joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x40d660
jl 0x40d657
cmp dword [ebp + 0xc], 0
ja 0x40d660
xor eax, eax
xor edx, edx
jmp 0x40d797
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x40d682
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040d7a0
jmp 0x40d797
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.00409dd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40d6f1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00403dd0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0040bb10
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00404b70
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.0040ba00
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x40d788
mov ecx, dword [ebp - 8]
call fcn.0040a700
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x40d761
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00516636
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x40d75f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40d797
jmp 0x40d70d
cmp dword [ebp - 4], 0
jbe 0x40d788
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00516636
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410750
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a1bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
push 0
call fcn.00411600
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.00411560
add esp, 8
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x164]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x4107d2
push 0x53d931
mov ecx, dword [ebp + 8]
call fcn.00403e90
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
jmp 0x4108a2
push str.TrustAgentlogsTAInstall
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call fcn.0051b2d6
add esp, 0xc
push 0
lea edx, [ebp - 0x164]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x410833
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x410833
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x410833
push 0x53d932
mov ecx, dword [ebp + 8]
call fcn.00403e90
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
jmp 0x4108a2
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00403e90
mov dword [ebp - 4], 0
mov byte [ebp - 0xd], 0x5c
lea ecx, [ebp - 0x3c]
call fcn.00404da0
sub eax, 1
push eax
lea ecx, [ebp - 0x3c]
call fcn.004041a0
movsx edx, byte [eax]
movsx eax, byte [ebp - 0xd]
cmp edx, eax
je 0x41087b
movzx ecx, byte [ebp - 0xd]
push ecx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040aca0
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403e40
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004040f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x411df0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x413750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0xffffffff
je 0x41376b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x1c], 0
jne 0x413773
mov ecx, dword [ebp - 8]
call fcn.00413260
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x10]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41381b
cmp dword [ebp - 0x10], 4
jne 0x41381b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6d
jne 0x4137b9
mov byte [ebp - 1], 1
jmp 0x4137bd
mov byte [ebp - 1], 0
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 1]
mov byte [eax], cl
push 0
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040c870
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040b100
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413819
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x413819
mov ecx, dword [ebp + 8]
call fcn.0040b100
push eax
push str._Receive_succeed_:_s_n
call fcn.004139d0
add esp, 8
mov al, 1
jmp 0x41384a
jmp 0x41383c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6d
jne 0x413830
mov byte [ebp - 2], 1
jmp 0x413834
mov byte [ebp - 2], 0
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 2]
mov byte [edx], al
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.0040c870
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x413850
Capabilities:
Connect pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x4138c8
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x413881
mov byte [ebp - 1], 1
jmp 0x413885
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
test ecx, ecx
jne 0x4138c8
push str.Not_Connect_n
call fcn.004139d0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00413260
movzx edx, al
test edx, edx
jne 0x4138c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x217
je 0x4138c8
xor al, al
jmp 0x41398d
mov ecx, dword [ebp - 8]
call fcn.00413720
movzx eax, al
test eax, eax
jne 0x4138fa
push str.Not_Init_n
call fcn.004139d0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00413260
movzx ecx, al
test ecx, ecx
jne 0x4138fa
xor al, al
jmp 0x41398d
mov ecx, dword [ebp + 8]
call fcn.0040b100
push eax
push str._Send_succeed_:_s_n
call fcn.004139d0
add esp, 8
mov ecx, dword [ebp + 8]
call fcn.00404da0
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41395e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x18], 0
jne 0x41395a
mov ecx, dword [ebp - 8]
call fcn.00413230
jmp 0x4138c8
xor al, al
jmp 0x41398d
push 0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404da0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b100
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41398b
xor al, al
jmp 0x41398d
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x413c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a2fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00403ae0
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00413ce0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.00413ac0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00413dd0
mov dword [ebp - 0x20], 0x413b80
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.0040ab70
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
call fcn.0051b7d5
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x413c95
lea ecx, [ebp - 0x14]
call fcn.0040c620
jmp 0x413ca6
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
push 6
call fcn.00444d4a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00413dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ccd0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a955
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x27c], 0x22c
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x41cd1f
xor al, al
jmp 0x41ce2a
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x41ce28
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00406cf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404da0
push eax
lea ecx, [ebp - 0x38]
call fcn.0040b120
push eax
lea edx, [ebp - 0x50]
push edx
call fcn.0041a100
add esp, 0xc
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x14], 0
jmp 0x41cd85
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.0040cda0
cmp dword [ebp - 0x14], eax
jae 0x41cdcd
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004156a0
push eax
call fcn.0041a4e0
add esp, 8
movzx eax, al
test eax, eax
je 0x41cdcb
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004156a0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0041c290
mov byte [ebp - 0xd], 1
jmp 0x41cd7c
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x41ce08
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.004040f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00407a00
jmp 0x41cd1f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e8b0
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53aa3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [ebp + 8]
cmp eax, dword [0x5ad12c]
jae 0x41e8db
jmp 0x41ea9e
cmp dword [ebp + 0xc], 0
jne 0x41e8e6
jmp 0x41ea9e
lea ecx, [ebp - 0x10]
call fcn.0041dc90
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 8
ja 0x41e901
cmp dword [ebp + 8], 0
jae 0x41e908
mov dword [ebp + 8], 0
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.GWCLI
mov edx, dword [ebp + 8]
shl edx, 4
add edx, str.trace
push edx
movzx eax, word [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x2a]
push eax
movzx ecx, word [ebp - 0x2e]
push ecx
movzx edx, word [ebp - 0x30]
push edx
push str._02d__02d__02d__02d:_02d:_02d_s_s
lea eax, [ebp - 0x10]
push eax
call fcn.0041ee70
add esp, 0x28
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041e460
mov dword [ebp - 0x18], 0
push 0x53e6e8
lea ecx, [ebp - 0x10]
call fcn.0041f8f0
push 0x53e6ec
lea ecx, [ebp - 0x10]
call fcn.0041e140
mov ecx, dword [0x5ad130]
and ecx, 1
je 0x41e9ae
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41e9ae
lea ecx, [ebp - 0x10]
call fcn.0040ab70
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x5ad130]
and edx, 2
je 0x41ea8f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0
push 0x80
push 4
push 0
push 5
push 0x40000000
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x41ea6c
push 2
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x400000
jbe 0x41ea0f
mov dword [ebp - 0x1c], 1
push 2
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x500000
jbe 0x41ea40
push 0
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041f180
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ab70
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x41ea8f
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041e060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41faf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41fb14
xor eax, eax
jmp 0x41fb94
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fb2b
xor eax, eax
jmp 0x41fb94
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x41fb77
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x41fb77
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x41fb4e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x41fb83
xor eax, eax
jmp 0x41fb94
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x41fb91
xor eax, eax
jmp 0x41fb94
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x420240
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0x53eae0
call fcn.00420fc0
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00420470
movzx ecx, al
test ecx, ecx
je 0x420278
mov ecx, dword [ebp + 8]
call fcn.0040b6d0
movzx edx, al
test edx, edx
je 0x42027c
xor al, al
jmp 0x42028d
mov ecx, dword [ebp + 8]
call fcn.0040b100
push eax
mov ecx, dword [ebp - 4]
call fcn.004209e0
mov esp, ebp
pop ebp
ret 4
Function at 0x4202a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53aadd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.00406f00
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsInterfaceLayer.exe
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42036f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0x208
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push str.Path
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420335
mov dword [ebp - 0x18], 1
jmp 0x42033c
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x42036f
cmp dword [ebp - 0x14], 4
je 0x42035e
cmp dword [ebp - 0x14], 5
jne 0x420360
jmp 0x42036f
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040e440
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406b80
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00407a00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4208d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53aadd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.00406f00
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x53edb8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42099f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0x208
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0x53ee40
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420965
mov dword [ebp - 0x18], 1
jmp 0x42096c
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x42099f
cmp dword [ebp - 0x14], 4
je 0x42098e
cmp dword [ebp - 0x14], 5
jne 0x420990
jmp 0x42099f
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040e440
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406b80
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00407a00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x420a50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x420a69
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x420a6d
xor al, al
jmp 0x420aa7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x420a7f
xor al, al
jmp 0x420aa7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.00420620
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jne 0x420a9d
mov dword [ebp - 4], 1
jmp 0x420aa4
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x426650
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ad97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00426b80
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00426db0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0041b2d0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jne 0x426709
push 0x14
call fcn.00445cc2
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x4266e6
push 0
push 0x10000
mov ecx, dword [ebp - 0x14]
call fcn.00426d50
mov dword [ebp - 0x18], eax
jmp 0x4266ed
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53afdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x42f8bf
push 0x410
push 0
lea ecx, [ebp - 0x474]
push ecx
call fcn.00511fb0
add esp, 0xc
lea edx, [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42f89d
push 0x541f54
lea ecx, [ebp - 0x34]
call fcn.00406cf0
mov dword [ebp - 4], 0
push 0x541f58
lea ecx, [ebp - 0x34]
call fcn.00410640
push 0x541f68
lea ecx, [ebp - 0x34]
call fcn.00410640
lea ecx, [ebp - 0x34]
call fcn.0040b120
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0042f1c0
add esp, 8
push 0x541f74
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.00405220
add esp, 0xc
mov byte [ebp - 4], 1
push 0x541f94
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.00405220
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.0040b120
push eax
lea eax, [ebp - 0x474]
push eax
push 0
lea ecx, [ebp - 0x64]
call fcn.0040b120
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00436090
movzx ecx, al
test ecx, ecx
jne 0x42f86d
push 0x541fac
push 5
push 0x5b0688
call fcn.00410bb0
add esp, 0xc
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00407a00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00407a00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407a00
mov al, byte [ebp - 0xd]
jmp 0x42f8df
mov byte [ebp - 0xe], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00407a00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00407a00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407a00
mov al, byte [ebp - 0xe]
jmp 0x42f8df
push 0xe7
push 0x541fc8
push 0x541fe4
push 5
push 0x5b0688
call fcn.00410bb0
add esp, 0x14
xor al, al
jmp 0x42f8df
push 0xea
push str.TAInstall::CreateShortCut
push 0x542028
push 5
push 0x5b0688
call fcn.00410bb0
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret