joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fe28
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405228
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42fe76
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00405498
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433ef8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43402b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x421ca8]
call fcn.00421da8
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x434001
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00421e48
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405498
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x434040
call fcn.00405540
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00421fd0
lea ecx, [ebp - 4]
mov edx, 0x43407c
mov eax, dword [ebp - 0xc]
call fcn.00422248
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040e918
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x433fe4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x434088
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4744a4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433feb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4340d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x43411f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x434102
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x434113
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x43411f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4560e4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45628f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x456270
mov dl, 1
mov eax, dword [0x416500]
call fcn.004043cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405228
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45625f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448608
test al, al
je 0x456252
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4562a0
lea eax, [ebp - 0x254]
call fcn.0040a344
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x456252
xor eax, eax
push ebp
push 0x45624b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4562d8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x456234
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00405498
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x456234
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00405498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456252
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x456155
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041a314
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456296
lea eax, [ebp - 0x260]
call fcn.00405228
ret

Function at 0x456c08
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47ac94]
cmp byte [eax + 0xad], 0
jne 0x456c79
cmp dword [0x47acb0], 0
jne 0x456c3a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456bc4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47acb0], eax
cmp dword [0x47acac], 0
jne 0x456c55
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47acac], eax
cmp dword [0x47acb4], 0
jne 0x456c79
push esp
push 0
push 0
push 0x456b68
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x47acb4], eax
pop edx
ret
Function at 0x456e4c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x456e63
add esp, 0xfffffff0
call fcn.00404720
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e468
mov eax, dword [0x47529c]
cmp word [eax + 2], 0
jne 0x456e8b
mov eax, dword [0x47529c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458a64
mov eax, dword [0x47534c]
cmp word [eax + 2], 0
jne 0x456ea5
mov eax, dword [0x47534c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458c70
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4232c8]
call fcn.0042adac
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45705c
mov eax, dword [0x4751b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b180
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459344
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4751b8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dc14
test eax, eax
je 0x456fac
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409cfc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dc48
test eax, eax
je 0x456fc0
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00405498
mov byte [ebx + 0xd4], 0
push ebx
push 0x458574
call fcn.0041fc04
mov dword [ebx + 0xc8], eax
mov eax, dword [0x47509c]
cmp byte [eax], 0
jne 0x457011
mov eax, ebx
call fcn.004571a0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045951c
mov eax, ebx
call fcn.0045a080
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457051
call fcn.00404778
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4582c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x458332
mov eax, ebx
call fcn.0045a4ec
test al, al
jne 0x458332
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405318
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45831f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45833f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040527c
jmp 0x45833f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040527c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x459700
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45976e
mov eax, esi
call fcn.004434c8
test al, al
je 0x45976e
mov eax, dword [ebx + 0x84]
call fcn.004431bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45976e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x459762
push 0
mov eax, dword [ebx + 0x84]
call fcn.004431bc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043b378
jmp 0x45976e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045953c
pop esi
pop ebx
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x13076165
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x74d4611e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10003720
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [ecx + 0x30]
mov dl, byte [esp + 0xc]
movsx eax, byte [ebx]
cmp eax, 0x45
je 0x10003738
cmp eax, 0x4f
je 0x10003752
jmp 0x1000376a
mov ebx, 1
test dl, dl
je 0x1000376c
mov al, dl
shr dl, 1
and eax, 1
xor ebx, eax
test dl, dl
jne 0x10003741
jmp 0x1000376c
xor ebx, ebx
test dl, dl
je 0x1000376c
mov cl, dl
shr dl, 1
and ecx, 1
xor ebx, ecx
test dl, dl
jne 0x10003758
jmp 0x1000376c
xor ebx, ebx
test ebx, ebx
je 0x10003779
mov edx, dword [esp + 4]
mov eax, dword [edx + 0x48]
jmp 0x1000377b
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x1000613c
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov ecx, edx
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x10009824
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov dword [0x10019650], 1
push 0x1001a428
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov eax, dword [0x1001d794]
cmp dword [eax + ebx*4], 0
jne 0x1000985b
mov ecx, dword [0x1001d794]
mov dword [ecx + ebx*4], 0
jmp 0x10009864
inc ebx
cmp ebx, 0x400
jb 0x10009841
cmp ebx, 0x400
jne 0x1000987d
push 0xb
call fcn.1000d7f8
mov ebx, 0xffffffff
jmp 0x10009907
push 1
push 0x2a8
call fcn.1000d828
add esp, 8
mov esi, eax
test eax, eax
jne 0x100098a0
push 0xc
call fcn.1000d7f8
mov ebx, 0xffffffff
jmp 0x10009907
lea edx, [esp + 0x10]
push edx
push 4
push dword [esp + 0x2c]
push 0x1000991b
push dword [esp + 0x30]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test eax, eax
