joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c59
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45da56
call fcn.0043f3e1
push 0x467670
mov ecx, 0x481188
call fcn.004029b5
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x409c96
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040471e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
jmp 0x40fa65
lea ecx, [ebp - 0x38]
call fcn.00435ffb
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x467684
lea edi, [ebp - 0x38]
call fcn.00401518
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401518
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.004189a5
cmp dword [ebp - 0x30], ebx
pop ecx
pop ecx
jle 0x409d90
mov edi, 0x48115c
push 0x467688
mov ecx, edi
call fcn.00424930
test eax, eax
je 0x409d75
push str.LI_SKIP_EULA
mov ecx, edi
call fcn.00424930
test eax, eax
je 0x409d75
cmp dword [ebp - 0x30], 1
jle 0x409d75
cmp dword [ebp - 0x30], ebx
jg 0x409d17
jmp fcn.0043058c
mov ecx, dword [ebp - 0x34]
push 0x4676b8
call fcn.004043bb
test eax, eax
jne 0x409d75
cmp dword [ebp - 0x30], 1
jle 0x409d12
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
lea ecx, [esi + 0x98]
call fcn.0040ad8e
push ebx
mov byte [esi + 0xac], 1
mov eax, dword [0x48109c]
push ebx
push 0x401
push dword [eax + 0x30]
mov dword [eax + 0x58], ebx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [0x481158]
cmp eax, ebx
je 0x409d75
push ebx
push ebx
push 0x467630
push eax
call fcn.00416e7c
cmp byte [esi + 0xac], bl
jne 0x409d90
cmp dword [ebp - 0x30], ebx
jle 0x409d12
push dword [ebp - 0x34]
lea ecx, [esi + 0x98]
call fcn.0040ad8e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004361ac
call fcn.0043f4b9
ret

Function at 0x409da2
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45da56
call fcn.0043f3e1
push 0x467670
mov ecx, 0x481188
call fcn.004029b5
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x409dde
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040471e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
jmp 0x40fa65
lea ecx, [ebp - 0x38]
call fcn.00435ffb
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x467684
lea edi, [ebp - 0x38]
call fcn.00401518
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401518
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
call fcn.004189a5
cmp byte [esi + 0xac], 0
pop ecx
pop ecx
mov edi, ebx
je 0x409e2d
push 2
pop edi
mov ebx, dword [ebp - 0x30]
jmp 0x409e78
test edi, edi
jl 0x409e8e
cmp edi, dword [ebp - 0x30]
jge 0x409e8e
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x409e77
push str.CProgressPage
push eax
call fcn.0040aa15
test al, al
pop ecx
pop ecx
je 0x409e60
push esi
call fcn.00409fd7
cmp edi, dword [ebp - 0x30]
jge 0x409e8e
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
push eax
lea ecx, [esi + 0x98]
call fcn.0040ad8e
inc edi
cmp edi, ebx
jb 0x409e32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004361ac
call fcn.0043f4b9
ret
jmp fcn.0043058c
Function at 0x40cbb9
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x45d2e3
call fcn.0043f3e1
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0x26
jne 0x40cd87
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405244
mov byte [ebp - 4], 1
mov esi, 0x465e64
push esi
push 0x468170
lea eax, [ebp - 0x10]
push eax
call fcn.0040d49a
push esi
push 0x468174
lea eax, [ebp - 0x10]
push eax
call fcn.0040d49a
lea ecx, [ebp - 0x30]
call fcn.00435ffb
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x466ec8
lea edi, [ebp - 0x30]
call fcn.00401518
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00405244
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004189a5
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.004015d7
xor edi, edi
cmp dword [ebp - 0x28], ebx
jle 0x40ccd5
push edi
lea ecx, [ebp - 0x30]
call fcn.0040d677
push eax
lea ecx, [ebp - 0x14]
call fcn.00405244
mov byte [ebp - 4], 5
cmp edi, 3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
jl 0x40cdb6
xor esi, esi
cmp eax, ebx
jle 0x40ccc3
lea ecx, [esi + 1]
cmp eax, ecx
jle 0x40cca1
lea eax, [ebp - 0x14]
call fcn.00408912
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00403f96
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.00408912
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00403f96
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
inc esi
inc esi
cmp esi, eax
jl 0x40cc86
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004089bb
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x40cc5b
lea ecx, [ebp - 0x18]
call fcn.00401a8d
mov byte [ebp - 4], 6
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x468178
push eax
call fcn.00402014
add esp, 0xc
call fcn.0041895e
neg al
mov dword [ebp - 0x14], ebx
sbb eax, eax
and eax, 0x200
add eax, 0x20006
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40cd58
lea ecx, [ebp - 0x14]
call fcn.0040912c
cmp eax, ebx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jne 0x40cd58
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push ebx
push str.DeploymentFlags
push ecx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14]
call fcn.0040912c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004089bb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004361ac
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004089bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004089bb
call fcn.0043f4b9
ret 4
lea esi, [eax - 1]
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.00408912
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00403f96
mov eax, esi
cmp eax, ebx
jg 0x40cd9b
jmp 0x40ccc3
Function at 0x40d6b9
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x45e567
call fcn.0043f414
lea ecx, [ebp - 0x2c]
call fcn.00430697
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401a8d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.0041409c
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
push 0x468260
lea ecx, [ebp - 0x18]
call fcn.004184a6
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x40d732
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.0041a761
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004089bb
or dword [ebp - 4], 0xffffffff
call fcn.004306ad
mov eax, dword [ebp - 0x20]
jmp 0x40d7b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
call fcn.00427250
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x40d708
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40d75b
and dword [ebp - 0x18], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x1c]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401b15
push str..exe
mov ecx, esi
call fcn.004092fc
push dword [esi]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40d708
call fcn.00403129
mov dword [ebp - 0x20], eax
jmp 0x40d708
call fcn.0043f4b9
ret 0x14
Function at 0x40f3b5
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x465e64
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f415
push 0x800
call eax
test eax, eax
jne 0x40f40e
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40f41a
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40f41a
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40f58e
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.0043d433
add esp, 0xc
test eax, eax
jne 0x40f572
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043efa0
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043dae7
push 0x468790
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043dae7
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [ebp - 0x434]
mov esi, dword [ebp - 0x430]
jmp 0x40f579
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40f4e2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043b023
leave
ret
Function at 0x40f82f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00435210
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40f850
xor eax, eax
jmp 0x40f863
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f84c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x4107cc
Capabilities:
Terminate process

