joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x4b8043
cmp byte [eax], 0x64
jne 0x4b8043
cmp ecx, 1
je 0x4b8043
movsx ecx, byte [eax + 1]
cmp ecx, 0x58
je 0x4b8051
cmp ecx, 0x78
je 0x4b8104
cmp ecx, 0x69
jne 0x4b8043
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004baff0
xor edi, edi
test eax, eax
je 0x4b8191
mov ebx, eax
mov ecx, esi
call fcn.004b7f60
test eax, eax
je 0x4b8191
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x4b800c
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4b819b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x4daec4
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 0
jmp 0x4b8191
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004b5010
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004b5010
xor edi, edi
test eax, eax
je 0x4b8191
mov ebx, eax
mov ecx, esi
call fcn.004b5010
test eax, eax
je 0x4b8191
mov ebp, eax
mov ecx, esi
call fcn.004b7f60
test eax, eax
je 0x4b8191
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea edx, [ecx - 0xfd8]
cmp edx, 0xfffff007
ja 0x4b80ce
mov dword [esp], eax
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4b819b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
mov eax, dword [esp]
add ecx, 0x20
mov dword [edi + 4], ecx
mov edx, dword [esi + 0x116c]
mov ecx, dword [edx + 4]
lea edi, [edx + ecx]
add edi, 0xffffffe8
mov dword [edx + ecx - 0x14], 0x1010142
mov dword [edx + ecx - 0x18], 0x4daf30
mov dword [edx + ecx - 0x10], ebx
mov dword [edx + ecx - 0xc], ebp
mov dword [edx + ecx - 8], eax
jmp 0x4b8191
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004b5010
xor edi, edi
test eax, eax
je 0x4b8191
mov ebx, eax
mov ecx, esi
call fcn.004b7f60
test eax, eax
je 0x4b8191
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x4b815f
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4b819b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x4daec4
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 1
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0048e830
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43b655
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
and edi, esi
call fcn.0043b688
add edi, 0x40a46a0f
xor dword [ecx], eax
push esi
pop edi
sub esi, esi
inc ecx
or esi, esi
sub edi, esi
cmp ecx, edx
jne fcn.0043b655
inc esi
or edi, edi
inc esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, str.Continue_
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, str.Error_
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, str.Can_not_create_some_of_your_include_files.
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, str.Can_not_allocate_the_memory.
lea ecx, [0x40e460]
call fcn.00404068
mov edx, str.Wrong_password.
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, str.The_file
lea ecx, [0x40e3f4]
call fcn.00404068
mov edx, str._already_exists_in_the_current_directory._Overwrite_
lea ecx, [0x40e408]
jmp loc.00413578

Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4
Function at 0x793990
Capabilities:
Encode data using xor

Disassembly:
jmp 0x79399a
pushal
call 0x7939a0
pop ebp
sub ebp, 0x10
sub ebp, 0x393990
jmp 0x7939b6
mov eax, 0x393990
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b6
mov edx, 0x60e0bdbf
xor byte [eax], dl
inc eax
dec ecx
jne 0x7939cd
jmp 0x7939e0
xor al, 0x72
xor al, 0x36
cmp dword [edi + 0x7e3ebfbf], 0x47
mov edi, 0x72bcbfbf
pop es
mov ch, 0xbf
mov edi, 0xbf9705bf
mov edi, 0xbc5d48bf
ja 0x793a33
mov bl, 0xbf
mov edi, 0xef7abcbf
out dx, eax
xlatb
xchg edi, eax
fdiv dword [ecx + 0x6ddad7bf]
xchg ebp, eax
mov edi, 0xd79b93be
push eax
push cs
xchg edi, eax
mov dl, 0x57
mov edx, 0x56bfbfbf
xchg ebp, eax
mov edi, 0x32eabfbf
rcr dword [ebx - 0x48c5cb41], cl
mov edi, 0x2a34bfbf
mov bl, 0xbf
mov edi, 0xaf3234bf
mov edi, 0x567ebfbf
mov ebp, 0x7d3cbd8e
mov ebx, 0x4b3ab0f6
inc eax
inc eax
inc eax
loop 0x793ac9
mov bl, 0xbf
xor al, 0x33
wait
mov ebx, 0xd7bfbfbf
xchg edi, eax
fdiv dword [ecx + 0x6ddad7bf]
xchg ebp, eax
mov edi, 0xee9b93be
xchg ebx, eax
wait
out dx, al
push edi
mov edx, 0x56bfbfbf
cmp byte [ebp - 0x14154041], 0xe2
inc eax
retf 0x40b3
xrelease xchg byte [esi + 0x3cba7e3c], bh
push edi
mov ebx, 0x40400256
inc eax
xchg esi, eax
jmp 0x793a60

Function at 0x438cb6
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edi
inc ebx
sub ecx, ebx
call fcn.00438cdc
and ebx, ecx
sub ecx, ecx
xor dword [edx], edi
inc ebx
or ecx, ecx
inc edx
and ebx, ecx
cmp edx, esi
jne fcn.00438cb6
add ebx, ecx
dec ebx
ret
Function at 0x41c520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8900
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x640844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x34
mov dword [edi + 4], 0
lea esi, [edi + 0x20]
mov dword [edi + 0x14], 0
push 0
push esi
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.004ef230
mov dword [edi + 0x24], 0x80
add esp, 0xc
mov dword [esi], 0x34
mov eax, dword [0x647e58]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x6b
mov dword [edi + 0x38], 0x426c60
mov dword [edi + 0x40], 0x4251f0
mov dword [edi + 0x3c], edi
mov dword [edi + 0x34], 0x66
mov dword [edi + 0x24], 0x88
mov dword [ebp - 4], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
call fcn.00427f00
mov esi, dword [0x647e58]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push 0x6b
push esi
call ebx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41c652
push 0xf0
push 0x6b
push esi
call ebx
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
test eax, eax
je 0x41c61b
push eax
push esi
call ecx
push eax
mov dword [edi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push dword [ebp - 0x10]
push esi
call ecx
push eax
mov dword [edi + 0x58], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push ebx
push esi
call fcn.00426930
mov ebx, eax
add esp, 8
cmp ebx, esi
je 0x41c647
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov dword [edi + 0x5c], eax
test ebx, ebx
je 0x41c652
or dword [edi + 0x24], 1
mov dword [edi + 0x2c], ebx
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x60], vtable.dxi::IInstallerPanel.0
mov dword [edi + 0x64], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], 0
mov dword [edi], vtable.CheckOpenProgPageView.0
lea ecx, [edi + 0x7c]
mov dword [edi + 0x60], vtable.CheckOpenProgPageView.1.0
mov dword [edi + 0x74], 0
push 1
mov dword [ebp - 4], 1
mov dword [edi + 0x78], 0
call fcn.0044d380
lea esi, [edi + 0x9c]
mov byte [ebp - 4], 2
push 0xe0
mov dword [ebp + 0xc], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ece2f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0xa4], 1
mov dword [edi + 0x70], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x438d5e
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push 0
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.00438a90
test eax, eax
jne 0x438d2e
cmp ebx, 0x4e
jne 0x438d3a
cmp dword [esi + 4], 0x436
jne 0x438d5e
cmp dword [esi + 8], 0xfffffffe
jne 0x438d5e
cmp dword [ebp + 0x10], 0x436
jne 0x438d25
cmp dword [esi + 0x10], eax
jne 0x438d25
push 5
push eax
push eax
lea eax, [esi + 0x7c]
push eax
push 0x5decac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18
cmp ebx, 0x110
jne 0x438d5e
mov eax, dword [edi + 0x18]
mov dword [eax + 0x20], 1
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, dword [edi + 0x18]
cmp dword [eax + 0x20], 0
jne 0x438d2e
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
Function at 0x439790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca59a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x640844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x34
mov dword [edi + 4], 0
lea esi, [edi + 0x20]
mov dword [edi + 0x14], 0
push 0
push esi
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.004ef230
mov dword [edi + 0x24], 0x80
add esp, 0xc
mov dword [esi], 0x34
mov eax, dword [0x647e58]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x4b0
mov dword [edi + 0x38], 0x426c60
mov dword [edi + 0x40], 0x4251f0
mov dword [edi + 0x3c], edi
mov dword [edi + 0x34], 0x66
mov dword [edi + 0x24], 0x88
mov dword [ebp - 4], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
call fcn.00427f00
mov esi, dword [0x647e58]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push 0x4b0
push esi
call ebx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4398c8
push 0xf0
push 0x4b0
push esi
call ebx
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
test eax, eax
je 0x439891
push eax
push esi
call ecx
push eax
mov dword [edi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push dword [ebp - 0x10]
push esi
call ecx
push eax
mov dword [edi + 0x58], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push ebx
push esi
call fcn.00426930
mov ebx, eax
add esp, 8
cmp ebx, esi
je 0x4398bd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov dword [edi + 0x5c], eax
test ebx, ebx
je 0x4398c8
or dword [edi + 0x24], 1
mov dword [edi + 0x2c], ebx
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x60], vtable.dxi::IInstallerPanel.0
