joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100442b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0x14], eax
jne 0x100442ce
lea ecx, [esp + 0xc]
mov dword [ebp + 0x14], ecx
mov esi, dword [ebp + 8]
push 1
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10044301
call fcn.100048b0
test eax, eax
js 0x10044305
mov eax, dword [esp + 0x10]
mov edi, eax
jmp 0x10044309
mov edi, dword [esp + 0x10]
mov edx, dword [esi + 0x14]
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10044330
call fcn.100048b0
test eax, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, edi
jne 0x1004434a
cmp ecx, ebx
jne 0x1004434a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push eax
mov eax, dword [esi + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004436b
call fcn.100048b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10045828
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10065af4], 0
push esi
push edi
jne 0x1004579e
call fcn.1004570a
test eax, eax
je 0x100457e3
mov eax, dword [0x10065af4]
cmp eax, 1
jne 0x100457bf
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100457e3
jmp 0x10045825
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10045825
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100457e7
xor eax, eax
jmp 0x10045825
mov eax, dword [esi]
push dword [0x10065af4]
call edi
mov edi, eax
test edi, edi
je 0x10045809
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x10045825
lea edi, [esi + 0xff0]
push esi
push dword [0x10065af4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1004580f
mov eax, esi
pop edi
pop esi
ret
jmp 0x1004578a

Function at 0x10045a28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10063068]
jne 0x10045a32
repz ret
jmp fcn.10046090
Function at 0x10009276
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94c
mov eax, dword [0x10046040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100119dd
test eax, eax
js 0x10009504
push 0x104
lea eax, [ebp - 0x13c]
push eax
push dword [0x1004603c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov edi, 0x100012dc
push edi
lea eax, [ebp - 0x34]
push 0x2d
push eax
call fcn.10014b2d
add esp, 0xc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001354
push 2
push 0x10003584
mov byte [ebp - 0x2f], 0x5c
call fcn.10014b2d
test eax, eax
je 0x100092f3
mov eax, 0x80040201
jmp 0x10009504
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x1000136c
push 3
push 0x10003234
call fcn.10014b2d
test eax, eax
jne 0x100092e9
push 1
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001388
push 4
mov esi, 0x10003304
push esi
call fcn.10014b2d
test eax, eax
jne 0x100092e9
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 5
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009357
mov byte [ebp - 0x93c], al
lea eax, [ebp - 0x93c]
push eax
push 0
push 0
push 0x100013a4
call fcn.10014b2d
test eax, eax
jne 0x100092e9
lea eax, [ebp - 0x2e]
push eax
push esi
call fcn.10014b2d
lea eax, [ebp - 0x2e]
push eax
push edi
push 0
push 0x100013a4
call fcn.10014b2d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013c0
push 6
push 0x10003434
call fcn.10014b2d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013dc
push 7
push 0x10003444
call fcn.10014b2d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013fc
push 9
push 0x10003454
call fcn.10014b2d
test eax, eax
jne 0x100092e9
push 0x10001424
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x94c], eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
lea eax, [ebp - 0x940]
push eax
push 1
push 0
push 0x10001434
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009502
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x944]
push eax
push 0
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
mov eax, dword [ebp - 0x944]
inc eax
add eax, esi
mov dword [ebp - 0x944], eax
call fcn.10009f0e
mov esi, esp
test esi, esi
je 0x10009502
lea eax, [ebp - 0x94c]
push eax
push esi
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10001424
push dword [ebp - 0x944]
push esi
call fcn.10014b2d
push 0x10001450
lea eax, [ebp - 0x13c]
push 0x106
push eax
call fcn.10014b2d
add esp, 0xc
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 1
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009502
mov eax, 0xc7ce0017
jmp 0x10009504
xor eax, eax
lea esp, [ebp - 0x958]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f00
leave
ret
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.10014b2d
mov dword [0x10048aa4], eax
call fcn.10014b2d
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.10014b2d
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.10014b2d
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.10014b2d
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.10014b2d
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.10014b2d
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10014b2d
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.10014b2d
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x10014b2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10014b3c
pop dword [ebp - 0x4c]
mov eax, 0x9342ea66
add eax, 0x7cbe60d6
