joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403be0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.00434290
mov eax, dword [0x4d7064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x1a34], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403de6
push edi
push 0x228
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.00460000
add esp, 0xc
mov dword [ebp - 0x1a30], 0x22c
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403de2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1a3c], eax
cmp eax, dword [ebp - 0x1a28]
je 0x403dc7
push dword [ebp - 0x1a34]
lea eax, [ebp - 0x1a0c]
push eax
call fcn.00488f0c
add esp, 8
test eax, eax
jne 0x403dc7
push 0x800
push eax
lea eax, [ebp - 0x1804]
push eax
call fcn.00460000
add esp, 0xc
push dword [ebp - 0x1a28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x403d96
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00460000
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x403d8b
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00460000
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.00460837
add esp, 0x14
test eax, eax
je 0x403d53
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x403d53
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403d40
lea eax, [ebp - 0x1004]
jmp 0x403d71
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403d60
lea eax, [ebp - 0x804]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1804]
push 0x400
push eax
call fcn.00488f01
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x403d9c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a38], ecx
cmp dword [esi + 8], eax
je 0x403db8
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x403dc7
lea ecx, [ebp - 0x1a38]
push ecx
push eax
mov ecx, esi
call fcn.004033f0
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x1a3c]
jne 0x403c61
push ebx
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043427a
mov esp, ebp
pop ebp
ret 8
Function at 0x4050e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
mov dword [ebp - 0xe8], 0x740068
mov dword [ebp - 0xe4], 0x700074
mov dword [ebp - 0xe0], 0x2f003a
mov dword [ebp - 0xdc], 0x73002f
mov dword [ebp - 0xd8], 0x35002e
mov dword [ebp - 0xd4], 0x740032
mov dword [ebp - 0xd0], 0x6f006f
mov dword [ebp - 0xcc], 0x62006c
mov dword [ebp - 0xc8], 0x78006f
mov dword [ebp - 0xc4], 0x63002e
mov dword [ebp - 0xc0], 0x6d006f
mov dword [ebp - 0xbc], 0x61002f
mov dword [ebp - 0xb8], 0x79006e
mov dword [ebp - 0xb4], 0x650073
mov dword [ebp - 0xb0], 0x720061
mov dword [ebp - 0xac], 0x680063
mov dword [ebp - 0xa8], 0x70003f
mov dword [ebp - 0xa4], 0x640069
mov dword [ebp - 0xa0], 0x7b003d
mov dword [ebp - 0x9c], 0x690070
mov dword [ebp - 0x98], 0x7d0064
mov dword [ebp - 0x94], 0x740026
mov dword [ebp - 0x90], 0x700079
mov dword [ebp - 0x8c], 0x3d0065
mov dword [ebp - 0x88], 0x74007b
mov dword [ebp - 0x84], 0x700079
mov dword [ebp - 0x80], 0x7d0065
mov dword [ebp - 0x7c], 0x610026
mov dword [ebp - 0x78], 0x740063
mov dword [ebp - 0x74], 0x6f0069
mov dword [ebp - 0x70], 0x3d006e
mov dword [ebp - 0x6c], 0x61007b
mov dword [ebp - 0x68], 0x740063
mov dword [ebp - 0x64], 0x6f0069
mov dword [ebp - 0x60], 0x7d006e
mov dword [ebp - 0x5c], 0x610026
mov dword [ebp - 0x58], 0x700070
mov dword [ebp - 0x54], 0x7b003d
mov dword [ebp - 0x50], 0x700061
mov dword [ebp - 0x4c], 0x7d0070
mov dword [ebp - 0x48], 0x610026
mov dword [ebp - 0x44], 0x700070
mov dword [ebp - 0x40], 0x650076
mov dword [ebp - 0x3c], 0x3d0072
mov dword [ebp - 0x38], 0x76007b
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x26007d
mov dword [ebp - 0x2c], 0x69006d
mov dword [ebp - 0x28], 0x3d0064
mov dword [ebp - 0x24], 0x6d007b
mov dword [ebp - 0x20], 0x640069
mov dword [ebp - 0x1c], 0x26007d
mov dword [ebp - 0x18], 0x69006d
mov dword [ebp - 0x14], 0x320064
mov dword [ebp - 0x10], 0x7b003d
mov dword [ebp - 0xc], 0x69006d
mov dword [ebp - 8], 0x320064
mov dword [ebp - 4], 0x7d
call fcn.004059e0
mov ecx, eax
test ecx, ecx
je 0x405337
mov eax, dword [ecx]
push 2
push 0x73
call dword [eax]
test eax, eax
je 0x405341
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x73
jl 0x40532d
mov dword [eax - 0xc], 0x73
xor eax, eax
mov ecx, dword [esi]
push 0xe6
