joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439020
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x471ae8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x439059
inc eax
mov dword [esi + 0x10], eax
jmp 0x43916c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43906d
mov eax, 0xffffffc7
jmp 0x43916e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43907e
cmp dword [esi + 8], eax
jne 0x43906d
cmp dword [esi + 8], eax
jne 0x439097
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x439097
mov eax, 0xffffffc7
jmp 0x43916e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4390ab
push eax
mov ecx, ebx
call fcn.00438850
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004011f0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4390dc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00401240
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00437fc0
test eax, eax
mov dword [esp + 0x38], eax
je 0x43910f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4775e8
call fcn.00401420
mov eax, dword [esp + 0x38]
jmp 0x43916e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00438e80
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x439153
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00438ea0
mov esi, eax
test esi, esi
jne 0x439183
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00438e80
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x439125
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4775e8
call fcn.00401420
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4775e8
call fcn.00401420
mov eax, esi
jmp 0x43916e
Function at 0x43c580
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43c5b3
push esi
call fcn.0043f540
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43c5ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43c639
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c622
mov eax, dword [esi + 8]
test eax, eax
je 0x43c5d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43c61e
cmp eax, 2
je 0x43c622
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43c5ca
cmp eax, 3
je 0x43c5fd
cmp eax, 1
jne 0x43c5ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43c5ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43c5ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043c660
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43c648
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043c660
add esp, 4
pop esi
ret

Function at 0x462d76
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x462dae
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004659d1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004659a9
jmp 0x462dba
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x464467
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4644a9
call fcn.0046bc49
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4644a9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4644a0
xor eax, eax
jmp 0x4644b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004644b7
pop edi
pop esi
pop ebx
ret 4

Function at 0x46c307
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46c335
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46c353
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046c26d
jmp 0x46c353
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46c353
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046c26d
test edi, edi
mov eax, edi
jne 0x46c33d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x44f8f7
call fcn.0043a381
lea ecx, [ebp - 0x1c]
call fcn.0042b383
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402e9c
or dword [ebp - 4], 0xffffffff
call fcn.0042b399
and dword [ebp - 0x18], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402d73
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402d6a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x402d73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x402d73
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, edi
je 0x402d36
cmp word [esi], bx
jne 0x402d32
cmp dword [ebp - 0x20], ebx
je 0x402d2c
push dword [ebp - 0x20]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
call fcn.00402e06
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
jmp 0x402d32
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x402d02
or dword [ebp - 4], 0xffffffff
jmp 0x402d71
mov dword [ebp - 0x18], 1
jmp 0x402d7b
call fcn.0040345e
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x402d9e
call fcn.0043a426
ret 4
Function at 0x40679e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406801
cmp dword [ebp + 0xc], 1
je 0x4067da
cmp dword [ebp + 0xc], 2
je 0x4067da
push 0xd
pop eax
jmp 0x406801
test edi, edi
mov eax, dword [ebp - 4]
je 0x4067fb
test eax, eax
je 0x4067f7
test al, 1
jne 0x4067d5
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4067fb
jmp 0x4067d5
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x4070a6
Capabilities:
Get common file path

Disassembly:
push 0x28
mov eax, 0x44f5ec
call fcn.0043a381
mov edi, ecx
lea ecx, [ebp - 0x34]
call fcn.0042b383
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.004016d0
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.004062b9
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.00409449
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40711c
call fcn.0040345e
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b60
or dword [ebp - 4], 0xffffffff
call fcn.0042b399
mov eax, esi
call fcn.0043a426
ret
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040556c
lea ecx, [ebp - 0x18]
call fcn.004062b9
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.00409449
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x407176
call fcn.0040345e
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b60
mov dword [ebp - 4], ebx
jmp 0x40710f
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040556c
lea eax, [ebp - 0x1c]
push eax
call fcn.004090ab
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x4071e1
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0040f252
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b60
mov dword [ebp - 4], ebx
call fcn.0042b399
mov eax, dword [ebp - 0x24]
jmp 0x407116
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.0040161a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0040f252
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b60
mov dword [ebp - 4], ebx
call fcn.0042b399
xor eax, eax
jmp 0x407116
Function at 0x408ad0
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x44f52a
call fcn.0043a34e
and dword [ebp - 4], 0
mov edx, 0x4596bc
mov ecx, 0x46fa78
call fcn.00402da6
mov ebx, eax
test ebx, ebx
mov edi, 0xbdd
je 0x408cb1
mov esi, dword [ebp + 8]
push 0
push edi
call fcn.00408f0c
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00401527
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
lea ebx, [ebp - 0x10]
call fcn.00413856
pop ecx
mov byte [ebp - 4], 2
push 0x5c
mov esi, ebx
call fcn.00409018
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.004091a6
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409039
mov byte [ebp - 4], 4
call fcn.00408fd4
push 0x22
mov ecx, ebx
call fcn.004042cb
push str.__installscan
mov ecx, ebx
call fcn.004092be
mov edx, str.LaunchAs
mov ecx, 0x46fa78
xor esi, esi
xor ebx, ebx
call fcn.00402da6
cmp eax, esi
je 0x408bca
push str.AsInvoker
push eax
call fcn.004357da
test eax, eax
pop ecx
pop ecx
je 0x408bca
push 3
push 5
inc ebx
call fcn.004137e3
test al, al
pop ecx
pop ecx
je 0x408bca
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.004148d7
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x408c24
push 0x40
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.00435760
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x14]
call fcn.00409091
push eax
neg ebx
push esi
sbb ebx, ebx
and ebx, 0x1000000
push ebx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
call fcn.00409091
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x408c24
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x30]
call ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040556c
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0040556c
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x1f40
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
jne 0x408c8d
mov dword [ebp - 0x18], esi
mov ebx, 0x1f4
jmp 0x408c5a
xor esi, esi
cmp dword [ebp - 0x1c], esi
jle 0x408c8d
add dword [ebp - 0x18], 7
push dword [ebp - 0x18]
mov esi, dword [ebp + 8]
push edi
call fcn.00408f0c
sub dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x408c58
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00401b60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401b60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401b60
mov esi, dword [ebp + 8]
push 0x5f
push edi
call fcn.00408f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401b60
xor eax, eax
inc eax
call fcn.0043a426
ret 8
Function at 0x409753
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x450fad
call fcn.0043a34e
mov eax, dword [esi + 0xa0]
cmp eax, 1
jge 0x409789
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.004047bb
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x46f8a8
jmp fcn.0040da3c
lea edi, [esi + 0x98]
dec eax
mov ecx, edi
call fcn.0040aa8f
mov ebx, str.CFinishedPage
push ebx
mov ecx, eax
call fcn.00401e7a
test eax, eax
je 0x4097b3
push ebx
push dword [edi + 8]
mov ecx, edi
call fcn.004302b6
mov eax, dword [esi + 0xa0]
dec eax
lea ecx, [esi + 0x90]
cmp dword [ecx], eax
je 0x4097e6
mov dword [ecx], eax
mov ecx, edi
call fcn.0040aa8f
push dword [eax]
call fcn.00436184
pop ecx
push eax
push 0
push 0x8002
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043a426
ret

Function at 0x4097ec
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x450fad
call fcn.0043a34e
lea esi, [edi + 0xa0]
mov eax, dword [esi]
cmp eax, 1
jne 0x409814
cmp dword [edi + 0x90], 0
jne 0x409814
push edi
call fcn.00409961
mov esi, dword [esi]
cmp esi, 1
jge 0x40983a
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.004047bb
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x46f8a8
jmp fcn.0040da3c
dec esi
cmp dword [edi + 0x90], esi
je 0x409855
push 0
push 0
push 0x8002
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043a426
ret
Function at 0x40d672
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x45151a
call fcn.0043a3b7
cmp byte [ebx + 0xcc], 0
jne 0x40d7b5
mov eax, dword [ebx + 0xa8]
xor esi, esi
cmp eax, esi
je 0x40d6be
cmp dword [ebx + 0xa4], esi
mov edx, dword [ebx + 0x19c]
push esi
je 0x40d6ad
push str.InstallBroken
jmp 0x40d6b2
push str.InstallCancelled
call fcn.00406261
pop ecx
pop ecx
jmp 0x40d7ae
lea ecx, [ebp - 0x24]
call fcn.004062b9
mov dword [ebp - 4], esi
push dword [ebx + 0xbc]
lea eax, [ebp - 0x24]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00402471
add esp, 0xc
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409231
cmp eax, esi
jne 0x40d76b
push str.LI_UPDATE
mov ecx, 0x46fa4c
call fcn.00416480
test eax, eax
je 0x40d725
lea eax, [ebx + 0xe0]
push 0x4579e4
push eax
call fcn.0040e486
test eax, eax
pop ecx
pop ecx
je 0x40d76b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 3
push esi
push str.InstallationID
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40d76b
lea eax, [ebx + 0xe0]
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x46fa48]
test ecx, ecx
je 0x40d781
push eax
call fcn.00412414
xor esi, esi
mov ecx, dword [0x46fa48]
cmp ecx, esi
je 0x40d783
push str.InstallerFinished
call fcn.004124b2
jmp 0x40d783
xor esi, esi
mov eax, dword [ebx + 0x19c]
push esi
push str.InstallFinished
call fcn.0040624e
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406805
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401b60
mov byte [ebx + 0xcc], 1
call fcn.0043a43a
ret

Function at 0x40d7bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0042f27e
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40d7dc
xor eax, eax
jmp 0x40d7ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d7d8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8

Function at 0x40da3c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
test esi, esi
push edi
je 0x40da73
mov ebx, ecx
add ebx, 0x19c
mov edi, dword [ebx]
test edi, edi
je 0x40da68
call fcn.004094a8
mov edx, dword [ebx]
push 0
push str.InstallBroken
call fcn.00406261
pop ecx
pop ecx
mov eax, dword [esi]
push 0
push 0
mov ecx, esi
call dword [eax + 0x14]
push 1
call fcn.00436e35
int3
Function at 0x40df8c
Capabilities:
Terminate process

Disassembly:
push 0x410
mov eax, 0x45112c
call fcn.0043a3b7
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x418], 0
test ebx, ebx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x41c], eax
je 0x40e083
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x40dfd7
mov esi, ebx
mov edi, eax
call fcn.004094a8
mov edi, dword [ebp - 0x414]
push 0x454398
mov ecx, ebx
call fcn.0042b4a1
test eax, eax
jne 0x40dffb
push 0x458760
mov ecx, ebx
call fcn.0042b4a1
test eax, eax
je 0x40e083
mov edi, dword [edi + 0x19c]
test edi, edi
je 0x40e015
push 0
push str.InstallBroken
mov edx, edi
call fcn.00406261
pop ecx
pop ecx
mov eax, dword [ebx]
push 0
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x46f8a8
je 0x40e054
call fcn.0040d63b
and dword [ebp - 4], 0
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x40e066
call fcn.0040d63b
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00401b60
push esi
call fcn.00436e35
xor esi, esi
inc esi
mov dword [edi + 0xa4], esi
mov dword [0x46f950], esi
mov esi, dword [0x46f8c8]
call fcn.00409753
test ebx, ebx
je 0x40e0b5
push dword [ebp - 0x41c]
mov ecx, edi
push ebx
call fcn.004310cb
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
call fcn.0043a43a
ret 8

Function at 0x40e56d
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x450aed
call fcn.0043a34e
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x40e5b5
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.0040aa8f
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x40e59b
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.0042f364
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.0042f364
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.0043014f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040fd0c
call fcn.0043a426
ret

Function at 0x40eabc
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x44e8bf
call fcn.0043a34e
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40eafe
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40eafe
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401b60
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043a426
ret
Function at 0x412e84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call fcn.00435760
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x1000000
push esi
push esi
push esi
call fcn.00409091
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.0040556c
cmp edi, esi
jne 0x412ee3
xor eax, eax
jmp 0x412ef6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413306
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x44fc59
call fcn.0043a3b7
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.00414b85
mov ecx, dword [ebp - 0x22c]
push 0x458084
call fcn.00401527
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.00401527
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x413522
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x413522
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x413506
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00401527
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.004062b9
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x4134e8
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.00401527
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.0041326b
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401b00
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b60
lea edi, [ebp - 0x220]
call fcn.00414b85
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00401e7a
test eax, eax
jne 0x4134e8
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.00401527
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.0041326b
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401aeb
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401b60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.00401b60
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x4133b8
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00401b60
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401b60
mov eax, dword [ebp - 0x22c]
call fcn.0043a43a
ret