joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1162880
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x118c8b0
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.01174e3b
add esp, 0xc
test eax, eax
je 0x11628a4
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0117550d
mov eax, dword [esp + 0x1c]
push eax
call fcn.0117572f
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0117550d
lea ebp, [esi + 0x32]
push ebp
call fcn.011757ec
mov edx, dword [esp + 0x30]
push edx
push 1
mov edi, eax
push esi
push edi
call fcn.0117512e
mov eax, dword [esp + 0x40]
push eax
call fcn.011751c2
lea ebx, [edi + esi]
mov eax, 0x32
call fcn.01162950
mov ecx, dword [esp + 0x4c]
push 0x118c924
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.01174e3b
add esp, 0x40
test eax, eax
je 0x1162922
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push 1
push ebp
push edi
call fcn.01175401
mov ecx, dword [esp + 0x20]
push ecx
call fcn.011751c2
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x1164570
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.01179170
mov eax, dword [0x1192c20]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [0x11893d4]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x11645c8
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.011748db
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x1164607
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x1164606
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.01175401
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x11645d0
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.011751c2
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.011748db
add esp, 0x100c
ret
Function at 0x11661b0
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.01179170
mov eax, dword [0x1192c20]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x118c8b0
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.01174e3b
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x116621b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.011748db
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0117550d
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0117572f
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0117550d
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0117512e
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x11662c6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.01166020
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0117512e
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x1166291
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.011660c0
mov edx, dword [esp + 0x10]
push edx
call fcn.011751c2
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x11661f4
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.011748db
add esp, 0x1068
ret
Function at 0x1168080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x1168087
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1168164
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x118de80]
inc ecx
sub edx, 8
sub esi, 1
jne 0x11680a0
pop edi
test edx, edx
je 0x116818b
jmp 0x1168170
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x118de80]
inc ecx
sub edx, 1
jne 0x1168170
not eax
pop esi
ret

Function at 0x1168190
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x118de80]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x118de80]
mov dword [edx + 8], ecx
ret

Function at 0x11681e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x118de80]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x118de80]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x11695e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x11695fe
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x11695f2
cmp dword [edi + 0x7c], ebx
je 0x116960d
call fcn.011699c0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.01169350
add esp, 0xc
test eax, eax
je 0x1169634
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.011757ec
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1169672
push 0x4000
call fcn.011757ec
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x116967f
push esi
call fcn.01175d47
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x11696c7
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.011684a0
test eax, eax
jne 0x11696c7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x11696ee
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0x11696f4
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0x1169731
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0x1169731
call fcn.01168190
add ebp, 1
jne 0x1169720
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x402e95
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx + 0x14]
sub esp, 0xc
push esi
lea esi, [eax + ecx + 0x18]
lea edx, [esi + 0xc]
cmp ebx, dword [edx]
jae 0x402eaf
mov eax, ebx
jmp 0x402ef0
push edi
movzx edi, word [ecx + 6]
xor eax, eax
test edi, edi
jbe 0x402eec
mov dword [ebp - 4], edx
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
cmp edx, edi
jne 0x402ecc
mov edx, dword [ecx + 0x50]
jmp 0x402ed2
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
cmp ebx, dword [edx]
jb 0x402ee1
cmp ebx, dword [ebp - 8]
jb 0x402ef3
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], 0x28
cmp eax, edi
jb 0x402ebd
or eax, 0xffffffff
pop edi
pop esi
leave
ret
imul eax, eax, 0x28
lea ecx, [eax + esi]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, ebx
jmp 0x402eef

Function at 0x403273
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x404540
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea eax, [edi + edi]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4045af
cmp dword [esp + 0x10], 1
je 0x404581
pop edi
mov eax, 0x32
pop esi
ret 0xc
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x404591
pop edi
mov word [esi], cx
pop esi
ret 0xc
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4045af
cmp ecx, edi
jae 0x4045aa
xor edx, edx
pop edi
mov word [esi + ecx*2], dx
pop esi
ret 0xc
mov eax, 0xea
pop edi
pop esi
ret 0xc

Function at 0x4047c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x40
lea eax, [esp + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0x44
call fcn.004043e0
add esp, 0xc
xor eax, eax
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x14]
push edx
push eax
push eax
push 0x8000000
push eax
push eax
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
push eax
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40481f
xor al, al
add esp, 0x54
ret
mov edx, dword [esp]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x404819
mov eax, dword [esp + 0x60]
push ebx
push esi
mov bl, 1
test eax, eax
je 0x40484d
push eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x40484d
xor bl, bl
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop esi
mov al, bl
pop ebx
add esp, 0x54
ret
Function at 0x4049d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20c
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jle 0x404a8f
cmp eax, 0x104
jae 0x404a8f
push esi
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004045c0
mov esi, eax
add esp, 8
test esi, esi
je 0x404a8e
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0xc]
mov ebx, eax
push edx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xc], 0
mov ebp, eax
jle 0x404a8c
mov eax, dword [ebp]
push edi
push esi
push eax
mov edi, 0x401598
call fcn.00404670
add esp, 8
test al, al
jne 0x404a4a
mov edi, ebx
jmp 0x404a65
cmp dword [esp + 0x10], 1
jle 0x404a65
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push ebx
call esi
push 0x401594
push eax
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [esp + 0x224], eax
jle 0x404a84
mov ecx, dword [esp + 0x220]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20c
ret

Function at 0x404aa0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x208
lea eax, [esp]
push eax
push 0
push 0x4013f4
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x404ac9
xor al, al
add esp, 0x208
ret
push esi
mov esi, dword [esp + 0x214]
push 0x104
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x102
ja 0x404b18
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404b18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404b18
push 0x40159c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov al, 1
pop esi
add esp, 0x208
ret
xor al, al
pop esi
add esp, 0x208
ret

