joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414081
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push ebx
push eax
xor ebx, ebx
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414127
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push 4
push eax
inc dword [ebp - 4]
push 4
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.0041be35
cmp byte [ebp + 0xc], bl
je 0x414107
push ebx
push str.ctrl
lea ecx, [ebp - 0x18]
call fcn.0041c047
lea ecx, [ebp - 0x18]
call fcn.0041cd1e
push 0x47e800
push eax
mov ecx, 0x47e788
call fcn.00421ce6
lea ecx, [ebp - 0x18]
call fcn.0041befb
pop ebx
leave
ret 8

Function at 0x41412c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push esi
xor esi, esi
cmp dword [0x47e6b0], esi
je 0x41425b
mov ecx, 0x47e6b0
call fcn.0041cd1e
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x47e6b0]
inc ecx
push ecx
push eax
call fcn.0041dd95
add esp, 0x10
test al, al
je 0x41425b
cmp dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
jbe 0x414242
push ebx
push edi
mov esi, 0x104
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
shl eax, 2
push 5
mov edi, dword [eax + ecx]
mov ebx, dword [eax + ecx + 4]
add edi, dword [ebp - 0x10]
add ebx, dword [ebp - 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414230
push 0x47dfc8
lea ecx, [ebp - 0x1c]
call fcn.0041be99
push 0
push str.WININIT.INI
lea ecx, [ebp - 0x1c]
call fcn.0041c047
push esi
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.00424500
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00424500
add esp, 0x18
lea eax, [ebp - 0x224]
push esi
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call edi
lea eax, [ebp - 0x120]
push esi
push eax
push ebx
call edi
lea ecx, [ebp - 0x1c]
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x224]
push eax
push str.Rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x1c]
call fcn.0041befb
add dword [ebp - 4], 2
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x414185
pop edi
pop ebx
push dword [ebp - 8]
call fcn.00424dce
mov ecx, 0x47e6b0
mov dword [esp], 0x42e0c8
call fcn.0041bf12
pop esi
leave
ret
Function at 0x41455e
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [esp + 0x10]
mov edi, eax
cmp edi, 0xffffffff
je 0x4145b5
mov eax, dword [esi + 8]
lea edx, [esi + 0x10]
mov ecx, eax
and cl, 0x10
neg cl
sbb ecx, ecx
and al, 8
and ecx, edx
neg al
push ecx
lea ecx, [esi + 0x18]
sbb eax, eax
push 0
and eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esi + 8]
test cl, 2
je 0x4145cc
test cl, 4
jne 0x4145e6
mov ecx, dword [esi + 0xc]
and al, 0xdc
test cl, 4
je 0x4145d8
or al, 2
test cl, 8
je 0x4145df
or al, 0x20
test cl, 0x10
je 0x4145e6
or al, 1
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
ret 8
Function at 0x414a3d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ecx, ebx
call fcn.0041cd1e
push eax
call fcn.0040df52
test al, al
pop ecx
je 0x414bb1
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
mov ecx, ebx
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xc
je 0x414aa6
cmp esi, 0x20
jne 0x414bb1
cmp dword [0x47e19c], edi
je 0x414b23
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041be99
push edi
push str..delete_on_reboot0
lea ecx, [ebp - 0xc]
call fcn.0041c047
push 1
pop esi
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
call fcn.0040df52
test al, al
pop ecx
je 0x414aff
mov eax, dword [ebp - 0xc]
push 1
dec eax
lea ecx, [ebp - 0xc]
push eax
call fcn.0041c3a9
push esi
lea eax, [ebp - 0xc]
push 0x42c0d4
push eax
call fcn.0041c467
add esp, 0xc
inc esi
jmp 0x414ac8
push edi
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
mov ecx, ebx
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414b94
lea ecx, [ebp - 0xc]
call fcn.0041befb
test byte [0x47e192], 0x40
jne 0x414bbb
lea ecx, [ebp - 0x1c]
call fcn.0041bdc5
mov ecx, ebx
call fcn.0041cd1e
push eax
mov ecx, 0x47ee40
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041c467
add esp, 0xc
mov ecx, 0x47e700
call fcn.0041cd1e
mov ecx, dword [ebp - 0x10]
push 5
push eax
mov esi, dword [ecx + 8]
lea ecx, [ebp - 0x1c]
call fcn.0041cd1e
push eax
push esi
mov ecx, 0x47dfb8
call fcn.0041b2cc
cmp eax, 4
lea ecx, [ebp - 0x1c]
jne 0x414c12
call fcn.0041befb
jmp 0x414a51
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.0041bf80
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [eax], 2
call fcn.0041befb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
lea eax, [ebp - 0x120]
push str..tmp
push eax
call fcn.0041dbff
pop ecx
mov esi, 0x47e6b0
pop ecx
push ebx
mov ecx, esi
call fcn.0041c0c5
push edi
mov ecx, esi
call fcn.0041bff8
lea eax, [ebp - 0x120]
push edi
push eax
mov ecx, esi
call fcn.0041c047
push edi
mov ecx, esi
call fcn.0041bff8
lea eax, [ebp - 0x120]
mov ecx, ebx
push eax
call fcn.0041bf12
mov ecx, dword [ebp + 0xc]
push 1
pop eax
mov dword [ecx], eax
jmp 0x414bb4
call fcn.0041befb
xor eax, eax
jmp 0x414bb4
Function at 0x414e57
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041be35
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
dec eax
push eax
call fcn.0041bfe3
cmp al, 0x5c
je 0x414e8c
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0041bff8
lea ecx, [ebp - 0xc]
call fcn.0041bdc5
push 0x42e0c8
lea ecx, [ebp - 0xc]
call fcn.0041bf12
push esi
lea ecx, [ebp - 0x18]
call fcn.0041cd1e
push eax
lea eax, [ebp - 0xc]
push str._s_d.tmp
push eax
call fcn.0041c467
add esp, 0x10
lea ecx, [ebp - 0xc]
inc esi
call fcn.0041cd1e
push eax
call fcn.0040df52
test al, al
pop ecx
jne 0x414e94
xor esi, esi
lea ecx, [ebp - 0xc]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x414f52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x414f68
lea ecx, [ebp - 0x24]
call fcn.0041bdc5
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push str.You_dont_have_write_privilege_to_directory__s._Please_have_your_system_administrator__or_other_user_with_higher_privileges__install_this_software.
push eax
call fcn.0041c467
add esp, 0xc
lea ecx, [ebp - 0x24]
push esi
call fcn.0041cd1e
push eax
mov ecx, 0x47dfb8
push dword [0x47e178]
call fcn.0041b2a8
lea ecx, [ebp - 0x24]
call fcn.0041befb
lea ecx, [ebp - 0xc]
call fcn.0041befb
lea ecx, [ebp - 0x18]
call fcn.0041befb
xor al, al
jmp 0x414f7a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0xc]
call fcn.0041befb
lea ecx, [ebp - 0x18]
call fcn.0041befb
mov al, 1
pop esi
leave
ret 4
Function at 0x4158e2
Capabilities:
Copy file
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x47e58c], edi
mov ebx, ecx
jne 0x415906
cmp dword [0x47e598], edi
je 0x415a52
test byte [0x47e18c], 0x40
je 0x41591b
mov ecx, ebx
call fcn.0041b61b
jmp 0x4159c1
lea eax, [ebp - 4]
mov ecx, 0x47e58c
push eax
push 0x20019
push edi
call fcn.0041cd1e
push eax
push dword [0x47e588]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4159a7
lea eax, [ebp - 0x108]
mov ecx, 0x47e788
push eax
call fcn.004229a8
lea eax, [ebp - 0x108]
push eax
call fcn.0040df52
test al, al
pop ecx
je 0x415a52
lea eax, [ebp - 0x108]
mov esi, 0x47e688
push eax
mov ecx, esi
call fcn.0041bf12
push edi
push str..bak
mov ecx, esi
call fcn.0041c047
push edi
mov ecx, esi
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
jmp 0x415a4b
cmp dword [0x47e598], edi
jne 0x4159c6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
mov ecx, ebx
call fcn.004155d2
pop edi
pop esi
pop ebx
leave
ret
push edi
push edi
push edi
push edi
mov ecx, 0x47e598
call fcn.0041cd1e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x4159b8
lea eax, [ebp - 0x108]
mov ecx, 0x47e788
push eax
call fcn.004229a8
lea eax, [ebp - 0x108]
push eax
call fcn.0040df52
test al, al
pop ecx
je 0x415a52
lea eax, [ebp - 0x108]
mov esi, 0x47e688
push eax
mov ecx, esi
call fcn.0041bf12
push edi
push str..bak
mov ecx, esi
call fcn.0041c047
push edi
mov ecx, esi
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x4159c1
Function at 0x419146
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x94
push 0x47e1dc
mov dword [0x47e650], esi
mov dword [0x47e654], esi
mov dword [0x47e65c], 2
mov dword [0x47e490], esi
mov byte [0x47e544], 1
mov dword [0x47e17c], eax
mov dword [0x47e184], esi
mov dword [0x47e180], esi
mov dword [0x47e178], esi
mov dword [0x47e1dc], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x38
push esi
push 0x47e298
mov dword [0x47e84c], esi
call fcn.00424500
push 0x4c
push esi
push 0x47e118
call fcn.00424500
push 8
push esi
push 0x47e780
call fcn.00424500
push 0x38
push esi
push 0x47e300
call fcn.00424500
mov edi, 0x104
mov dword [0x47e314], 0x424269
push edi
mov dword [0x47e300], 0x42423d
mov dword [0x47e304], 0x424295
mov dword [0x47e30c], 0x424316
mov dword [0x47e308], 0x4243aa
mov dword [0x47e310], 0x42444a
mov dword [0x47e32c], 0x41d830
mov dword [0x47e334], 0x41d728
mov dword [0x47e328], 0x41d46f
mov dword [0x47e330], 0x41d0fd
mov dword [0x47e324], 0x47e190
call fcn.00424dd9
add esp, 0x34
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x419275
mov ecx, 0x47e924
call fcn.0041cd1e
push eax
call fcn.0041d881
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00424500
add esp, 0xc
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov ecx, 0x47e6c8
call fcn.0041bf12
push dword [ebp + 8]
call fcn.00424dce
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041be35
lea ecx, [ebp - 0xc]
call fcn.0041cd68
push 1
push esi
push str._SILENT
lea ecx, [ebp - 0xc]
call fcn.0041c6d0
or edi, 0xffffffff
cmp eax, edi
je 0x4192d8
mov byte [0x47f27c], 1
push 1
push esi
push str._REVERT
lea ecx, [ebp - 0xc]
call fcn.0041c6d0
cmp eax, edi
je 0x4192f3
mov byte [0x47f2d5], 1
push ebx
lea eax, [ebp - 0xa0]
push esi
push eax
mov dword [0x47e6d8], edi
mov dword [0x47e6dc], edi
mov dword [0x47e6e0], edi
mov dword [0x47e6e4], edi
mov dword [0x47e6e8], edi
mov dword [0x47e6ec], edi
mov dword [0x47e6f0], edi
mov dword [0x47e6f4], edi
call fcn.00424500
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x41935c
mov dword [0x47e19c], 1
jmp 0x41937b
mov eax, dword [ebp - 0x94]
mov dword [0x47e19c], esi
and eax, 0xffff
cmp eax, 0x3e8
ja 0x41937b
mov byte [0x47e299], 1
lea ecx, [ebp - 0xc]
call fcn.0041befb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x419be3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, 0x47e2f0
push edi
push 0x2c
mov ecx, esi
call fcn.0041c8fd
push 0x28
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0041c8fd
xor edi, edi
mov dword [ebp - 0x18], eax
cmp eax, edi
mov dword [ebp - 8], edi
jle 0x419d50
mov esi, 0x47e570
mov ebx, 0x42bc40
lea ecx, [ebp - 0x14]
call fcn.0041bdc5
push 4
mov ecx, 0x47e6c8
push dword [ebp - 4]
call fcn.0041cd1e
push eax
lea ecx, [ebp - 0x14]
call fcn.0041cac5
add dword [ebp - 4], 4
lea eax, [ebp - 0x11c]
push str..TTF
push eax
call fcn.0041dbff
pop ecx
pop ecx
push 1
pop eax
mov dword [0x47f21c], eax
mov dword [0x47e290], eax
mov eax, dword [0x47f28c]
cmp eax, edi
je 0x419c77
push eax
call fcn.00424dce
pop ecx
push 4
call fcn.00424dd9
pop ecx
mov dword [0x47f28c], eax
push edi
lea ecx, [ebp - 0x14]
call fcn.0041c8fd
add eax, dword [ebp - 4]
mov ecx, dword [0x47f28c]
push edi
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call fcn.0041c8fd
push eax
lea eax, [ebp - 0x11c]
push dword [ebp - 4]
mov ecx, 0x47e6c8
push eax
call fcn.0041cd1e
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
jne 0x419d57
push edi
lea ecx, [ebp - 0x14]
call fcn.0041c8fd
add dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push str..FOT
push eax
call fcn.0041dbff
pop ecx
lea eax, [ebp - 0x11c]
pop ecx
push edi
push eax
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceA]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
lea eax, [ebp - 0x220]
push edi
push eax
mov ecx, esi
call fcn.0041c047
push edi
push ebx
mov ecx, esi
call fcn.0041c047
lea eax, [ebp - 0x11c]
push edi
push eax
mov ecx, esi
call fcn.0041c047
push edi
push ebx
mov ecx, esi
call fcn.0041c047
lea ecx, [ebp - 0x14]
call fcn.0041befb
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x419c23
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
call fcn.0041befb
xor al, al
jmp 0x419d52

Function at 0x419d70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x47e350
lea ecx, [ebp - 0xc]
call fcn.0041be99
xor ebx, ebx
lea ecx, [ebp - 0xc]
push ebx
push str.mutex
call fcn.0041c047
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x419ded
mov ecx, 0x47e850
call fcn.0041cd1e
push eax
push str.AstrumInstaller
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
je 0x419ded
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x419de4
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.0041befb
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x419eb2
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
lea eax, [ebp - 4]
push esi
xor ebx, ebx
push eax
push 0x20019
push ebx
mov ecx, 0x47e58c
mov dword [ebp - 4], ebx
call fcn.0041cd1e
push eax
push dword [0x47e588]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419f2c
push edi
push 0x4d
pop ecx
lea edi, [ebp - 0x19f]
mov byte [ebp - 0x1a0], bl
mov dword [ebp - 0x14], 0x136
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push ebx
push str.AutorunCommand
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop edi
je 0x419f33
xor al, al
jmp 0x419fbf
lea eax, [ebp - 0x1a0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041be35
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041bfe3
cmp al, 0x22
je 0x419f64
push ebx
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0041ca01
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0041bff8
push 0x44
lea eax, [ebp - 0x68]
pop esi
push esi
push ebx
push eax
call fcn.00424500
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [ebp - 0x68], esi
call fcn.00424500
add esp, 0x18
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
call fcn.0041cd1e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x419fb5
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.0041befb
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41b09c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x47e614], edi
mov esi, ecx
mov ebx, 0x42bc5c
je 0x41b114
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add esi, 0x124
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.0041bf12
mov eax, dword [esi]
mov ecx, esi
dec eax
push eax
call fcn.0041bfe3
cmp al, 0x5c
jne 0x41b142
mov eax, dword [esi]
push 1
dec eax
mov ecx, esi
push eax
call fcn.0041c3a9
jmp 0x41b142
add esi, 0x124
push 0x47e6c8
mov ecx, esi
call fcn.0041bf80
push 1
push edi
push ebx
mov ecx, esi
call fcn.0041c7db
push eax
push edi
mov ecx, esi
call fcn.0041cc95
push eax
mov ecx, esi
call fcn.0041bf80
cmp dword [0x47e614], 0
je 0x41b1e0
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0xc]
push eax
call fcn.0041be35
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041c7db
cmp eax, 0xffffffff
je 0x41b1d8
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c3a9
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041c7db
cmp eax, 0xffffffff
je 0x41b1d8
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c3a9
lea eax, [ebp - 0xc]
mov ecx, 0x47e628
push eax
call fcn.0041bf80
lea ecx, [ebp - 0xc]
jmp 0x41b29e
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x110], 0
je 0x41b2a3
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x111], 0x5c
je 0x41b23b
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 0xc]
and esi, 0x7fffffff
call fcn.0041bdc5
push 0x42e0c8
lea ecx, [ebp - 0xc]
call fcn.0041bf12
mov eax, esi
inc esi
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push str._sinst_d
push eax
call fcn.0041c467
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0041cd1e
push eax
call fcn.0040df52
test al, al
pop ecx
jne 0x41b251
lea eax, [ebp - 0xc]
mov ecx, 0x47e628
push eax
call fcn.0041bf80
lea ecx, [ebp - 0xc]
call fcn.0041befb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b45d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ecx + 0x158]
xor ebx, ebx
push edi
mov ecx, dword [esi]
cmp ecx, ebx
je 0x41b47a
push ebx
call fcn.00407827
mov dword [esi], ebx
push dword [0x47e184]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [0x47e770], ebx
je 0x41b4bd
cmp byte [0x47f289], 0
je 0x41b4a1
push ebx
call dword [0x47e714]
pop ecx
cmp byte [0x47f288], 0
je 0x41b4b3
push 1
call dword [0x47e714]
pop ecx
mov ecx, 0x47e710
call fcn.0041e681
mov ecx, 0x47e2d0
call fcn.0041bd2d
cmp byte [ebp + 8], 0
je 0x41b4e3
mov eax, dword [0x47f26c]
cmp eax, ebx
je 0x41b4e3
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x47f26c], ebx
cmp dword [0x47e784], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 8], ebx
jle 0x41b51c
xor edi, edi
mov eax, dword [0x47e780]
cmp dword [edi + eax], ebx
lea ecx, [edi + eax]
jbe 0x41b50b
call fcn.0041cd1e
push eax
call esi
inc dword [ebp + 8]
add edi, 0xc
mov eax, dword [ebp + 8]
cmp eax, dword [0x47e784]
jl 0x41b4f6
cmp dword [0x47e52c], ebx
mov dword [ebp + 8], ebx
mov edi, 0x47e520
jle 0x41b566
push dword [ebp + 8]
mov ecx, edi
call fcn.0041e860
mov ebx, eax
lea ecx, [ebx + 4]
call fcn.0041cd1e
push eax
call esi
test ebx, ebx
je 0x41b556
lea ecx, [ebx + 4]
call fcn.0041befb
push ebx
call fcn.00424dce
pop ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [0x47e52c]
jl 0x41b52c
xor ebx, ebx
mov ecx, edi
call fcn.0041e921
lea ecx, [ebp - 0x10]
call fcn.0041bdc5
mov dword [ebp - 4], ebx
push ebx
mov edi, 0x47e570
mov ecx, edi
call fcn.0041c9d2
test al, al
je 0x41b5bd
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
inc ebx
call fcn.0041c92f
test bl, 1
je 0x41b5ad
lea ecx, [ebp - 0x10]
call fcn.0041cd1e
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [ebp - 0x10]
call fcn.0041cd1e
push eax
call esi
push dword [ebp - 4]
jmp 0x41b57e
push 0x42e0c8
mov ecx, edi
call fcn.0041bf12
mov ecx, 0x47df9c
call fcn.0041cd1e
push eax
call esi
mov ecx, 0x47dfa8
call fcn.0041cd1e
push eax
call esi
mov ecx, 0x47df90
call fcn.0041cd1e
push eax
call esi
mov ecx, 0x47e788
call fcn.0041cd1e
push eax
call esi
push dword [0x47e180]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x10]
call fcn.0041befb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41b61b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0041bdc5
mov ecx, 0x47e350
call fcn.0041cd1e
push eax
lea eax, [ebp - 0x14]
push str._s_installation_couldnt_be_found._Try_re_installing_the_application_before_running_update.
push eax
call fcn.0041c467
add esp, 0xc
lea eax, [ebp - 4]
xor ebx, ebx
mov ecx, 0x47e58c
push eax
push 0x20019
push ebx
call fcn.0041cd1e
push eax
push dword [0x47e588]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b6dc
cmp dword [0x47e598], ebx
jne 0x41b691
cmp dword [0x47e5a4], ebx
jne 0x41b691
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b717
mov eax, 0x104
push esi
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00424500
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x47e598
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
call fcn.0041cd1e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x41b70f
cmp dword [0x47e6bc], ebx
je 0x41b6f8
and dword [0x47e18c], 0xffffffbf
push ebx
push str._IsUpdate_
call fcn.0041d728
jmp 0x41b717
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041cd1e
push eax
push ebx
mov ecx, 0x47dfb8
call fcn.0041b2a8
jmp 0x41b73b
cmp dword [0x47e5a4], ebx
jne 0x41b71b
mov bl, 1
jmp 0x41b73b
test byte [0x47e191], 0x20
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
je 0x41b734
call fcn.0041b749
jmp 0x41b739
call fcn.0041b8ea
mov bl, al
lea ecx, [ebp - 0x14]
call fcn.0041befb
mov al, bl
pop edi
pop ebx
leave
ret