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x68fd2edd
sub dword [ebp - 0x5c], 0x1aaae992
mov dword [ebp - 0x58], 0x317478b8
sub dword [ebp - 0x58], 0xff412c73
mov dword [ebp - 0x54], 0xe866f7e0
sub dword [ebp - 0x54], 0x9c1ab3b2
mov dword [ebp - 0x50], 0x2240a3ca
sub dword [ebp - 0x50], 0x2240a3ca
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x69e62820
add eax, 0xa619e964
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x43c70e3c
sub dword [ebp - 0x5c], 0xcf54a4e6
mov dword [ebp - 0x58], 0x84f44d28
add dword [ebp - 0x58], 0xbc78144d
mov dword [ebp - 0x54], 0x1c53988d
sub dword [ebp - 0x54], 0xb8e42c21
mov dword [ebp - 0x50], 0x5ae45edc
sub dword [ebp - 0x50], 0x5ae45edc
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x427ac
push 0
call eax
mov ecx, 0xbe2d7925
sub ecx, 0xbe2d3773
xor edx, edx
add edx, eax
mov esi, 0x9dcd2f67
add esi, 0x7237e899
add esi, dword [ebp - 0x4c]
mov ebx, 0x5a1f0d6f
sub ebx, 0x68785d98
xor dword [ebp - 8], ebx
mov edi, dword [esi]
xor dword [ebp - 0x18], 0x7b673ecf
xor edi, ebx
add dword [ebp - 0x28], eax
mov dword [edx], edi
add dword [ebp - 0xc], 0x642c4b3
add edx, 0xa5a6eaf
sub edx, 0xa5a6eab
add esi, 0xadcb1fc0
sub esi, 0xadcb1fbc
loop 0x10014c5b
add eax, 0xffba3d27
sub eax, 0xffb9438c
mov ebx, eax
add eax, 5
mov ecx, 0xc21d144d
add ecx, 0x4de2ebb3
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1001537c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10046040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10046b38], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
jne 0x100153aa
push edi
call fcn.10014b2d
jmp 0x100153ea
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100153ee
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push esi
push 1
call dword [sym.imp.kernel32.dll_GetACP]
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x100153ee
cmp eax, ebx
ja 0x100153ee
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call fcn.10014b2d
xor eax, eax
jmp 0x100153f3
mov eax, 0x80030002
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009f00
leave
ret 8
Function at 0x4215b1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
mov edi, ecx
push 0x20
push esi
push edi
call fcn.004df7f8
add esp, 0xc
cmp eax, 0x20
je 0x4215df
push 6
jmp 0x421676
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esi + 0x10]
mov dword [esi + 0xc], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esi + 0x14]
mov dword [esi + 0x10], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esi + 0x18]
mov dword [esi + 0x14], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esi + 0x1c]
mov dword [esi + 0x18], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.004d62be
pop ecx
pop ecx
test eax, eax
jne 0x4215d8
cmp dword [esi], 0x4944424d
jne 0x421674
cmp dword [esi + 4], 0x30314646
jne 0x421674
mov eax, dword [ebp - 0x24]
cmp eax, 0x20
jb 0x421674
add eax, 0xffffffe0
cmp eax, dword [esi + 0x14]
jb 0x421674
sub eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jb 0x421674
sub eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jb 0x421674
sub eax, dword [esi + 0x1c]
neg eax
sbb eax, eax
and eax, 8
jmp 0x421677
push 8
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x421687
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 8]
add ecx, eax
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x18]
add eax, dword [ebx + 0x1c]
push eax
mov dword [ebp - 0x10], ecx
call fcn.0044ada0
mov dword [ebp - 0xc], eax
pop ecx
test eax, eax
jne 0x4216be
inc eax
jmp 0x42182e
push esi
push edi
mov edi, dword [ebx + 0x14]
xor esi, esi
add edi, dword [ebx + 0x18]
mov ecx, eax
mov dword [ebp - 8], ecx
add edi, dword [ebx + 0x1c]
je 0x421704
push edi
push ecx
push dword [ebp - 4]
call fcn.004df7f8
add esp, 0xc
test eax, eax
js 0x421816
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 8], ecx
test eax, eax
jne 0x4216fd
test edi, edi
jne 0x42181e
test edi, edi
jne 0x4216d2
mov eax, dword [ebp - 0xc]
mov edi, eax
xor edx, edx
mov eax, dword [ebx + 0x14]
push 0xc
pop ecx
div ecx
test edx, edx
jne 0x42181e
mov eax, dword [ebx + 0x14]
add eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x18]
mov ebx, dword [ebx + 0x1c]
add edx, eax
add ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], eax
jae 0x421821
mov ebx, dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [edi + 4]
mov dword [edi], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [edi + 8]
mov dword [edi + 4], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp dword [edi], eax
ja 0x42181e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
sub eax, ecx
cmp dword [edi], eax
ja 0x42181e
cmp dword [edi], 0
mov dword [ebp - 0x1c], esi
jbe 0x4217a5
mov eax, ebx
mov edx, ecx
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, eax
mov al, byte [ecx + edx]
add byte [edx], al
inc esi
inc edx
cmp esi, dword [edi]
jb 0x421795
mov ecx, dword [ebp - 4]
xor esi, esi
mov eax, dword [edi]
push eax
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.004d981a
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
jne 0x42181a
add dword [ebp - 4], ecx
add ebx, ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp dword [edi + 4], eax