Function at 0x404b30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [esp + 0x214]
dec eax
cmp eax, 0x102
ja 0x404b72
lea ecx, [esp + 4]
push esi
push ecx
call fcn.00404aa0
add esp, 8
test al, al
je 0x404b72
mov al, 1
pop esi
add esp, 0x208
ret
mov eax, dword [esp + 0x210]
push 0x104
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x404bbb
push eax
lea edx, [esp + 8]
push edx
call fcn.004045c0
lea edx, [esp + 0xc]
xor ecx, ecx
push esi
push edx
mov word [eax], cx
call fcn.00404aa0
add esp, 0x10
pop esi
add esp, 0x208
ret
xor al, al
pop esi
add esp, 0x208
ret
Function at 0x404bd0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x440
push ebx
mov ebx, dword [esp + 0x448]
test ebx, ebx
je 0x404dd2
mov eax, ebx
lea edx, [eax + 2]
jmp 0x404bf0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404bf0
sub eax, edx
sar eax, 1
je 0x404dd2
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x42]
push ecx
mov word [esp + 0x44], ax
call fcn.004043e0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x256]
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x208
mov word [esp + 0x258], dx
call fcn.004043e0
add esp, 0x18
push 0
push 0x26
lea ecx, [esp + 0x248]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x240]
push edx
lea eax, [esp + 0x3c]
push 0x401638
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
call esi
test eax, eax
jne 0x404cc1
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x401598
push 0x4015b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [esp + 0x38]
push edx
call esi
test eax, eax
jne 0x404cc1
mov word [esp + 0x38], ax
lea eax, [esp + 0x38]
lea edx, [eax + 2]
jmp 0x404cd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404cd0
sub eax, edx
sar eax, 1
je 0x404d0b
push 0xa
push 0
push ebx
lea ecx, [esp + 0x44]
push ecx
push 0x4015a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
lea edx, [esp + 8]
push edx
push 0x401ba0
push 0x15
push 0
push 0x401bb0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x404d3b
pop esi
xor eax, eax
pop ebx
add esp, 0x440
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x404cfd
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x94]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404d77
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 0xc]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor edx, edx
mov word [esp + 0x18], dx
lea edx, [esp + 0x18]
push edx
push edx
mov esi, eax
push edx
push edx
mov eax, 8
mov word [esp + 0x38], ax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
xor eax, eax
pop ebx
add esp, 0x440
ret
Function at 0x404de0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004043e0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22e]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x208
mov word [esp + 0x230], dx
call fcn.004043e0
add esp, 0x18
push 0
push 0x26
lea ecx, [esp + 0x220]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
push 0x401638
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call esi
test eax, eax
jne 0x404ea2
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x401598
push 0x4015b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [esp + 0x10]
push edx
call esi
test eax, eax
jne 0x404ea2
mov word [esp + 0x10], ax
lea eax, [esp + 0x10]
lea edx, [eax + 2]
pop esi
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404eb0
sub eax, edx
sar eax, 1
jne 0x404ef4
lea ecx, [esp]
push ecx
push 0x401ba0
push 0x15
push 0
push 0x401bb0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x404f00
mov eax, dword [esp]
test eax, eax
je 0x404f00
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, 1
add esp, 0x41c
ret
xor eax, eax
add esp, 0x41c
ret
Function at 0x405990
Capabilities:
Accept command line arguments
Delete directory
Delete file

Disassembly:
sub esp, 0x624
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov edi, dword [esp + 0x630]
mov dword [0x40ecc4], eax
lea eax, [esp + 0x424]
push eax
push edi
call fcn.00404b30
add esp, 8
test al, al
jne 0x4059cf
pop edi
mov eax, 0x65
pop ebx
add esp, 0x624
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [esp + 0x14]
mov esi, eax
push esi
push edx
call fcn.00405030
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.004043e0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x236]
push eax
mov word [esp + 0x238], dx
call fcn.004043e0
push 0x104
lea ecx, [esp + 0x23c]
push ecx
push 0x104
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x450]
push eax
push edi
call fcn.00405350
add esp, 0x30
test al, al
jne 0x405a68
pop esi
pop edi
mov eax, 0x66
pop ebx
add esp, 0x624
ret
call ebx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x224]
mov dword [0x40ecc8], eax
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x18], 0x67
call fcn.00405800
add esp, 0xc
test al, al
je 0x405ae4
push 2
lea ecx, [esp + 0x14]
push ecx
push 0x401450
push 0x40156c
push SysReAllocString
call fcn.00404f10
add esp, 0x14
test al, al
je 0x405abf
cmp word [esp + 0x10], 0x30
je 0x405ae4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x18]
push edx
call esi
lea eax, [esp + 0x220]
push eax
call esi
lea ecx, [esp + 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x624
ret

Function at 0x405ba0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.004043e0
add esp, 0xc
push 0x104
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405bdd
add esp, 0x208
ret
lea eax, [esp]
push eax
call fcn.00405b00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00405990
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405c70
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405c8c
xor al, al
pop esi
pop ecx
ret 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x405ca2
pop ebx
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esi]
mov eax, dword [esi + 4]
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405cf9
push 0
lea edx, [esp + 0x10]
push edx
push edi
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x405d02
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test eax, eax
pop ebx
setne al
pop esi
pop ecx
ret 4

Function at 0x4061fd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d3d4]
jne 0x406207
repz ret
jmp fcn.00407ed0