joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba860
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ba866
ret

Function at 0x4db128
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db2d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0053e250
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4db2f0
call fcn.0053deb4
mov eax, ebx
call fcn.00525344
mov edi, eax
dec edi
test edi, edi
jl 0x4db1e0
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00525318
mov edx, dword [0x49b1f8]
call fcn.0053cfc0
test al, al
je 0x4db1dc
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00525318
lea edx, [ebp - 0x14]
call fcn.004e13d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0053e250
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0053df28
inc esi
dec edi
jne 0x4db18e
mov al, byte [0x4db2f4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4db300
mov eax, dword [ebp - 0xc]
call fcn.005303f8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0053dc38
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004e13d4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4db2f0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.004e13d4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4db2f0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4db2f0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4db30c
call fcn.0052bd58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db2e0
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0053dbc4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0053dbc4
lea eax, [ebp - 0x14]
call fcn.0053dba0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0053dbc4
ret

Function at 0x53c6f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x56cca0], 0x8088405
inc edx
mov dword [ebx + 0x56cca0], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x5631d7
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov ecx, dword [ebp]
mov eax, dword [ecx]
lea eax, [eax + ebx + 5]
cmp byte [eax - 5], 0xe9
jne 0x5631fa
add eax, dword [eax - 4]
cmp dword [esi + 0x14], eax
mov al, 1
je 0x5632c9
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
test eax, eax
sete byte [ebp - 0x14]
jne 0x563216
push 0x20
push 0x40
call dword [edi - 0x1c]
test eax, eax
je 0x5632e2
push ebx
push edi
push eax
push esi
xchg edi, ebx
mov ecx, dword [ebp]
mov esi, dword [ecx]
add esi, edi
mov edi, eax
mov dword [ebp - 4], esi
add dword [ebp - 4], 5
lea edx, [ebp - 8]
push edi
push esi
push edx
push esi
push edi
push ebx
call fcn.005631ab
pop edx
pop ecx
mov esi, eax
mov edi, dword [ebp - 8]
sub eax, dword [ebp - 4]
jae 0x563281
mov al, byte [edx]
cmp al, 0xcc
je 0x5632d2
cmp al, 0xeb
je 0x5632d2
and al, 0xfe
cmp al, 0xc2
je 0x5632d2
push 7
pop ecx
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 0x14
je 0x56322c
sub edx, 0xe
add edx, ecx
mov ax, word [edx]
cmp al, 0xeb
jne 0x56327d
sub edx, esi
inc edx
inc edx
neg edx
cmp dl, ah
je 0x5632d2
loop 0x56325d
jmp 0x56322c
lea eax, [ebp - 8]
push esi
push eax
push ecx
call fcn.0056316c
mov edi, dword [ebp - 8]
mov al, 0xe9
stosb byte es:[edi], al
lea ecx, [edi + 4]
mov eax, esi
sub eax, ecx
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov al, 0xe9
stosb byte es:[edi], al
pop esi
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
pop dword [edx]
sub eax, ecx
stosd dword es:[edi], eax
pop edi
pop ebx
sub ecx, 5
push edx
push ebp
lea eax, [ebp - 0x10]
mov ebp, ecx
push 5
push eax
call fcn.00561fdf
test eax, eax
pop ebp
pop edx
je 0x5632cb
leave
ret
mov ecx, dword [edx]
and dword [edx], 0
jmp 0x5632d6
pop esi
pop ecx
pop edi
pop ebx
cmp byte [ebp - 0x14], 0
je 0x5632e0
push ecx
call dword [edi - 0x18]
sub eax, eax
leave
ret

Function at 0x563a28
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [eax], 0xfffff000
jne 0x563a3d
mov dl, byte [eax + 5]
cmp dl, 0xe8
je 0x563a43
cmp dl, 0xcc
je 0x563a43
dec eax
dec ecx
jne fcn.00563a28
jmp 0x563a76
add eax, 0xa
mov edx, eax
add eax, dword [eax - 4]
mov dword [0x564670], eax
add edx, 0xf
mov cl, 0x35
cmp byte [edx], 0xa1
je 0x563a67
add edx, 0x20
cmp byte [edx], cl
je 0x563a67
dec edx
dec edx
cmp byte [edx], cl
jne 0x563a76
mov eax, dword [edx + 1]
test al, 3
jne 0x563a76
mov ecx, dword [eax]
mov dword [0x56468b], ecx
ret
Function at 0x563a77
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebx + 0x3c]
mov edx, dword [ebx + edx + 0x78]
test edx, edx
je 0x563ad9
add edx, ebx
cmp eax, 0x10000
jae 0x563a90
sub eax, dword [edx + 0x10]
jmp 0x563acb
push ebp
push esi
push edi
xchg ebp, eax
mov ecx, dword [edx + 0x18]
mov esi, dword [edx + 0x20]
add esi, ebx
push edx
jecxz 0x563ab4
lodsd eax, dword [esi]
sub edi, edi
add eax, ebx
dec ecx
mov dl, byte [edi + eax]
cmp dl, byte [edi + ebp]
jne 0x563a9d
inc edi
test dl, dl
jne 0x563aa5
sub eax, eax
pop edx
pop edi
pop esi
pop ebp
test eax, eax
jne 0x563ad9
sub ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x24]
inc ecx
neg ecx
add eax, ebx
movzx eax, word [eax + ecx*2]
mov ecx, ebx
add ecx, dword [edx + 0x1c]
lea edx, [ecx + eax*4]
mov eax, dword [edx]
add eax, ebx
jmp 0x563adb
sub eax, eax
ret

Function at 0x563b6f
Capabilities:
Access peb ldr_data

Disassembly:
sete byte [eax]
push ebx
push ebp
cld
cmp byte [0x563b9b], 0
je 0x563b7a
ret
mov eax, 0x563b9c
cmp byte [eax], 0
je 0x5636ab
push 0x40
push 0xfffffffffffffffe
call fcn.0054db34
cmp byte [0x563b9b], 0
je 0x563b88
ret
Function at 0x409da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499d9f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4c5cd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x409e20
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xc], 0x4a7dac
cmp dword [ebp + 8], 0
jne 0x409dee
mov dword [ebp - 0x18], 0
jmp 0x409e01
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x4c
call fcn.0040ad90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004807b4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.mailru::exception.0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax + 0xc], vtable.mailru::exception.1.0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x14
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x14
call fcn.00401ca0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x40ac20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40ac29
xor ecx, ecx
jne 0x40ac29
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ac70
mov eax, dword [ebp - 0xc]
jmp 0x40accd
cmp dword [ebp - 4], 1
je 0x40ac83
cmp dword [ebp - 4], 2
je 0x40ac83
mov eax, 0xd
jmp 0x40accd
cmp dword [ebp + 0xc], 0
je 0x40acc1
cmp dword [ebp - 8], 0
je 0x40acb9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40acb0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x40acb7
mov eax, 0xd
jmp 0x40accd
jmp 0x40acc1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c250
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.0040c8d0
cmp dword [ebp + 8], 1
je 0x40c27a
mov ecx, dword [ebp - 4]
add ecx, 0x4c
call fcn.00401f30
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x40c290
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x70]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x6c], 0
je 0x40c2a6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x6c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041f300
mov esp, ebp
pop ebp
ret 4
Function at 0x40e9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a2ac
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4c5cd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], 0
push 0x40
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.00480c90
add esp, 0xc
mov dword [ebp - 0x64], 0x44
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp + 8]
call fcn.00413ba0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00413b70
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x7c]
call fcn.004110d0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x8e], ax
lea ecx, [ebp - 0x8e]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.0040f530
mov ecx, dword [ebp + 0xc]
call fcn.00401340
movzx edx, al
test edx, edx
jne 0x40ea74
mov ecx, dword [ebp + 0xc]
call fcn.00401f30
mov dword [ebp - 0x94], eax
jmp 0x40ea7e
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x94]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
call fcn.0040b230
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40eace
mov byte [ebp - 0x8f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.0040b1b0
mov al, byte [ebp - 0x8f]
jmp 0x40eb18
cmp dword [ebp + 0x10], 0
jne 0x40eae2
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040eb30
add esp, 4
jmp 0x40eafc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 0xc], ecx
mov byte [ebp - 0x90], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.0040b1b0
mov al, byte [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40eb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e9a0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40eb8e
xor al, al
jmp 0x40ec18
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00410bc0
add esp, 8
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ec20
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 4]
call fcn.0040ec40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x15], al
movzx edx, byte [ebp - 0x15]
test edx, edx
jne 0x40ebeb
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40ebeb
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx edx, byte [ebp - 0x15]
test edx, edx
je 0x40ec07
cmp dword [ebp + 0x1c], 0
je 0x40ec07
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dl, byte [ebp - 0x15]
mov byte [ebp - 0x21], dl
lea ecx, [ebp - 4]
call fcn.0040ec60
mov al, byte [ebp - 0x21]
mov esp, ebp
pop ebp
ret
Function at 0x40efd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a3ba
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4c5cd8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp - 0x80]
call fcn.0040f5b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00401340
movzx eax, al
test eax, eax
je 0x40f01e
jmp 0x40f146
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401f30
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40f046
jmp 0x40f146
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.00410bc0
add esp, 8
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f170
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f190
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x80]
call fcn.0040f910
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.00449940
add esp, 8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x88]
call fcn.004098f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c]
call fcn.00443bc0
mov dword [ebp - 0x44], 0
jmp 0x40f0d2
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x10]
jge 0x40f12e
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x60]
call fcn.00401f50
mov byte [ebp - 4], 5
cmp dword [ebp - 0x44], 0
jne 0x40f114
lea ecx, [ebp - 0x60]
call fcn.00401f30
push eax
lea ecx, [ebp - 0x30]
call fcn.00401f30
push eax
call fcn.004810e1
add esp, 8
test eax, eax
je 0x40f120
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x80]
call fcn.0040fb00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x60]
call fcn.00401100
jmp 0x40f0c9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00401100
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0040f1b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00480438
mov esp, ebp
pop ebp
ret 8
Function at 0x412870
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4c5cd8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00417190
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00412980
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4128db
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0040aae0
mov eax, dword [ebp - 0x224]
jmp 0x41296c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x412941
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00412870
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x412938
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0040aae0
mov eax, dword [ebp - 0x228]
jmp 0x41296c
mov dword [ebp - 4], 0x100
jmp 0x4128e2
lea ecx, [ebp - 0x14]
call fcn.0040ab00
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00412840
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0040aae0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00480438
mov esp, ebp
pop ebp
ret 4
Function at 0x41cd60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x41cd69
xor ecx, ecx
jne 0x41cd69
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41cd8a
mov eax, 0xd
jmp 0x41cde5
xor eax, eax
jne 0x41cd71
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41cd9b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x425520
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bef4
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x84]
mov dword [eax], vtable.SoftInstaller.0
mov dword [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x84]
add ecx, 0xe8
call fcn.00409220
mov byte [ebp - 0x85], al
movzx ecx, byte [ebp - 0x85]
test ecx, ecx
jne 0x4256b3
mov ecx, dword [ebp - 0x84]
add ecx, 0xb8
call fcn.00401340
mov byte [ebp - 0x86], al
movzx edx, byte [ebp - 0x86]
test edx, edx
jne 0x4256b3
mov eax, dword [ebp - 0x84]
add eax, 0xb8
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004254e0
add esp, 8
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040e1f0
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2c]
call fcn.00443bc0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
call fcn.00401100
mov edx, dword [ebp - 0x84]
add edx, 0xb8
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.004254e0
add esp, 8
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x9c]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.004254e0
add esp, 8
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xa4]
call fcn.00401f30
mov dword [ebp - 0xa8], eax
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00401100
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x64]
call fcn.00401100
jmp 0x4256c2
mov dword [ebp - 4], 9
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x84]
add ecx, 0x12c
call fcn.00443bc0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x84]
add ecx, 0x110
call fcn.00401100
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x84]
add ecx, 0xe8
call fcn.00409090
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x84]
add ecx, 0xe0
call fcn.00416ec0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x84]
add ecx, 0xd8
call fcn.004050a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x84]
add ecx, 0xb8
call fcn.00401100
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x84]
add ecx, 0x9c
call fcn.00401100
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x84]
add ecx, 0x80
call fcn.00401100
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x84]
add ecx, 0x44
call fcn.00416720
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x84]
call fcn.00416680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c022
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4c5cd8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x220]
call fcn.0040ce40
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x228], eax
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00480c90
add esp, 0xc
cmp dword [ebp - 0x228], 0
jl 0x425dd2
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x425dd2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040cf20
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040ce60
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040cf00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480438
mov esp, ebp
pop ebp
ret 8