joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411840
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435106
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x44600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x448240], 0x43e180
mov dword [0x448248], 0x43e2e4
push 0
mov dword [ebp - 0x10], 0x448240
mov dword [0x44825c], 1
mov dword [0x448258], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x411aee
lea eax, [ecx + 0x400000]
mov dword [0x448254], ecx
mov dword [0x448250], eax
mov edx, 0x1555
mov eax, dword [0x448258]
mov dword [0x44824c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x448258]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x448258]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x448258]
add ecx, eax
sub edx, 1
jne 0x4118d4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x448260
mov dword [ebp - 0x18], 0x448260
mov dword [ebp - 0x1c], 0x448260
mov dword [0x448260], 0x43d47c
mov dword [0x448264], edx
mov dword [0x448268], edx
mov byte [ebp - 4], 1
mov dword [0x448260], 0x43d3a4
mov dword [0x44826c], edx
mov dword [0x448274], edx
mov dword [0x448270], edx
mov dword [0x448278], 0x40
mov byte [ebp - 4], 2
mov dword [0x448278], 0x80
mov byte [ebp - 4], 5
mov dword [0x44827c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x448290
mov dword [ebp - 0x1c], 0x448290
call esi
mov byte [ebp - 4], 7
mov dword [0x4482a8], 0
mov byte [ebp - 4], 8
push 0x4482b4
mov dword [ebp - 0x1c], 0x4482b4
call esi
mov byte [ebp - 4], 9
mov dword [0x4482cc], 0x3e8
mov dword [ebp - 0x18], 0x4482e0
mov dword [ebp - 0x14], 0x4482e0
mov dword [0x4482e0], 0x43d47c
mov dword [0x4482e4], 0
mov dword [0x4482e8], 0
mov byte [ebp - 4], 0xa
mov dword [0x4482e0], 0x43d3a4
mov dword [0x4482ec], 0
mov dword [0x4482f4], 0
mov dword [0x4482f0], 0
mov dword [0x4482f8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x4482f8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [0x4482d4], 0x3e80
mov dword [0x4482d8], 1
mov dword [0x4482dc], 0
lea eax, [eax*2 + 2]
mov dword [0x4482d0], eax
mov byte [ebp - 4], 0xe
push 0x4482fc
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x448314
call fcn.004106f0
mov byte [ebp - 4], 0x10
mov dword [0x448280], 0
mov dword [0x44833c], 0
movsd xmm0, qword [0x43ee08]
movsd qword [0x448288], xmm0
xorps xmm0, xmm0
mov dword [0x448340], 0
mov dword [0x448344], 0
mov dword [0x448348], 0
mov dword [0x448284], 0
movq qword [0x4482ac], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x448240
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00423d13
int3
Function at 0x4126b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x448258]
jg 0x4126eb
push 0x44825c
call fcn.00414ae0
mov ecx, dword [0x448254]
add esp, 4
test ecx, ecx
je 0x4126dd
mov eax, dword [ecx]
mov dword [0x448254], eax
mov dword [0x44825c], 1
test ecx, ecx
jne 0x4126fd
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
pop esi
test ecx, ecx
je 0x412708
mov eax, ecx
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.00423d13
int3

Function at 0x412770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x44824c]
jb 0x4127df
cmp esi, dword [0x448250]
jae 0x4127df
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x448258]
jle 0x4127f4
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4127ff
push dword [0x448258]
push esi
push edi
call fcn.00423450
push 0x44825c
call fcn.00414ae0
mov eax, dword [0x448254]
add esp, 0x10
mov dword [esi], eax
mov dword [0x448254], esi
mov esi, edi
mov dword [0x44825c], 1
pop edi
jmp 0x4127f4
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x4127ff
mov eax, esi
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
call fcn.00423d13
int3
Function at 0x413340
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4353a8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x44600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4134f9
cmp word [esi], 0
je 0x4134f9
lea ecx, [ebp - 0x3c]
call fcn.00403030
mov dword [ebp - 4], 0
lea edx, [ebp - 0x3c]
mov ecx, esi
call fcn.00413510
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x41348b
cmp eax, 0x5c
jne 0x4133b1
cmp word [esi + 2], 0
je 0x41348b
cmp word [esi + 2], 0x3a
jne 0x4133d5
movzx eax, word [esi + 4]
test ax, ax
je 0x41348b
cmp eax, 0x5c
jne 0x4133d5
cmp word [esi + 6], 0
je 0x41348b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41348b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41348b
cmp eax, 3
jne 0x413487
push 0x5c
push esi
call fcn.00420c9b
mov edx, eax
add esp, 8
test edx, edx
je 0x413487
cmp word [edx + 2], 0
jne 0x413435
sub edx, 2
cmp edx, esi
jb 0x413487
nop
cmp word [edx], 0x5c
je 0x413431
sub edx, 2
cmp edx, esi
jae 0x413420
xor esi, esi
jmp 0x413490
cmp edx, esi
jb 0x413487
lea ecx, [ebp - 0x68]
call fcn.00403030
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x68]
push edx
push esi
call fcn.00415800
lea ecx, [ebp - 0x68]
call fcn.00401d50
mov ecx, eax
call fcn.00413340
test eax, eax
je 0x41347b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00402700
jmp 0x413490
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00402700
xor esi, esi
jmp 0x413490
mov esi, 1
mov dword [ebp - 4], 2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], vtable.CVolMem.0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4134b9
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 0xc]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x3c], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4353e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x44600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4136c7
cmp word [esi], 0
je 0x4136c7
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004219d0
or dword [ebp - 0x50], 1
xor eax, eax
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x38]
push esi
call fcn.00414460
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x413649
xor esi, esi
jmp 0x41366c
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x413692
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call dword [eax + 0xc]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4136e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43543c
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x44600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4138b7
cmp word [esi], 0
je 0x4138b7
lea ecx, [ebp - 0x244]
call fcn.00403030
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x238], 0
test eax, eax
je 0x413757
push eax
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call dword [eax + 0xc]
movzx eax, word [esi]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
cmp eax, 0x5c
je 0x413790
test ax, ax
je 0x4137c2
cmp word [esi + 2], 0x3a
jne 0x4137c2
cmp word [esi + 4], 0x5c
jne 0x4137c2
push 0x5c
push esi
call fcn.00420c9b
add esp, 8
test eax, eax
je 0x4137c2
cmp eax, esi
jbe 0x4137ae
cmp word [eax - 2], 0x3a
lea ecx, [eax - 2]
cmovne eax, ecx
sub eax, esi
lea ecx, [ebp - 0x244]
add eax, 2
sar eax, 1
push eax
push esi
call fcn.00415800
mov edi, dword [ebp - 0x238]
test edi, edi
jne 0x4137e5
cmp dword [ebp - 0x220], edi
jne 0x4137db
mov edi, 0x43be60
jmp 0x4137e5
mov edi, dword [ebp - 0x228]
test edi, edi
je 0x413815
cmp word [edi], 0
je 0x413815
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x413815
cmp word [edi], 0
je 0x41380e
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, 1
jmp 0x413817
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test edi, edi
je 0x41383b
cmp word [ebp - 0x218], 0
je 0x41383b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 4], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x248], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x413876
push eax
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call dword [eax + 0xc]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
jmp 0x4138b9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f8ed
mov esp, ebp
pop ebp
ret
Function at 0x4142a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 0x14]
jne 0x4142b9
mov eax, dword [esi + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [esi + 0xc]
test ecx, ecx
jne 0x4142ec
test edi, edi
je 0x4142cd
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xc]
pop edi
mov dword [esi + 0xc], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x414300
push ecx
mov ecx, esi
call fcn.00414240
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [esi + 0x18]
mov eax, 0x40
test ebx, ebx
cmovle ebx, eax
mov eax, dword [esi + 0x10]
cmp eax, ecx
jl 0x414329
sub eax, ecx
cmp eax, ebx
jg 0x414329
pop ebx
mov eax, edi
mov dword [esi + 0x14], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, ecx
cdq
idiv ebx
mov eax, dword [esi]
sub ebx, edx
add ebx, ecx
mov edx, dword [eax + 8]
cmp eax, vtable.CVolMem.0
jne 0x4143dc
cmp edi, dword [0x44824c]
jb 0x4143a7
cmp edi, dword [0x448250]
jae 0x4143a7
cmp ebx, dword [0x448258]
jle 0x4143ba
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4143d5
push dword [0x448258]
push edi
push eax
call fcn.00423450
push 0x44825c
call fcn.00414ae0
mov eax, dword [0x448254]
add esp, 0x10
mov dword [edi], eax
mov dword [0x448254], edi
mov edi, dword [ebp - 4]
mov dword [0x44825c], 1
jmp 0x4143ba
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x4143d5
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov eax, edi
pop ebx
mov dword [esi + 0xc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.00423d13
push ebx
push edi
mov ecx, esi
call edx
mov edi, eax
jmp 0x4143be
Function at 0x417480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435956
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x44600c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x41752c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x41752c
call fcn.00416850
mov edi, eax
jmp 0x417661
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41754f
call fcn.00416850
jmp 0x417654
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41756d
call fcn.00416850
jmp 0x417654
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x41758e
mov edi, 0x8007000e
jmp 0x417656
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
test edx, edx
ja 0x4176a5
jb 0x4175b8
cmp eax, 0xffffffff
ja 0x4176a5
cmp eax, 0x400
jbe 0x4175d4
push eax
lea ecx, [ebp - 0x418]
call fcn.004199a0
mov dword [ebp - 4], 1
jmp 0x417608
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x417608
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x417619
mov edi, 0x8007000e
jmp 0x417656
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x417634
call fcn.00416850
jmp 0x417654
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00418350
mov edi, eax
test esi, esi
je 0x417661
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x41767e
lea ecx, [ebp - 0x418]
call fcn.00419990
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041f8ed
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0040ea80
int3
Function at 0x401018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x167c
call fcn.0044b550
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004454d0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46d5b8]
xor ecx, ecx
inc ecx
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov edi, 0x206
test byte [eax + 0x904e], cl
je 0x4010e1
push eax
lea eax, [ebp - 0x1678]
mov dword [ebp - 0x268], ecx
call fcn.00406c46
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push esi
push eax
call fcn.004454d0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x401094
push 0x454a20
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 2
je 0x401164
push eax
lea eax, [ebp - 0x1678]
mov dword [ebp - 0x268], 2
call fcn.00406c46
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push esi
push eax
call fcn.004454d0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x40111c
push 0x454a40
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401546
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x190
call fcn.00403ba1
test eax, eax
jne 0x401572
push 0x30
push str.Cannot_start_install
push str.There_is_a_problem_with_the_install_program.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4015a1
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00401e3f
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov eax, dword [0x46d5b8]
add eax, 0xafab
push eax
call fcn.00414287
xor eax, eax
pop ecx
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x40164f
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x364]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
je 0x4016af
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x915d
push eax
lea eax, [ebp - 0x364]
push eax
call edi
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 2
je 0x4016cf
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x89c4
push eax
lea eax, [ebp - 0x364]
push eax
call edi
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x4000000
push 3
push esi
push 1
push esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x564]
push str._s__cleanup__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004454d0
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x564]
push eax
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401786
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push dword [ebp + 0xc]
call fcn.0043b790
pop ecx
pop ecx
test eax, eax
je 0x4017b9
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
ret
Function at 0x401e3f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x454be8
push eax
mov dword [0x46d5c0], eax
call esi
push str.user32
mov dword [0x46d5c4], eax
call edi
push str.SetWindowTextW
push eax
mov dword [0x46d5c8], eax
call esi
push str.GetWindowTextW
push dword [0x46d5c8]
mov dword [0x46d5cc], eax
call esi
mov dword [0x46d5d0], eax
xor eax, eax
pop edi
pop esi
cmp dword [0x46d5c4], eax
je 0x401eb5
mov byte [0x46d5b7], 1
cmp dword [0x46d5cc], eax
jne 0x401eba
mov byte [0x46d5b7], al
push 0x90
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0x94
call fcn.004454d0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x46d5b7], al
leave
ret

Function at 0x4025e3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x402602
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0041bb7a
add esp, 0xc
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402638
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
pop ebp
ret

Function at 0x402645
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4026aa
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push edi
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.0043b2c8
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x4026aa
test edi, edi
je 0x4026a8
push edi
call fcn.0043bdb4
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x4026cd
test edi, edi
je 0x4026d7
push dword [ebx]
push edi
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0041bb7a
add esp, 0xc
test edi, edi
je 0x4026d7
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
leave
ret