jne 0x100098d7
push esi
call fcn.1000ae7c
call fcn.1000d758
mov ebx, 0xffffffff
add esp, 4
jmp 0x10009907
mov ecx, dword [0x1001d794]
mov dword [ecx + ebx*4], esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0x1c], edi
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x14], edi
mov ebx, dword [esp + 0x14]
push 0x1001a428
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1000e8e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x1000e92a
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x1000e926
test byte [ebx + 0x1001a4a8], 0x10
jne 0x1000e93b
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x1001a4e4]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x1000e92a
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x1000e921
push 9
call fcn.1000d7f8
mov eax, 0xffffffff
jmp 0x1000e921
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x1001a4a8], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x1001a4e4]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x1000ea19
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x1000e97e
or byte [ebx + 0x1001a4a8], 1
mov ecx, eax
or ecx, ecx
je 0x1000eac0
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x1000e9e8
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x1000eac0
cmp edi, edx
jae 0x1000ea2d
cmp byte [edi], 0xa
jne 0x1000e996
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x1000ea8a
cmp edi, edx
jae 0x1000ea2d
cmp byte [edi], 0xa
jne 0x1000e9b9
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x1000e9b3
dec edi
test byte [ebx + 0x1001a4a8], 8
jne 0x1000ea0b
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x1001a4e4]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x1000ea19
or byte [ebx + 0x1001a4a8], 1
mov edx, edi
jmp 0x1000e98d
push 9
call fcn.1000d7f8
mov eax, 0xffffffff
jmp 0x1000eac5
test byte [ebx + 0x1001a4a8], 1
jne 0x1000ea8a
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x1001a4e4]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x1000ea19
mov eax, dword [ebp - 8]
or eax, eax
je 0x1000ea83
cmp byte [edi - 1], 0xa
je 0x1000ea8a
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x1001a4e4]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x1000ea19
jmp 0x1000ea8a
or byte [ebx + 0x1001a4a8], 1
cmp esi, 0
je 0x1000eac0
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x1001a4a8], 8
jne 0x1000eac0
mov ecx, esi
sub ecx, edi
je 0x1000eac0
test byte [ebx + 0x1001a4a8], 1
je 0x1000e94a
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40249e
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov al, byte [0x415564]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x4024da
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x4024ce
mov edx, 0x414125
mov eax, ebx
call fcn.0040f288
mov edx, 0x415564
mov eax, ebx
call fcn.0040f288
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.0040f0b4
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402503
lea edx, [ebx + 1]
jmp 0x402505
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x402556
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x40252e
jmp 0x402527
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x402527
mov byte [ebx + eax], 0x20
jmp 0x40252e
inc eax
cmp byte [ebx + eax], 0
jne 0x402517
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x402543
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x402555
cmp edx, 0x20
jne 0x40254c
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x40255d
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x40250c
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405e34
mov edi, eax
test edi, edi
je 0x402589
mov edx, str..inf
mov eax, edi
call fcn.0040f23c
test eax, eax
jne 0x402589
mov dword [esi + 0xc], str.Install
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00406964
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x4025b1
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406a30
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x4025f4
cmp byte [esp + 1], 0
jne 0x4025f4
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040f1b4
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.0040f288
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00406964
test al, al
je 0x4026dc
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x40261e
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x4026dc
cmp byte [0x414044], 0
jne 0x402635
cmp byte [esp], 0
je 0x40268d
mov ebx, dword [0x4148b0]
test ebx, ebx
je 0x402649
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x40264d
xor eax, eax
jmp 0x402652
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x402665
push 0
push dword [0x4148b0]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
test ebx, ebx
je 0x40268d
push 1
push dword [0x4148b0]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x4026a9
mov edx, str..exe
mov eax, edi
call fcn.0040f23c
test eax, eax
je 0x4026dc
cmp byte [0x414044], 0
je 0x4026c4
cmp byte [esp], 0
jne 0x4026c4
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x4026dc
cmp byte [esp], 0
je 0x4026d1
mov edx, 0xc8
jmp 0x4026d6
mov edx, 0x3e8
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x401340
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
test eax, eax
push ebx
lea ebx, [ecx + 8]
jne 0x40135b
mov eax, 0x57
pop ebx
add esp, 0xc
ret 8
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4013be
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
test esi, esi
jne 0x40149f
push eax
push 0x8000080
push 3
push eax
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4013ab
call edi
mov esi, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x401497
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x401497
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401457
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401479
mov ecx, dword [esp + 0x10]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, eax
mov dword [edx], eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov esi, dword [esp + 0x24]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x403660
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path
Get startup folder

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
push edi
mov ebx, ebp
mov esi, dword [esp + 0x124]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x10]
push eax
push ebp
push esi
call edi
test eax, eax
je 0x4036ad
mov ebx, ebp
lea ecx, [esp + 0x10]
sub ebx, 0x18
push ecx
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 7
push ebx
push esi
call edi
test eax, eax
jne 0x4037d3
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov esi, eax
lea ecx, [esp + 0x14]
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x4036f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
test esi, esi
jne 0x4037d3
mov eax, dword [esp + 0x128]
test eax, eax
je 0x4037d3
mov edi, 0x413040
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x128]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp ebp, 0x18
rep movsb byte es:[edi], byte [esi]
je 0x40376d
cmp ebp, 7
jne 0x4037c8
mov edi, str..lnk
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4037d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4037d3
cmp ebx, 0x18
jne 0x4037d3
cmp ebp, ebx
jne 0x4037d3
mov ebp, 7
jmp 0x403673
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc