joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406380
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x43c], ecx
push edi
mov byte [ebp - 0x431], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x438], eax
cmp eax, 0xffffffff
jne 0x4063d1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x40648d
push ecx
lea ecx, [ebp - 0x410]
call fcn.0040d530
mov edi, eax
add esp, 4
cmp edi, str.winex11.drv
je 0x406425
test edi, edi
je 0x40642c
push str.winex11.drv
push edi
call fcn.00415313
add esp, 8
test eax, eax
sete al
test al, al
je 0x40642c
mov byte [ebp - 0x431], 1
push ecx
lea ecx, [ebp - 0x210]
call fcn.0040d530
mov esi, eax
push esi
push edi
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
push str.Module:__p__06X___16s__s_r_n
push dword [ebp - 0x43c]
call fcn.004069f0
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
push esi
mov ebx, eax
call fcn.00413186
push edi
call fcn.00413186
add esp, 8
test ebx, ebx
jne 0x4063f1
mov bl, byte [ebp - 0x431]
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x406830
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
jne 0x40684e
push str.InstallCrashHandler:_skipping_because__crashDumpPath_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ecx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004067a0
test al, al
jne 0x40686a
push str.InstallCrashHandler:_skipping_because__SetSymbolsDir___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ecx
pop ebp
ret
push edi
call fcn.00414ef6
add esp, 4
mov dword [0x430500], eax
test esi, esi
je 0x40688c
push esi
call fcn.00414ef6
add esp, 4
mov dword [0x430508], eax
jmp 0x406896
mov dword [0x430508], 0
call fcn.004064b0
test al, al
je 0x4068af
push str.InstallCrashHandler:_skipping_because_isWine_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ecx
pop ebp
ret
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
call fcn.00406550
push 8
call fcn.0040e550
add esp, 4
mov esi, eax
push 0
push 0x20000
push 0
mov dword [esi], 0x42b028
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x42aed4
push str.https:__kjkpub.s3.amazonaws.com_repairpartner_rel_RepairPartner_1.1.0.37
push str._s_s.pdb.lzsa
mov dword [esi + 4], eax
mov dword [0x430520], esi
call fcn.0040d750
add esp, 0xc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x43050c], eax
test eax, eax
jne 0x40692f
push str.InstallCrashHandler:_skipping_because__gDumpEvent_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ecx
pop ebp
ret
push 0
push 0
push 0
push 0x405c70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4304fc], eax
test eax, eax
jne 0x40695d
push str.InstallCrashHandler:_skipping_because__gDumpThread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ecx
pop ebp
ret
push 0x405cc0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x406770
push 0x16
call fcn.004146ee
add esp, 8
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x407680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x43056c]
push ebx
push esi
mov esi, ecx
push edi
cmp esi, eax
je 0x407740
test esi, esi
je 0x4076b1
test eax, eax
je 0x4076b1
push eax
push esi
call fcn.00415313
add esp, 8
test eax, eax
sete al
test al, al
jne 0x407740
mov edx, esi
call fcn.0040d760
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4076cf
push esi
push str.SetCurrentLangByCode:_unknown_lang_code:__s_n
call fcn.00405580
add esp, 8
xor ecx, ecx
mov dword [0x430570], ecx
mov eax, 0x42c5a8
test ecx, ecx
jle 0x4076f1
mov edi, edi
cmp byte [eax], 0
je 0x4076eb
inc eax
cmp byte [eax], 0
jne 0x4076e5
dec ecx
inc eax
test ecx, ecx
jg 0x4076e0
push 0xa
push 2
push 0
mov dword [0x43056c], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x407740
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x407740
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x407740
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004077e0
mov ecx, esi
call fcn.004070e0
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x407e70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea edx, [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040c4c0

Function at 0x408150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe10
mov eax, dword [0x42f00c]
xor eax, esp
mov dword [esp + 0xe0c], eax
push esi
push edi
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4081d6
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4081d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 8]
mov edx, eax
push ecx
mov ecx, esi
call fcn.0040d0f0
add esp, 4
test al, al
je 0x4081d6
lea ecx, [esp + 8]
call fcn.00407e80
pop edi
pop esi
mov ecx, dword [esp + 0xe0c]
xor ecx, esp
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
mov ecx, str.The_installer_has_been_corrupted._Please_download_it_again._nSorry_for_the_inconvenience_
call fcn.00407030
cmp dword [0x430604], 0
mov esi, eax
jne 0x408209
test esi, esi
je 0x4081ff
push esi
call fcn.00414ef6
add esp, 4
mov dword [0x430604], eax
jmp 0x408209
mov dword [0x430604], 0
push esi
push 0x42c300
call fcn.00407e70
add esp, 8
xor al, al
mov ecx, dword [esp + 0xe14]
pop edi
pop esi
xor ecx, esp
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x408230
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x42f00c]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
mov eax, ecx
mov edx, 0x42b188
push edi
mov dword [esp + 0xc], eax
call fcn.0040cae0
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x408356
mov edi, dword [esp + 0xc]
test byte [esp + 0x18], 0x10
jne 0x408294
add ebx, dword [esp + 0x38]
jmp 0x408337
mov ecx, 0x42b18c
lea eax, [esp + 0x44]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4082c6
test dx, dx
je 0x4082c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4082c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4082a0
xor eax, eax
jmp 0x4082cb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x408337
mov eax, 0x42b190
lea ecx, [esp + 0x44]
lea ecx, [ecx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x408306
test dx, dx
je 0x408302
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x408306
add ecx, 4
add eax, 4
test dx, dx
jne 0x4082e0
xor eax, eax
jmp 0x40830b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x408337
lea edx, [esp + 0x44]
mov ecx, edi
call fcn.0040cae0
mov esi, eax
mov ecx, esi
call fcn.00408230
push esi
add ebx, eax
call fcn.00413186
mov esi, dword [esp + 0x14]
add esp, 4
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408284
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x14]
push edi
call fcn.00413186
mov ecx, dword [esp + 0x270]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x408b80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4305fc]
sub esp, 0x3c
mov edx, 0x42b5cc
push esi
call fcn.0040cae0
mov esi, eax
test esi, esi
je 0x408bef
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00410300
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0
push 0
push 0x10
push dword [0x4305e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.00413186
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409460
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
mov edi, dword [0x4305f0]
push 0
push 0
push 0xe
push edi
call ebx
mov dword [ebp - 0x23c], eax
inc eax
push 2
push eax
mov dword [ebp - 0x238], eax
call fcn.00413258
mov esi, eax
add esp, 8
test esi, esi
je 0x4094dd
push esi
push dword [ebp - 0x238]
push 0xd
push edi
call ebx
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x234]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4094dd
test byte [ebp - 0x234], 0x10
jne 0x4094f1
mov ecx, esi
call fcn.0040ca40
push esi
mov edi, eax
call fcn.00413186
add esp, 4
mov esi, edi
push ecx
lea eax, [ebp - 0x210]
mov ecx, str.Select_the_folder_where_RepairPartner_should_be_installed:
push eax
call fcn.00407030
push eax
mov edx, esi
call fcn.004093d0
add esp, 0xc
test eax, eax
jne 0x409520
push dword [0x430610]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x409581
lea edi, [ebp - 0x210]
mov edx, 0x42bcc4
mov ecx, edi
call fcn.0040d3e0
test al, al
jne 0x409544
mov edx, 0x42b25c
mov ecx, edi
call fcn.0040cae0
mov edi, eax
push edi
push 0
push 0xc
push dword [0x4305f0]
call ebx
push 0xffffffffffffffff
push 0
push 0xb1
push dword [0x4305f0]
call ebx
push dword [0x4305f0]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x210]
cmp edi, eax
je 0x409581
push edi
call fcn.00413186
add esp, 4
push esi
call fcn.00413186
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret

Function at 0x409a20
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push 8
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x409aaf
cmp esi, 0xffffffff
je 0x409aaf
push 0x424
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.00410300
add esp, 0xc
mov dword [ebp - 0x430], 0x428
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x409aaf
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x409a90
lea edx, [ebp - 0x210]
mov ecx, ebx
call fcn.0040cce0
test al, al
jne 0x409acb
lea eax, [ebp - 0x430]
push eax
push esi
call edi
test eax, eax
jne 0x409a90
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x409ab1
Function at 0x409ad0
Capabilities:
Enumerate processes
Find taskbar
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x240], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x409bd1
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x409bd1
mov dword [ebp - 0x23c], 0
mov esi, dword [ebp - 0x230]
mov ecx, esi
mov edx, dword [ebp - 0x240]
call fcn.00409a20
test al, al
je 0x409b8f
push esi
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x409b8c
cmp esi, 0xffffffff
je 0x409b8c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x409b8c
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
mov esi, dword [ebp - 0x23c]
inc esi
mov dword [ebp - 0x23c], esi
jmp 0x409b95
push esi
call ebx
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x409b31
test esi, esi
jle 0x409bd4
push str.Shell_TrayWnd
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov esi, dword [ebp - 0x23c]
jmp 0x409bd4
or esi, 0xffffffff
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x409bf0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.InstallLocation
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallRepairPartner
mov ecx, 0x80000001
call fcn.0040dc60
mov edi, eax
add esp, 4
test edi, edi
jne 0x409c46
push str.InstallLocation
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallRepairPartner
mov ecx, 0x80000002
call fcn.0040dc60
push 0
mov edi, eax
call fcn.00413186
add esp, 8
test edi, edi
je 0x409c96
mov edx, str..exe
mov ecx, edi
call fcn.0040d3e0
test al, al
je 0x409c6a
mov ecx, edi
call fcn.0040ca40
push edi
mov esi, eax
call fcn.00413186
add esp, 4
mov edi, esi
test edi, edi
je 0x409c96
xor eax, eax
cmp ax, word [edi]
je 0x409c96
lea eax, [ebp - 0x230]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x409c96
test byte [ebp - 0x230], 0x10
je 0x409c96
xor esi, esi
jmp 0x409d04
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00410300
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x409cc9
xor esi, esi
jmp 0x409cda
lea eax, [ebp - 0x20c]
push eax
call fcn.00414ef6
add esp, 4
mov esi, eax
push edi
call fcn.00413186
add esp, 4
test esi, esi
je 0x409cf5
mov edx, str.WXBL
mov ecx, esi
call fcn.0040cae0
jmp 0x409d02
push str.C:WXBL
call fcn.00414ef6
add esp, 4
mov edi, eax
push esi
call fcn.00413186
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
call fcn.0040e41c
mov esp, ebp
pop ebp
ret

Function at 0x409d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00410300
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x409d6a
xor edi, edi
xor ebx, ebx
jmp 0x409db3
lea eax, [ebp - 0x20c]
push eax
call fcn.00414ef6
mov edi, eax
add esp, 4
test edi, edi
jne 0x409d83
xor ebx, ebx
jmp 0x409db3
push esi
push 0
mov ecx, str.Repair_Partner
call fcn.00407030
mov edx, str..lnk
mov ecx, eax
call fcn.0040d450
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.0040cae0
push esi
mov ebx, eax
call fcn.00413186
add esp, 8
pop esi
push edi
call fcn.00413186
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x409e80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409ead
xor bl, bl
jmp 0x409f4a
mov ecx, dword [0x4305fc]
mov edx, str.libmupdf.dll
call fcn.0040cae0
mov ecx, dword [0x4305fc]
mov edx, str.npPdfViewer.dll
mov edi, eax
call fcn.0040cae0
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x430]
push eax
push esi
mov dword [ebp - 0x430], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x409f34
mov ebx, dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x409f00
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.0040cce0
test al, al
jne 0x409f64
mov ecx, dword [ebp - 0x434]
lea edx, [ebp - 0x210]
call fcn.0040cce0
test al, al
jne 0x409f64
lea eax, [ebp - 0x430]
push eax
push esi
call ebx
test eax, eax
jne 0x409f00
xor bl, bl
push dword [ebp - 0x434]
call fcn.00413186
push edi
call fcn.00413186
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x409f36

Function at 0x409f70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a054
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40a054
jmp 0x409fc0
mov ecx, dword [ebp - 0x230]
call fcn.00409e80
test al, al
je 0x40a034
lea eax, [ebp - 0x214]
push eax
call fcn.00414ef6
mov ebx, dword [0x42f8d0]
add esp, 4
mov dword [ebp - 0x23c], eax
mov ecx, 0x42f8d0
lea eax, [ebx + 1]
push eax
call fcn.00407990
test al, al
jne 0x40a000
xor eax, eax
mov byte [eax], al
mov eax, dword [0x42f8dc]
lea edi, [eax + ebx*4]
mov eax, dword [0x42f8d0]
cmp eax, ebx
jbe 0x40a024
sub eax, ebx
shl eax, 2
push eax
lea eax, [edi + 4]
push edi
push eax
call fcn.0040f290
add esp, 0xc
lea eax, [ebx + 1]
mov dword [0x42f8d0], eax
mov eax, dword [ebp - 0x23c]
mov dword [edi], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x409fc0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x40a960
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.00410300
add esp, 0xc
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
call fcn.0040e140
push 1
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], str.REPAIR_PARTNER_INSTALLER_FRAME
mov dword [ebp - 0x28], 0x40a850
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor ecx, ecx
test ax, ax
setne al
mov esp, ebp
pop ebp
ret
Function at 0x40aac0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call ebx
test eax, eax
je 0x40ab44
lea esp, [esp]
cmp dword [ebp - 0x58], 0x12
je 0x40ac65
lea eax, [ebp - 0x5c]
push eax
push dword [0x4305e8]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40ab32
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call ebx
test eax, eax
jne 0x40ab00
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
test edi, edi
jne 0x40ab8c
test esi, esi
jne 0x40ab8c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [ebp - 0x40]
mov dword [ebp - 0x10], edi
sbb esi, dword [ebp - 0x3c]
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x10]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild qword [ebp - 0x28]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
jmp 0x40abb4
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [ebp - 0x40]
mov dword [ebp - 0x18], edi
sbb esi, dword [ebp - 0x3c]
mov dword [ebp - 0x14], esi
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild qword [ebp - 0x30]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fmul qword [0x42cec0]
fcomp qword [0x42cec8]
fnstsw ax
test ah, 0x41
jne 0x40aae7
mov eax, dword [0x4305e0]
test eax, eax
je 0x40aae7
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40aae7
mov ecx, 0x42f8d0
call fcn.0040b1f0
call fcn.00409f70
cmp dword [0x42f8d0], 0
jne 0x40ac3e
mov esi, dword [0x42a5f0]
mov ecx, str.Thank_you_for_choosing_RepairPartner_
call fcn.00407030
test eax, eax
je 0x40ac20
push eax
call fcn.00414ef6
add esp, 4
mov edi, eax
jmp 0x40ac22
xor edi, edi
push dword [0x430a80]
call fcn.00413186
add esp, 4
mov dword [0x430a80], edi
mov dword [0x42f8cc], esi
jmp 0x40ac43
call fcn.0040a130
call fcn.00409dd0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x40aae7
mov eax, dword [ebp - 0x54]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x400]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40af3b
cmp eax, 0xf6
jae 0x40af3b
lea eax, [ebp - 0x400]
push eax
call fcn.00414ef6
add esp, 4
mov dword [ebp - 0x428], eax
mov esi, eax
jmp 0x40af43
xor esi, esi
mov dword [ebp - 0x428], esi
test esi, esi
je 0x40af64
lea eax, [ebp - 0x424]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x40af64
test byte [ebp - 0x424], 0x10
jne 0x40afbc
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00410300
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x40af9a
xor edi, edi
jmp 0x40afab
lea eax, [ebp - 0x210]
push eax
call fcn.00414ef6
add esp, 4
mov edi, eax
push esi
call fcn.00413186
mov esi, edi
add esp, 4
mov dword [ebp - 0x428], esi
test esi, esi
je 0x40b023
lea eax, [ebp - 0x424]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x40b023
test byte [ebp - 0x424], 0x10
je 0x40b023
mov edx, str.installer.dmp
mov ecx, esi
call fcn.0040cae0
mov edx, str.installer.txt
mov ecx, esi
mov edi, eax
call fcn.0040cae0
push dword [ebp - 0x428]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.00406830
add esp, 4
push esi
call fcn.00413186
add esp, 4
push edi
call fcn.00413186
mov esi, dword [ebp - 0x428]
add esp, 4
push esi
call fcn.00413186
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.0040e41c
mov esp, ebp
pop ebp
ret