joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030af
Capabilities:
Compare security identifiers

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.00434d50
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0xf94], eax
push ebx
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x6b]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x6c], bl
call fcn.00434780
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 8
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], bl
mov byte [ebp - 0x72], bl
mov byte [ebp - 0x71], bl
mov byte [ebp - 0x70], bl
mov byte [ebp - 0x6f], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402c5f
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x6c]
push eax
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x402be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_GetTokenInformation_Fail___d_
jmp 0x402c6b
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x402c0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_AllocateAndInitializeSid_Fail___d_
jmp 0x402c6b
push esi
xor esi, esi
cmp dword [ebp - 0x6c], ebx
jbe 0x402c39
push edi
lea edi, [ebp - 0x68]
push dword [edi]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x402c35
inc esi
add edi, 8
cmp esi, dword [ebp - 0x6c]
jb 0x402c1b
jmp 0x402c38
xor ebx, ebx
inc ebx
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_EqualSid___d_
push 0x44e95c
push 0x46ca30
call fcn.00401ae2
add esp, 0x10
mov eax, ebx
pop esi
jmp 0x402c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CExecuteEnvironMent::QueryIfUserIsAdmin:_OpenProcessToken_Fail___d_
push 0x44e95c
push 0x46ca30
call fcn.00401ae2
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 0xf94]
xor ecx, ebp
pop ebx
call fcn.00434664
add ebp, 0xf98
leave
ret
push esi
mov esi, ecx
call fcn.0040259c
mov ecx, esi
test eax, eax
je 0x4030c3
pop esi
jmp 0x402b4b
call fcn.004029fd
neg eax
sbb eax, eax
inc eax
pop esi
ret

Function at 0x403448
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jle 0x40346f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x18]
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, byte [eax]
mov byte [esi + eax], dl
inc eax
dec edi
jne 0x403462
pop esi
pop edi
ret 0x10
Function at 0x403d25
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.00434d50
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x5c], bl
jne 0x403dd0
test byte [esi + 0x58], 8
je 0x403dd0
push 0x7ff
lea eax, [ebp - 0x803]
push ebx
push eax
mov byte [ebp - 0x804], bl
call fcn.00434780
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x804]
push eax
call fcn.00435a3e
push 0xfff
lea eax, [ebp - 0x1803]
push ebx
push eax
mov byte [ebp - 0x1804], bl
call fcn.00434780
lea eax, [ebp - 0x804]
push eax
push edi
lea eax, [ebp - 0x1804]
push str.__s___s
push eax
call fcn.00435943
add esp, 0x34
lea eax, [ebp - 0x1804]
push eax
cmp byte [esi + 0x5d], bl
je 0x403dca
mov ecx, esi
call fcn.0040366b
jmp 0x403dd0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434664
leave
ret
Function at 0x4045df
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 7
mov esi, ecx
pop ecx
mov byte [ebp - 0x2c], 0
lea edi, [ebp - 0x2b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [ebp + 8]
stosb byte es:[edi], al
xor eax, eax
push 7
mov byte [ebp - 0x4c], 0
pop ecx
lea edi, [ebp - 0x4b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xc], 0
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x44ea70
push ebx
stosb byte es:[edi], al
call fcn.004353c3
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40465f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CExtractManager::InitSomInfo:_fopen_error__s___d_
push 0x44e95c
push 0x46e460
call fcn.00401ae2
add esp, 0x14
xor eax, eax
jmp 0x404775
push 0x10
lea ebx, [esi + 0x19ac]
push 0
push ebx
call fcn.00434780
push 0
push 0x3e8
push edi
call fcn.004373c9
push edi
push 1
lea eax, [ebp - 0x2c]
push 0x11
push eax
call fcn.004376ee
push edi
push 1
lea eax, [ebp - 0x4c]
push 7
push eax
call fcn.004376ee
push edi
push 1
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.004376ee
add esp, 0x48
push edi
push 1
push 0x10
push ebx
call fcn.004376ee
push edi
call fcn.00435281
push 0x11
lea eax, [ebp - 0x2c]
push str.SOMDOCUMENTNORMAL
xor edi, edi
push eax
mov dword [esi + 0x1450], edi
call fcn.00435cbf
add esp, 0x20
mov ebx, 0x46e460
test eax, eax
jne 0x4046e6
mov dword [esi + 0x1450], edi
jmp 0x40473f
push 0x11
lea eax, [ebp - 0x2c]
push str.SOMDOCUMENTOLESOM
push eax
call fcn.00435cbf
add esp, 0xc
test eax, eax
jne 0x404709
mov dword [esi + 0x1450], 1
jmp 0x40473f
push 0x11
lea eax, [ebp - 0x2c]
push str.SOMDOCUMENTSIMPLE
push eax
call fcn.00435cbf
add esp, 0xc
test eax, eax
jne 0x40472c
mov dword [esi + 0x1450], 2
jmp 0x40473f
push str.CExtractManager::InitSomInfo:_somType_Check_Error__
push 0x44e95c
push ebx
call fcn.00401ae2
add esp, 0xc
add esi, 0x1454
cmp byte [ebp - 0xc], 0x52
mov dword [esi], edi
jne 0x404751
mov dword [esi], edi
jmp 0x404772
cmp byte [ebp - 0xc], 0x41
jne 0x40475f
mov dword [esi], 1
jmp 0x404772
push str.CExtractManager::InitSomInfo:_somEncType_Check_Error__
push 0x44e95c
push ebx
call fcn.00401ae2
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434664
leave
ret 4
Function at 0x405474
Capabilities:
Get common file path

Disassembly:
push 0x938
mov eax, 0x44a9b8
call fcn.004346dc
mov ebx, dword [ebp + 8]
mov esi, 0x104
push esi
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00434780
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00403b54
add esp, 0x14
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4055a8
cmp dword [ebp - 0x31c], 2
lea eax, [ebp - 0x218]
jne 0x40551b
push esi
push edi
push eax
call fcn.00434780
add esp, 0xc
push 1
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.SOM_
push eax
call fcn.004354b1
lea eax, [ebp - 0x218]
push eax
call fcn.004378ef
add esp, 0xc
jmp 0x4055a8
push ecx
mov ecx, esp
mov dword [ebp - 0x944], esp
push eax
call fcn.004032d0
lea ecx, [ebp - 0x93c]
call fcn.00410790
push esi
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00434780
add esp, 0xc
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0x93c]
call fcn.004109c0
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call fcn.004354df
pop ecx
pop ecx
mov ecx, dword [ebp - 0x940]
add ecx, 0xfffffff0
call fcn.004026da
lea eax, [ebp - 0x218]
push 0x450150
push eax
call fcn.004354b1
lea eax, [ebp - 0x218]
push eax
call fcn.004378ef
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x93c]
call fcn.00410740
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.004354df
pop ecx
pop ecx
call fcn.0043475f
ret 4
Function at 0x405d1c
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0xc20]
push ebp
call fcn.00405474
push 0x45062c
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0xc
mov edi, 0x44e95c
mov esi, 0x46e460
test eax, eax
jne 0x405d60
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push str.image_
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0xc
test eax, eax
jne 0x405d88
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP_image___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push 0x208
push 0
push ebp
call fcn.00434780
add esp, 0xc
push ebp
mov ecx, ebx
call fcn.00405474
push ebp
push str.CExtractManager::SetDirectory:_TEMP___s_
push edi
push esi
call fcn.00401ae2
lea ebp, [ebx + 0x810]
push 0x104
push ebp
call fcn.00403b54
push 0x45062c
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0x24
test eax, eax
jne 0x405de6
push ebp
push str.CExtractManager::SetDirectory:_set_WIN___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_WIN___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push 0x104
lea ebp, [ebx + 0xa18]
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x45062c
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0xc
test eax, eax
jne 0x405e30
push ebp
push str.CExtractManager::SetDirectory:_set_SYS32___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SYS32___s_
push edi
push esi
call fcn.00401ae2
lea ebp, [ebx + 0xe28]
push 0x104
push ebp
call fcn.00403b54
push str.Softcamp
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0x24
test eax, eax
jne 0x405e76
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push str._sds_
push ebp
call fcn.004354b1
push ebp
call fcn.004378ef
add esp, 0xc
test eax, eax
jne 0x405e9e
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SDS___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
lea ebp, [ebx + 0x1030]
push ebp
mov ecx, ebx
call fcn.00404aa2
push ebp
push str.CExtractManager::SetDirectory:_CUR___s_
push edi
push esi
call fcn.00401ae2
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407576
Capabilities:
Check if file exists
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x80
cmp eax, 1
jne 0x4075a3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push esi
push 2
push ebx
