joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dd01
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.0043b5d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocStringLen
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x45dd76
xor eax, eax
jmp 0x45dec5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push 0x3c
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x45deb1
mov eax, dword [ebp - 0x14]
push ebx
add eax, 0x18
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x45ddf4
sub dword [ebp - 8], 0xffffff80
jmp 0x45de0b
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x45de08
add dword [ebp - 8], 0x90
jmp 0x45de0b
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x45deb1
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call edi
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x45deb1
push ebx
push ebx
add eax, 0xfffffff0
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], ebx
jne 0x45deb1
cmp dword [ebp - 0x2c], ebx
jne 0x45deb1
cmp dword [ebp - 0x28], ebx
jne 0x45deb1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x45deb1
mov edi, dword [ebp + 0xc]
push eax
mov dword [edi], eax
call fcn.00437405
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [edi]
push ebx
push ebx
sub eax, 0x10
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx], ebx
pop esi
setne al
pop edi
pop ebx
leave
ret
Function at 0x45e034
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46ead8
push eax
mov dword [0x48e8f8], eax
call esi
push str.user32
mov dword [0x48e8fc], eax
call edi
push str.SetWindowTextW
push eax
mov dword [0x48e900], eax
call esi
push str.GetWindowTextW
push dword [0x48e900]
mov dword [0x48e904], eax
call esi
mov dword [0x48e908], eax
xor eax, eax
pop edi
pop esi
cmp dword [0x48e8fc], eax
je 0x45e0aa
mov byte [0x48e8eb], 1
cmp dword [0x48e904], eax
jne 0x45e0af
mov byte [0x48e8eb], al
push 0x90
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0x94
call fcn.0043b5d0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x48e8eb], al
leave
ret

Function at 0x45ef62
Capabilities:
Delete registry key

Disassembly:
lea ecx, [eax + 0x208]
push ecx
add eax, 0x30c
call fcn.00401966
pop ecx
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
ret
Function at 0x45f054
Capabilities:
Check http status code
Create http request
Reference http user-agent string

Disassembly:
mov eax, 0x467f35
call fcn.00467738
sub esp, 0x410
push ebx
push esi
mov esi, 0x104
push esi
call fcn.00437405
push esi
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x14], eax
call fcn.0043b5d0
mov eax, dword [0x48e8ec]
add esp, 0x10
cmp byte [eax + 0xc08e], bl
je 0x45f254
lea esi, [eax + 0xc08f]
cmp esi, ebx
je 0x45f254
lea edx, [esi + 1]
mov cl, byte [esi]
inc esi
cmp cl, bl
jne 0x45f0a3
sub esi, edx
je 0x45f254
add eax, 0xc993
cmp eax, ebx
je 0x45f254
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45f0c2
sub eax, edx
je 0x45f254
push edi
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_GB__rv:1.9.0.5__Gecko_2008120122_Firefox_3.0.5
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [0x48e8ec]
push ebx
push 0x40300
push ebx
push ebx
add ecx, 0xc08f
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x3ff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x41b]
push ebx
push eax
mov byte [ebp - 0x41c], bl
call fcn.0043b5d0
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x13
push dword [ebp - 0x18]
mov edi, 0x400
mov dword [ebp - 0x1c], edi
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.00436b21
pop ecx
mov byte [ebp - 0x41c], bl
mov dword [ebp - 0x1c], edi
cmp eax, 0xc8
jne 0x45f1c2
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x2f
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x45f179
mov byte [ebp - 0x41c], bl
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45f182
sub eax, edx
cmp eax, ebx
je 0x45f1c2
lea eax, [ebp - 0x41c]
push str.filename
push eax
call fcn.00437410
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x45f1c2
add edi, 9
push 0x46f770
push edi
call fcn.00437410
pop ecx
pop ecx
cmp eax, ebx
je 0x45f1be
mov byte [eax], bl
cmp edi, ebx
jne 0x45f1dd
mov eax, dword [0x48e8ec]
add eax, 0xc08f
push 0x2f
push eax
call fcn.00436990
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x45f1dd
inc edi
push dword [ebp - 0x18]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [0x48e8ec]
call fcn.0045d842
push 0x1414
mov esi, eax
call fcn.004369bd
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x45f220
push esi
push dword [0x48e8ec]
mov esi, eax
call fcn.0045ee4b
mov esi, eax
jmp 0x45f222
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xef2]
push eax
push 0x46eba0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
pop edi
cmp esi, ebx
je 0x45f254
push esi
call fcn.00436979
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45fc4b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45fcb0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push edi
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.00437405
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x45fcb0
test edi, edi
je 0x45fcae
push edi
call fcn.0043756e
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x45fcd3
test edi, edi
je 0x45fcdd
push dword [ebx]
push edi
push 0x46dc40
call fcn.004036c0
add esp, 0xc
test edi, edi
je 0x45fcdd
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45fce3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x45fd02
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0x46dc40
call fcn.004036c0
add esp, 0xc
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fd38
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
pop ebp
ret
Function at 0x460e35
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1430
call fcn.0043b7f0
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [eax + 0x208]
push edi
push ecx
add eax, 0x30c
call fcn.00401966
pop ecx
xor edi, edi
push edi
mov esi, eax
push 0x46f318
push esi
call fcn.00460354
add esp, 0xc
push 1
push 0x46f974
push esi
mov dword [ebp - 8], eax
call fcn.00460354
add esp, 0xc
push edi
push 0x46f978
push esi
mov dword [ebp - 0xc], eax
call fcn.00460354
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0x46eb98
push esi
xor eax, eax
call fcn.004601f5
mov dword [ebp - 0x1c], eax
push 0x46f97c
push esi
xor eax, eax
call fcn.004601f5
push edi
mov ebx, 0x46f984
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.00460354
add esp, 0x1c
push 1
mov edi, 0x46f990
push edi
push esi
mov dword [ebp - 0x18], eax
call fcn.00460354
add esp, 0xc
push esi
push SysReAllocStringLen
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0
push dword [ebp - 0x18]
push ebx
push esi
call fcn.00460236
push 1
push dword [ebp - 0x10]
push edi
push esi
call fcn.00460236
mov eax, dword [0x48e8ec]
add esp, 0x20
test dword [eax + 0xc086], 2
jne 0x460f27
push 0
push dword [ebp - 8]
push 0x46f318
push esi
call fcn.00460236
add esp, 0x10
mov eax, dword [0x48e8ec]
test dword [eax + 0xc086], 1
jne 0x460f49
push dword [ebp - 0x1c]
push 0x46eb98
push esi
call fcn.004601d6
add esp, 0xc
mov eax, dword [0x48e8ec]
test dword [eax + 0xc086], 4
jne 0x460f84
cmp dword [ebp + 8], 0
je 0x460f84
push dword [ebp + 8]
push 0x46f97c
push esi
call fcn.004601d6
add esp, 0xc
push 1
push dword [ebp - 0xc]
push 0x46f974
push esi
call fcn.00460236
add esp, 0x10
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x460fac
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x460f90
sub eax, edx
je 0x460fac
push 0
push edi
push 0x46f978
push esi
call fcn.00460236
add esp, 0x10
push 0
call fcn.00437895
pop ecx
mov dword [ebp - 0x24], eax
push SysReAllocStringLen
mov ecx, esi
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x20], edx
call fcn.00457060
push 8
lea eax, [ebp - 0x24]
push eax
push 0xb
push 0x46ebac
lea eax, [ebp - 0x142c]
call fcn.00457235
push esi
call fcn.0043756e
pop ecx
push dword [ebp - 8]
call fcn.0043756e
pop ecx
push dword [ebp - 0xc]
call fcn.0043756e
pop ecx
push edi
call fcn.0043756e
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x461568
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x4616f7
cmp dword [ebp + 0x10], ebx
je 0x4616f7
cmp esi, ebx
je 0x461593
cmp dword [esi + 4], ebx
jne 0x461598
cmp dword [esi + 0xc], ebx
je 0x4615da
xor eax, eax
cmp dword [esi + 4], ebx
je 0x4615b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046018c
add esp, 0xc
cmp eax, ebx
jne 0x4616f9
cmp dword [esi + 0xc], ebx
je 0x4616f9
push dword [ebp + 0x10]
add esi, 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046018c
add esp, 0xc
jmp 0x4616f9
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0043b5d0
add esp, 0xc
push str.theme_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0046605c
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x46160f
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x46161f
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocStringLen
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4616b5
push str.data_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0046605c
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x46166f
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x46167f
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocStringLen
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4616f7
push ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
inc eax
push eax
call fcn.00437405
pop ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
mov byte [eax + ecx], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x4616f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461bed
Capabilities:
Create process on windows
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2044
call fcn.0043b7f0
push ebx
push edi
mov edi, dword [0x48e8ec]
lea eax, [edi + 0x2958]
mov dword [ebp - 4], eax
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461c10
sub eax, edx
je 0x461d83
cmp dword [edi + 0xa36e], ebx
je 0x461d83
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x1843]
push ebx
push eax
mov byte [ebp - 0x1844], bl
call fcn.0043b5d0
push esi
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], bl
call fcn.0043b5d0
push esi
lea eax, [ebp - 0x1043]
push ebx
push eax
mov byte [ebp - 0x1044], bl
call fcn.0043b5d0
push esi
lea eax, [ebp - 0x843]
push ebx
push eax
mov byte [ebp - 0x844], bl
call fcn.0043b5d0
push esi
lea eax, [ebp - 0xc43]
push ebx
push eax
mov byte [ebp - 0xc44], bl
call fcn.0043b5d0
push esi
lea eax, [ebp - 0x1443]
push ebx
push eax
mov byte [ebp - 0x1444], bl
call fcn.0043b5d0
lea eax, [ebp - 0x1844]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x844]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1444]
add esp, 0x48
mov dword [ebp - 0x28], eax
lea eax, [esi + 1]
push 0x7ff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2043]
push ebx
push eax
mov dword [ebp - 0x44], 0x3c
mov byte [ebp - 0x2044], bl
call fcn.0043b5d0
mov ecx, dword [ebp - 4]
push edi
push fcn.004616fe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x103
lea eax, [ebp - 0x2044]
call fcn.0045d87b
lea eax, [ebp - 0x2044]
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461d43
lea ecx, [ebp - 0x44]
push ecx
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x2044]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x38], 3
pop esi
je 0x461d6c
cmp dword [ebp - 0x38], 4
jne 0x461d83
push 1
push ebx
push ebx
lea eax, [ebp - 0x2044]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
leave
ret
Function at 0x461d87
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48e8ec]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp byte [eax + 0xc08e], bl
je 0x461ea0
lea ecx, [eax + 0xc08f]
cmp ecx, ebx
je 0x461ea0
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x461db6
sub ecx, esi
je 0x461e9f
lea ecx, [eax + 0xc993]
cmp ecx, ebx
je 0x461e9f
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x461dd6
sub ecx, esi
je 0x461e9f
add eax, 0xca97
push eax
push SysReAllocStringLen
call fcn.0045dec9
pop ecx
pop ecx
test al, al
jne 0x461e9f
mov eax, dword [0x48e8ec]
add eax, 0xca97
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045dec9
pop ecx
pop ecx
test al, al
jne 0x461e9f
call fcn.0045f054
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.0043b5d0
mov eax, dword [0x48e8ec]
push eax
push fcn.004616fe
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [eax + 0xc88f]
push 0x104
lea eax, [ebp - 0x10c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.0045d87b
add esp, 0x20
cmp esi, ebx
je 0x461e98
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461e78
sub eax, edx
je 0x461e98
push 5
push ebx
lea eax, [ebp - 0x10c]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.0043756e
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x4642d2
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x364]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x48e8ec]
test byte [eax + 0xa366], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
je 0x464332
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0xa475
push eax
lea eax, [ebp - 0x364]
push eax
call edi
mov eax, dword [0x48e8ec]
test byte [eax + 0xa366], 2
je 0x464352
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x9cdc
push eax
lea eax, [ebp - 0x364]
push eax
call edi
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x4000000
push 3
push esi
push 1
push esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x564]
push str._s__cleanup__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0043b5d0
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x564]
push eax
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464424
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push dword [ebp + 0xc]
call fcn.00436990
pop ecx
pop ecx
test eax, eax
je 0x464457
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
ret
Function at 0x464478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x167c
call fcn.0043b7f0
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0043b5d0
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x48e8ec]
add esp, 0xc
mov dword [ebp - 0x58], 0x44
test byte [eax + 0xa366], 1
mov edi, 0x206
je 0x46453a
push 1
push eax
lea esi, [ebp - 0x1678]
call fcn.0045ee4b
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push ebx
push eax
call fcn.0043b5d0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
add eax, 2
cmp cx, bx
jne 0x4644e8
push 0x46e91c
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x48e8ec]
test byte [eax + 0xa366], 2
je 0x4645ba
push 2
push eax
lea esi, [ebp - 0x1678]
call fcn.0045ee4b
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push ebx
push eax
call fcn.0043b5d0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
add eax, 2
cmp cx, bx
jne 0x46456d
push 0x46e93c
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4645c2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
call fcn.00463fe9
test eax, eax
jne 0x4645eb
push 0x30
push str.Cannot_start_install
push str.There_is_a_problem_with_the_install_program.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
leave
ret
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.0045e034
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov eax, dword [0x48e8ec]
add eax, 0xcbc3
push eax
call fcn.004530c3
xor eax, eax
pop ecx
inc eax
leave
ret
Function at 0x466023
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x466038
xor eax, eax
pop ebp
ret
shr eax, 4
not eax
and eax, 1
pop ebp
ret

Function at 0x466042
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x466057
xor eax, eax
pop ebp
ret
and eax, 0x10
pop ebp
ret