joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437a60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x80
push 0
push esi
call fcn.00493600
push 0x60
lea eax, [esi + 0xa0]
push 0
push eax
call fcn.00493600
add esp, 0x18
mov dword [esi + 0x80], 0x67452301
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xefcdab89
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0x98badcfe
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0x10325476
mov dword [esi + 0x9c], 0
pop esi
pop ebp
ret

Function at 0x437b70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x100
push 0
push esi
call fcn.00493600
add esp, 0xc
mov dword [esi + 0x80], 0x6a09e667
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xbb67ae85
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0x3c6ef372
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0xa54ff53a
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0x510e527f
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0x9b05688c
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0x1f83d9ab
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0x5be0cd19
mov dword [esi + 0xbc], 0
pop esi
pop ebp
ret
Function at 0x43c360
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffc0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1178
call fcn.00492020
mov eax, dword [0x4f22ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
push 0x100
mov dword [ebp - 0x114c], eax
xor esi, esi
lea eax, [ebp - 0x1140]
mov edi, edx
push esi
push eax
mov dword [ebp - 0x1144], edi
call fcn.00493600
add esp, 0xc
mov dword [ebp - 0x1148], esi
test edi, edi
je 0x43c57b
cmp dword [ebp - 0x114c], esi
je 0x43c57b
cmp byte [edi], 0
jne 0x43c3e3
push 2
push 1
call fcn.0049570f
add esp, 8
mov esi, eax
jmp 0x43c435
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, 1
jle 0x43c433
push 2
push edi
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x43c433
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 0x1144]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x43c435
push esi
call fcn.004998ec
add esp, 4
xor esi, esi
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1150], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1144], eax
test esi, esi
je 0x43c475
push esi
call fcn.004998ec
mov eax, dword [ebp - 0x1144]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0xffffffff
jne 0x43c4b3
call fcn.00440bb0
push eax
push str.Could_not_open_file:__s
call fcn.004407e0
add esp, 8
mov dword [0x4fa958], 0xc003006e
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491940
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x1140]
push eax
call fcn.00437b70
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
jmp 0x43c4d0
mov eax, dword [0x4fa958]
test eax, eax
jns 0x43c4e3
cmp ax, 0x4c7
je 0x43c56e
push 0
lea eax, [ebp - 0x1148]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push edi
call esi
test eax, eax
je 0x43c551
mov eax, dword [ebp - 0x1148]
test eax, eax
je 0x43c522
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1140]
push eax
call fcn.0043bba0
add esp, 0xc
jmp 0x43c4d0
lea eax, [ebp - 0x1140]
push eax
call fcn.0043bf60
mov edi, dword [ebp - 0x114c]
lea esi, [ebp - 0x1140]
mov ecx, 8
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1150]
mov esi, 1
jmp 0x43c570
mov dword [0x4fa958], 0xc003001e
call fcn.00440bb0
push eax
push str.__Read_error:__s
call fcn.004407e0
add esp, 8
xor esi, esi
test edi, edi
je 0x43c57b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00491940
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x43dd40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4f22ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push edi
push 0x104
push 0
push eax
mov edi, edx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x124], ebx
call fcn.00493600
add esp, 0xc
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x11c], 4
mov dword [ebx], 0
test edi, edi
je 0x43df8a
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x43ddc2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esi, ecx
je 0x43ddde
cmp byte [edi + esi], 0x5c
je 0x43de14
sub esi, 1
jne 0x43ddd3
lea eax, [ebp - 0x110]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43ded6
mov dword [ebp - 0x110], 0
jmp 0x43df66
cmp esi, 0x104
jae 0x43df8a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43de25
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x43de4c
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43de40
sub ecx, edx
inc ecx
jmp 0x43de51
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00493080
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43de67
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x43de93
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43de80
sub ecx, edx
lea eax, [ebp - 0x108]
add eax, ecx
jmp 0x43de96
lea eax, [ebp - 5]
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push eax
push dword [ebp - 0x114]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43df0f
mov dword [ebp - 0x10c], 0
jmp 0x43df59
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 7
push 0
push 0
push 0
push str.Akeo_ConsultingRufus
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x43df0f
mov dword [ebp - 0x10c], 0
jmp 0x43df59
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x124]
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [edi + esi]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x43df4f
test eax, eax
jne 0x43df59
cmp dword [ebp - 0x118], 4
jne 0x43df59
cmp dword [ebp - 0x11c], eax
jbe 0x43df59
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x43df66
push eax
call ebx
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x43df73
push ecx
call ebx
mov eax, dword [ebp - 0x120]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491940
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00491940
mov esp, ebp
pop ebp
ret
Function at 0x43f5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x43f5f9
call fcn.00440bb0
push eax
push dword [ebp + 0xc]
push str.Could_not_locate_resource__s:__s
call fcn.004407e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x43f629
call fcn.00440bb0
push eax
push dword [ebp + 0xc]
push str.Could_not_load_resource__s:__s
call fcn.004407e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 0x14], 0
mov esi, eax
mov ebx, dword [ebp + 0x10]
je 0x43f6b1
mov eax, dword [ebx]
test eax, eax
jne 0x43f646
mov dword [ebx], esi
mov eax, esi
push 1
push eax
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
jne 0x43f670
push dword [ebp + 0xc]
push str.Could_not_allocate_resource__s
call fcn.004407e0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
cmp esi, eax
cmovb eax, esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.00493080
mov ecx, dword [ebx]
add esp, 0xc
cmp esi, ecx
jbe 0x43f6ba
mov eax, esi
sub eax, ecx
push eax
push dword [ebp + 0xc]
push str.WARNING:_Resource__s_was_truncated_by__d_bytes_
call fcn.004407e0
add esp, 0xc
mov dword [ebx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [ebx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440190
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov edx, dword [0x4fad90]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x53d94c
mov dword [ebp - 0x10], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [ebp - 0xc], str.NoDriveTypeAutorun
mov dword [ebp - 8], eax
mov dword [ebp + 0x10], 0
push esi
push edi
test edx, edx
je 0x4401fa
push 1
mov ecx, str.DisableLGP
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x4401f4
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x440217
push ecx
lea eax, [ebp - 4]
mov edx, str.DisableLGP
push eax
push ecx
mov ecx, 0x80000001
call fcn.0043dd40
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 4], ecx
setne cl
test ecx, ecx
je 0x440285
mov ecx, dword [0x52b91c]
mov eax, 0xffc
sub eax, ecx
push str.LPG_handling_disabled__per_settings
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440250
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x4403a9
mov byte [ecx + 0x540f60], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0x43fc00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x440308
mov ecx, dword [0x52b91c]
mov eax, 0xffc
sub eax, ecx
push str.SetLGP:_Unable_to_start_thread
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4402d3
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x4403a9
mov byte [ecx + 0x540f60], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x440391
mov ecx, dword [0x52b91c]
mov eax, 0xffc
sub eax, ecx
push str.SetLGP:_Killing_stuck_thread_
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0xc
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440350
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x4403a9
push 0
push esi
mov byte [ecx + 0x540f60], al
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
neg eax
pop edi
sbb eax, eax
and eax, dword [ebp + 0x10]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00491a70
int3
Function at 0x4407e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp + 0xc]
mov edi, 0xffd
push eax
push ecx
push dword [ebp + 8]
mov edx, edi
push ecx
mov ecx, 0x53e040
call fcn.0041a450
mov esi, eax
add esp, 0x10
test esi, esi
cmovs esi, edi
add esi, 0x53e040
cmp esi, 0x53e040
jbe 0x44083d
jmp 0x440820
movzx eax, byte [esi - 1]
push eax
call fcn.0049f350
add esp, 4
test eax, eax
je 0x44083d
dec esi
mov byte [esi], 0
cmp esi, 0x53e040
ja 0x440820
mov word [esi], 0xa0d
mov byte [esi + 2], 0
cmp byte [0x53e040], 0
jne 0x44085f
push 2
push 1
call fcn.0049570f
add esp, 8
mov edi, eax
jmp 0x4408b4
push 0
push 0
push 0xffffffffffffffff
push 0x53e040
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, 1
jle 0x4408b2
push 2
push esi
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
je 0x4408b2
push esi
push edi
push 0xffffffffffffffff
push 0x53e040
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x4408b4
push edi
call fcn.004998ec
add esp, 4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4fae2c]
test eax, eax
je 0x440912
cmp eax, 0xffffffff
je 0x440912
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7ffffffe
push 0x7ffffffe
push 0xb1
push eax
call esi
push edi
push 0
push 0xc2
push dword [0x4fae2c]
call esi
push 0
push 0
push 0xba
push dword [0x4fae2c]
call esi
push eax
push 0
push 0xb6
push dword [0x4fae2c]
call esi
push edi
call fcn.004998ec
add esp, 4
pop edi
pop esi
pop ecx
pop ebp
ret

Function at 0x440920
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x44092c
xor edi, edi
jmp 0x440990
cmp byte [esi], 0
jne 0x440941
push 2
push 1
call fcn.0049570f
add esp, 8
mov edi, eax
jmp 0x440990
push ebx
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x44098d
push 2
push ebx
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
je 0x44098d
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x44098f
push edi
call fcn.004998ec
add esp, 4
xor edi, edi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4fae2c]
test eax, eax
je 0x4409ee
cmp eax, 0xffffffff
je 0x4409ee
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7ffffffe
push 0x7ffffffe
push 0xb1
push eax
call esi
push edi
push 0
push 0xc2
push dword [0x4fae2c]
call esi
push 0
push 0
push 0xba
push dword [0x4fae2c]
call esi
push eax
push 0
push 0xb6
push dword [0x4fae2c]
call esi
push edi
call fcn.004998ec
add esp, 4
pop edi
pop esi
ret
Function at 0x440a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, ecx
push edi
mov edx, 0x4d36b0
call fcn.00427330
mov edi, eax
test edi, edi
jne 0x440a33
push ebx
push str.Error:_Cant_open_file__s
call fcn.004407e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push edi
call fcn.004a3516
add esp, 0xc
push edi
call fcn.004a3105
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.004a3516
add esp, 0xc
push esi
call fcn.00499907
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x440a86
push ebx
push esi
push str.Error:_Cant_allocate__d_bytes_buffer_for_file__s
call fcn.004407e0
add esp, 0xc
xor esi, esi
push edi
call fcn.00499b6b
add esp, 4
jmp 0x440abc
push edi
push esi
push 1
push eax
call fcn.004a2a0d
add esp, 0x10
cmp eax, esi
je 0x440aaf
push ebx
push str.Error:_Cant_read__s
call fcn.004407e0
push edi
xor esi, esi
call fcn.00499b6b
add esp, 0xc
jmp 0x440abc
push edi
call fcn.00499b6b
add esp, 4
test esi, esi
jne 0x440acf
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.004998ec
add esp, 4
mov dword [ebx], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4416c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x44172f
cmp byte [edi], 0
jne 0x4416e4
push 2
push 1
call fcn.0049570f
add esp, 8
mov esi, eax
jmp 0x441731
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x44172f
push 2
push ebx
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x44172f
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x441731
push esi
call fcn.004998ec
add esp, 4
xor esi, esi
push 0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push 0x441670
push 0
push 0
mov dword [ebp - 0x18], 0x80000000
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 0x80
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0x3e5
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x4417ac
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xbb8
push edi
call ebx
cmp eax, 0x102
jne 0x4417a3
push edi
call dword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
push 0xffffffffffffffff
push edi
call ebx
mov dword [ebp - 4], 0x102
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4417b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
je 0x4417c2
push esi
call fcn.004998ec
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4417e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
test eax, eax
push ebx
push esi
push edi
push 1
lea ebx, [ebp - 0x10]
mov dword [ebp - 0xc], edx
cmovne ebx, eax
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x441825
call fcn.00440bb0
push eax
push str.Warning:_Could_not_read_file_pointer__s
call fcn.004407e0
add esp, 8
mov edi, dword [ebp + 8]
mov esi, 1
lea ecx, [ecx]
cmp esi, 1
jbe 0x441850
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x44190d
push 0
push ebx
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44189a
mov eax, dword [ebx]
mov dword [0x4fa974], 0
cmp edi, eax
je 0x441929
cmp dword [0x4fadac], 0
je 0x441889
test eax, eax
je 0x44191c
push edi
push eax
push str.Wrote__d_bytes_but_requested__d
call fcn.004407e0
add esp, 0xc
jmp 0x4418bd
call fcn.00440bb0
push eax
push str.Write_error__s
call fcn.004407e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xc0030000
mov dword [0x4fa974], eax
cmp dword [ebp + 0xc], 0
je 0x4418ec
cmp esi, 4
jae 0x4418e2
push 5
push str.Retrying_in__d_seconds...
call fcn.004407e0
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 4
jbe 0x441830
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
test eax, eax
jne 0x441904
push 0xc003001d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Could_not_set_file_pointer___Aborting
call fcn.004407e0
add esp, 4
jmp 0x4418ec
push str.Warning:_Possible_short_write
call fcn.004407e0
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441e30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
push edi
mov edi, edx
lea eax, [esi + 0x57]
test edi, edi
je 0x441eb5
push ebx
push 2
push 0x80
mov byte [edi], 0
call fcn.0049570f
add esp, 8
mov ebx, eax
push 0x80
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
je 0x441ea0
push 0
push 0
push 0x80
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x441ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test ebx, ebx
je 0x441ead
push ebx
call fcn.004998ec
add esp, 4
mov eax, dword [ebp - 4]
mov byte [edi + 0x7f], 0
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 4
lea eax, [ebp - 4]
mov edx, str.SoftwareMicrosoftPowerShell1Install
push eax
push 4
mov ecx, 0x80000002
call fcn.00427520
add esp, 0xc
cmp dword [ebp - 4], 0
jg 0x4461c1
push 4
lea eax, [ebp - 4]
mov edx, str.SoftwareMicrosoftPowerShell3Install
push eax
push 4
mov ecx, 0x80000002
call fcn.00427520
add esp, 0xc
cmp dword [ebp - 4], 0
jg 0x4461c1
mov ecx, dword [0x52b91c]
mov eax, 0xffc
sub eax, ecx
push str.Notice:_The_ISO_download_feature_has_been_deactivated_because_a_compatible_PowerShell_version_was_not_detected_on_this_system.
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0xc
lea edx, [ecx + 1]
jmp 0x446190
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446190
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x44624a
mov byte [ecx + 0x540f60], al
mov esp, ebp
pop ebp
ret
cmp dword [0x4fb838], 0
jne 0x446231
call fcn.00442150
test eax, eax
jg 0x446231
mov ecx, dword [0x52b91c]
mov eax, 0xffc
sub eax, ecx
push str.Notice:_The_ISO_download_feature_has_been_deactivated_because_Check_for_updates_is_disabled_in_your_settings.
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446204
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x44624a
mov byte [ecx + 0x540f60], al
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x445dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
call fcn.00491a70
int3
Function at 0x446fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x10], 0
push edi
push eax
mov ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
xor esi, esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x44707c
push esi
push esi
push 0x31
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x44707c
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
jne 0x44703e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
test ebx, ebx
jle 0x44707c
lea eax, [ebx + 1]
push 2
push eax
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x44707c
lea eax, [ebx + 1]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x44707c
lea eax, [ebp - 0x10]
push eax
push ebx
jmp 0x447074
cmp byte [ebx], 0
jne 0x4470a5
push 2
push 1
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x44707c
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x447060
sub ecx, edx
lea eax, [ebp - 0x10]
sar ecx, 1
push eax
push ecx
push esi
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push esi
call fcn.004998ec
add esp, 4
cmp edi, 0xffffffff
je 0x447098
test edi, edi
je 0x447098
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
cmp eax, 1
jg 0x4470c5
xor esi, esi
jmp 0x44707c
push 2
push eax
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x44707c
push dword [ebp - 8]
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp - 8]
je 0x447055
push esi
call fcn.004998ec
add esp, 4
xor esi, esi
jmp 0x44707c