joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410070
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
push ebp
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
xor ebp, ebp
push ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call fcn.0040ff30
mov esi, eax
test esi, esi
jl 0x410171
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
push ebp
push 0x80
push eax
push ebp
push ebp
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x410104
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4100e7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x4100f2
mov esi, 0x80004005
push esi
push 0xe7
push str.._resrutil.cpp
call fcn.00410700
jmp 0x41015b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push edi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410154
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x410139
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x410144
mov esi, 0x80004005
push esi
push 0xed
push str.._resrutil.cpp
call fcn.00410700
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
jge 0x41016f
test ebp, ebp
je 0x41016f
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret 0xc

Function at 0x4103a0
Capabilities:
Move file

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
xor ebp, ebp
test edi, edi
je 0x4103b3
lea ebp, [esi + 1]
cmp dword [esp + 0x20], esi
je 0x4103bc
or ebp, 2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4104a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x4103f9
cmp eax, 0x50
je 0x4103eb
cmp eax, 0xb7
jne 0x4103f9
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
cmp eax, 3
jne 0x410499
movzx ecx, word [ebx]
xor edi, edi
mov eax, ebx
test cx, cx
je 0x41048b
movzx ecx, cx
cmp cx, 0x5c
jne 0x41041d
mov edi, eax
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x410415
test edi, edi
je 0x41048b
xor ecx, ecx
push ecx
push ebx
mov word [edi], cx
call fcn.0040fcd0
mov esi, eax
mov edx, 0x5c
mov word [edi], dx
test esi, esi
jl 0x4104a9
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4104a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41046c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x4104a9
push esi
push 0x42e
push 0x42c508
call fcn.00410700
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov esi, 0x80070003
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
test eax, eax
jle 0x4104a7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x4104c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x220
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x21c], eax
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
mov edx, dword [esp + 0x22c]
push ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x23c]
push ecx
xor ebx, ebx
push 0x104
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
mov esi, 0x80004005
mov dword [esp + 0x14], ebx
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x410554
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x410539
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jge 0x410554
push esi
push 0x4be
push 0x42c508
call fcn.00410700
jmp 0x41060c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x410560
cmp edi, 0xffffffff
jne 0x4105dc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push edx
push ebx
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x20]
push str._s_s_05d._s
push edx
call fcn.0040fcb0
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x41060b
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x4105d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4105c1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070050
jne 0x4105cf
xor esi, esi
jmp 0x4105d3
test esi, esi
jl 0x41060b
inc ebx
cmp ebx, 0x3e8
jl 0x410560
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4105e9
mov dword [eax], edi
or edi, 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4105ff
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [esp + 0x10], 0
cmp edi, 0xffffffff
je 0x41060b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41061a
push eax
call fcn.0040f4e0
mov ecx, dword [esp + 0x228]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00411220
add esp, 0x220
ret 0x10

Function at 0x411220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434150]
jne 0x41122a
repz ret
jmp fcn.00417d7c
Function at 0x423d7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041a877
and dword [ebp - 4], 0
cmp dword [0x4360b8], 0
mov ebx, eax
jne 0x423e2d
push 0x42e7dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423ede
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42e7d0
push edi
call esi
test eax, eax
je 0x423ede
push eax
call fcn.0041a805
mov dword [esp], 0x42e7c0
push edi
mov dword [0x4360b8], eax
call esi
push eax
call fcn.0041a805
mov dword [esp], 0x42e7ac
push edi
mov dword [0x4360bc], eax
call esi
push eax
call fcn.0041a805
mov dword [esp], 0x42e790
push edi
mov dword [0x4360c0], eax
call esi
push eax
call fcn.0041a805
pop ecx
mov dword [0x4360c8], eax
test eax, eax
je 0x423e2d
push 0x42e778
push edi
call esi
push eax
call fcn.0041a805
pop ecx
mov dword [0x4360c4], eax
mov eax, dword [0x4360c4]
cmp eax, ebx
je 0x423e85
cmp dword [0x4360c8], ebx
je 0x423e85
push eax
call fcn.0041a880
push dword [0x4360c8]
mov esi, eax
call fcn.0041a880
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423e85
test edi, edi
je 0x423e85
call esi
test eax, eax
je 0x423e7c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423e7c
test byte [ebp - 0xc], 1
jne 0x423e85
or dword [ebp + 0x10], 0x200000
jmp 0x423ebe
mov eax, dword [0x4360bc]
cmp eax, ebx
je 0x423ebe
push eax
call fcn.0041a880
pop ecx
test eax, eax
je 0x423ebe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423ebe
mov eax, dword [0x4360c0]
cmp eax, ebx
je 0x423ebe
push eax
call fcn.0041a880
pop ecx
test eax, eax
je 0x423ebe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4360b8]
call fcn.0041a880
pop ecx
test eax, eax
je 0x423ede
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423ee0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4258f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00411440
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x42594e
cmp dword [ebp - 0x11c], 6
jb 0x42594e
mov dword [ebp - 0x124], 1
jmp 0x425958
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret

Function at 0x425a90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call fcn.004258f0
test eax, eax
je 0x425b29
push 0x42e968
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x425b27
mov dword [ebp - 0x830], 0
push str.QueryFullProcessImageNameW
mov eax, dword [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x425b1a
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x830]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x82c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x425b78
push str.Window_is_XP_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModulePathWrap___:_GetModuleFileNameEx___err___d_n
lea edx, [ebp - 0x828]
push edx
call fcn.0040dd20
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.GetModulePathWrap___Out_:_lpszModPath___s__ret__int____d_n
lea eax, [ebp - 0x828]
push eax
call fcn.0040dd20
add esp, 0x10
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret
Function at 0x426c10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x426c36
xor eax, eax
jmp 0x426c73
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x426c51
xor eax, eax
jmp 0x426c73
mov ecx, dword [ebp - 0xc]
add ecx, 0x98
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x426c71
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax]
mov eax, ecx
jmp 0x426c73
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x426fc0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00426f40
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x20]
call fcn.00426df0
movzx edx, al
test edx, edx
je 0x4270a4
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x20]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
je 0x42709c
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0xc], 0
je 0x42708f
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42708f
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x10], edx
mov al, 1
jmp 0x4270a6
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
call fcn.00426f40
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x4270d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4270f4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp - 8], ax
movzx eax, word [ebp - 8]
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 0
je 0x42710d
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, dword [ebp + 0xc]
sete dl
mov dword [ebp - 4], edx
jmp 0x4271a5
movzx eax, word [ebp + 8]
and eax, 0x3ff
cmp eax, 4
jne 0x427187
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xc04
ja 0x427147
cmp dword [ebp - 0xc], 0xc04
je 0x42716c
cmp dword [ebp - 0xc], 0x404
je 0x427168
cmp dword [ebp - 0xc], 0x804
je 0x42715b
jmp 0x427177
cmp dword [ebp - 0xc], 0x1004
je 0x42715f
cmp dword [ebp - 0xc], 0x1404
je 0x427170
jmp 0x427177
xor edx, edx
jne 0x42715b
mov dword [ebp + 8], 0x804
jmp 0x427177
xor eax, eax
jne 0x427168
xor ecx, ecx
jne 0x42716c
mov dword [ebp + 8], 0x404
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, dword [ebp + 0xc]
sete al
mov dword [ebp - 4], eax
jmp 0x4271a5
movzx ecx, word [ebp + 8]
and ecx, 0x3ff
movzx edx, word [ebp + 0xc]
and edx, 0x3ff
xor eax, eax
cmp ecx, edx
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4276b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x427713
jmp 0x42782c
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x427745
jmp 0x42782c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x42f240
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401cc0
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x4277aa
jmp 0x42782c
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.mst
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040fcb0
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x4277e0
jmp 0x42782c
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004103a0
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x42782c
cmp dword [ebp + 0x10], 1
jne 0x42782c
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004276b0
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret
Function at 0x427840
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x4278a3
jmp 0x4279bc
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x4278d5
jmp 0x4279bc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x42f1c4
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401cc0
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x42793a
jmp 0x4279bc
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.msi
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040fcb0
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x427970
jmp 0x4279bc
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004103a0
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x4279bc
cmp dword [ebp + 0x10], 1
jne 0x4279bc
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00427840
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret
Function at 0x429690
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x820
push 0
lea eax, [ebp - 0x828]
push eax
call fcn.00411440
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x410
lea ecx, [ebp - 0x828]
push ecx
call fcn.004018a0
add esp, 0x10
movzx edx, word [ebp - 0x828]
test edx, edx
je 0x4296f3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret

Function at 0x429a20
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
call fcn.0040f390
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x429a64
mov eax, dword [ebp - 0x224]
push eax
call fcn.0041141b
add esp, 4
test eax, eax
jne 0x429a77
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x429b7d
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x224]
push eax
push 0x42fbe8
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040fcb0
add esp, 0xc
mov dword [ebp - 0x21c], 0
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00411440
add esp, 0xc
mov dword [ebp - 0x220], 0x206
mov dword [ebp - 0x228], 1
lea ecx, [ebp - 0x21c]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x214]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429b61
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push 0x42f8e4
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429b54
lea ecx, [ebp - 0x210]
push ecx
push str._sTemp
lea edx, [ebp + 0xc]
push edx
call fcn.0040fcb0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041141b
add esp, 4
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], 0
je 0x429b77
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret
Function at 0x4520df
Capabilities:
Encode data using xor

Disassembly:
invalid
xor eax, 0xb9cf0502
faddp st(0)
mov esi, 0x7ad97e80
jb 0x45207b
cmp edx, eax
dec eax
mov bl, 0x97
scasb al, byte es:[edi]
outsb dx, byte [esi]
jb 0x452096
jo 0x45209c
xchg edx, eax
pushfd
invalid
and al, 0x72
push 0x4ad3b9ed
or byte [esi + 0x30ab04ba], dl
cmp al, 0xd4
cmp edx, dword [ebp + 0x74f36972]
jo 0x45202a
xchg ebp, eax
jb 0x4520f7
je 0x452101
cwde
stc
hlt
jnp 0x45208b
xor dl, byte [ecx + esi - 0x1d628f2b]
jo 0x45203b
loop 0x45211f
jg 0x45202f
mov ds, ebx
dec esi
sbb ecx, dword [esi + 0x54]
fisttp dword [esi + 0x1b]
dec esi
push esp
scasd eax, dword es:[edi]
ja 0x4520c5
adc ebp, esi
call 0x907eeb57
into
sub byte [esi], dh
invalid
in al, 0xae
cwde
loop 0x4520e5
add ecx, ebx
push esi
lodsb al, byte [esi]
dec ecx
shl dword [ebx + 0x4d], 0x53
stosb byte es:[edi], al
mov al, byte [ebp + 0x34a26858]
mov byte [0x34bd975a], al
xor al, 0x90
mul byte [edi - 0x4c16b77]
sti
sti
mov cx, 0x17e2
sbb dh, byte [0x2920a6b9]
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
cwde
adc al, 0xe0
pop ecx
mov dword [edx + 0x5ab06c68], eax
cmpsb byte [esi], byte es:[edi]
mov dh, 0x89
stosd dword es:[edi], eax
leave
add al, 0x8b
sub al, byte [ecx + edi*4 + 0x47e9a53d]
fstp qword [ebp + 0x7e]
pop ecx
jne 0x452118
jae 0x4520b1
mov ah, 0xc9
inc esi
int1
sahf
xor dword [0xc0cb51f8], esi
xor eax, 0xc0cb51f8
jns 0x45219e
jle 0x45213b
sbb dh, byte [ebp + 0x7645c732]
mov ebx, 0xebb56fa4
xor edx, dword [edx + 0x79346406]
adc edx, edx
xchg ebp, eax
test al, 0x6c
out dx, eax
test ch, dh
xor eax, 0x1ac541dc
mov ch, 0x32
mov dword [ebp + 0x76], 0xb56fa4bb
jmp 0x45215f
inc ecx
lds ebx, [edx]
cwde
adc eax, 0xa80db631
mov edx, 0xe744d070
test ecx, ecx
push ecx
mov edx, 0xad0bbb15
mov bh, 0x7c
mov edx, 0x74377767
lea esp, [edi]
adc eax, 0xb7ad0bbb
jl 0x45210e
ja 0x45218e
je 0x4520e6
daa
xchg ebp, eax
mov al, byte [0x26e4b7e9]
jge 0x452123
jge 0x452123
insd dword es:[edi], dx
daa
cmp eax, 0x999c70b9
mov ecx, 0xaf32be68
jno 0x452119
hlt
mov byte [0xd4da8aa4], al
sbb esp, dword [edi + 0x2f46aaae]
inc edx
mov ebp, 0x7805bd1d
popal
mov esp, dword [edx]
mov word [ebx - 0x1ba03db1], fs
cdq
xor eax, 0x520110b8
mov ecx, 0x4498baf9
inc esp
jns 0x45217a
sub al, 0x53
fldcw word [ebp + 0x45c5a694]
or dword [edi - 0x36], edi
jle 0x45214d
xchg edx, eax
nop
push esi
mov byte [esi - 0x34], al
dec esi
mov edi, 0xf904fa4e
jnp 0x452200
push ebx
retf 0x6875
pop ebx
sub eax, 0x8cbf8119
pop es
insd dword es:[edi], dx
add dword [ebx], esi
aas
sbb eax, 0x835cd232
dec ecx
adc cl, byte [ebp + ecx*4 + 0x51ab1d80]
sbb eax, 0x5c8bf308
inc esp
xchg esp, eax
mov ebp, 0x4697918d
dec ebp
push ecx
dec esp
push ecx
or dl, al
sub al, 0xcd
push ebx
dec esp
inc eax
pop eax
pop edi
rcr byte [edx + 0x1d5c4c97], 0x86
invalid