mov word [ecx + 0xe6], ax
lea eax, [ebp - 0xe8]
push eax
push 0xe6
push dword [esi]
call fcn.004076d0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401de0
push 0x80004005
call fcn.00401de0
call fcn.004023d0
int3
Function at 0x4055e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x4055fd
xor edi, edi
jmp 0x405754
cmp dword [ebp + 0x14], 0
je 0x40572d
push 0x1440
call fcn.0041c510
mov edi, eax
add esp, 4
test edi, edi
je 0x4056c3
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov dword [ebp - 0x28], edx
test ecx, ecx
je 0x405637
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea esi, [edi + 0x1418]
mov dword [edi], ecx
mov dword [edi + 0x1414], 1
mov dword [esi + 0x24], 0
test edx, edx
je 0x405661
mov eax, dword [edx]
mov ecx, edx
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0x1000
lea esi, [edi + 4]
push 0
push esi
call fcn.00460000
push 0x800
push ebx
push esi
call fcn.00489c8d
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.00460000
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x4056a9
push 0x208
push eax
push esi
call fcn.00489c8d
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4056c5
mov edx, dword [ecx]
lea eax, [ebp - 0x4c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4056c5
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x405780
push 0
push 0
mov dword [ebp - 0xc], 0x405780
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0048a143
add esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], vtable.CSimpleThread.0
test eax, eax
je 0x405726
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x405754
sub esp, 0x28
mov edi, esp
mov dword [edi + 0x24], 0
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x405748
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.00406210
mov edi, eax
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x40576c
mov esi, dword [ecx]
lea eax, [ebp + 0x1c]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x405a90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00434290
mov eax, dword [0x4d7064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push eax
call fcn.00460000
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x405b88
test edi, edi
je 0x405b88
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x405b88
cmp eax, 0x3fff
ja 0x405b88
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x405b88
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x4b7690
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x405b88
mov esi, dword [ebp + 0x14]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.00460000
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00407690
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043427a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0043427a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4061d0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4061f5
test byte [ebp - 4], 7
je 0x4061f5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x406ff0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cd0d0
push 0x4611e0
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4d7064]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
test edi, edi
je 0x4070b8
cmp word [edi], si
je 0x4070b8
test eax, eax
je 0x40706e
cmp word [eax], si
je 0x40706e
push esi
push esi
push eax
push edi
push esi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x4070b8
mov esi, 1
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4070d7
push 0x410
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.00460000
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [ebp - 0x42c]
push eax
push edi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x4070b8
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4070d7
test esi, esi
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043427a
mov esp, ebp
pop ebp
ret
Function at 0x4074e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407539
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407539
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40752a
cmp esi, edx
jae 0x407539
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x407518
cmp esi, edx
jae 0x407539
cmp word [esi], 0
je 0x407539
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x408a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4d7064]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x408bd4
cmp esi, 0x40
jb 0x408bbd
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x408af7
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x408bbd
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x408b10
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x408bbd
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x408b20
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x408b50
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x408bd4
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x408bc1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043427a
mov esp, ebp
pop ebp
ret
Function at 0x40e140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0x740068
mov dword [ebp - 0x108], 0x700074
mov dword [ebp - 0x104], 0x2f003a
mov dword [ebp - 0x100], 0x77002f
mov dword [ebp - 0xfc], 0x770077
mov dword [ebp - 0xf8], 0x2e0031
mov dword [ebp - 0xf4], 0x320035
mov dword [ebp - 0xf0], 0x6f0074
mov dword [ebp - 0xec], 0x6c006f
mov dword [ebp - 0xe8], 0x6f0062
mov dword [ebp - 0xe4], 0x2e0078
mov dword [ebp - 0xe0], 0x6f0063
mov dword [ebp - 0xdc], 0x2f006d
mov dword [ebp - 0xd8], 0x650073
mov dword [ebp - 0xd4], 0x760072
mov dword [ebp - 0xd0], 0x630069
mov dword [ebp - 0xcc], 0x2f0065
mov dword [ebp - 0xc8], 0x6e0069
mov dword [ebp - 0xc4], 0x650064
mov dword [ebp - 0xc0], 0x2e0078
mov dword [ebp - 0xbc], 0x740068
mov dword [ebp - 0xb8], 0x6c006d
mov dword [ebp - 0xb4], 0x66003f
mov dword [ebp - 0xb0], 0x6f0072
mov dword [ebp - 0xac], 0x3d006d
mov dword [ebp - 0xa8], 0x6e0061
mov dword [ebp - 0xa4], 0x730079
mov dword [ebp - 0xa0], 0x610065
mov dword [ebp - 0x9c], 0x630072
mov dword [ebp - 0x98], 0x260068
mov dword [ebp - 0x94], 0x690070
mov dword [ebp - 0x90], 0x3d0064
mov dword [ebp - 0x8c], 0x70007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x26007d
mov dword [ebp - 0x80], 0x69006d
mov dword [ebp - 0x7c], 0x3d0064
mov dword [ebp - 0x78], 0x6d007b
mov dword [ebp - 0x74], 0x640069
mov dword [ebp - 0x70], 0x26007d
mov dword [ebp - 0x6c], 0x32006d
mov dword [ebp - 0x68], 0x7b003d
mov dword [ebp - 0x64], 0x69006d
mov dword [ebp - 0x60], 0x320064
mov dword [ebp - 0x5c], 0x26007d
mov dword [ebp - 0x58], 0x700061
mov dword [ebp - 0x54], 0x760070
mov dword [ebp - 0x50], 0x720065
mov dword [ebp - 0x4c], 0x7b003d
mov dword [ebp - 0x48], 0x700061
mov dword [ebp - 0x44], 0x760070
mov dword [ebp - 0x40], 0x720065
mov dword [ebp - 0x3c], 0x26007d
mov dword [ebp - 0x38], 0x73006f
mov dword [ebp - 0x34], 0x7b003d
mov dword [ebp - 0x30], 0x73006f
mov dword [ebp - 0x2c], 0x26007d
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x610064
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x7b003d
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x610064
mov dword [ebp - 8], 0x650074
mov dword [ebp - 4], 0x7d
call fcn.004059e0
mov ecx, eax
test ecx, ecx
je 0x40e3f7
mov eax, dword [ecx]
push 2
push 0x85
call dword [eax]
test eax, eax
je 0x40e401
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x85
jl 0x40e3ed
mov dword [eax - 0xc], 0x85
xor eax, eax
mov ecx, dword [esi]
push 0x85
mov word [ecx + 0x10a], ax
lea eax, [ebp - 0x10c]
push eax
push 0x85
push dword [esi]
call fcn.00407bc0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401de0
push 0x80004005
call fcn.00401de0
call fcn.004023d0
int3
Function at 0x40f790
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041c7d0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret
Function at 0x411840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b13d5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4d7064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], vtable.ILayerWindow.0
lea eax, [esi + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CMessageBox.0
mov dword [esi + 0x20], vtable.CMessageBox.1.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea edi, [eax - 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x411909
cmp ecx, dword [edi]
jne 0x411909
lock inc dword [eax]
jmp 0x411937
mov eax, dword [ecx]
lea ebx, [edi + 4]
push 2
push dword [ebx]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4119e5
mov eax, dword [ebx]
mov dword [edi + 4], eax
mov eax, dword [ebx]
inc eax
push eax
push dword [ebp + 8]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00407bc0
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], eax
mov eax, dword [ebp + 0x10]
push 0xa4
mov byte [ebp - 4], 1
mov dword [esi + 0x84], eax
call fcn.0041c510
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4119ca
mov ecx, eax
call fcn.0042e380
test eax, eax
jne 0x4119cc
xor eax, eax
mov dword [esi + 0x28], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.004023d0
int3
Function at 0x413da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00414490
mov ecx, eax
call fcn.0040bb20
test eax, eax
je 0x413dd6
mov edx, dword [pe_dos_header]
lea eax, [esi + 4]
xor ecx, ecx
cmp esi, 0x70
cmove eax, ecx
push eax
push ecx
call dword [edx + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi - 0x6c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x413e25
push dword [ebp - 4]
lea edi, [esi - 0x70]
lea eax, [edi + 0x20]
push eax
push 0x4d6e50
push 0x4d6db0
push 0x4dbfb0
call fcn.00413750
movzx ebx, ax
add esp, 0x14
mov eax, dword [edi + 0x14]
mov dword [ebp - 4], ebx
test eax, eax
jne 0x413e4d
call fcn.00426cef
mov dword [edi + 0x14], eax
test eax, eax
jne 0x413e4d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
push dword [esi - 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [pe_dos_header]
lea eax, [esi + 4]
xor edx, edx
cmp esi, 0x70
cmove eax, edx
push eax
push edx
call dword [ecx + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call fcn.00426df1
test bx, bx
je 0x413e25
lea ebx, [edi + 8]
test ebx, ebx
je 0x413ede
test edi, edi
je 0x413ede
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x4d6db4
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4d6dcc]
mov dword [ebx + 8], eax
push 0x4d6db4
mov dword [0x4d6dcc], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x4d6de0]
mov eax, dword [0x4d6de8]
mov edx, dword [0x4d6ddc]
sub eax, ecx
push 0
push dword [0x4dbfb4]
push 0
push 0
push eax
mov eax, dword [0x4d6de4]
sub eax, edx
push eax
mov eax, dword [ebp - 4]
push ecx
push edx
push 0x86020000
push 0
movzx eax, ax
push eax
push 0x80000
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x413e25
push 1
push 0xc0000005
call fcn.0040d020
int3

Function at 0x4140b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x6c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4140cb
push 0
push dword [esi - 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x415130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4d7064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str.OnUninstallStart_callback...
call fcn.0040d760
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00460000
add esp, 0x10
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.InstallDate
push str.SOFTWAREAnything
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4151d1
lea edx, [ebp - 0x20c]
lea ecx, [esi + 0x1c]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4151b5
sub edx, esi
lea eax, [ebp - 0x20c]
sar edx, 1
push edx
push eax
call fcn.00406e60
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043427a
mov esp, ebp
pop ebp
ret 4
Function at 0x416b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3c], 0x740068
push edi
mov dword [ebp - 0x38], 0x700074
mov dword [ebp - 0x34], 0x2f003a
mov dword [ebp - 0x30], 0x73002f
mov dword [ebp - 0x2c], 0x610065
mov dword [ebp - 0x28], 0x630072
mov dword [ebp - 0x24], 0x2e0068
mov dword [ebp - 0x20], 0x320035
mov dword [ebp - 0x1c], 0x6f0074
mov dword [ebp - 0x18], 0x6c006f
mov dword [ebp - 0x14], 0x6f0062
mov dword [ebp - 0x10], 0x2e0078
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x2f006d
mov word [ebp - 4], ax
call fcn.004059e0
mov ecx, eax
test ecx, ecx
je 0x416c5c
mov eax, dword [ecx]
push 2
push 0x1c
call dword [eax]
test eax, eax
je 0x416c66
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1c
jl 0x416c52
mov dword [eax - 0xc], 0x1c
xor eax, eax
mov ecx, dword [esi]
push 0x38
mov word [ecx + 0x38], ax
lea eax, [ebp - 0x3c]
push eax
push 0x38
push dword [esi]
call fcn.0041a7e0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401de0
push 0x80004005
call fcn.00401de0
call fcn.004023d0
int3