ja 0x42181e
mov eax, dword [edi + 4]
push eax
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.004d981a
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
jne 0x42181a
add dword [ebp - 8], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x24]
neg ecx
add eax, ecx
cmp dword [edi + 8], eax
jl 0x42181e
mov eax, dword [ebp - 0x10]
add eax, ecx
cmp dword [edi + 8], eax
jg 0x42181e
add ebx, dword [edi + 8]
add edi, 0xc
cmp edi, dword [ebp - 0x28]
jb 0x421743
jmp 0x421821
push 6
jmp 0x421820
push 7
jmp 0x421820
push 8
pop esi
push dword [ebp - 0xc]
call fcn.0044adf0
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421833
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov dword [ebp - 0x68], ecx
mov eax, edx
mov ecx, dword [ebp + 8]
mov edx, 0x8000
push edi
mov dword [ebp - 0x6c], ecx
or edi, 0xffffffff
push ecx
mov ecx, eax
mov dword [ebp - 0x64], edi
xor ebx, ebx
call fcn.00421588
mov dword [ebp - 0x60], eax
pop ecx
test eax, eax
jns 0x421876
push 6
pop eax
jmp 0x421954
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.004215b1
mov esi, eax
test esi, esi
jne 0x421929
push ecx
mov ecx, dword [ebp - 0x68]
mov edx, 0x8000
call fcn.00421588
mov edi, eax
pop ecx
test edi, edi
jns 0x4218a7
push 6
pop esi
jmp 0x421929
lea eax, [ebp - 0x3c]
push eax
push edi
call fcn.004d62be
pop ecx
pop ecx
test eax, eax
jne 0x42189f
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x28], eax
je 0x4218c3
push 8
jmp 0x4218a1
push eax
call fcn.0044ada0
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4218d5
xor esi, esi
inc esi
jmp 0x421929
push dword [ebp - 0x54]
push ebx
push edi
call fcn.004df7f8
mov esi, dword [ebp - 0x54]
add esp, 0xc
cmp eax, esi
jne 0x42189f
call fcn.00490086
mov edx, esi
mov ecx, ebx
call fcn.00490072
not eax
cmp eax, dword [ebp - 0x50]
je 0x421902
push 4
jmp 0x4218a1
push ecx
mov ecx, dword [ebp - 0x6c]
mov edx, 0x8301
call fcn.00421588
mov dword [ebp - 0x64], eax
pop ecx
test eax, eax
js 0x42189f
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
push eax
push ebx
call fcn.00421687
pop ecx
pop ecx
mov esi, eax
push ebx
call fcn.0044adf0
pop ecx
push dword [ebp - 0x60]
call fcn.004d8b4d
pop ecx
test edi, edi
js 0x421944
push edi
call fcn.004d8b4d
pop ecx
mov eax, dword [ebp - 0x64]
test eax, eax
js 0x421952
push eax
call fcn.004d8b4d
pop ecx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret

Function at 0x422828
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push 0x4ff978
push eax
push eax
mov byte [esi], al
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x42285a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb al, al
inc al
mov byte [esi], al
mov eax, esi
pop esi
ret
Function at 0x4230e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x51a0a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
xor edi, edi
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
mov edx, 0x20006
push eax
mov ecx, str.PTimes
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00422b3b
mov edx, dword [ebp + 8]
pop ecx
lea ecx, [esp + 0x2c]
call fcn.00422ab0
push 8
pop esi
cmp dword [esp + 0x40], esi
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [esp + 0x40], esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
push ecx
push edi
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push edi
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea ecx, [esp + 0x2c]
push edi
push 1
setne bl
call fcn.0041b875
lea ecx, [esp + 0x14]
call fcn.004426e0
mov ecx, dword [esp + 0x44]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 4

Function at 0x423340
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x51a0a0]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], edi
call fcn.0042399d
test eax, eax
jne 0x423370
xor al, al
jmp 0x4233fe
push ecx
push ecx
mov esi, esp
push eax
mov dword [esi], eax
call fcn.00415c05
pop ecx
lea ecx, [esp + 0x24]
mov dword [esi + 4], eax
call fcn.00437d50
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
mov edx, 0x20006
mov dword [esp + 0x1c], edi
mov ecx, str.RLZs
mov dword [esp + 0x20], edi
call fcn.00422b3b
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00442ad0
test eax, eax
lea ecx, [esp + 0xc]
setne bl
call fcn.004426e0
push edi
push 1
lea ecx, [esp + 0x24]
call fcn.0041b875
mov al, bl
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 4
Function at 0x42486f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push ecx
push ecx
mov dword [esi + 0x44], eax
divsd xmm0, qword [0x5127b8]
mulsd xmm0, qword [0x5127d0]
addsd xmm0, qword [0x5127b0]
movsd qword [esp], xmm0
call fcn.004d6535
xor eax, eax
cmp dword [esi + 0x48], 2
pop ecx
sete al
add esi, 0x1c
add eax, 0x80000001
fstp qword [ebp - 0x1c]
cvttsd2si edi, qword [ebp - 0x1c]
cmp dword [esi + 0x14], 8
pop ecx
jb 0x4248ce
mov esi, dword [esi]
push 0x202
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00442630
cmp dword [ebp - 0x1c], 0
je 0x4248fe
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 4
push 0
push str.InstallerProgress
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x1c]
call fcn.004426e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4