Disassembly:
push 0x40c
mov eax, 0x45e64b
call fcn.0043f44a
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
je 0x410895
mov eax, dword [0x481158]
cmp eax, ebx
je 0x41080a
push ebx
push ebx
push eax
mov esi, edi
call fcn.00417130
push 0x4615fc
mov ecx, edi
call fcn.0043149a
test eax, eax
jne 0x41082a
push 0x466444
mov ecx, edi
call fcn.0043149a
test eax, eax
je 0x410895
mov eax, dword [edi]
push ebx
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, edi
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x480fd8
je 0x410867
call fcn.0040f59b
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x410879
call fcn.0040f59b
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.004089bb
push esi
call fcn.0043df81
mov eax, dword [ebp - 0x414]
xor esi, esi
inc esi
mov dword [eax + 0xac], esi
mov dword [0x481088], esi
mov esi, dword [0x480ff8]
call fcn.00409af3
cmp edi, ebx
je 0x4108cd
push dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push edi
call fcn.00436ac7
mov ebx, eax
mov eax, ebx
call fcn.0043f4cd
ret 8
Function at 0x411407
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x45b616
call fcn.0043f44a
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
mov dword [ebp - 0x3c], edi
je 0x411524
cmp byte [edi + 0x41], bl
je 0x411524
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x41143f
xor al, al
jmp 0x411526
lea esi, [ebp - 0x30]
call fcn.00411164
mov dword [ebp - 4], ebx
lea eax, [edi + 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.004111e3
mov esi, eax
call fcn.00411254
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.004111e3
mov esi, eax
call fcn.00411254
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x4114a4
dec eax
je 0x4114a7
dec eax
dec eax
jne 0x411510
mov bl, 1
jmp 0x411510
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.004111e3
mov esi, eax
call fcn.00411254
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x4114ec
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.004111e3
mov esi, eax
call fcn.00411254
push eax
call fcn.0043d82b
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x41150e
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x4114a0
test ecx, ecx
jne 0x411450
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.0041119c
mov edi, dword [ebp - 0x3c]
jmp 0x411450
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004129f5
mov al, bl
jmp 0x411526
mov al, 1
call fcn.0043f4cd
ret

Function at 0x412ba2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412c05
cmp dword [ebp + 0xc], 1
je 0x412bde
cmp dword [ebp + 0xc], 2
je 0x412bde
push 0xd
pop eax
jmp 0x412c05
test edi, edi
mov eax, dword [ebp - 4]
je 0x412bff
test eax, eax
je 0x412bfb
test al, 1
jne 0x412bd9
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x412bff
jmp 0x412bd9
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x412d08
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x45dfc0
call fcn.0043f3e1
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x412d50
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.004091cd
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x412d36
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.004352f6
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.004352f6
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.004361ac
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041442d
call fcn.0043f4b9
ret

Function at 0x413389
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x45b3b2
call fcn.0043f3e1
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4133cb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4133cb
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.004089bb
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043f4b9
ret
Function at 0x4184a6
Capabilities:
Get common file path

Disassembly:
push 0x24
mov eax, 0x45b19a
call fcn.0043f414
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.00430697
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.00401663
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.00401a8d
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.0040d696
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41851b
call fcn.00403129
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004089bb
or dword [ebp - 4], 0xffffffff
call fcn.004306ad
mov eax, esi
jmp 0x41863e
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.004053d4
lea ecx, [ebp - 0x18]
call fcn.00401a8d
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.0040d696
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x418575
call fcn.00403129
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004089bb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004089bb
mov dword [ebp - 4], ebx
jmp 0x41850f
push ebx
lea ecx, [ebp - 0x18]
call fcn.004053d4
lea eax, [ebp - 0x1c]
push eax
call fcn.0041409c
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x4185d5
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a761
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004089bb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004089bb
mov dword [ebp - 4], ebx
jmp 0x418636
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.004015ad
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a761
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004089bb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004089bb
mov dword [ebp - 4], ebx
call fcn.004306ad
xor eax, eax
jmp 0x41863e
call fcn.004306ad
mov eax, dword [ebp - 0x24]
call fcn.0043f4b9
ret

Function at 0x418644
Capabilities:
Accept command line arguments

Disassembly:
push 0x18
mov eax, 0x45b160
call fcn.0043f414
mov edi, ecx
call fcn.00401663
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x418677
call fcn.00403129
jmp 0x4186e2
lea ecx, [ebp - 0x24]
call fcn.00430697
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
push dword [esi]
mov ecx, edi
call fcn.004015ad
or dword [ebp - 4], 0xffffffff
call fcn.004306ad
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
neg eax
sbb eax, eax
and eax, 0x5ffefffe
add eax, 0xa0010002
jmp 0x4186e2
call fcn.0043f4b9
ret
Function at 0x4186e8
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x45bfa5
call fcn.0043f3e1
lea ecx, [ebp - 0x10]
call fcn.00401a8d
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00418644
xor ecx, ecx
test eax, eax
setge cl
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
mov esi, ecx
call fcn.0043efa0
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push edi
push 0x1000000
push edi
neg esi
push edi
sbb esi, esi
and esi, dword [ebp - 0x10]
push edi
call fcn.0040d5e4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.004053d4
cmp esi, edi
jne 0x418780
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004089bb
mov eax, edi
call fcn.0043f4b9
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x20]
jmp 0x41876c
Function at 0x418ae8
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x45cd42
call fcn.0043f44a
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.00408df5
mov ecx, dword [ebp - 0x22c]
push 0x465e64
call fcn.00401518
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.00401518
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x418d04
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x418d04
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x418ce8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00401518
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401a8d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x418cca
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.00401518
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.00418a4d
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401b2a
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004089bb
lea edi, [ebp - 0x220]
call fcn.00408df5
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004043bb
test eax, eax
jne 0x418cca
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.00401518
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.00418a4d
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401b15
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004089bb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.004089bb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.004089bb
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x418b9a
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.004089bb
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.004089bb
mov eax, dword [ebp - 0x22c]
call fcn.0043f4cd
ret