joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
mov esi, ecx
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x409b97
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 0x20c]
push ecx
push ebx
mov ecx, esi
call fcn.00409940
test eax, eax
jne 0x409a83
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
mov eax, dword [edi + 0x20c]
xor ebp, ebp
test eax, eax
jbe 0x409b32
lea esi, [edi + 0x224]
mov al, byte [esi - 0x10]
mov dl, byte [esi - 0x14]
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], 0
mov cx, word [eax + 0xc]
mov word [esp + 0x1c], cx
mov dx, word [eax + 0xe]
mov word [esp + 0x1e], dx
mov ecx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and eax, 0xffff
imul ecx, eax
cmp ecx, 8
jl 0x409ae2
mov byte [esp + 0x1a], 0
jmp 0x409aea
mov dl, 1
shl dl, cl
mov byte [esp + 0x1a], dl
mov eax, dword [esi - 4]
mov ecx, dword [esp + 0x14]
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.004099f0
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x20]
push 0x10
push edx
push ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409b97
cmp dword [esp + 0x30], 0x10
jne 0x409b97
mov eax, dword [edi + 0x20c]
inc ebp
add esi, 0x20
cmp ebp, eax
jb 0x409a99
mov eax, dword [edi + 0x20c]
xor ebx, ebx
test eax, eax
jbe 0x409b8c
lea esi, [edi + 0x224]
mov eax, dword [esi]
push 0
mov ebp, dword [eax + 0x14]
mov dword [eax + 0x14], 0
mov ecx, dword [esi - 4]
mov edx, dword [esi - 8]
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409b97
mov ecx, dword [esp + 0x30]
mov eax, dword [esi - 4]
cmp ecx, eax
jne 0x409b97
mov edx, dword [esi]
inc ebx
add esi, 0x20
mov dword [edx + 0x14], ebp
mov eax, dword [edi + 0x20c]
cmp ebx, eax
jb 0x409b44
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
Function at 0x409bb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409c2f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x409c2f
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x409c2f
push ebx
push ebp
push edi
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov ebp, eax
mov eax, ecx
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x409dc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409ead
mov esi, dword [esp + 0x28]
mov ecx, edi
push esi
mov word [esp + 0x14], 0x4d42
mov word [esp + 0x1a], bp
mov word [esp + 0x1c], bp
call fcn.00409d80
and eax, 0xffff
push esi
add eax, 0x36
mov ecx, edi
mov dword [esp + 0x1e], eax
call fcn.00409d90
imul eax, dword [esi + 8]
mov edx, dword [esp + 0x1a]
lea ecx, [esp + 0x24]
add eax, edx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
lea edx, [esp + 0x18]
push 0xe
shr eax, 2
push edx
push ebx
mov dword [esp + 0x26], eax
call ebp
test eax, eax
je 0x409ea6
cmp dword [esp + 0x24], 0xe
jne 0x409ea6
mov eax, dword [esi + 8]
push esi
cdq
sub eax, edx
mov ecx, edi
sar eax, 1
mov dword [esi + 8], eax
call fcn.00409d90
mov edi, eax
mov ecx, dword [esp + 0x1a]
imul edi, dword [esi + 8]
lea eax, [esp + 0x24]
add edi, ecx
push 0
push eax
push edi
push esi
push ebx
call ebp
test eax, eax
je 0x409ea6
cmp dword [esp + 0x24], edi
jne 0x409ea6
mov ecx, dword [esi + 8]
push ebx
shl ecx, 1
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x409fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x40a026
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x40a026
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x40a007
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x40a3b0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x40a3e8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x40b070
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x40b0b9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x40b530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x421110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0040b0e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0040b160
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0040b160
lea ecx, [esi + 0xc]
call fcn.0041aab8
lea ecx, [esi + 0x10]
call fcn.0041aab8
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0040c6f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0040c6f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0040c6f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0041ab2d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041ab2d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4201c9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4201f7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x420215
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042012f
jmp 0x420215
mov eax, dword [esi + 0x14]
test eax, eax
je 0x420215
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042012f
test edi, edi
mov eax, edi
jne 0x4201ff
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401b70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4476f6
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x460cd0]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
push 0x465138
lea ecx, [esp + 8]
call fcn.00403020
mov dword [esp + 0x818], 0
push 0x465338
lea ecx, [esp + 0xc]
call fcn.00403020
mov byte [esp + 0x818], 1
mov eax, dword [esp + 4]
push 0x44ea58
push eax
call fcn.0042f75b
add esp, 8
test eax, eax
jne 0x401ca1
push eax
push 0x24
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401c8f
push 0x3ff
push str._twain_32_
lea edx, [esp + 0x14]
push 0x400
push edx
call fcn.0042f0da
push 0x3ff
push 0x465138
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.0042f0da
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401c76
push 1
lea ecx, [esp + 0x10]
call fcn.0041be50
add esp, 4
test eax, eax
je 0x401ca1
lea edx, [esp + 0xc]
push edx
push str.RemoveDirectory_:_Fail_to_remove___s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x401ca1
lea eax, [esp + 0xc]
push eax
push str.RemoveDirectory_:___s__is_not_exist
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x401ca1
push str.RemoveDirectory_:_cannot_get_windows_PAth
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov ecx, 0x465138
call fcn.00401d10
test al, al
jne 0x401cc1
push str.RemoveDirectory_:_cannot_get_program_files_path
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov byte [esp + 0x818], 0
lea ecx, [esp + 8]
call fcn.004036b0
mov dword [esp + 0x818], 0xffffffff
lea ecx, [esp + 4]
call fcn.004036b0
xor al, al
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0042f002
add esp, 0x818
ret
Function at 0x401d10
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447130
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1010
call fcn.00434bf0
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov byte [ebp - 0x1019], 1
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x401efe
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401d61
sub eax, edx
sar eax, 1
je 0x401efe
push 0x800
push ebx
lea eax, [ebp - 0x1018]
push eax
call fcn.00430500
add esp, 0xc
push ebx
push 0x26
lea ecx, [ebp - 0x1018]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401db5
push esi
lea edx, [ebp - 0x1018]
push edx
push str._s_s
call fcn.00402fe0
add esp, 0xc
push 0x800
push ebx
lea eax, [ebp - 0x818]
push eax
call fcn.00430500
push 0x3ff
lea ecx, [ebp - 0x1018]
push ecx
push 0x400
lea edx, [ebp - 0x818]
push edx
call fcn.0042f011
push 0x3ff
push str.TotalUninstaller_
push 0x400
lea eax, [ebp - 0x818]
push eax
call fcn.0042f0da
push 0x3ff
push str.TotalUninstaller.exe
push 0x400
lea ecx, [ebp - 0x818]
push ecx
call fcn.0042f0da
lea edx, [ebp - 0x818]
push edx
push str.totaluninstaller_module_:___s_
mov ecx, 0x466338
call fcn.0041a690
add esp, 0x44
push 1
lea ecx, [ebp - 0x818]
call fcn.0041be50
add esp, 4
test eax, eax
je 0x401e5f
push str.Fail_to_remove_Totaluninstaller
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov byte [ebp - 0x1019], bl
push 0x800
push ebx
lea eax, [ebp - 0x818]
push eax
call fcn.00430500
push 0x3ff
lea ecx, [ebp - 0x1018]
push ecx
push 0x400
lea edx, [ebp - 0x818]
push edx
call fcn.0042f011
push 0x3ff
push str.TotalUninstaller
push 0x400
lea eax, [ebp - 0x818]
push eax
call fcn.0042f0da
push 1
lea ecx, [ebp - 0x818]
call fcn.0041be50
add esp, 0x30
test eax, eax
je 0x401ed5
push str.Fail_to_remove_Totaluninstaller
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov byte [ebp - 0x1019], bl
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1019]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x401ee2

Function at 0x4033f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403409
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403444
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403440
lea ebx, [ebx]
cmp esi, eax
jae 0x403444
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403430
cmp esi, eax
jb 0x40344a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4047d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4482d8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push edi
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004240b0
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x24]
push ecx
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0x26]
mov dword [esp + 0x18], ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
call fcn.00402070
mov dword [esp + 0xc], vtable.CGdiObject.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0xc], vtable.CBrush.0
mov eax, 1
mov dword [esp + 0x40], eax
sub dword [esp + 0x1c], eax
add dword [esp + 0x18], eax
push 0xf2f2f1
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x10]
call fcn.00424251
cmp byte [esi + 0x174], 1
jne 0x40489f
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 4]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
or eax, 0xffffffff
mov byte [esi + 0x174], bl
mov dword [esp + 0x40], eax
mov dword [esp + 0xc], vtable.CBrush.0
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xc]
call fcn.00402e60
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404f80
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x446900
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x460cd0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 0x17
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, esi
je 0x405000
push str.Get_Start_Program_Folder_Location_Fail___
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x1c], 3
push 0x459988
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00430c48
lea edx, [ebp]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x405039
push str.Get_Start_Program__Folder_Path_Fail___
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 0x18], 3
push 0x459988
lea ecx, [ebp - 0x18]
push ecx
call fcn.00430c48
lea eax, [ebp]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x405040
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 2], 0x5c
jne 0x405074
lea eax, [ebp]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x405060
sub eax, edx
sar eax, 1
mov word [ebp + eax*2 - 2], si
lea eax, [ebp]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x405080
sub eax, edx
sar eax, 1
je 0x4050a5
lea edx, [ebp]
push edx
push 0x400
push edi
call fcn.0042f50c
add esp, 0xc
jmp 0x4050b7
push str.Get_StartMenu__Folder_Path_Fail___
mov ecx, 0x466338
call fcn.0041a690
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0042f002