mov dword [edi + 0x64], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], 0
mov dword [edi], vtable.FinishPageView.0
lea ecx, [edi + 0x78]
mov dword [edi + 0x60], vtable.FinishPageView.1.0
mov dword [edi + 0x70], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x74], 0
call fcn.00489610
lea ecx, [edi + 0xd8]
mov byte [ebp - 4], 2
call fcn.00489610
lea ecx, [edi + 0x138]
mov byte [ebp - 4], 3
call fcn.00489610
lea ecx, [edi + 0x198]
mov byte [ebp - 4], 4
call fcn.00489610
lea ecx, [edi + 0x1f8]
mov byte [ebp - 4], 5
call fcn.00489610
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b920
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0x4c8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x18], eax
mov ecx, esi
lea eax, [ebp - 0x18]
push eax
call fcn.0043bed0
test al, al
jne 0x43b967
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x64]
add ecx, 0x64
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
test al, al
jne 0x43b97f
mov ecx, esi
call fcn.00439ca0
mov ecx, dword [esi + 0x64]
call fcn.0045fb60
test al, al
jne 0x43b998
push str.Post_install_page_not_launched_n
call fcn.0043c3f0
add esp, 4
push edi
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x3c], 0x5dede0
mov dword [ebp - 0x1c], 0x82
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x43b9eb
call fcn.004d6e68
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x43b9eb
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43baa9
push 0
push 0
push eax
call fcn.004d6f6a
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x640030
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x640048]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push 0x640030
mov dword [0x640048], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x426c60
push edi
push 0xaf
push dword [0x647e58]
call fcn.00428320
cmp eax, 6
jne 0x43baa9
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43baa9
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43baa9
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x28]
pop edi
test eax, eax
je 0x43bab7
push eax
call fcn.004d6f14
mov ecx, dword [esi + 0x64]
call fcn.0045b020
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret
Function at 0x43bcb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca7ed
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x640844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x43bd8a
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push 0
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043bad0
test eax, eax
jne 0x43be03
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x43bd20
mov eax, dword [edi + 0x18]
mov ecx, edi
push esi
push ebx
mov dword [eax + 0x20], 1
call fcn.0043b1b0
jmp 0x43bd7c
cmp eax, 0x136
jne 0x43bda0
mov eax, dword [edi + 0x18]
mov dword [ebp + 0xc], ebx
mov dword [eax + 0x20], 1
mov esi, dword [edi + 0x64]
push str.DialogBackground
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x7a4]
lea ecx, [esi + 0x7a4]
call dword [eax + 8]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esi + 0x7a4]
lea ecx, [esi + 0x7a4]
push str.PageStaticText
call dword [eax + 8]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esi + 0x7a8]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [edi + 0x18]
cmp dword [eax + 0x20], 0
jne 0x43be03
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x138
jne 0x43bdc4
mov eax, dword [edi + 0x18]
push ecx
mov dword [eax + 0x20], 1
mov eax, esp
push ecx
mov ecx, edi
mov dword [eax], esi
mov eax, esp
mov dword [eax], ebx
mov eax, dword [edi]
call dword [eax + 0x14]
jmp 0x43bd7c
cmp eax, 0x4e
jne 0x43bd8a
mov eax, dword [esi + 4]
cmp eax, 0x4c9
jne 0x43be1c
cmp dword [esi + 8], 0xfffffffe
jne 0x43be57
cmp ebx, eax
jne 0x43bdfa
cmp dword [esi + 0x10], 0
jne 0x43bdfa
push 5
push 0
push 0
lea eax, [esi + 0x7c]
push eax
push 0x5decac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4c5
jne 0x43be8f
cmp dword [esi + 8], 0xffffff4f
jne 0x43be5e
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push esi
push ebx
call fcn.0043af90
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4c5
jne 0x43be8f
cmp dword [esi + 8], 0xffffff9b
jne 0x43bea5
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push esi
push ebx
call fcn.0043ae90
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4c7
jne 0x43bd8a
cmp dword [esi + 8], 0xffffff4f
jne 0x43beb0
jmp 0x43be2c
cmp eax, 0x4c7
jne 0x43bd8a
cmp dword [esi + 8], 0xffffff9b
jne 0x43bd8a
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push esi
push ebx
call fcn.0043ae90
jmp 0x43be39