joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002997
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x1007084]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x254], ebx
je 0x1002b50
cmp byte [ebx], 0
je 0x1002b50
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
inc eax
cmp eax, 0x104
ja 0x1002b50
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
call fcn.01004dd7
cmp al, 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x1002a0f
push 0x1001310
lea eax, [ebp - 0x10c]
push eax
call esi
push 0x10014ac
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
je 0x1002b45
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
lea ecx, [ebp - 0x220]
push ecx
mov dword [ebp - 0x258], eax
call ebx
mov ecx, dword [ebp - 0x258]
lea eax, [ecx + eax + 1]
cmp eax, 0x104
ja 0x1002b18
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x10014a8
lea eax, [ebp - 0x220]
push eax
call ebx
test eax, eax
je 0x1002b18
push 0x10014a4
lea eax, [ebp - 0x220]
push eax
call ebx
test eax, eax
je 0x1002b18
mov ebx, dword [ebp - 0x254]
push ebx
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
call fcn.01004dd7
cmp al, 0x5c
je 0x1002ac9
push 0x1001310
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
test byte [ebp - 0x24c], 1
je 0x1002af9
mov eax, dword [ebp - 0x24c]
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test byte [ebp - 0x24c], 0x10
lea eax, [ebp - 0x10c]
push eax
je 0x1002b10
call fcn.01002997
jmp 0x1002b1e
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1002b1e
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002a40
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
jmp 0x1002b5d
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01004f75
leave
ret 4
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x414ddb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [esi], eax
sub edx, 1
add esi, 4
and edx, ebx
dec ecx
and ecx, ebx
cmp esi, edi
jne fcn.00414ddb
add ecx, ecx
push 0xd764858d
pop ecx
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4035fc
pop dword [ebp - 0x20]
mov eax, 0x2e11e977
add eax, 0xd22e4c85
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x879723cc
add dword [ebp - 0x30], 0xc6bb217f
mov dword [ebp - 0x2c], 0x29fcc9d1
sub dword [ebp - 0x2c], 0xf7c97d8c
mov dword [ebp - 0x28], 0xc31aa9a7
sub dword [ebp - 0x28], 0x76ce6579
mov dword [ebp - 0x24], 0xa6861e40
sub dword [ebp - 0x24], 0xa6861e40
lea eax, [ebp - 0x30]
push eax
mov eax, 0x2e597020
add eax, 0xd1e6fffc
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xc07c5daa
add dword [ebp - 0x30], 0xb3f60bac
mov dword [ebp - 0x2c], 0x31da7c4b
sub dword [ebp - 0x2c], 0xf06e1ad6
mov dword [ebp - 0x28], 0x47bf8fa3
sub dword [ebp - 0x28], 0xe4502337
mov dword [ebp - 0x24], 0xe4014841
add dword [ebp - 0x24], 0x1bfeb7bf
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37f61
push 0
call eax
mov ecx, 0x3d6e686b
add ecx, 0xc291e0ad
xor ebx, ebx
add ebx, eax
mov edx, 0x3b8825c8
add edx, 0xc4b8a238
add edx, dword [ebp - 0x20]
mov edi, 0xcb95eb9a
sub edi, 0xda74465
add dword [ebp - 0xc], ecx
mov esi, dword [edx]
sub dword [ebp - 0xc], 0xf001f8f5
add esi, edi
xor dword [ebp - 8], esi
mov dword [ebx], esi
xor dword [ebp - 0x14], 0x9e685cb3
add ebx, 4
add edx, 0x78ed8be3
add edx, 0x87127421
loop 0x40371b
add eax, 0x11733
mov ebx, eax
add eax, 0x1840b031
add eax, 0xe7bf4fd4
mov ecx, 0xc041155e
add ecx, 0x3ffeeaa2
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40ac1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40ac29
pop dword [ebp - 8]
mov eax, 0x15db87dc
sub eax, 0x159adbb3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xe381fbb0
add dword [ebp - 0x18], 0x6ad0499b
mov dword [ebp - 0x14], 0x55a09405
sub dword [ebp - 0x14], 0x236d47c0
mov dword [ebp - 0x10], 0x9a2d4d61
sub dword [ebp - 0x10], 0x4de10933
mov dword [ebp - 0xc], 0xda6d52de
sub dword [ebp - 0xc], 0xda6d52de
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x11344ac2
add dword [ebp - 0x18], 0x633e1e94
mov dword [ebp - 0x14], 0x35a9c0ce
add dword [ebp - 0x14], 0xbc2a0a7
mov dword [ebp - 0x10], 0xbe6664ee
sub dword [ebp - 0x10], 0x5af6f882
mov dword [ebp - 0xc], 0x124d4022
add dword [ebp - 0xc], 0xedb2bfde
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x38a44a5f
add eax, 0xc79c85e9
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a138
push 0
call eax
mov ecx, 0xdf9a8f2e
sub ecx, 0xdf9a4615
xor esi, esi
add esi, eax
mov edi, 0xdc12860e
add edi, 0x242f29f2
add edi, dword [ebp - 8]
mov edx, 0x94f83b62
sub edx, 0x1f41287a
xor dword [ebp - 4], 0x9c96090b
mov ebx, dword [edi]
add ebx, edx
xor dword [ebp - 4], 0x567f5c51
mov dword [esi], ebx
sub dword [ebp - 4], edx
add esi, 0x4ad35677
add esi, 0xb52ca98d
add edi, 0x8060ed6a
sub edi, 0x8060ed66
loop 0x40ad48
add eax, 0x11737
mov ebx, eax
add eax, 5
mov ecx, 0xae243987
add ecx, 0x521bc679
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4047e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4047f4
pop dword [ebp - 0x10]
mov eax, 0x4047f4
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x35ce0
push 0
mov eax, 0x4ec0eedf
add eax, 0xb17ff1f9
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x3a51
mov edi, eax
mov edx, 0x413bc4
add edx, dword [ebp - 0x10]
mov esi, 0xbfd8d8b3
sub esi, 0x14036c25
sub dword [ebp - 4], ecx
mov ebx, dword [edx]
add dword [ebp - 4], 0x2ea7511b
sub ebx, esi
xor dword [ebp - 8], edx
mov dword [edi], ebx
xor dword [ebp - 4], 0x24e43d22
add edi, 0x8047c025
add edi, 0x7fb83fdf
add edx, 4
loop 0x404842
add eax, 0xdc17
mov ebx, eax
add eax, 5
mov ecx, 0x27ce86c0
sub ecx, 0x278e86c0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40345b
pop dword [ebp - 0x38]
mov eax, 0xb3911e89
sub eax, 0xb350ea2e
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x510f91
sub dword [ebp - 0x48], 0xb1feca46
mov dword [ebp - 0x44], 0xbea7b1af
sub dword [ebp - 0x44], 0x8c74656a
mov dword [ebp - 0x40], 0x87a5b192
sub dword [ebp - 0x40], 0x3b596d64
mov dword [ebp - 0x3c], 0x633a89dc
sub dword [ebp - 0x3c], 0x633a89dc
lea eax, [ebp - 0x48]
push eax
mov eax, 0x15dd7edb
add eax, 0xea62c179
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x276d2136
sub dword [ebp - 0x48], 0xb2fab7e0
mov dword [ebp - 0x44], 0x35018be9
add dword [ebp - 0x44], 0xc6ad58c
mov dword [ebp - 0x40], 0xb3245457
sub dword [ebp - 0x40], 0x4fb4e7eb
mov dword [ebp - 0x3c], 0x83ff5377
add dword [ebp - 0x3c], 0x7c00ac89
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x7f41a2ad
sub eax, 0x7f01625d
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39853
push 0
call eax
mov ecx, 0xde65c933
add ecx, 0x219a896c
xor esi, esi
add esi, eax
mov edi, 0x408400
add edi, dword [ebp - 0x38]
mov edx, 0x94af2533
add edx, 0xfc99df6c
mov ebx, dword [edi]
xor ebx, edx
xor dword [ebp - 0xc], 0x8cc7e21d
mov dword [esi], ebx
add dword [ebp - 0x28], 0xc9c830ab
add esi, 0x30148d5e
sub esi, 0x30148d5a
add edi, 0x95eef7e6
sub edi, 0x95eef7e2
loop 0x403579
add eax, 0x8ceb257d
add eax, 0x731617d2
xor ebx, ebx
add ebx, eax
add eax, 0x9c5874cd
add eax, 0x63a78b38
mov ecx, 0x7af50524
sub ecx, 0x7ab50524
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4015d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x401630
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401726
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x4016a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x401675
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x401685
cmp byte [esp + 0x1e], 0
je 0x401685
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401685
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x4019c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x405030
call sym._EnterCriticalSection_4
mov ebx, dword [0x405048]
sub esp, 4
test ebx, ebx
je 0x401a0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401a04
test esi, esi
je 0x401a04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4019e0
mov dword [esp], 0x405030
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40596d
pop dword [ebp - 8]
mov eax, 0x4951c58c
sub eax, 0x49116c1f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc86d6ed3
add dword [ebp - 0x18], 0x85e4d678
mov dword [ebp - 0x14], 0xce0c225
add dword [ebp - 0x14], 0x25528a20
mov dword [ebp - 0x10], 0xa4470248
sub dword [ebp - 0x10], 0x57fabe1a
mov dword [ebp - 0xc], 0xaaab7f59
sub dword [ebp - 0xc], 0xaaab7f59
lea eax, [ebp - 0x18]
push eax
mov eax, 0x56ecfaa9
sub eax, 0x56ac8a49
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa8945cb5
add dword [ebp - 0x18], 0xcbde0ca1
mov dword [ebp - 0x14], 0xb49fdd73
sub dword [ebp - 0x14], 0x73337bfe
mov dword [ebp - 0x10], 0x7b5ec7e
add dword [ebp - 0x10], 0x5bb97fee
mov dword [ebp - 0xc], 0x662169c2
sub dword [ebp - 0xc], 0x662169c2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x8e078bb1
sub eax, 0x8dc71ab1
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35d73
push 0
call eax
mov ecx, 0x4cb67c44
add ecx, 0xb349c83b
xor ebx, ebx
add ebx, eax
mov esi, 0x5aacfac4
add esi, 0xa594053c
add esi, dword [ebp - 8]
mov edx, 0x38f392f1
sub dword [ebp - 4], 0x8d95ce00
mov edi, dword [esi]
sub dword [ebp - 4], 0x3a16d04
sub edi, edx
xor dword [ebp - 4], 0xe141463e
mov dword [ebx], edi
xor dword [ebp - 4], 0x9abece99
add ebx, 0x53a3f181
sub ebx, 0x53a3f17d
add esi, 0x478169b5
sub esi, 0x478169b1
loop 0x405a8b
add eax, 0x6984e1c7
sub eax, 0x6983dcf8
mov ebx, eax
add eax, 0x12efd58
add eax, 0xfed102ad
mov ecx, 0x337f46c4
add ecx, 0xccc0b93c
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4056c0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4034db
pop dword [ebp - 0xc]
mov eax, 0x4614c56f
sub eax, 0x45d49094
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x22118784
sub dword [ebp - 0x1c], 0xd3bf4239
mov dword [ebp - 0x18], 0xf599a82
add dword [ebp - 0x18], 0x22d9b1c3
mov dword [ebp - 0x14], 0x1532dbbd
sub dword [ebp - 0x14], 0xc8e6978f
mov dword [ebp - 0x10], 0x4a803e03
add dword [ebp - 0x10], 0xb57fc1fd
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x819cbd11
add eax, 0x7ea38343
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x26f49cfa
sub dword [ebp - 0x1c], 0xb28233a4
mov dword [ebp - 0x18], 0x819168bd
sub dword [ebp - 0x18], 0x40250748
mov dword [ebp - 0x14], 0xd2c7f743
sub dword [ebp - 0x14], 0x6f588ad7
mov dword [ebp - 0x10], 0xe84656fe
add dword [ebp - 0x10], 0x17b9a902
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3517c
push 0
call eax
mov ecx, 0xb9f7b003
sub ecx, 0xb9f76f2f
mov ebx, eax
mov esi, 0x45aea5b
sub esi, 0x41a665b
add esi, dword [ebp - 0xc]
mov edi, 0x4f393e4
add edi, 0x722cb3b4
add dword [ebp - 8], 0x6846112c
mov edx, dword [esi]
sub dword [ebp - 8], 0xd53d9f85
sub edx, edi
mov dword [ebx], edx
xor dword [ebp - 8], esi
add ebx, 4
add esi, 0x5496ede
add esi, 0xfab69126
loop 0x4035f8
add eax, 0x47cb77cd
sub eax, 0x47ca81aa
mov ebx, eax
add eax, 0x31962b77
sub eax, 0x31962b72
mov ecx, 0xec90bc90
add ecx, 0x13af4370
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x402077
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x20], eax
call fcn.004240fc
pop ecx
pop ecx
push ebx
push 0x80000080
push 2
push ebx
push 1
push 0xc0000000
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x14], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x18], eax
call esi
push dword [ebp - 0x14]
push 0xfffffffffffffff4
call esi
mov ecx, 0x431440
call fcn.00401a9d
mov edi, eax
cmp edi, ebx
jne 0x40211f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Cant_load_Python_for_pre_install_script___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x10]
push eax
call fcn.00401654
add esp, 0x10
or eax, 0xffffffff
jmp 0x4021f7
push dword [ebp - 0x20]
call fcn.0040c6a4
pop ecx
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push dword [ebp - 0x1c]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x18]
push 0xfffffffffffffff4
call esi
cmp dword [ebp - 0x20], ebx
je 0x4021e2
mov eax, str.Running_the_pre_installation_script_failed_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402151
push ebx
push dword [ebp - 0x14]
sub eax, edx
mov edi, eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x402175
mov dword [ebp - 0x18], 0x1000
mov eax, dword [ebp - 0x18]
lea eax, [eax + edi + 1]
push eax
call fcn.0040c6a4
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4021d7
mov eax, str.Running_the_pre_installation_script_failed_r_n
mov edx, esi
mov dword [ebp - 0x1c], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402195
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
lea eax, [esi + edi]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
add eax, esi
push esi
mov byte [eax + edi], bl
call fcn.00401654
push esi
call fcn.00407f30
pop ecx
jmp 0x4021e1
push str.Out_of_memory_
call fcn.00401654
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x74
leave
ret