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4075e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateSomFile:_CreateError__FileName:__s___x_
push 0x44e95c
push 0x46e520
call fcn.00401ae2
add esp, 0x14
xor eax, eax
jmp 0x4076fa
mov edi, dword [ebp + 0x14]
lea eax, [edi + 0x10]
push eax
call fcn.00416408
mov esi, eax
lea eax, [edi + 0x10]
push eax
push ebx
push esi
mov dword [ebp + 0x14], esi
call fcn.00434780
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004373c9
add esp, 0x1c
test eax, eax
je 0x40761e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4075dd
push dword [ebp + 8]
push edi
push 1
push esi
call fcn.004376ee
add esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0xa
push str.SCDSSS02
push dword [ebp - 4]
mov byte [esi + edi], bl
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
jne 0x407667
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_FileName:__s_
push 0x44e95c
push 0x46e520
call fcn.00401ae2
add esp, 0x10
jmp 0x407613
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x18]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x407684
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_SIZE_FileName:__s_
jmp 0x407653
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x1c]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4076a1
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Key_FileName:__s_
jmp 0x407653
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4076bd
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Data_FileName:__s_
jmp 0x407653
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x14]
call fcn.004163fd
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
add eax, 4
push eax
call fcn.004354df
push dword [ebp + 0xc]
push 0x451700
push 0x44e95c
push 0x46e520
call fcn.00401ae2
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x408efe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], esi
mov edi, 0x20019
call fcn.00408ec5
cmp eax, 1
jne 0x408f1d
mov edi, 0x20219
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408f5b
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
je 0x408f56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x408f6b
cmp dword [ebp - 4], esi
je 0x408f69
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40922e
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
lea eax, [esi + 0x210]
push 0
push eax
mov dword [ebp - 0x430], eax
call fcn.00434780
mov edi, dword [esi]
add esp, 0xc
test edi, edi
je 0x409305
and dword [ebp - 0x42c], 0
push 0x424
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00434780
add esp, 0xc
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x409305
lea eax, [ebp - 0x42c]
push eax
push edi
mov dword [ebp - 0x42c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4092fe
add esi, 8
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.00435177
pop ecx
pop ecx
test eax, eax
je 0x4092dc
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4092b6
jmp 0x4092fe
lea eax, [ebp - 0x20c]
push eax
call fcn.00434b50
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
call fcn.00437edd
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00434664
leave
ret 4
Function at 0x4095f5
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
push esi
push edi
mov edi, ecx
call fcn.0040935e
xor esi, esi
push 0x228
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.00434780
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
jne 0x409644
xor eax, eax
jmp 0x4096b9
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4096ae
push ebx
lea ebx, [edi + 4]
push 0x418
call fcn.004163ce
pop ecx
mov esi, eax
push esi
mov ecx, ebx
call fcn.0040954e
mov eax, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 4], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [esi + 8]
push 0x452030
push eax
call fcn.004353da
add esp, 0xc
push esi
mov ecx, edi
call fcn.0040922e
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40965d
xor esi, esi
inc esi
pop ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp + 0x1b0]
pop edi
xor ecx, ebp
pop esi
call fcn.00434664
add ebp, 0x1b4
leave
ret
Function at 0x40b67d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46ca20]
sub esp, 0x10
cmp eax, 3
je 0x40b73e
test eax, eax
je 0x40b73e
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWARESOFTCAMPSoftCamp_Document_SecurityDAT
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b6e5
push str.IsAnsiDSClient_:_Reg_Open_Fail.._DSClient_Not_Installed_...
push 0x44e95c
push 0x46e8a8
call fcn.00401ae2
add esp, 0xc
xor eax, eax
inc eax
leave
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.UNICL
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b6e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
mov eax, 0x453464
je 0x40b71e
mov eax, str.ANSI
push eax
push str.IsAnsiDSClient_:_Key_Value___s_
push 0x44e95c
push 0x46e8a8
call fcn.00401ae2
add esp, 0x10
cmp dword [ebp - 8], 1
je 0x40b755
jmp 0x40b6e0
push str.IsAnsiDSClient_:_GetDSInstalledProduct____VERSION_PRODUCT_OS
push 0x44e95c
push 0x46e8a8
call fcn.00401ae2
add esp, 0xc
xor eax, eax
leave
ret
Function at 0x40e8da
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x2a4
mov eax, 0x44b366
call fcn.004346dc
xor esi, esi
push esi
mov ebx, ecx
call fcn.00420656
push 1
mov ecx, ebx
call fcn.0041bdcf
push 0x43
push esi
push esi
push esi
push esi
push 0x470798
mov ecx, ebx
call fcn.004208e5
mov ecx, ebx
call fcn.0040e4e8
cmp eax, 0xffffffc3
je 0x40ea6e
cmp eax, 0xffffffcc
je 0x40ea62
push 0x46d6c0
lea ecx, [ebp - 0x2c]
call fcn.00407b3c
push str.DSSomOath.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0040e7c2
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40e950
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x44e95c
mov esi, 0x46ea98
test eax, eax
je 0x40e9d3
push 0
mov ecx, ebx
call fcn.00420656
push str.SOMAuth::ExcuteSOM_DSSomOath.ini_exist
push edi
push esi
call fcn.00401ae2
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.00410187
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x40e99a
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00410162
lea ecx, [ebp - 0x2b0]
call fcn.00419968
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40e9bd
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.00419222
call fcn.0041fd4e
mov ecx, dword [eax + 4]
call fcn.0040d27b
push str.CSOMAuthorizeDlg::OnAuthOk_PreExcuteSOM
push edi
push esi
call fcn.00401ae2
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0xc]
test eax, eax
je 0x40ea4d
push str.CSOMAuthorizeDlg::OnAuthOk_ExcuteSOM
push edi
push esi
call fcn.00401ae2
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x10]
test eax, eax
jne 0x40ea34
mov ecx, ebx
call fcn.0041931c
push str.SOMAuth::ExcuteSOM_Error____
push edi
push esi
call fcn.00401ae2
add esp, 0xc
jmp 0x40ea54
mov ecx, 0x46e5a0
call fcn.0040a770
push 0x4548f8
push edi
push esi
call fcn.00401ae2
add esp, 0xc
mov ecx, ebx
call fcn.0041931c
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401bef
jmp 0x40ea6e
call fcn.00410404
mov ecx, ebx
call fcn.0041931c
call fcn.0043475f
ret
Function at 0x40f28d
Capabilities:
Create process on windows

Disassembly:
push 0x54
mov eax, 0x44b44b
call fcn.00434673
mov edi, ecx
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00434780
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00434780
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x60], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40f32a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess:_CreateProcess_Error____Code:_d_
push 0x44e95c
push 0x46eb58
call fcn.00401ae2
add esp, 0x10
push str.SOMER011
lea eax, [ebp + 8]
push eax
mov ecx, 0x46ee00
call fcn.00412590
push eax
lea ecx, [edi + 0x804]
mov dword [ebp - 4], esi
call fcn.0040314d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
jmp 0x40f32d
xor eax, eax
inc eax
call fcn.0043474b
ret 4

Function at 0x410404
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 0x54
mov eax, 0x44b63d
call fcn.00434673
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00434780
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], 0x44
call fcn.00434780
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x46d6c0
lea ecx, [ebp]
call fcn.00407b3c
push str.SomDeletor.exe
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.0040e7c2
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040e7c2
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x410491
lea eax, [ebp + 4]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4104b2
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Error___
jmp 0x4104b7
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Success___
push 0x44f1c8
push 0x46ec18
call fcn.00403d25
add esp, 0xc
push esi
push 1
lea ecx, [ebp]
call fcn.00401bef
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.00434664
add ebp, 0x820
leave
ret
Function at 0x410500
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x410528
pop edi
pop esi
add esp, 0xc
ret
push ebx
push esi
call fcn.00416408
mov ecx, dword [esp + 0x10]
add esp, 4
mov ebx, eax
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x410577
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x45062c
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueW
push ebx
test eax, eax
jne 0x410580
call fcn.004163fd
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
call fcn.004163fd
add esp, 4
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x410ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov dword [esp + 4], 0
mov esi, 0x20019
call fcn.00410e60
cmp eax, 1
jne 0x410ebe
mov esi, 0x20219
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push esi
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x410f0e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
test eax, eax
je 0x410f07
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
mov eax, dword [esp]
test eax, eax
je 0x410f1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret