call fcn.00406c07
cmp dword [ebp - 0x30], edi
je 0x412f8e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x64]
push 0x475544
push eax
call fcn.00406c97
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.004066a2
push edi
push 1
lea ecx, [ebp - 0x64]
call fcn.004064bb
cmp dword [esi + 0x28], 8
jb 0x412f99
mov esi, dword [esi + 0x14]
jmp 0x412f9c
add esi, 0x14
push esi
push 0x475508
call fcn.0044c398
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x44]
call fcn.004064bb
mov ecx, dword [ebp + 0x1e0]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cad9
add ebp, 0x1e4
leave
ret

Function at 0x412fcb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 8]
call fcn.00416cb8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00435b0d
lea ecx, [ebp - 8]
call fcn.00416fbc
mov edi, str._silence
push edi
lea ecx, [ebp - 8]
call fcn.00416cb8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00435abb
lea ecx, [ebp - 8]
mov bl, al
call fcn.00416fbc
test bl, bl
je 0x413087
push 0x473a34
lea ecx, [ebp - 0xc]
call fcn.00416cea
push edi
lea ecx, [ebp - 8]
call fcn.00416cb8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00435ad1
mov eax, dword [eax]
push dword [eax + 0xc]
lea ecx, [esi + 0x10]
call fcn.00406a49
lea ecx, [ebp - 8]
call fcn.00416fbc
lea ecx, [ebp - 0xc]
call fcn.00416fbc
cmp dword [esi + 0x24], 0
jne 0x413071
mov ecx, esi
call fcn.00412ebe
mov byte [esi + 0x2c], 1
xor esi, esi
inc esi
lea ecx, [ebp - 4]
call fcn.004251ba
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x413078
Function at 0x413cbe
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x1fc]
sub esp, 0x27c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x1f8], eax
mov eax, dword [ebp + 0x204]
push ebx
push edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x208]
xor ebx, ebx
push ebx
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x413d09
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x413d4e
push esi
lea eax, [ebp - 0x20]
push eax
push 0x47afa0
xor esi, esi
inc esi
push esi
push ebx
push 0x47afc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x413d45
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x47afb0
push eax
call dword [ecx]
test eax, eax
jge 0x413d67
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
pop esi
mov ecx, dword [ebp + 0x1f8]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x1fc
leave
ret 8
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push ebx
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x14]
xor eax, eax
push 0x208
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push ebx
push eax
call fcn.0044d0c0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
add esp, 0xc
push 2
push ebx
push 0x104
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x48]
call fcn.00406c07
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
mov dword [ebp - 0x1c], esi
call fcn.00413259
test al, al
je 0x413df3
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x64]
call fcn.00406c07
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x80]
call fcn.00406c07
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
mov dword [ebp - 0x1c], 7
call fcn.004132ff
mov byte [ebp - 0x15], bl
test al, al
jne 0x413df7
mov byte [ebp - 0x15], 1
test byte [ebp - 0x1c], 4
je 0x413e0b
and dword [ebp - 0x1c], 0xfffffffb
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.004064bb
test byte [ebp - 0x1c], 2
je 0x413e1f
and dword [ebp - 0x1c], 0xfffffffd
push ebx
push esi
lea ecx, [ebp - 0x64]
call fcn.004064bb
test byte [ebp - 0x1c], 1
je 0x413e2f
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.004064bb
cmp byte [ebp - 0x15], bl
je 0x413e4a
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, bl
jmp 0x413d4d
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
lea eax, [ebp - 0x48]
push eax
call fcn.004095d7
cmp dword [eax + 0x18], 8
pop ecx
jb 0x413e6b
mov ecx, dword [eax + 4]
jmp 0x413e6e
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x24]
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.004064bb
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push esi
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov bl, 1
jmp 0x413e34
Function at 0x413e93
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.YYSetupCore::_do3XUpdate_begin.
mov esi, ecx
call fcn.0044c398
mov dword [esp], str.yywizard.exe
add esi, 8
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00406c29
push 0x40
xor esi, esi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.0044d0c0
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
cmp dword [ebp - 8], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x74], 0x44
jae 0x413ef4
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x413f34
push 0xffffffffffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.YYSetupCore::_do3XUpdate__wait_finish.
call fcn.0044c398
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp - 0x30]
call edi
push dword [ebp - 0x2c]
call edi
push str.YYSetupCore::_do3XUpdate_finish.
call fcn.0044c398
pop ecx
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cad9
leave
ret
Function at 0x4143b3
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x86c]
sub esp, 0x8ec
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x868], eax
mov eax, dword [ebp + 0x87c]
push ebx
push esi
mov esi, dword [ebp + 0x878]
push edi
mov edi, dword [ebp + 0x874]
mov dword [ebp + 0x48], eax
xor eax, eax
push 0x7fe
mov word [ebp + 0x68], ax
xor ebx, ebx
lea eax, [ebp + 0x6a]
push ebx
push eax
mov dword [ebp + 0x44], esi
call fcn.0044d0c0
add esp, 0xc
cmp esi, ebx
je 0x4144de
mov esi, 0x4736a0
push esi
push edi
push esi
lea ecx, [ebp - 4]
call fcn.00406c07
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00406c5e
add esp, 0xc
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00406c29
add esp, 0xc
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp + 0x18]
call fcn.004064bb
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.004064bb
push esi
push dword [ebp + 0x44]
lea ecx, [ebp - 0x20]
call fcn.00406c07
push eax
push 0x4760e0
lea ecx, [ebp - 0x3c]
call fcn.00406c07
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00406c5e
add esp, 0xc
push eax
lea eax, [ebp - 4]
push eax
call fcn.00406c29
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x4c]
call fcn.004066a2
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.004064bb
push ebx
push edi
lea ecx, [ebp + 0x18]
call fcn.004064bb
push ebx
push edi
lea ecx, [ebp - 0x3c]
call fcn.004064bb
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.004064bb
cmp dword [ebp + 0x64], 8
mov eax, dword [ebp + 0x50]
jae 0x4144c0
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x68]
push 0x3ff
push eax
call fcn.0044e9b1
add esp, 0xc
push ebx
push edi
lea ecx, [ebp + 0x4c]
call fcn.004064bb
jmp 0x4144fe
cmp dword [edi + 0x18], 8
jb 0x4144e9
mov edi, dword [edi + 4]
jmp 0x4144ec
add edi, 4
push edi
lea eax, [ebp + 0x68]
push 0x3ff
push eax
call fcn.0044e9b1
add esp, 0xc
push 0x40
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0044d0c0
xor eax, eax
mov dword [ebp + 0x34], ebx
lea edi, [ebp + 0x38]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x48]
lea eax, [ebp + 0x68]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x414561
cmp byte [ebp + 0x880], bl
je 0x414551
push 0xffffffffffffffff
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x38]
call esi
mov ecx, dword [ebp + 0x868]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x86c
leave
ret 0x10
Function at 0x414677
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push str..lnk
mov edi, 0x473a64
push edi
push eax
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x298], ecx
call fcn.00406c29
add esp, 0xc
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c29
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
push 0x24c
lea eax, [ebp - 0x288]
push ebx
push eax
mov dword [ebp - 0x28c], ebx
call fcn.0044d0c0
mov eax, dword [ebp - 0x38]
add esp, 0xc
cmp dword [ebp - 0x24], 8
jae 0x4146f8
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x290], eax
cmp eax, 0xffffffff
je 0x4147af
test byte [ebp - 0x28c], 0x10
jne 0x414788
lea eax, [ebp - 0x260]
push eax
push edi
push dword [ebp - 0x294]
lea eax, [ebp - 0x2b4]
push eax
call fcn.00406c29
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00406c29
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x2b4]
call fcn.004064bb
cmp dword [esi + 0x18], 8
jb 0x414761
mov eax, dword [esi + 4]
jmp 0x414764
lea eax, [esi + 4]
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
jae 0x414770
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov ecx, dword [ebp - 0x298]
call fcn.00413cbe
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414715
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004064bb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
leave
ret 8
Function at 0x4148f6
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x284
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
xor eax, eax
push 0x208
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x64], ebx
call fcn.0044d0c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push str._APPDATA_MicrosoftInternet_ExplorerQuick_Launch
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x414a66
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c07
push str.YY.exe
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00406c29
mov eax, dword [ebp - 0x40]
add esp, 0xc
cmp dword [ebp - 0x2c], 8
jae 0x41497b
lea eax, [ebp - 0x40]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x414998
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.00414677
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 7
call fcn.004062d2
push str.User_PinnedStartMenu
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406c29
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00406799
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.004064bb
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4149e2
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x4149f9
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00414677
push str.User_PinnedTaskBar
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406c29
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00406799
push esi
push ebx
lea ecx, [ebp - 0x80]
call fcn.004064bb
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x414a30
lea eax, [ebp - 0x24]
push eax
call edi
pop edi
test eax, eax
je 0x414a48
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00414677
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.004064bb
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004064bb
mov ecx, dword [ebp + 0x200]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x204
leave
ret
Function at 0x414d66
Capabilities:
Terminate process

Disassembly:
push str.DUOWAN_SPEAK_MAIN_FRAME__4D1BB563_E5FC_4771_AD17_6442A4147044
push dword [esp + 8]
call fcn.00409898
pop ecx
pop ecx
test eax, eax
je 0x414d95
push 0
push 0
push 0x8259
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push str.YYSetupDecompressor::_quitYY__post_message__WM_APP__601__to_YY_for_quit.
call fcn.0044c398
pop ecx
push esi
push dword [esp + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x414dba
push str.YYSetupDecompressor::_quitYY__OpenProcess_return_NULL__YY_already_quit.
call fcn.0044c398
pop ecx
jmp 0x414de1
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x414de1
push str.YYSetupDecompressor::_quitYY__WaitForSingleObject_time_out__will_terminate_process.
call fcn.0044c398
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret 4

Function at 0x414de5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0x474cc8
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x414e0a
push str.YYSetupDecompressor::_load7zDataFromResource__Find_resource_yy.7z__fail.
call fcn.0044c398
pop ecx
xor eax, eax
jmp 0x414e3b
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x414e29
push str.YYSetupDecompressor::_load7zDataFromResource__Load_resource_yy.7z__fail.
call fcn.0044c398
pop ecx
xor eax, eax
jmp 0x414e3a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x415115
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str..old
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00406c29
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x415147
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x41515a
lea eax, [ebp - 0x1c]
cmp dword [esi + 0x18], 8
jb 0x415165
mov esi, dword [esi + 4]
jmp 0x415168
add esi, 4
push eax
push esi
call fcn.00408358
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044cad9
leave
ret 4
Function at 0x415465
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x228
mov dword [ebp - 0x6b8], eax
xor esi, esi
lea eax, [ebp - 0x280]
push esi
push eax
mov dword [ebp - 0x6b4], ecx
call fcn.0044d0c0
add esp, 0xc
push esi
push 2
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x284]
push ecx
push eax
mov dword [ebp - 0x6b0], eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4155cb
mov edi, str.YY.exe
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x58]
call fcn.00406c07
push edi
lea ecx, [ebp - 0x20]
call fcn.00406c07
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408ac6
pop ecx
pop ecx
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x20]
inc bl
call fcn.004064bb
test bl, bl
je 0x4155a4
push 0x424
lea eax, [ebp - 0x6a8]
push esi
push eax
call fcn.0044d0c0
add esp, 0xc
push dword [ebp - 0x27c]
mov dword [ebp - 0x6ac], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x6ac]
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00406c07
mov eax, dword [ebp - 0x6b4]
add eax, 0x2c
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c29
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408ac6
add esp, 0x14
push esi
push 1
test eax, eax
je 0x4155ea
lea ecx, [ebp - 0x3c]
call fcn.004064bb
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x6b0]
call sub.KERNEL32.dll_Process32NextW
push esi
push 1
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.004064bb
cmp ebx, esi
jne 0x4154d3
push dword [ebp - 0x6b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
leave
ret 4
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x6b8]
mov dword [ecx], eax
lea ecx, [ebp - 0x3c]
call fcn.004064bb
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.004064bb
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.004064bb
mov al, 1
jmp 0x4155d9

Function at 0x415656
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
call fcn.00414de5
mov edi, eax
test edi, edi
jne 0x415680
push str.YYSetupDecompressor::_decompress___load7zDataFromResource_fail.
call fcn.0044c398
pop ecx
xor al, al
jmp 0x4156b4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
je 0x415690
lea ecx, [esi + 0x24]
jmp 0x415692
xor ecx, ecx
push ebx
push ecx
push dword [esi + 0x28]
lea ecx, [esi + 0x2c]
push ecx
push dword [ebp - 4]
push eax
call fcn.004153f3
add esp, 0x14
push edi
mov ecx, esi
mov bl, al
call fcn.00414e3f
mov al, bl
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4156b8
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
mov eax, ecx
push edi
lea edi, [eax + 0x2c]
lea eax, [ebp - 0x34]
push edi
push eax
mov dword [ebp - 0x38], edi
call fcn.00409ac8
push str.temp
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406c29
lea eax, [ebp - 0x18]
push eax
call fcn.00409675
mov eax, dword [ebp - 0x14]
add esp, 0x18
push 8
pop ebx
cmp dword [ebp], ebx
jae 0x41570e
lea eax, [ebp - 0x14]
push eax
push str.YYSetupCore::cleanUpFile__delete_temp_directory__s
call fcn.0044c398
push str.updatefiles
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00406c29
lea eax, [ebp + 4]
push eax
call fcn.00409675
mov eax, dword [ebp + 8]
add esp, 0x18
cmp dword [ebp + 0x1c], ebx
jae 0x415742
lea eax, [ebp + 8]
push eax
mov esi, str.YYSetupCore::cleanUpFile__Delete_temp_directory__s
push esi
call fcn.0044c398
lea eax, [ebp + 0x20]
push edi
push eax
call fcn.00409b48
lea eax, [ebp + 0x20]
push eax
call fcn.00409675
mov eax, dword [ebp + 0x24]
add esp, 0x14
cmp dword [ebp + 0x38], ebx
jae 0x41576f
lea eax, [ebp + 0x24]
push eax
push str.YYSetupCore::cleanUpFile__strUpdateCachePath_s
call fcn.0044c398
push str.oem.txt
lea eax, [ebp + 0x58]
push edi
push eax
call fcn.00406c29
push str.ProductInfo.txt
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00406c29
mov eax, dword [ebp + 0x5c]
add esp, 0x20
cmp dword [ebp + 0x70], ebx
jae 0x4157a9
lea eax, [ebp + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
mov eax, dword [ebp + 0x5c]
cmp dword [ebp + 0x70], ebx
jae 0x4157bd
lea eax, [ebp + 0x5c]
push eax
push esi
call fcn.0044c398
mov eax, dword [ebp + 0x40]
pop ecx
pop ecx
cmp dword [ebp + 0x54], ebx
jae 0x4157d1
lea eax, [ebp + 0x40]
push eax
call edi
mov eax, dword [ebp + 0x40]
cmp dword [ebp + 0x54], ebx
jae 0x4157df
lea eax, [ebp + 0x40]
push eax
push esi
call fcn.0044c398
push dword [ebp - 0x38]
call fcn.0040bd03
push str.YYSetupCore::cleanUpFile__clean_single_directory_old_files.
call fcn.0044c398
push dword [ebp - 0x38]
call fcn.0040c409
push str.YYSetupCore::cleanUpFile__clean_old_directories_before_install.
call fcn.0044c398
add esp, 0x18
xor edi, edi
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp + 0x3c]
call fcn.004064bb
push edi
push esi
lea ecx, [ebp + 0x58]
call fcn.004064bb
push edi
push esi
lea ecx, [ebp + 0x20]
call fcn.004064bb
push edi
push esi
lea ecx, [ebp + 4]
call fcn.004064bb
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.004064bb
push edi
push esi
lea ecx, [ebp - 0x34]
call fcn.004064bb
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cad9
add ebp, 0x78
leave
ret