joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c720
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x408], 1
test al, 1
je 0x41c753
mov ebx, 3
test al, 4
je 0x41c764
mov dword [ebp - 0x408], 0x21
or ebx, 4
mov ecx, dword [edi + 4]
push 0x100
lea eax, [ebp - 0x404]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [edi + 0x2c], 0
jne 0x41c7d6
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x41c7d6
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c793
mov ecx, dword [esi + 0x18]
sub eax, edx
lea edx, [esi + 0x1c]
push edx
mov edx, dword [edi + 0x28]
push 0
push 0x25
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push 1
push ecx
push edx
call dword [sym.imp.UxTheme.dll_DrawThemeText]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
test byte [esi + 0x10], 4
mov dword [ebp - 0x40c], eax
je 0x41c7f3
mov eax, 0x828282
jmp 0x41c803
movzx eax, byte [edi + 0x2c]
neg eax
sbb eax, eax
and eax, 0xfefff8
add eax, 8
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esi + 0x18]
push 1
push edx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [edi + 4]
push 0x100
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c840
mov ecx, dword [esi + 0x18]
sub eax, edx
lea edx, [ebp - 0x414]
push edx
sar eax, 1
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c871
sub eax, edx
mov edx, dword [ebp - 0x408]
sar eax, 1
mov ecx, dword [esi + 0x24]
mov edi, eax
mov eax, dword [esi + 0x28]
push edx
push eax
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x410]
cdq
sub eax, edx
sar eax, 1
push ecx
sar ebx, 1
sub ebx, eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x414]
cdq
sub eax, edx
push ebx
sar eax, 1
sar ecx, 1
sub ecx, eax
mov eax, dword [esi + 0x18]
push ecx
push edi
lea edx, [ebp - 0x204]
push edx
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
mov ecx, dword [ebp - 0x40c]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dc2
mov esp, ebp
pop ebp
ret 4
Function at 0x41cd40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x400
mov edi, ecx
call fcn.00453347
add esp, 4
push 1
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 4]
push 0
push 0
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41cd8c
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [edi + 4]
push 0x200
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cdb0
push 0
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
sar eax, 1
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push esi
call fcn.004532eb
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dc2
mov esp, ebp
pop ebp
ret 4

Function at 0x41eef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
je 0x41ef4f
mov dword [edi], 0
jmp 0x41ef10
mov eax, 0x400000
cmp esi, 0x400000
ja 0x41ef1f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x41ef57
test ecx, ecx
je 0x41ef4f
test esi, esi
jne 0x41ef10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x41f390
push 0
push 0
mov byte [esi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f470
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov byte [esi + 0xe], 1
test eax, eax
je 0x41f4a7
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 8]
mov dword [esi + 0x10], 0
test ecx, ecx
je 0x41f4a7
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
pop esi
jmp eax
pop esi
ret
Function at 0x41f7c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ffa8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, esi
call fcn.00402639
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f800
test al, 0x10
je 0x41f85a
push 0x47ba48
push 0x47ba50
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x2c]
call fcn.004025ce
push 0
push esi
or eax, 0xffffffff
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004030d3
push 0x47bfec
mov eax, edi
push 0
push eax
lea edi, [ebx + 0x8e20]
or eax, 0xffffffff
call fcn.004030d3
push eax
call fcn.0040260d
lea ecx, [ebp - 0x2c]
call fcn.004025ff
xor al, al
jmp 0x41f85c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret

Function at 0x41f880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ffa8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, esi
call fcn.00402639
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f8c0
test al, 0x10
jne 0x41f91a
push 0x47ba48
push 0x47a888
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x2c]
call fcn.004025ce
push 0
push esi
or eax, 0xffffffff
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004030d3
push 0x47bfec
mov eax, edi
push 0
push eax
lea edi, [ebx + 0x8e20]
or eax, 0xffffffff
call fcn.004030d3
push eax
call fcn.0040260d
lea ecx, [ebp - 0x2c]
call fcn.004025ff
xor al, al
jmp 0x41f91c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret

Function at 0x41fd50
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push str.wnloader_web_setup_mutex
push 0x47a888
call fcn.004089f0
add esp, 8
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete al
pop ecx
ret
Function at 0x41fd80
Capabilities:
Check if file exists
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ffa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
call edx
mov esi, eax
lea eax, [edi + 0xb14]
mov dword [ebp - 4], 0
call fcn.00403979
lea ecx, [ebp - 0x2c]
call fcn.004025ff
lea eax, [edi + 0xb14]
call fcn.00402639
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41fe04
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41fe04
test al, 0x10
jne 0x41fe04
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret

Function at 0x420290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
xor ecx, ecx
push ecx
push 0x47a83c
push 0x47acc0
mov word [esi + 0x90c], cx
lea edi, [esi + 0x704]
call fcn.004089f0
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0xc
push eax
push 0x104
push edi
call ebx
mov eax, edi
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4202e5
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 0x702], 0x5c
jne 0x42031d
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420304
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esi + eax*2 + 0x702], dx
add esi, 0xbec
push esi
push edi
push 0x47bb2c
push 0x47acc0
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call ebx
add esp, 0x14
push esi
push ecx
push str.oftware_s
push 0x47ab40
call fcn.004089f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x41c]
push 0x104
push ecx
call ebx
add esp, 0x10
push 0
lea edx, [ebp - 0x420]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4203e2
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4203a4
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x420]
push ecx
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push str.exec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dc2
mov esp, ebp
pop ebp
ret 4
Function at 0x420520
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
mov ecx, esi
call edx
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
mov dword [esi + 0x8d2c], eax
cmp eax, 2
jne 0x420569
push str.nstalled_already
push 0x47bb6c
call fcn.004089f0
mov ecx, dword [esi + 0x8d28]
add esp, 8
push eax
push str.INFO
call fcn.00417c10
mov ecx, esi
pop esi
jmp fcn.0041fd80
Function at 0x421c90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
mov dx, word [eax]
push edi
mov word [ebp - 0xc], dx
xor edx, edx
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp - 0x290], ecx
lea ecx, [ebp - 0x2a8]
mov word [ebp - 6], dx
push ecx
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xa], 0x5c003a
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x421d00
mov edi, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x294]
shrd edi, ecx, 0x14
shr ecx, 0x14
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp edi, eax
jbe 0x421d20
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret
push str.reeSpace
push 0x47ba50
call fcn.004089f0
add esp, 8
push 0x47bfec
push eax
lea ecx, [esi + 0x8e20]
push ecx
call fcn.0040260d
push eax
call fcn.0040260d
mov eax, dword [esi]
push 0xa
push 0x40
lea edx, [ebp - 0x8c]
push edx
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
push eax
call fcn.004538b6
push 0x47be98
push 0x47be94
call fcn.004089f0
add esp, 0x18
mov esi, eax
call fcn.0041efe0
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.0041c9c0
mov eax, dword [eax]
test eax, eax
jne 0x421d90
mov eax, esi
lea ecx, [ebp - 0x8c]
push ecx
push eax
push 0x100
lea edx, [ebp - 0x28c]
push 0x100
push edx
call fcn.00453612
mov ecx, dword [ebp - 0x290]
add esp, 0x14
push 0x10
push 0
lea eax, [ebp - 0x28c]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00452dc2
mov esp, ebp
pop ebp
ret
Function at 0x4223b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x8d2c], 2
je 0x4224fd
sub esp, 0x1c
lea ecx, [ebx + 0x24]
mov eax, esp
mov dword [ebp - 0x5c], esp
push ecx
call fcn.004025ce
lea esi, [ebp - 0x3c]
call fcn.00444560
mov dword [ebp - 4], 0
cmp dword [ebx + 0x8d2c], 1
jne 0x42241c
push str.einstallStart
push 0x47abe8
jmp 0x422426
push str.nstallStart
push 0x47b4cc
call fcn.004089f0
add esp, 8
push eax
lea edx, [ebp - 0x3c]
push edx
xor ecx, ecx
mov edx, ebx
call fcn.00420a90
mov eax, dword [ebx + 0x8d28]
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x3c]
call fcn.00444610
push 0x28
mov byte [ebp - 4], 1
call fcn.00453347
mov esi, eax
add esp, 4
mov dword [ebp - 0x60], esi
test esi, esi
je 0x422496
lea eax, [ebp - 0x58]
call fcn.00402639
mov dword [ebp - 0x5c], eax
lea edi, [esi + 4]
mov eax, edi
call fcn.004025a7
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
mov dword [esi], str.sendStart
call fcn.00402628
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], 1
jmp 0x422498
xor esi, esi
mov byte [ebp - 4], 1
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push 0
lea eax, [ebp - 0x3c]
push eax
mov ecx, ebx
call edx
lea eax, [ebp - 0x64]
push eax
push 0
push esi
push fcn.00421de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, ebx
call fcn.0041f710
lea ecx, [ebp - 0x58]
call fcn.004025ff
lea ecx, [ebp - 0x2c]
call fcn.004025ff
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [ebp - 0x60]
lea esi, [ebp - 0x3c]
call fcn.00422780
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004532eb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret

Function at 0x423b80
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x423b8d
mov al, 1
pop esi
ret
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi - 4]
mov eax, dword [edx + 0x38]
lea ecx, [esi - 4]
call eax
xor al, al
pop esi
ret
Function at 0x424280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d98b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x491654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x24
call fcn.00453347
add esp, 4
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x4242ef
mov eax, dword [esi - 0x808]
call fcn.00404075
mov edi, dword [eax + 4]
mov eax, dword [esi - 0x808]
mov ecx, dword [eax + 8]
mov ebx, dword [ecx + 4]
call fcn.00404075
mov ecx, dword [esi + 0x20]
push eax
mov eax, dword [ebp - 0x10]
push edi
push eax
mov edx, ebx
call fcn.004256c0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call ebx
mov eax, dword [edi + 8]
push 5
push eax
call ebx
mov ecx, dword [esi + 0x24]
add ecx, 0xbec
push ecx
call fcn.00407d40
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425a60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ff41
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x491654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea edi, [esi + 0x30]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x190
mov dword [esi + 0x10], 0x19
mov dword [esi + 0x14], 0xbd
mov eax, edi
mov dword [esi], vtable.StageItemUIImpl.0
call fcn.004025a7
lea eax, [esi + 0x4c]
mov dword [ebp - 4], 0
call fcn.004025a7
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov byte [ebp - 4], 1
call fcn.0040260d
fldz
mov eax, dword [ebp + 0xc]
fstp dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
push 0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0
push eax
push 0x19
push 0x190
push edx
push 0xbd
push 0x50000000
push 0
push str.Static
push 0
mov dword [esi + 0x1c], eax
mov byte [esi + 0x28], 1
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], 0
call edi
push 0
push 0
push 0
push eax
push 0x19
push 0x17c
push 0
push 0x14
push 0x50000000
push 0x47a8cc
push str.Static
push 0
mov dword [esi + 4], eax
call edi
push 1
mov dword [esi + 0x20], eax
mov ecx, dword [ebx]
push ecx
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
call fcn.00453347
add esp, 4
mov dword [ebp + 0x14], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x425b8d
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
push 0
push 4
push 4
push ebx
push edx
push ecx
mov ecx, 0xb
push eax
lea ebx, [ecx - 2]
call fcn.00449a10
jmp 0x425b8f
xor eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 0x24], eax
mov eax, dword [eax + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, word [ebp + 0x1c]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 0x50]
push 0x47c0e0
push ecx
push edi
lea ebx, [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x425bcb
push ebx
mov ecx, edi
call fcn.00449870
add esp, 4
fldz
push ecx
mov ecx, esi
fstp dword [esp]
mov dword [esi + 0x2c], 0
call fcn.00425c70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x426f30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47437b
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.004675f0
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x102c]
mov esi, ecx
mov ebx, edx
call fcn.004025a7
xor edi, edi
push edi
lea ecx, [ebp - 0x1010]
xor eax, eax
push ecx
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x102c]
mov word [ebp - 0x1010], ax
call fcn.00429180
cmp dword [ebp - 0x101c], edi
jne 0x427020
push 0x18
mov dword [ebp - 0x1030], edi
call fcn.00453347
add esp, 4
cmp eax, edi
je 0x426fbe
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 1
mov edi, eax
lea edx, [ebp - 0x1030]
push edx
push 0
push edi
push fcn.004268e0
mov dword [edi + 0xc], esi
push 0
add esi, 0x14
push 0
mov dword [edi + 8], 0
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x427011
push 0x47bfec
push str.installJreInThread_fail
add ebx, 0x8e20
push ebx
call fcn.0040260d
push eax
call fcn.0040260d
push edi
call fcn.004268e0
lea ecx, [ebp - 0x102c]
call fcn.004025ff
mov eax, esi
jmp 0x42707c
push str.exists_
add ebx, 0x8e58
push ebx
call fcn.0040260d
mov ecx, eax
push 0x47bfec
push edi
lea eax, [ebp - 0x102c]
push eax
or eax, 0xffffffff
mov edi, ecx
call fcn.004030d3
push eax
call fcn.0040260d
cmp dword [esi + 8], 0
je 0x42706f
mov esi, dword [esi + 8]
fld dword [0x483400]
mov edx, dword [esi]
mov eax, dword [edx]
push ecx
fstp dword [esp]
push 0x64
push 0
mov ecx, esi
call eax
lea ecx, [ebp - 0x102c]
call fcn.004025ff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret
Function at 0x427240
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473e81
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov edi, ecx
cmp dword [edi + 8], 0
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], eax
je 0x4272b0
mov ecx, dword [edi + 8]
fldz
mov edx, dword [ecx]
mov eax, dword [edx]
push ecx
fstp dword [esp]
push 0
push 2
call eax
cmp dword [edi + 8], 0
je 0x4272b0
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 0x52
call eax
call fcn.0041f7c0
test al, al
je 0x427345
mov eax, esi
call fcn.00402639
push eax
lea eax, [ebp - 0x234]
call fcn.004025ce
lea esi, [ebx + 0x90c]
mov dword [ebp - 4], 0
cmp word [esi], 0
jne 0x42731d
cmp word [ebx + 0x704], 0
jne 0x4272f5
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
push 0x104
push esi
lea eax, [ebx + 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x427311
xor ecx, ecx
mov word [esi], cx
cmp word [esi], 0
jne 0x42731d
lea esi, [ebx + 0x704]
push str.core
push esi
lea edx, [ebp - 0x234]
mov ecx, ebx
call fcn.00426440
add esp, 8
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
call fcn.004025ff
cmp dword [edi + 8], 0
je 0x427374
mov ecx, dword [edi + 8]
fld dword [0x483468]
mov edx, dword [ecx]
mov eax, dword [edx]
push ecx
fstp dword [esp]
push 0x32
push 2
call eax
cmp dword [edi + 8], 0
je 0x427374
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 0x55
call eax
mov esi, dword [ebp - 0x270]
call fcn.0041f7c0
test al, al
je 0x4273cc
mov eax, esi
call fcn.00402639
push eax
lea eax, [ebp - 0x250]
call fcn.004025ce
push str.plugin
mov esi, ebx
mov dword [ebp - 4], 1
call fcn.00420200
push eax
lea edx, [ebp - 0x250]
mov ecx, ebx
call fcn.00426440
add esp, 8
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0xffffffff
call fcn.004025ff
cmp dword [edi + 8], 0
je 0x4273fb
mov ecx, dword [edi + 8]
fld dword [0x483400]
mov edx, dword [ecx]
mov eax, dword [edx]
push ecx
fstp dword [esp]
push 0x64
push 2
call eax
cmp dword [edi + 8], 0
je 0x4273fb
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 0x57
call eax
lea eax, [ebp - 0x26c]
call fcn.004025a7
push 1
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 2
call fcn.00429180
lea edx, [ebp - 0x218]
push edx
mov ecx, ebx
call fcn.004265f0
mov eax, dword [ebp - 0x274]
add esp, 4
call fcn.00402639
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
mov eax, dword [ebp - 0x270]
call fcn.00402639
push eax
call esi
cmp dword [edi + 8], 0
je 0x427466
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0x5a
call edx
lea ecx, [ebp - 0x26c]
call fcn.004025ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret 0x10