joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0x64
push 0x4406b0
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
call fcn.004047ec
mov dword [ebp - 4], eax
push 0x64
push 0x44064c
push 0xbb
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401054
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
mov edx, dword [0x440510]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401136
add esp, 4
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004011b6
add esp, 8
test eax, eax
jne 0x40107b
xor eax, eax
jmp 0x401130
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x30], eax
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4010c9
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x4010c1
push 0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 1
push 0
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 8]
jbe 0x401123
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401421
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 8], 0xb0
jae 0x4014bf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.00401421
add esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
jne 0x40147b
mov byte [ebp - 0x114], 0
jmp 0x4014bd
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 4
div ecx
test edx, edx
jne 0x40149f
lea edx, [ebp - 0x104]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4014bd
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0xd
div ecx
test edx, edx
jne 0x4014bd
mov byte [ebp - 0x112], 0x4d
mov byte [ebp - 0x111], 0
jmp 0x4014c8
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x401a08
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x10], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x43b3e4]
mov dword [ecx + 0xa0], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x43fb40]
mov dword [eax + 0x98], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb8], 0
je 0x401a80
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x18c], 0x43b3ec
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [eax + 0x1a0], ecx
jmp 0x401b4c
mov edx, dword [str.appcommand.ini]
mov dword [ebp - 0x2c], edx
mov eax, dword [0x43fb90]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x43fb94]
mov dword [ebp - 0x24], ecx
mov dx, word [0x43fb98]
mov word [ebp - 0x20], dx
mov al, byte [0x43fb9a]
mov byte [ebp - 0x1e], al
push 0
push 0
push 4
push 0
push 0
push 2
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b20
push 0x80
call fcn.0042b235
add esp, 4
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x401b20
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], 4
jne 0x401b20
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
add ecx, 0x6b0
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x43fb9c
push 5
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov dword [ebp - 0x18], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xa4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x43b3e8]
mov dword [ecx + 0x9c], edx
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov ecx, dword [0x43fb3c]
mov dword [eax + 0x94], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x170], 0x42f030
mov eax, dword [ebp - 4]
push eax
call fcn.004049b0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4046ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [edx + 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], 0x4d42
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0x14]
mov dword [ebp - 0x26], edx
mov word [ebp - 0x22], 0
mov word [ebp - 0x20], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov dword [ebp - 0x1e], edx
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
lea eax, [edx*4 + 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4047e8
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4047e8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret
Function at 0x4047ec
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
push 1
push 0xd
call fcn.00401c31
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x40485c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0xa
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 4], 0
je 0x40486f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], 0
je 0x404887
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [ebp - 8]
jmp 0x4049ac
mov dword [ebp - 0x470], 0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.o23ne.doc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffff
jne 0x4048c4
xor eax, eax
jmp 0x4049ac
push 0
push 0x80
push 4
push 0
push 1
push 4
push str.two.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4048ee
xor eax, eax
jmp 0x4049ac
push 0
lea eax, [ebp - 0x478]
push eax
push 0x448
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404983
push 2
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x474], eax
push 0
mov ecx, dword [ebp - 0x478]
push ecx
push 0
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 0x46c]
push ecx
mov edx, dword [ebp - 0x478]
push edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov edx, dword [ebp - 0x478]
push edx
push 0
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 0x478], 0x448
je 0x4048ee
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42bf39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x440170
cmp edx, dword [eax]
je 0x42bf5b
add eax, 8
inc ecx
cmp eax, 0x440200
jl 0x42bf4c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x440170]
jne 0x42c089
mov eax, dword [0x440720]
cmp eax, 1
je 0x42c063
test eax, eax
jne 0x42bf8c
cmp dword [0x4400c4], 1
je 0x42c063
cmp edx, 0xfc
je 0x42c089
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42bfc3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0042cd20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0042ae20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x42c006
lea eax, [ebp - 0x1a4]
push eax
call fcn.0042ae20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42e4c0
push edi
call fcn.0042cea0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0042cd20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0042cd30
lea eax, [ebp - 0xa0]
push 0x42e4a0
push eax
call fcn.0042cd30
push dword [esi + 0x440174]
lea eax, [ebp - 0xa0]
push eax
call fcn.0042cd30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0042ce10
add esp, 0x2c
pop edi
jmp 0x42c089
lea eax, [ebp + 8]
lea esi, [esi + 0x440174]
push 0
push eax
push dword [esi]
call fcn.0042ae20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40145c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4014b9
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4014b1
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004013bf
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4014bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.0041b768
mov esi, eax
pop ecx
test esi, esi
je 0x40150d
xor edx, edx
test ebx, ebx
jbe 0x40150d
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x4014f7
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403422
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40342e
mov eax, 0x428470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403442
test al, 0x10
jne 0x403442
push 1
pop eax
ret
xor eax, eax
ret

Function at 0x403b11
Capabilities:
Get file size

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x403b1d
mov eax, 0x428470
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
ja 0x403b56
cmp esi, 0xffffffff
je 0x403b52
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x403b6a
mov ecx, dword [esp + 8]
cmp esi, 0xffffffff
mov dword [ecx], eax
je 0x403b68
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret 4

Function at 0x404b24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov esi, eax
mov ecx, esi
call fcn.00413194
push 1
mov ecx, esi
mov edi, eax
call fcn.00413179
mov ecx, esi
call fcn.00413172
push eax
mov ecx, esi
call fcn.004130f9
mov ecx, edi
call fcn.00414d9c
push eax
mov ecx, esi
call fcn.00413134
lea eax, [ebp - 0x800]
push 0x400
push eax
mov ecx, ebx
call fcn.00404cd5
test eax, eax
jne 0x404ba3
mov edi, 0x47f
mov ecx, esi
mov dword [0x434bb4], edi
call fcn.00413141
shr eax, 0xa
push eax
push edi
call fcn.00415587
pop ecx
pop ecx
jmp 0x404cc9
lea eax, [ebp - 0x400]
push eax
push 0
lea eax, [ebp - 0x800]
push 0x42d1cc
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x400]
push eax
call fcn.0041609e
lea eax, [ebp - 0x400]
push 0x2e
push eax
call fcn.0041cbc0
and byte [eax], 0
pop ecx
pop ecx
lea eax, [ebp - 0x400]
push eax
call fcn.00416047
test eax, eax
jne 0x404bf9
lea eax, [ebp - 0x400]
push eax
call fcn.00415f9d
lea eax, [ebp - 0x400]
mov edi, 0x431c0c
push eax
push edi
call fcn.0041bb20
pop ecx
pop ecx
push dword [0x42e1ec]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413c89
test eax, eax
jne 0x404c48
push 2
mov ecx, esi
call fcn.00413179
push dword [0x42e1ec]
mov ecx, esi
call fcn.0041312d
push eax
push 0x433ce0
call fcn.00415ec8
jmp 0x404c64
push dword [0x42e1ec]
push edi
push 0x433ce0
call fcn.00415ec8
mov ecx, esi
call fcn.00413c9d
test eax, eax
je 0x404cc9
push dword [0x42e200]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413c89
test eax, eax
je 0x404c98
push 1
push 0
push 0
push 1
push dword [0x42e200]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413eea
mov ecx, ebx
call fcn.00404d96
test eax, eax
jne 0x404cb5
mov eax, 0x481
push 0
mov dword [0x434bb4], eax
push eax
jmp 0x404b97
cmp dword [esi + 0x14bc], 5
jne 0x404ccd
mov ecx, esi
call fcn.00413e45
test eax, eax
jne 0x404ccd
xor eax, eax
jmp 0x404cd0
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404cd5
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov ecx, eax
call fcn.00413141
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x404d16
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.00404d6b
test eax, eax
jne 0x404d62
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x404d32
push esi
push edi
mov ecx, ebx
call fcn.00404d6b
test eax, eax
jne 0x404d62
push 0x431bf0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.00415c1d
add esp, 0xc
test eax, eax
jge 0x404d62
push edi
push esi
push 4
call fcn.00415c1d
add esp, 0xc
test eax, eax
jge 0x404d62
xor eax, eax
jmp 0x404d65
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x40558a
Capabilities:
Copy file
Create thread

Disassembly:
mov eax, 0x427142
call fcn.0041c160
sub esp, 0x428
push ebx
push edi
push dword [ebp + 8]
mov ebx, ecx
call fcn.00405798
test al, al
je 0x4055bd
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x405741
and byte [ebp - 0x434], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x433]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x434]
push esi
push eax
mov ecx, ebx
push dword [ebp + 8]
call fcn.004057c0
mov esi, 0x400
xor edi, edi
push esi
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push esi
mov dword [ebx + 0x90], eax
push eax
lea eax, [ebp - 0x434]
push 0xffffffffffffffff
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push esi
push eax
push 0xffffffffffffffff
mov dword [ebx + 0x94], eax
push dword [ebp + 0xc]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x2c
call fcn.0041b768
pop ecx
mov dword [ebp + 8], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x405653
push 4
push ebx
push dword [ebx + 0x90]
mov ecx, eax
call fcn.00405751
jmp 0x405655
xor eax, eax
mov dword [ebx + 0x98], eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push ebx
push 0x40553e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 4
mov dword [ebp - 0x10], esi
call fcn.0041b768
mov dword [eax], esi
pop ecx
mov esi, 0xff
mov dword [ebp + 8], eax
push esi
push 0xffffffffffffffff
push edi
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
mov dword [ebp + 0xc], eax
jne 0x4056dd
push 1
push edi
push edi
lea eax, [ebp - 0x34]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4056d4
cmp dword [ebp - 0x30], 0x8032
jne 0x4056c8
mov ecx, dword [ebx + 0x98]
call fcn.00405b5d
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4056a1
push esi
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
jmp 0x405691
push dword [ebp + 8]
call fcn.00406d57
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop ecx
push dword [ebx + 0x90]
call esi
push dword [ebx + 0x94]
call esi
mov ebx, dword [ebx + 0x98]
pop esi
cmp ebx, edi
je 0x405716
lea ecx, [ebx + 8]
call fcn.0040591c
push ebx
call fcn.00406d57
pop ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x405720
xor eax, eax
jmp 0x405741
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x14], edi
setge al
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x405aef
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x405b08
xor esi, esi
jmp 0x405b35
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0041c130
xor eax, eax
mov esi, esp
push eax
push eax
and byte [esi], 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405b53
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x64
jl 0x405afa
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4099ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a44
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x4328b4
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409a3b
mov byte [0x4338b4], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x409b87
Capabilities:
Hide graphical window

Disassembly:
push dword [0x4338d0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x409bb3
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4338d0]
call esi
push 0
push dword [0x4338c4]
call esi
pop esi
ret

Function at 0x409bb4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x4338d0]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.00413045
cmp dword [eax], 1
je 0x409c1e
cmp dword [eax + 4], ebx
je 0x409c73
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x409c73
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x4338d0]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret