joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb35a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x4fb386
test ecx, ecx
jne 0x4fb390
test esi, esi
jne 0x4fb390
mov eax, edx
jmp 0x4fb401
cmp eax, 0xffffffff
jne 0x4fb390
push 0xfffffffffffffffe
pop eax
jmp 0x4fb401
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x4fb401
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x4fb3c6
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x4fb3e5
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x4fb4ae
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x4fb426
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4fb430
xor ecx, ecx
jmp 0x4fb46f
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x4fb452
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00505f6d
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x4fb49a
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x4fb4ae
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4fb368
pop edi
pop esi
leave
ret
Function at 0x50bd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebp
ret

Function at 0x50bd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
ret
Function at 0x55baa0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 8
cmp eax, 3
jne 0x55baed
mov eax, dword [esp + 0x18]
test eax, eax
mov ecx, dword [esp + 0xc]
jle 0x55badb
movzx edx, word [ecx + 0x118]
cmp eax, edx
jg 0x55badb
push eax
mov eax, dword [esp + 0x14]
push eax
push str.tRNS
push ecx
call fcn.0055adb0
add esp, 0x10
add esp, 8
ret
push str.Invalid_number_of_transparent_colors_specified
push ecx
call fcn.00551dc0
add esp, 8
add esp, 8
ret
test eax, eax
push esi
jne 0x55bb49
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx + 8]
mov edx, dword [esp + 0x10]
mov cl, byte [edx + 0x127]
mov esi, 1
shl esi, cl
cmp eax, esi
jl 0x55bb22
push str.Ignoring_attempt_to_write_tRNS_chunk_out_of_range_for_bit_depth
push edx
call fcn.00551dc0
add esp, 8
pop esi
add esp, 8
ret
mov ecx, eax
mov byte [esp + 5], al
push 2
lea eax, [esp + 8]
push eax
shr ecx, 8
push str.tRNS
push edx
mov byte [esp + 0x14], cl
call fcn.0055adb0
add esp, 0x10
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x55bbc9
mov esi, dword [esp + 0x18]
movzx eax, word [esi + 2]
mov ecx, eax
mov byte [esp + 5], al
movzx eax, word [esi + 4]
push ebx
movzx ebx, word [esi + 6]
mov esi, dword [esp + 0x14]
mov edx, eax
mov byte [esp + 0xb], al
mov eax, ebx
mov byte [esp + 0xd], bl
mov bl, byte [esi + 0x127]
shr ecx, 8
shr edx, 8
shr eax, 8
cmp bl, 8
mov byte [esp + 8], cl
mov byte [esp + 0xa], dl
mov byte [esp + 0xc], al
pop ebx
jne 0x55bbaf
or al, dl
or al, cl
je 0x55bbaf
push str.Ignoring_attempt_to_write_16_bit_tRNS_chunk_when_bit_depth_is_8
push esi
call fcn.00551dc0
add esp, 8
pop esi
add esp, 8
ret
push 6
lea ecx, [esp + 8]
push ecx
push str.tRNS
push esi
call fcn.0055adb0
add esp, 0x10
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x10]
push 0x589778
push edx
call fcn.00551dc0
add esp, 8
pop esi
add esp, 8
ret
Function at 0x55bbe0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 3
push ebx
push esi
jne 0x55bc49
mov eax, dword [esp + 0x14]
mov cx, word [eax + 0x118]
test cx, cx
mov edx, dword [esp + 0x18]
jne 0x55bc0b
test byte [eax + 0x230], 1
jne 0x55bc28
movzx si, byte [edx]
cmp si, cx
jbe 0x55bc28
push str.Invalid_background_palette_index
push eax
call fcn.00551dc0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
mov cl, byte [edx]
push 1
lea edx, [esp + 0xc]
push edx
push str.bKGD
push eax
mov byte [esp + 0x18], cl
call fcn.0055adb0
add esp, 0x10
pop esi
pop ebx
add esp, 8
ret
test al, 2
je 0x55bcc8
mov esi, dword [esp + 0x18]
movzx eax, word [esi + 2]
movzx ebx, word [esi + 6]
mov ecx, eax
mov byte [esp + 9], al
movzx eax, word [esi + 4]
mov esi, dword [esp + 0x14]
mov edx, eax
mov byte [esp + 0xb], al
mov eax, ebx
mov byte [esp + 0xd], bl
mov bl, byte [esi + 0x127]
shr ecx, 8
shr edx, 8
shr eax, 8
cmp bl, 8
mov byte [esp + 8], cl
mov byte [esp + 0xa], dl
mov byte [esp + 0xc], al
jne 0x55bcad
or al, dl
or al, cl
je 0x55bcad
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push esi
call fcn.00551dc0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
push 6
lea eax, [esp + 0xc]
push eax
push str.bKGD
push esi
call fcn.0055adb0
add esp, 0x10
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx + 8]
mov edx, dword [esp + 0x14]
mov cl, byte [edx + 0x127]
mov esi, 1
shl esi, cl
cmp eax, esi
jl 0x55bcf9
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push edx
call fcn.00551dc0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
mov ecx, eax
mov byte [esp + 9], al
push 2
lea eax, [esp + 0xc]
push eax
shr ecx, 8
push str.bKGD
push edx
mov byte [esp + 0x18], cl
call fcn.0055adb0
add esp, 0x10
pop esi
pop ebx
add esp, 8
ret
Function at 0x560440
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
push ebx
mov ebx, dword [esp + 8]
je 0x5604a0
push ebp
push esi
push edi
mov edi, edi
mov ecx, dword [edx]
mov edi, dword [ecx]
mov esi, dword [edx + 4]
add esi, edi
mov edi, dword [edx + 8]
cmp ebx, edi
jge 0x560462
mov edi, ebx
xor ecx, ecx
test edi, edi
jle 0x560490
jmp 0x560470
movzx ebx, byte [ecx + esi]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x5a67d0]
shl eax, 8
xor eax, ebp
inc ecx
cmp ecx, edi
jl 0x560470
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0xc]
sub ebx, ecx
test edx, edx
mov dword [esp + 0x14], ebx
jne 0x560450
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5683a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5683ab
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x5684a3
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x58cbb0]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x5683c6
test edi, edi
je 0x5684c2
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x58cbb0]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x5684a7
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x45a2e3
call fcn.0043d951
lea ecx, [ebp - 0x18]
call fcn.0042eabc
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402ab8
or dword [ebp - 4], 0xffffffff
call fcn.0042ead2
and dword [ebp - 0x14], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402969
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402960
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x402969
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x402969
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, edi
je 0x402906
cmp word [esi], bx
jne 0x402902
cmp dword [ebp - 0x1c], ebx
je 0x4028fc
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00402a20
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
jmp 0x402902
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
inc esi
inc esi
jmp 0x4028d2
or dword [ebp - 4], 0xffffffff
jmp 0x402967
mov dword [ebp - 0x14], 1
jmp 0x402971
call fcn.00403116
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x40299a
call fcn.0043d9f6
ret 4
Function at 0x409032
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45b3f6
call fcn.0043d91e
push 0x4641c0
mov ecx, 0x47e0f0
call fcn.004029a2
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x40906f
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.00404773
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
jmp 0x40ea55
lea ecx, [ebp - 0x38]
call fcn.0043467b
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4641d4
lea edi, [ebp - 0x38]
call fcn.0040151c
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.0040151c
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.0041718e
cmp dword [ebp - 0x30], ebx
pop ecx
pop ecx
jle 0x409169
mov edi, 0x47e0c4
push 0x4641d8
mov ecx, edi
call fcn.00423150
test eax, eax
je 0x40914e
push str.LI_SKIP_EULA
mov ecx, edi
call fcn.00423150
test eax, eax
je 0x40914e
cmp dword [ebp - 0x30], 1
jle 0x40914e
cmp dword [ebp - 0x30], ebx
jg 0x4090f0
jmp fcn.0042e9b1
mov ecx, dword [ebp - 0x34]
push 0x464208
call fcn.0040440a
test eax, eax
jne 0x40914e
cmp dword [ebp - 0x30], 1
jle 0x4090eb
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
lea ecx, [esi + 0x98]
call fcn.0040a0f8
push ebx
mov byte [esi + 0xac], 1
mov eax, dword [0x47e004]
push ebx
push 0x400
push dword [eax + 0x30]
mov dword [eax + 0x58], ebx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [0x47e0c0]
cmp eax, ebx
je 0x40914e
push ebx
push ebx
push 0x464180
push eax
call fcn.00415c74
cmp byte [esi + 0xac], bl
jne 0x409169
cmp dword [ebp - 0x30], ebx
jle 0x4090eb
push dword [ebp - 0x34]
lea ecx, [esi + 0x98]
call fcn.0040a0f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0043482c
call fcn.0043d9f6
ret
Function at 0x40917b
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45b3f6
call fcn.0043d91e
push 0x4641c0
mov ecx, 0x47e0f0
call fcn.004029a2
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x4091b7
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.00404773
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
jmp 0x40ea55
lea ecx, [ebp - 0x38]
call fcn.0043467b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4641d4
lea edi, [ebp - 0x38]
call fcn.0040151c
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.0040151c
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
call fcn.0041718e
cmp byte [esi + 0xac], 0
pop ecx
pop ecx
mov edi, ebx
je 0x409206
push 2
pop edi
mov ebx, dword [ebp - 0x30]
jmp 0x409251
test edi, edi
jl 0x409267
cmp edi, dword [ebp - 0x30]
jge 0x409267
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x409250
push str.CProgressPage
push eax
call fcn.00409d73
test al, al
pop ecx
pop ecx
je 0x409239
push esi
call fcn.004093b0
cmp edi, dword [ebp - 0x30]
jge 0x409267
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
push eax
lea ecx, [esi + 0x98]
call fcn.0040a0f8
inc edi
cmp edi, ebx
jb 0x40920b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0043482c
call fcn.0043d9f6
ret
jmp fcn.0042e9b1
test ecx, ecx
je 0x40ea62
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x14]
push 1
call fcn.0043c6f6
int3
Function at 0x40c7c5
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x45be9f
call fcn.0043d951
lea ecx, [ebp - 0x2c]
call fcn.0042eabc
