joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401500
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401570
Capabilities:
Delete directory
Delete file
Get session user name
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, section..data
mov dword [ebp - 0x418], 0x104
push dword [esi]
call edi
test eax, eax
jne 0x4015c1
call ebx
cmp eax, 5
jne 0x4015c1
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call edi
add esi, 4
cmp esi, 0x451024
jl 0x4015a1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x4478fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ce9b
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cdc6
push str.userData.xml.gz
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x401656
call ebx
cmp eax, 5
jne 0x401656
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x4478fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ce9b
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cdc6
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x20c]
add esp, 0x18
push eax
call ebx
mov edi, 0x451024
nop dword [eax + eax]
mov esi, dword [edi]
mov ecx, 0x4473cc
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016d6
test dx, dx
je 0x4016d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4016b0
xor eax, eax
jmp 0x4016db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4016ed
push esi
call fcn.00401010
add esp, 4
jmp 0x401771
mov ecx, str..LOGS
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40171a
test dx, dx
je 0x401716
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40171a
add eax, 4
add ecx, 4
test dx, dx
jne 0x4016f4
xor eax, eax
jmp 0x40171f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40172e
push esi
call fcn.00401010
add esp, 4
jmp 0x401771
mov eax, 0x4473d8
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40175b
test dx, dx
je 0x401757
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40175b
add ecx, 4
add eax, 4
test dx, dx
jne 0x401735
xor eax, eax
jmp 0x401760
sbb eax, eax
or eax, 1
push esi
test eax, eax
jne 0x40176f
call fcn.00401010
add esp, 4
jmp 0x401771
call ebx
add edi, 4
cmp edi, 0x451034
jl 0x4016a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402c13
mov esp, ebp
pop ebp
ret
Function at 0x401ac0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00402c30
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 2
push 0
call eax
test eax, eax
js 0x401cae
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UnInstall.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_Uninstall
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0xe3c]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_Graphics
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x1044]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402c13
mov esp, ebp
pop ebp
ret
Function at 0x401cd0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124c
call fcn.00402c30
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push dword [ebp + 8]
push 0
call eax
test eax, eax
js 0x401f04
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_Graphics_LicensingConfigure_Licensing.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_UnInstall.lnk
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xe3c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_GraphicsMentor_Uninstall
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x1044]
add esp, 0x18
push eax
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_Graphics
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x124c]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402c13
mov esp, ebp
pop ebp
ret
Function at 0x401f20
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124c
call fcn.00402c30
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push dword [ebp + 8]
push 0
call eax
test eax, eax
js 0x402154
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040ce9b
push str.MentorMentor_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040ce9b
push str.MentorBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040ce9b
push str.MentorMentor_UninstallUninstall_Mentor_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040ce9b
push str.MentorMentor_UninstallUninstall_Mentor_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_LicensingConfigure_Licensing.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040ce9b
push str.MentorMentor_Uninstall
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cdc6
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0xe3c]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040ce9b
push str.Mentor_Licensing
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x1044]
push eax
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040ce9b
push 0x4478d4
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cdc6
add esp, 0x18
lea eax, [ebp - 0x124c]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402c13
mov esp, ebp
pop ebp
ret
Function at 0x402170
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x451040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44796c
push 0
call fcn.00421afa
push 0x114
lea eax, [ebp - 0x198]
push 0
push eax
call fcn.00403bf0
add esp, 0x14
mov dword [ebp - 0x198], 0x114
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x194], 6
push 0x40
sbb eax, eax
inc eax
mov dword [0x451a28], eax
lea eax, [ebp - 0x84]
push eax
push 0x447970
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40228b
push esi
lea eax, [ebp - 0x84]
push 0x5f
push eax
call fcn.00403897
add esp, 8
test eax, eax
je 0x402217
mov esi, 0x2d
mov word [eax], si
add eax, 2
push 0x5f
push eax
call fcn.00403897
add esp, 8
test eax, eax
jne 0x402202
cmp dword [0x451a28], 0
je 0x402277
push ebx
push edi
push 0x447980
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x44799c
push edi
call esi
push 0x4479b0
push edi
mov ebx, eax
call esi
push 4
push 0x451a34
push 0x20000001
lea ecx, [ebp - 0x84]
push ecx
call eax
movzx eax, word [0x451a34]
push eax
call ebx
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402c13
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x84]
push eax
call sub.Nlsdl.dll_DownlevelLocaleNameToLCID
mov dword [0x451a34], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402c13
mov esp, ebp
pop ebp
ret
Function at 0x40499e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x447cd8
push 0x447cd0
push 0x447cd8
push 0
call fcn.00404845
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4049d0
push dword [ebp + 8]
mov ecx, esi
call fcn.0040365d
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x404a12
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x447cfc
push 0x447cf4
push 0x447cfc
push 2
call fcn.00404845
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x404a43
mov ecx, esi
call fcn.0040365d
call esi
jmp 0x404a49
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x404a4c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x447d10
push 0x447d08
push 0x447d10
push 3
call fcn.00404845
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x404a80
mov ecx, esi
call fcn.0040365d
call esi
jmp 0x404a86
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x42ecb2
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ea91

Function at 0x430ef0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004306ea

Function at 0x430efb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00430925

Function at 0x438450
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438055

Function at 0x43845b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004381d6
Function at 0x10047a9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call sub.SYSSETUP.dll_SetupOobeInitDebugLog
push 0x1002238
push edi
push 0x5a7
mov esi, 0x1001470
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
mov ebx, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0x10
call ebx
push eax
call fcn.0100352b
cmp dword [0x1007308], edi
jne 0x100484e
cmp dword [0x10070f0], edi
jne 0x1004820
cmp dword [0x1007304], edi
jne 0x100484e
cmp dword [0x1007300], edi
jne 0x100484e
push 0x1002198
push edi
push 0x5b5
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
mov dword [0x1007308], 1
jmp 0x100484b
cmp dword [0x1007304], edi
jne 0x100484e
cmp dword [0x1007300], edi
jne 0x100484e
push 0x10020e8
push edi
push 0x5bb
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
mov dword [0x1007300], 0x1007020
add esp, 0x10
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x10048c3
cmp dword [0x1007308], edi
je 0x1004882
push 0x10020a4
push edi
push 0x5c6
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x10
call ebx
push eax
call fcn.01004336
jmp 0x1004916
cmp dword [0x1007304], edi
je 0x1004897
push dword [ebp + 8]
call fcn.010051fc
mov dword [ebp - 4], eax
jmp 0x1004916
mov eax, dword [0x1007300]
mov ebx, dword [eax + 8]
call dword [eax + 0x1c]
push ebx
mov dword [ebp + 8], eax
call fcn.010042b0
test eax, eax
jne 0x10048c8
push 0x1001f10
push edi
push 0x5dd
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1004933
cmp dword [ebp + 8], 0xfffffffe
je 0x1004911
cmp dword [0x10070f0], edi
jne 0x10048eb
push dword [ebp + 8]
call fcn.0100461d
test eax, eax
jne 0x1004916
mov dword [ebp - 4], 1
jmp 0x1004916
call fcn.01003cdd
test eax, eax
je 0x1004916
mov eax, dword [0x1007300]
mov eax, dword [eax + 0x18]
cmp eax, 0x10034b5
je 0x1004911
push dword [ebp + 8]
call eax
push edx
push eax
call fcn.01003de9
jmp 0x1004916
call fcn.0100372e
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x1002080
push edi
push 0x606
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10049ba
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [0x10070b0], 0xffffffff
mov eax, dword [0x10070b8]
mov dword [ebp - 4], eax
jne 0x1004a22
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1004a22
push 0x100225c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80000080
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x10070b0], eax
mov ecx, dword [ebp - 4]
call fcn.01005458
leave
ret
Function at 0x1004a31
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x10070b0], 0xffffffff
mov dword [ebp - 4], esi
je 0x1004acc
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp + 8]
push 0x500
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 4], esi
je 0x1004acc
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcslen]
lea ebx, [eax + eax + 4]
push ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x1004ac1
push esi
push esi
push ebx
push edi
push 0xffffffffffffffff
push dword [ebp - 4]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [0x10070b0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1004ad4
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10070b8]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x41c]
push eax
push 0xf003f
xor esi, esi
push esi
push 0x100229c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004b9d
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push esi
mov esi, 0x100228c
push esi
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004b91
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1004b6c
push 0x1002278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004b91
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01005458
leave
ret 4
Function at 0x1004d3e
Capabilities:
Check for time delay via gettickcount
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x80004005
mov dword [ebp - 4], 1
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1002e98
push edi
push 0xb4
mov esi, 0x10025c0
push esi
mov dword [ebp - 0x14], eax
call sub.SYSSETUP.dll_pSetupDebugPrint
push 0x1002e78
call fcn.01004a31
add esp, 0x14
push edi
push edi
push edi
push edi
push 0x1002e10
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x1004e5e
push 0x1002de4
push edi
push 0xbf
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push 0x1002db4
call fcn.01004a31
add esp, 0x14
push 0x80004005
push 0x1002d60
push edi
push 0xda
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push 0x80004005
push 0x1002d00
call fcn.01004a31
add esp, 0x1c
cmp ebx, edi
jne 0x1004f60
mov eax, dword [0x1007310]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0xc0]
mov ebx, eax
cmp ebx, edi
jne 0x1004f42
cmp dword [ebp - 0x10], 0x7fffffff
je 0x1004f42
call fcn.01004c17
mov ebx, eax
cmp ebx, edi
jne 0x1004f28
call fcn.0100495e
mov ebx, eax
push ebx
push 0x1002cb0
push edi
push 0xe9
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push ebx
push 0x1002c50
call fcn.01004a31
add esp, 0x1c
cmp ebx, 0xb02d
jne 0x1004ead
mov dword [ebp - 8], edi
jmp 0x1004ec6
push 4
lea ecx, [ebp - 4]
push ecx
push 0x46
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionW]
test eax, eax
jne 0x1004ea1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002bb0
push edi
push 0xcb
push esi
mov dword [ebp - 4], eax
call sub.SYSSETUP.dll_pSetupDebugPrint
push dword [ebp - 4]
push 0x1002b08
call fcn.01004a31
add esp, 0x1c
jmp 0x1004dbe
call fcn.0100493f
mov ebx, eax
jmp 0x1004de6
cmp ebx, 0xb034
jne 0x1004ebe
mov dword [ebp - 8], 1
xor ebx, ebx
cmp ebx, edi
jne 0x1004f60
push dword [ebp - 8]
call fcn.01004ce5
mov ebx, eax
cmp ebx, edi
jne 0x1004f06
call fcn.0100495e
mov ebx, eax
push ebx
push 0x1002ab0
push edi
push 0xfc
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push ebx
push 0x1002a48
call fcn.01004a31
add esp, 0x1c
cmp ebx, edi
jne 0x1004f60
call fcn.01004bb0
jmp 0x1004f60
push ebx
push 0x10029e0
push edi
push 0x105
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push ebx
push 0x1002968
call fcn.01004a31
add esp, 0x1c
jmp 0x1004f60
push ebx
push 0x1002908
push edi
push 0x10c
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push ebx
push 0x1002898
jmp 0x1004f1e
push 0x100285c
push edi
push 0x112
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push 0x1002820
call fcn.01004a31
add esp, 0x14
push 0x10027f4
push edi
push 0x116
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
push 0x10027c4
call fcn.01004a31
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
push eax
push 0x1002784
call fcn.01004a31
cmp dword [ebp - 0xc], edi
pop ecx
pop ecx
je 0x1004fa2
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret