joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db97
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x477cb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x4637fc
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40dbf7
push 0x800
call eax
test eax, eax
jne 0x40dbf0
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40dbfc
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40dbfc
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40dd70
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.0043cf2a
add esp, 0xc
test eax, eax
jne 0x40dd54
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043a060
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043d25d
push 0x465ba0
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043d25d
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x430]
jmp 0x40dd5b
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40dcc4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043917f
leave
ret
Function at 0x40ddb4
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x45c301
call fcn.0043f277
cmp byte [ebx + 0xc8], 0
jne 0x40debf
mov eax, dword [ebx + 0xa8]
xor esi, esi
cmp eax, esi
jne 0x40deb8
lea ecx, [ebp - 0x24]
call fcn.0041845d
mov dword [ebp - 4], esi
push dword [ebx + 0xb8]
lea eax, [ebp - 0x24]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00402009
add esp, 0xc
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004089c2
cmp eax, esi
jne 0x40de88
push str.LI_UPDATE
mov ecx, 0x47cfe4
call fcn.00419cf0
test eax, eax
je 0x40de44
lea eax, [ebx + 0xdc]
push 0x463224
push eax
call fcn.00411186
test eax, eax
pop ecx
pop ecx
je 0x40de88
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 3
push esi
push str.InstallationID
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40de88
lea eax, [ebx + 0xdc]
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x47cfe0]
test ecx, ecx
je 0x40dea0
push eax
call fcn.00415287
mov eax, dword [0x47cfe0]
test eax, eax
je 0x40dea0
push 0
push 1
push str.InstallerFinished
push eax
call fcn.00415325
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00408911
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0041253c
mov byte [ebx + 0xc8], 1
call fcn.0043f2fa
ret

Function at 0x40dec5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00433371
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40dee6
xor eax, eax
jmp 0x40def9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40dee2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x40ec7e
Capabilities:
Terminate process

Disassembly:
push 0x40c
mov eax, 0x45c212
call fcn.0043f277
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
je 0x40ed47
mov eax, dword [0x47cfe0]
cmp eax, ebx
je 0x40ecbc
push ebx
push ebx
push eax
mov esi, edi
call fcn.004155d9
push 0x45ee98
mov ecx, edi
call fcn.00430083
test eax, eax
jne 0x40ecdc
push 0x463d04
mov ecx, edi
call fcn.00430083
test eax, eax
je 0x40ed47
mov eax, dword [edi]
push ebx
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, edi
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x47ce68
je 0x40ed19
call fcn.0040dd7d
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x40ed2b
call fcn.0040dd7d
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.0041253c
push esi
call fcn.0043ca90
mov eax, dword [ebp - 0x414]
xor esi, esi
inc esi
mov dword [eax + 0xa4], esi
mov dword [0x47cf10], esi
mov esi, dword [0x47ce88]
call fcn.0040924d
cmp edi, ebx
je 0x40ed7f
push dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push edi
call fcn.00434b5d
mov ebx, eax
mov eax, ebx
call fcn.0043f2fa
ret 8
Function at 0x40f8ca
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x4594c3
call fcn.0043f277
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
mov dword [ebp - 0x3c], edi
je 0x40f9e7
cmp byte [edi + 0x41], bl
je 0x40f9e7
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40f902
xor al, al
jmp 0x40f9e9
lea esi, [ebp - 0x30]
call fcn.0040f627
mov dword [ebp - 4], ebx
lea eax, [edi + 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0040f6a6
mov esi, eax
call fcn.0040f717
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0040f6a6
mov esi, eax
call fcn.0040f717
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x40f967
dec eax
je 0x40f96a
dec eax
dec eax
jne 0x40f9d3
mov bl, 1
jmp 0x40f9d3
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.0040f6a6
mov esi, eax
call fcn.0040f717
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x40f9af
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.0040f6a6
mov esi, eax
call fcn.0040f717
push eax
call fcn.0043cea8
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x40f9d1
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x40f963
test ecx, ecx
jne 0x40f913
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.0040f65f
mov edi, dword [ebp - 0x3c]
jmp 0x40f913
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00410f34
mov al, bl
jmp 0x40f9e9
mov al, 1
call fcn.0043f2fa
ret

Function at 0x41111f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411182
cmp dword [ebp + 0xc], 1
je 0x41115b
cmp dword [ebp + 0xc], 2
je 0x41115b
push 0xd
pop eax
jmp 0x411182
test edi, edi
mov eax, dword [ebp - 4]
je 0x41117c
test eax, eax
je 0x411178
test al, 1
jne 0x411156
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41117c
jmp 0x411156
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x41126d
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x45bc06
call fcn.0043f20e
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x4112b5
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.00408a0c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x41129b
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.00433457
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.00433457
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.00434242
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00412a85
call fcn.0043f2e6
ret

Function at 0x411830
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x459232
call fcn.0043f20e
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x411872
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x411872
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0041253c
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043f2e6
ret
Function at 0x415db0
Capabilities:
Get common file path

Disassembly:
push 0x24
mov eax, 0x459cbd
call fcn.0043f241
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.0042e4ee
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.004016c5
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.0041845d
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.0040c829
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x415e25
call fcn.004030e7
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041253c
or dword [ebp - 4], 0xffffffff
call fcn.0042e504
mov eax, esi
jmp 0x415f48
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.004053eb
lea ecx, [ebp - 0x18]
call fcn.0041845d
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.0040c829
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x415e7f
call fcn.004030e7
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0041253c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041253c
mov dword [ebp - 4], ebx
jmp 0x415e19
push ebx
lea ecx, [ebp - 0x18]
call fcn.004053eb
lea eax, [ebp - 0x1c]
push eax
call fcn.00412642
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x415edf
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00417d30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0041253c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041253c
mov dword [ebp - 4], ebx
jmp 0x415f40
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.0040160f
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00417d30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0041253c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041253c
mov dword [ebp - 4], ebx
call fcn.0042e504
xor eax, eax
jmp 0x415f48
call fcn.0042e504
mov eax, dword [ebp - 0x24]
call fcn.0043f2e6
ret

Function at 0x415f4e
Capabilities:
Accept command line arguments

Disassembly:
push 0x18
mov eax, 0x459096
call fcn.0043f241
mov edi, ecx
call fcn.004016c5
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x415f81
call fcn.004030e7
jmp 0x415fec
lea ecx, [ebp - 0x24]
call fcn.0042e4ee
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
push dword [esi]
mov ecx, edi
call fcn.0040160f
or dword [ebp - 4], 0xffffffff
call fcn.0042e504
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
neg eax
sbb eax, eax
and eax, 0x5ffefffe
add eax, 0xa0010002
jmp 0x415fec
call fcn.0043f2e6
ret
Function at 0x415ff2
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x459c83
call fcn.0043f20e
lea ecx, [ebp - 0x10]
call fcn.0041845d
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00415f4e
xor ecx, ecx
test eax, eax
setge cl
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
mov esi, ecx
call fcn.0043a060
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push edi
push 0x1000000
push edi
neg esi
push edi
sbb esi, esi
and esi, dword [ebp - 0x10]
push edi
call fcn.0040c78f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.004053eb
cmp esi, edi
jne 0x41608a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041253c
mov eax, edi
call fcn.0043f2e6
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x20]
jmp 0x416076
Function at 0x416423
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x45aa4a
call fcn.0043f277
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.0040d679
mov ecx, dword [ebp - 0x22c]
push 0x4637fc
call fcn.0040151c
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.0040151c
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x41663f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x41663f
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x416623
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040151c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.0041845d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x416605
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.0040151c
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.00416388
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401aea
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.0041253c
lea edi, [ebp - 0x220]
call fcn.0040d679
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004043f9
test eax, eax
jne 0x416605
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.0040151c
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.00416388
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401ad5
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.0041253c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.0041253c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.0041253c
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x4164d5
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0041253c
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.0041253c
mov eax, dword [ebp - 0x22c]
call fcn.0043f2fa
ret
Function at 0x416b31
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x477cb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.0043a060
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x416b8a
cmp dword [ebp - 0x110], 3
jae 0x416b90
cmp dword [ebp - 0x114], 5
ja 0x416b90
xor eax, eax
jmp 0x416b93
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043917f
leave
ret

Function at 0x416b9f
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x220
mov eax, 0x459c01
call fcn.0043f277
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov ecx, ebx
call fcn.0041845d
mov dword [ebp - 0x228], esi
call fcn.00416268
test al, al
je 0x416cc4
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00401aea
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x224]
call fcn.0040151c
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push edi
push dword [ebp - 0x224]
mov dword [ebp - 0x21c], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x416ca4
lea ecx, [ebp - 0x220]
call fcn.00408911
cmp eax, edi
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
jne 0x416ca4
push str.ProgramFilesDir
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x104
call fcn.0041111f
test eax, eax
jne 0x416ca4
mov eax, edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040151c
mov byte [ebp - 4], 4
push dword [eax]
push str._ProgramFiles_
push ebx
call fcn.0040866d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.0041253c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.00408911
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.0041253c
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x416cd6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416cf8
mov esi, dword [ebp + 8]
mov eax, 0x3fff
push eax
push eax
mov ecx, ebx
call fcn.0040c829
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004053eb
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0041253c
mov eax, ebx
call fcn.0043f2fa
ret
Function at 0x41737e
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x458626
call fcn.0043f20e
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push str.en_us
call fcn.004187a5
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x467dfc
push 0x17
push edi
push 0x463244
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x4173e8
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push dword [ebp + 8]
mov ebx, eax
add esi, 0x34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push ebx
call dword [esi]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x4173f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
call fcn.0043f2e6
ret

Function at 0x417422
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x64
mov eax, 0x45b536
call fcn.0043f20e
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x417445
mov eax, 0x80070057
jmp 0x41757d
lea eax, [ebp - 0x14]
push eax
call fcn.00416d69
pop ecx
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x14]
mov eax, dword [edi - 0xc]
cmp eax, ebx
mov byte [ebp - 0xd], bl
jne 0x417485
lea edi, [ebp - 0x1c]
mov byte [ebp - 0xd], 1
call fcn.0041726b
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00401aea
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0041253c
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], ebx
je 0x41754c
movzx ecx, byte [ebp - 0xd]
mov eax, dword [esi]
push ecx
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00417315
mov byte [ebp - 4], 2
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.0043a060
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 3
call fcn.0041845d
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00415f4e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c78f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x417518
xor esi, esi
jmp 0x417523
call fcn.004030e7
mov esi, eax
cmp esi, ebx
jl 0x417533
push dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2c]
call edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0041253c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0041253c
jmp 0x41756f
mov esi, dword [esi]
push 3
push ebx
push ebx
push esi
push 0x466dd0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x417568
xor esi, esi
jmp 0x41756f
call fcn.00408979
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041253c
mov eax, esi
call fcn.0043f2e6
ret