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0041966f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.004081cc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
push 0x464d04
lea ecx, [ebp - 0x18]
call fcn.00416c8f
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x40c83e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.00418c35
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401b66
or dword [ebp - 4], 0xffffffff
call fcn.0042ead2
mov eax, dword [ebp - 0x20]
jmp 0x40c8c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
call fcn.00425960
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x40c814
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40c867
and dword [ebp - 0x18], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x1c]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401b01
push str..exe
mov ecx, esi
call fcn.004086e8
push dword [esi]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40c814
call fcn.00403116
mov dword [ebp - 0x20], eax
jmp 0x40c814
call fcn.0043d9f6
ret 0x14
Function at 0x40e4a6
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x478030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x462e4c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e506
push 0x800
call eax
test eax, eax
jne 0x40e4ff
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40e50b
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40e50b
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40e67f
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.0043b9eb
add esp, 0xc
test eax, eax
jne 0x40e663
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043da30
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043bd1e
push 0x465238
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043bd1e
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x430]
jmp 0x40e66a
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40e5d3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00439767
leave
ret
Function at 0x40e6c3
Capabilities:
Set registry value

Disassembly:
push 0x30
mov eax, 0x45c07d
call fcn.0043d987
cmp byte [ebx + 0xc8], 0
jne 0x40e819
mov eax, dword [ebx + 0xa8]
test eax, eax
jne 0x40e812
lea ecx, [ebp - 0x38]
call fcn.0041966f
and dword [ebp - 4], 0
push dword [ebx + 0xb8]
lea eax, [ebp - 0x38]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00402026
and dword [ebp - 0x34], 0
add esp, 0xc
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
lea edi, [ebp - 0x34]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408666
test eax, eax
jne 0x40e7e2
push 0x10
pop esi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push str.InstallationID
mov eax, edi
push eax
mov dword [ebp - 0x3c], esi
call fcn.00411ade
test eax, eax
jne 0x40e751
cmp dword [ebp - 0x3c], esi
je 0x40e75d
mov esi, 0x46288c
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0xdc]
push 4
pop ecx
lea edi, [ebp - 0x20]
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40e776
lea esi, [ebp - 0x20]
jmp 0x40e7cc
push 0x4641d8
mov ecx, 0x47e0c4
call fcn.00423150
test eax, eax
je 0x40e79d
push 4
pop ecx
mov edi, 0x46288c
lea esi, [ebx + 0xdc]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40e7e2
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x30]
push eax
push 3
push 0
push str.InstallationID
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e7e2
lea esi, [ebp - 0x30]
lea eax, [ebx + 0xdc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x47e0c0]
test ecx, ecx
je 0x40e7fa
push eax
call fcn.00415bd8
mov eax, dword [0x47e0c0]
test eax, eax
je 0x40e7fa
push 0
push 1
push str.InstallerFinished
push eax
call fcn.00415c74
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.004085b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401b66
mov byte [ebx + 0xc8], 1
call fcn.0043da0a
ret

Function at 0x40e81f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00433958
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40e840
xor eax, eax
jmp 0x40e853
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e83c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x40f685
Capabilities:
Terminate process

Disassembly:
push 0x40c
mov eax, 0x45bf83
call fcn.0043d987
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
je 0x40f74e
mov eax, dword [0x47e0c0]
cmp eax, ebx
je 0x40f6c3
push ebx
push ebx
push eax
mov esi, edi
call fcn.00415f28
push 0x45e500
mov ecx, edi
call fcn.0042fbd4
test eax, eax
jne 0x40f6e3
push 0x463334
mov ecx, edi
call fcn.0042fbd4
test eax, eax
je 0x40f74e
mov eax, dword [edi]
push ebx
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, edi
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x47df48
je 0x40f720
call fcn.0040e68c
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x40f732
call fcn.0040e68c
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00401b66
push esi
call fcn.0043c6f6
mov eax, dword [ebp - 0x414]
xor esi, esi
inc esi
mov dword [eax + 0xa4], esi
mov dword [0x47dff0], esi
mov esi, dword [0x47df68]
call fcn.00408eda
cmp edi, ebx
je 0x40f786
push dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push edi
call fcn.00435662
mov ebx, eax
mov eax, ebx
call fcn.0043da0a
ret 8