joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40da48
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x4533f0
call fcn.0043b977
cmp byte [ebx + 0xc8], 0
jne 0x40db53
mov eax, dword [ebx + 0xa8]
xor esi, esi
cmp eax, esi
jne 0x40db4c
lea ecx, [ebp - 0x24]
call fcn.0041578f
mov dword [ebp - 4], esi
push dword [ebx + 0xb8]
lea eax, [ebp - 0x24]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00401fd3
add esp, 0xc
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408446
cmp eax, esi
jne 0x40db1c
push str.LI_UPDATE
mov ecx, 0x471b34
call fcn.00416fa0
test eax, eax
je 0x40dad8
lea eax, [ebx + 0xdc]
push 0x4599c4
push eax
call fcn.0040ee68
test eax, eax
pop ecx
pop ecx
je 0x40db1c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 3
push esi
push str.InstallationID
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40db1c
lea eax, [ebx + 0xdc]
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x471b30]
test ecx, ecx
je 0x40db34
push eax
call fcn.00412df0
mov ecx, dword [0x471b30]
test ecx, ecx
je 0x40db34
push 0
push 1
push str.InstallerFinished
call fcn.00412e8e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00408482
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401af6
mov byte [ebx + 0xc8], 1
call fcn.0043b9fa
ret

Function at 0x40db59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0042ffe0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40db7a
xor eax, eax
jmp 0x40db8d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40db76
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x40ee01
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ee64
cmp dword [ebp + 0xc], 1
je 0x40ee3d
cmp dword [ebp + 0xc], 2
je 0x40ee3d
push 0xd
pop eax
jmp 0x40ee64
test edi, edi
mov eax, dword [ebp - 4]
je 0x40ee5e
test eax, eax
je 0x40ee5a
test al, 1
jne 0x40ee38
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40ee5e
jmp 0x40ee38
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40ef4f
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x452e16
call fcn.0043b90e
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x40ef97
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.004084a7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x40ef7d
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.004300c6
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.004300c6
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.00430eb1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041076f
call fcn.0043b9e6
ret

Function at 0x40f554
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x450889
call fcn.0043b90e
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40f596
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40f596
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401af6
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043b9e6
ret
Function at 0x4134b7
Capabilities:
Get common file path

Disassembly:
push 0x28
mov eax, 0x45104d
call fcn.0043b941
mov edi, ecx
lea ecx, [ebp - 0x34]
call fcn.0042b1ef
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.0040169f
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.0041578f
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.0040c3d3
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41352d
call fcn.00403023
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401af6
or dword [ebp - 4], 0xffffffff
call fcn.0042b205
mov eax, esi
call fcn.0043b9e6
ret
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.00405304
lea ecx, [ebp - 0x18]
call fcn.0041578f
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.0040c3d3
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x413587
call fcn.00403023
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401af6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401af6
mov dword [ebp - 4], ebx
jmp 0x413520
push ebx
lea ecx, [ebp - 0x18]
call fcn.00405304
lea eax, [ebp - 0x1c]
push eax
call fcn.004082eb
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x4135f2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00413286
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401af6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401af6
mov dword [ebp - 4], ebx
call fcn.0042b205
mov eax, dword [ebp - 0x24]
jmp 0x413527
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.004015e9
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00413286
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401af6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401af6
mov dword [ebp - 4], ebx
call fcn.0042b205
xor eax, eax
jmp 0x413527

Function at 0x41366e
Capabilities:
Accept command line arguments

Disassembly:
push 0xc
mov eax, 0x4506bc
call fcn.0043b941
mov edi, ecx
call fcn.0040169f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x41369e
mov eax, 0x80004005
jmp 0x4136d8
and dword [ebp - 4], 0
push dword [esi]
mov ecx, edi
call fcn.004015e9
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x4136d8
call fcn.0043b9e6
ret
Function at 0x4136de
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x451013
call fcn.0043b90e
lea ecx, [ebp - 0x10]
call fcn.0041578f
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041366e
xor ecx, ecx
test eax, eax
setge cl
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
mov esi, ecx
call fcn.00436910
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push edi
push 0x1000000
push edi
neg esi
push edi
sbb esi, esi
and esi, dword [ebp - 0x10]
push edi
call fcn.0040c359
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.00405304
cmp esi, edi
jne 0x413776
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401af6
mov eax, edi
call fcn.0043b9e6
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x20]
jmp 0x413762
Function at 0x413b0f
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x451ca2
call fcn.0043b977
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.0040d313
mov ecx, dword [ebp - 0x22c]
push 0x459e5c
call fcn.004014f6
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.004014f6
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x413d2b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x413d2b
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x413d0f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.004014f6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.0041578f
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x413cf1
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.004014f6
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.00413a74
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401aa6
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401af6
lea edi, [ebp - 0x220]
call fcn.0040d313
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004042bc
test eax, eax
jne 0x413cf1
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.004014f6
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.00413a74
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401a91
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401af6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401af6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.00401af6
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x413bc1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00401af6
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401af6
mov eax, dword [ebp - 0x22c]
call fcn.0043b9fa
ret
Function at 0x41421d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46cd08]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.00436910
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x414276
cmp dword [ebp - 0x110], 3
jae 0x41427c
cmp dword [ebp - 0x114], 5
ja 0x41427c
xor eax, eax
jmp 0x41427f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435d90
leave
ret

Function at 0x41428b
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x220
mov eax, 0x450f91
call fcn.0043b977
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov ecx, ebx
call fcn.0041578f
mov dword [ebp - 0x228], esi
call fcn.00413954
test al, al
je 0x4143b0
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00401aa6
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x224]
call fcn.004014f6
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push edi
push dword [ebp - 0x224]
mov dword [ebp - 0x21c], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x414390
lea ecx, [ebp - 0x220]
call fcn.00408482
cmp eax, edi
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
jne 0x414390
push str.ProgramFilesDir
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x104
call fcn.0040ee01
test eax, eax
jne 0x414390
mov eax, edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.004014f6
mov byte [ebp - 4], 4
push dword [eax]
push str._ProgramFiles_
push ebx
call fcn.004080e8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.00401af6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.00408482
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00401af6
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x4143c2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4143e4
mov esi, dword [ebp + 8]
mov eax, 0x3fff
push eax
push eax
mov ecx, ebx
call fcn.0040c3d3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00405304
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401af6
mov eax, ebx
call fcn.0043b9fa
ret
Function at 0x414a6a
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x44fd6b
call fcn.0043b90e
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push str.en_us
call fcn.00415a5c
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x45ddec
push 0x17
push edi
push 0x4599e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x414ad4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push dword [ebp + 8]
mov ebx, eax
add esi, 0x34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push ebx
call dword [esi]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x414ae4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
call fcn.0043b9e6
ret

Function at 0x414b0e
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x64
mov eax, 0x452756
call fcn.0043b90e
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x414c42
lea eax, [ebp - 0x14]
push eax
call fcn.00414455
pop ecx
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x14]
mov eax, dword [edi - 0xc]
cmp eax, ebx
mov byte [ebp - 0xd], bl
jne 0x414b6b
lea edi, [ebp - 0x1c]
mov byte [ebp - 0xd], 1
call fcn.00414957
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00401aa6
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.00401af6
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], ebx
je 0x414c23
movzx ecx, byte [ebp - 0xd]
mov eax, dword [esi]
push ecx
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00414a01
mov byte [ebp - 4], 2
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.00436910
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 3
call fcn.0041578f
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041366e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c359
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x414c0a
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401af6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401af6
jmp 0x414c36
mov esi, dword [esi]
push 3
push ebx
push ebx
push esi
push 0x45d040
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401af6
call fcn.0043b9e6
ret
Function at 0x414c48
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x6c
mov eax, 0x451b00
call fcn.0043b90e
mov edi, 0x471b60
mov edx, 0x45ad7c
mov ecx, edi
call fcn.00402905
test eax, eax
je 0x414e41
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004014f6
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ebx, [ebp - 0x10]
call fcn.0041428b
pop ecx
mov dword [ebp - 4], 1
push 0x5c
mov esi, ebx
call fcn.00408261
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.004083bb
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408282
mov byte [ebp - 4], 3
call fcn.004080a4
push 0x22
mov ecx, ebx
call fcn.00403e90
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x414ce6
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00408558
mov edx, str.LaunchAs
mov ecx, edi
xor esi, esi
call fcn.00402905
cmp eax, ebx
je 0x414d44
push str.AsInvoker
push eax
call fcn.00436cf5
test eax, eax
pop ecx
pop ecx
jne 0x414d44
inc esi
call fcn.0041421d
test al, al
je 0x414d44
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.0041541a
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp byte [ebp + 8], bl
je 0x414d3c
mov ecx, dword [0x4719d8]
push ebx
call fcn.0042aed0
cmp edi, ebx
jne 0x414e09
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.00436910
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0041578f
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041366e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040c359
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040c359
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp byte [ebp + 8], bl
mov esi, eax
je 0x414de9
mov ecx, dword [0x4719d8]
push ebx
call fcn.0042aed0
push 0xea60
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x414de9
push ebx
push 0x414aed
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x414dfd
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00401af6
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00405304
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00405304
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00401af6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401af6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401af6
call fcn.0043b9e6
ret
Function at 0x415cc6
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415ce2
and dword [esi], eax
and dword [esi + 4], eax
jmp 0x415d58
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 8], eax
call fcn.00424d35
xor ebx, ebx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x415d05
mov dword [esi], ebx
jmp 0x415d55
push eax
push dword [ebp - 8]
xor edi, edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415d4a
and dword [ebp - 8], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x45a3b8
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 4], 0x34
jb 0x415d4a
mov eax, dword [ebp - 8]
test eax, eax
je 0x415d4a
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ebx, ecx
push dword [ebp - 0xc]
call fcn.00424d3a
pop ecx
mov dword [esi], edi
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x416b20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp byte [eax + 0x29], 0
je 0x416b3a
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
cmp eax, edi
jne 0x416b72
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], ecx
cmp eax, edi
push esi
mov esi, eax
jne 0x416c92
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.InstallerData
push ecx
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
jne 0x416ba7
mov edi, dword [ebp - 0xc]
test eax, eax
mov esi, eax
jne 0x416c87
lea edx, [ebp + 0xc]
push edx
call fcn.0040d3c2
push 0x7fff
lea eax, [ebp + 0xc]
push eax
call fcn.0040d364
test al, al
jne 0x416bfa
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d39c
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416be2
push edi
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x416bec
push eax
call esi
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
cmp byte [edx + 0x28], 0
jne 0x416c6c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x10], 0x7fff
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x416c6c
mov edx, dword [ebp + 0xc]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x416c10
call fcn.00408b3f
mov esi, eax
lea eax, [ebp + 0xc]
push eax
call fcn.0040d39c
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416c57
push edi
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x416ca9
push eax
call ebx
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
call fcn.004175c0
test eax, eax
jne 0x416cb7
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d39c
test edi, edi
je 0x416c92
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00408b3f
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x416ca9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push ecx
mov ebx, eax
call fcn.00417770
cmp dword [ebx + 0xc], 0
mov dword [ebp + 8], eax
je 0x416cf3
mov esi, dword [ebx + 4]
test esi, esi
mov ebx, dword [ebx]
je 0x416cfb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x416d05
cmp dword [ebp + 8], 0
jne 0x416cb4
jmp 0x416c7e
push 0x80004005
call fcn.00401777
mov eax, esi
jmp 0x416c3a