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x405110
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1260
call fcn.00434bf0
mov eax, dword [0x460cd0]
xor eax, esp
mov dword [esp + 0x125c], eax
test esi, esi
push ebx
push edi
mov bl, 1
je 0x405334
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405140
sub eax, edx
sar eax, 1
je 0x405334
push 0x800
lea eax, [esp + 0x264]
push 0
push eax
call fcn.00430500
add esp, 0xc
push 0x465138
push esi
push str._sUninstall__s_Printer_Software.lnk
lea edx, [esp + 0x26c]
call fcn.00402fe0
add esp, 0xc
push 0
lea ecx, [esp + 0x264]
call fcn.0041be50
add esp, 4
test eax, eax
jne 0x4051b5
lea ecx, [esp + 0x260]
push ecx
push str.__s_shortcut_has_been_deleted__
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
push 0x800
lea edx, [esp + 0xa64]
push 0
push edx
call fcn.00430500
add esp, 0xc
push esi
push str._s.lnk
lea edx, [esp + 0xa68]
call fcn.00402fe0
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xa64]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40531e
nop
push 0x800
lea edx, [esp + 0x264]
push 0
push edx
call fcn.00430500
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
push esi
push str._s_s
lea edx, [esp + 0x26c]
call fcn.00402fe0
mov eax, 0x465b38
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405240
sub eax, edx
sar eax, 1
je 0x4052a0
mov edx, 0x465b38
lea ecx, [esp + 0x260]
call fcn.00405650
test al, al
je 0x4052a0
push 0
lea ecx, [esp + 0x264]
call fcn.0041be50
add esp, 4
test eax, eax
jne 0x405294
lea ecx, [esp + 0x3c]
push ecx
push str.total_uninstaller_shortcut___s__has_been_removed___
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x405303
lea edx, [esp + 0x3c]
push edx
push str.total_uninstaller_shortcut___s__couldnt_be_removed___
jmp 0x4052f4
lea ecx, [esp + 0x260]
call fcn.00404dd0
test al, al
jne 0x4052ea
push 0
lea ecx, [esp + 0x264]
call fcn.0041be50
add esp, 4
test eax, eax
jne 0x4052de
lea eax, [esp + 0x3c]
push eax
push str.invalid_shortcut___s__has_been_removed___
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
jmp 0x405303
lea ecx, [esp + 0x3c]
push ecx
push str.invalid_shortcut___s__couldnt_be_removed___
jmp 0x4052f4
lea edx, [esp + 0x3c]
push edx
push str.there_is_available_shortcut___s__so_that_the_shortcut_folder_shouldnt_be_deleted_
mov ecx, 0x466338
call fcn.0041a690
add esp, 8
xor bl, bl
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405200
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop ebx
mov ecx, dword [esp + 0x125c]
xor ecx, esp
call fcn.0042f002
mov esp, ebp
pop ebp
ret
push str.the_total_uninstaller_shorcut_folder_path_is_invalid_so_that_the_total_uninstalle_shotcut_couldnt_be_deleted______
mov ecx, 0x466338
call fcn.0041a690
mov ecx, dword [esp + 0x1268]
add esp, 4
pop edi
pop ebx
xor ecx, esp
xor al, al
call fcn.0042f002
mov esp, ebp
pop ebp
ret
Function at 0x405910
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
test esi, esi
mov bl, 1
je 0x4059b0
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00430500
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 4
push 1
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40595f
push esi
xor bl, bl
push 0x44fcb0
jmp 0x40597f
mov eax, dword [esp + 8]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push str.Valid_Command_:___s_
mov ecx, 0x466338
call fcn.0041a690
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
test eax, eax
je 0x40599d
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4059a8
push eax
call esi
mov al, bl
pop esi
pop ebx
add esp, 0x5c
ret
pop esi
xor al, al
pop ebx
add esp, 0x5c
ret

Function at 0x4066f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4480b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x460cd0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.Gdiplus::Image.0
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.ImageEx.0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], 2
mov dword [esi + 0x14], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
call fcn.004272b3
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
mov byte [esi + 0x31], bl
call edi
push ebx
push 1
push 1
push ebx
mov dword [esi + 0x1c], eax
call edi
push ecx
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00403020
mov byte [esp + 0x20], 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x44e798
call fcn.00403020
mov byte [esp + 0x24], 2
push esi
mov byte [esp + 0x28], bl
call fcn.00406a20
cmp al, bl
je 0x4067bd
mov ecx, dword [esi + 0x10]
lea eax, [esi + 4]
push eax
push ecx
mov dword [eax], ebx
call sub.gdiplus.dll_GdipLoadImageFromStreamICM
mov dword [esi + 8], eax
call fcn.00406b60
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x406980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edx, dword [edi + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push eax
push ecx
push edx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4069a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov eax, dword [edi + 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4069a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x406a0c
cmp dword [esp + 0x10], 0
push esi
jne 0x4069e6
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
pop esi
mov dword [ebp], eax
mov bl, 1
pop ebp
mov al, bl
pop ebx
ret 8
mov edx, dword [edi + 0x20]
mov ebp, dword [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp ebp, eax
jl 0x406a0c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebp
push eax
push ecx
call fcn.00438530
add esp, 0xc
mov bl, 1
pop esi
pop ebp
mov al, bl
pop ebx
ret 8