joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418bab
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
and dword [esp + 4], 0
and dword [esp], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x600]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x5ec]
push esi
push edi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x600]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x5ec]
lea edi, [esp + 0x18]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.0041cc05
test al, al
je 0x418e18
mov esi, edi
call fcn.0041cbab
mov eax, dword [eax + 0x1ec]
cmp eax, dword [ebp + 0xc]
jne 0x418e0a
inc dword [esp + 0x10]
call fcn.0041cbab
cmp dword [eax + 0xe0], 3
jne 0x418df4
call fcn.0041cbab
cmp dword [eax + 0x1e0], 0
jne 0x418df4
push 0
call fcn.0044c724
pop ecx
mov edi, eax
mov ebx, edx
call fcn.0041cbab
mov dword [eax + 0x1d0], edi
mov dword [eax + 0x1d4], ebx
call fcn.0041cbab
mov dword [eax + 0x1e0], 1
call fcn.0041cbab
push 0x479d3c
add eax, 0x140
call fcn.00404518
pop ecx
test al, al
jne 0x418cc3
call fcn.0041cbab
sub esp, 0x1c
add eax, 0x140
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00401bcf
lea esi, [esp + 0x34]
call fcn.0041cbab
add eax, 0x15c
cmp dword [eax + 0x18], 8
jb 0x418cb7
mov eax, dword [eax + 4]
jmp 0x418cba
add eax, 4
push eax
call fcn.0041eec1
add esp, 0x20
lea esi, [esp + 0x18]
call fcn.0041cbab
add eax, 0x194
cmp dword [eax + 0x18], 8
jb 0x418cdc
mov ebx, dword [eax + 4]
jmp 0x418cdf
lea ebx, [eax + 4]
lea esi, [esp + 0x18]
call fcn.0041cbab
add eax, 0x15c
cmp dword [eax + 0x18], 8
jb 0x418cf8
mov edi, dword [eax + 4]
jmp 0x418cfb
lea edi, [eax + 4]
lea esi, [esp + 0x18]
call fcn.0041cbab
push ebx
mov ecx, edi
mov esi, eax
call fcn.00404707
push 0
mov dword [esi + 0x1e4], eax
call fcn.0044c724
pop ecx
pop ecx
lea esi, [esp + 0x18]
mov edi, eax
mov ebx, edx
call fcn.0041cbab
mov dword [eax + 0x1d8], edi
mov dword [eax + 0x1dc], ebx
call fcn.0041cbab
mov eax, dword [eax + 0x1e4]
mov dword [esp + 0x14], eax
call fcn.0041cbab
cmp dword [eax + 0x1e4], 0
jne 0x418d64
call fcn.0041cbab
mov dword [eax + 0x1e0], 3
jmp 0x418dcf
call fcn.0041cbab
cmp dword [eax], 0x2694
jne 0x418d99
lea esi, [esp + 0x18]
call fcn.0041cbab
cmp dword [eax + 0xe8], 1
jle 0x418d99
call fcn.0041cbab
and dword [esp + 0x14], 0
mov dword [eax + 0x1e0], 3
jmp 0x418dac
lea esi, [esp + 0x18]
call fcn.0041cbab
mov dword [eax + 0x1e0], 2
lea esi, [esp + 0x18]
call fcn.0041cbab
add eax, 0x15c
cmp dword [eax + 0x18], 8
jb 0x418dc5
mov eax, dword [eax + 4]
jmp 0x418dc8
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp + 8]
push dword [esp + 0x14]
add ebx, 0x60c
mov eax, dword [ebx]
mov edi, dword [eax]
lea esi, [esp + 0x1c]
add edi, 8
call fcn.0041cbab
mov ecx, dword [ebx]
push eax
call dword [edi]
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x18]
call fcn.0041cbab
cmp dword [eax + 0x1e0], 3
jne 0x418e0a
inc dword [esp + 0xc]
lea esi, [esp + 0x18]
call fcn.0041cbd6
jmp 0x418bd9
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [esp + 0x10], ecx
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b16f
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x46c794
call fcn.004515c0
mov ebx, ecx
lea eax, [ebx + 0x288]
cmp dword [eax + 0x18], 8
jb 0x41b18e
mov eax, dword [eax + 4]
jmp 0x41b191
add eax, 4
push eax
call fcn.0044c78b
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x600]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x5ec]
pop ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x600]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x5ec]
lea edi, [ebp - 0x38]
lea esi, [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.0041cc05
test al, al
je 0x41b2ac
mov esi, edi
call fcn.0041cbab
mov ecx, dword [ebp - 0x30]
cmp dword [eax], ecx
je 0x41b1e9
call fcn.0041cbd6
jmp 0x41b1af
call fcn.0041cbab
add eax, 0x124
push eax
lea esi, [ebp - 0x2c]
call fcn.00401bcf
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jbe 0x41b217
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41b212
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
jmp 0x41b21a
mov dword [ebp - 0x30], ebx
lea esi, [ebp - 0x38]
call fcn.0041cbab
add eax, 0x178
cmp dword [eax + 0x18], 8
jb 0x41b232
mov edi, dword [eax + 4]
jmp 0x41b235
lea edi, [eax + 4]
lea esi, [ebp - 0x38]
call fcn.0041cbab
add eax, 0x1b0
cmp dword [eax + 0x18], 8
jb 0x41b24d
mov eax, dword [eax + 4]
jmp 0x41b250
add eax, 4
push 1
push edi
push dword [ebp - 0x30]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
mov edi, eax
call fcn.0044c724
pop ecx
push edx
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push str.prodstarttime
call fcn.004070da
call fcn.00413dee
push edi
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push str.prodstartcode
call fcn.004070da
call fcn.00413d06
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00401e74
cmp edi, 0x20
setg al
jmp 0x41b2ae
xor al, al
call fcn.00451643
ret
Function at 0x41b610
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x46c767
call fcn.004515c0
mov ebx, ecx
lea eax, [ebx + 0x288]
cmp dword [eax + 0x18], 8
jb 0x41b62f
mov eax, dword [eax + 4]
jmp 0x41b632
add eax, 4
push eax
call fcn.0044c78b
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x600]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x5ec]
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x600]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x5ec]
lea edi, [ebp - 0x34]
lea esi, [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.0041cc05
test al, al
je 0x41b749
mov esi, edi
call fcn.0041cbab
mov ecx, dword [ebp - 0x38]
cmp dword [eax], ecx
je 0x41b68a
call fcn.0041cbd6
jmp 0x41b650
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x38], esp
push str.retry
call fcn.004070da
sub esp, 0x1c
xor edi, edi
mov dword [ebp - 4], edi
mov esi, esp
mov dword [ebp - 0x3c], esp
push str.cbs_down
call fcn.004070da
lea esi, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0041cbab
sub esp, 0x1c
add eax, 4
mov esi, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.00401bcf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004181fe
add esp, 0x54
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41b6f2
lea eax, [ebp - 0x28]
push 1
push edi
push edi
push eax
push 0x47b9d0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push 0x47ac8c
mov ebx, eax
call fcn.004070da
sub esp, 0x1c
mov byte [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x3c], esp
push str.browserdown
call fcn.004070da
mov byte [ebp - 4], 2
call fcn.00413ca3
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00401e74
cmp ebx, 0x20
setge al
jmp 0x41b74b
mov al, 1
call fcn.00451643
ret

Function at 0x41d666
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, 1
jne 0x41d6d8
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0044c18b
leave
ret
Function at 0x41dfc6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xc08
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0xc08], eax
push 0x2c
mov eax, 0x46c0da
call fcn.00451557
mov edi, ecx
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x24]
push str.Software_
xor esi, esi
push eax
lea ecx, [ebp + 0xc18]
mov dword [ebp - 4], esi
call fcn.0040b246
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
push 9
push esi
push dword [ebp - 0x24]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call edi
test eax, eax
je 0x41e05f
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, dword [ebp + 0xc18]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc08]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0xc0c
leave
ret
xor eax, eax
push 0x206
mov word [ebp + 0xa00], ax
lea eax, [ebp + 0xa02]
push esi
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], esi
call fcn.00451670
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xa00]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41e1b5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xa00]
push eax
push dword [ebp - 0x24]
lea eax, [ebp]
push str._ls_ls
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
push 9
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x38]
call edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x47bc88
push dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call ebx
test eax, eax
jne 0x41e120
cmp dword [ebp - 0x10], 4
jne 0x41e120
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0xc14]
jne 0x41e120
mov dword [ebp - 0x2c], 1
xor eax, eax
push 0x1fc
mov word [ebp + 0x800], ax
lea eax, [ebp + 0x802]
push esi
push eax
call fcn.00451670
add esp, 0xc
mov dword [ebp - 0x18], 0x1fe
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x2c], esi
je 0x41e17a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x800]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.InstallInfo
push dword [ebp - 0x30]
call ebx
test eax, eax
jne 0x41e17a
inc eax
cmp dword [ebp - 0x10], eax
jne 0x41e17a
cmp word [ebp + 0x800], si
jne 0x41e1b2
push esi
push esi
xor eax, eax
inc dword [ebp - 0x14]
push esi
push esi
mov word [ebp + 0xa00], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xa00]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x104
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41e0b1
jmp 0x41e1b5
mov dword [ebp - 0x34], eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x34]
jmp 0x41e021
Function at 0x41e212
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x26]
push esi
push eax
xor ebx, ebx
call fcn.00451670
mov eax, dword [ebp + 0x1ec]
lea ecx, [ebp - 0x28]
add esp, 0xc
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, si
jne 0x41e257
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00451670
add esp, 0xc
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
mov dword [ebp - 0x80], edi
push 0x8000000
xor edi, edi
inc edi
push edi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
push esi
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41e305
push 0x4e20
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41e2cf
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 0x2c], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41e2eb
cmp dword [ebp - 0x2c], esi
jne 0x41e2eb
mov ebx, edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x38], esi
je 0x41e2fb
push dword [ebp - 0x38]
call edi
cmp dword [ebp - 0x3c], esi
je 0x41e305
push dword [ebp - 0x3c]
call edi
mov eax, dword [ebp + 0x1ec]
add eax, 0xfffffff0
call fcn.004026ee
mov ecx, dword [ebp + 0x1e0]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0044c18b
add ebp, 0x1e4
leave
ret
Function at 0x41e32d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea ecx, [ebp - 0x78]
push ecx
xor eax, eax
xor ebx, ebx
inc ebx
push ebx
push eax
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v2.0
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
call esi
test eax, eax
jne 0x41e382
push dword [ebp - 0x78]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v2.0.50727
push edi
call esi
test eax, eax
jne 0x41e3a1
push dword [ebp - 0x80]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x70], eax
jne 0x41e3ad
cmp dword [ebp - 0x6c], eax
je 0x41e417
lea ecx, [ebp - 0x70]
push ecx
push ebx
push eax
push str.SOFTWAREMicrosoft.NETFramework_
push edi
call esi
test eax, eax
jne 0x41e417
xor esi, esi
push 0x206
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x7c], 0x104
call fcn.00451670
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push str.InstallRoot
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e40e
cmp dword [ebp - 0x6c], ebx
jne 0x41e40e
cmp word [ebp - 0x68], si
je 0x41e40e
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c18b
add ebp, 0x1a4
leave
ret
Function at 0x41e432
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x1c
mov eax, 0x46b46b
call fcn.00451557
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x479d3c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0040405f
test eax, eax
je 0x41e52e
call fcn.0041e32d
test eax, eax
je 0x41e52e
lea eax, [ebp - 0x10]
push eax
push 3
push ebx
push str.SOFTWAREMicrosoft.NETFramework_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x41e4cb
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
mov esi, str.NoGuiFromShim
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], ebx
jne 0x41e4cb
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8003
call esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x28], esp
mov edi, esp
call fcn.004021f2
add eax, 0x10
mov dword [edi], eax
call fcn.0041e212
pop ecx
cmp eax, ebx
je 0x41e508
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
cmp dword [ebp - 0x24], ebx
jne 0x41e52e
cmp dword [ebp - 0x14], ebx
jne 0x41e525
push str.NoGuiFromShim
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004026ee
mov eax, dword [ebp - 0x1c]
call fcn.0045162f
ret
Function at 0x41ec7f
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3f90]
mov eax, 0x4010
call fcn.00453cf0
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0x3f8c], eax
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.00451670
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x41ed1a
lea ecx, [ebp - 0x74]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41ed1a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x479d68
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41ed1a
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
mov eax, edi
call fcn.004044cd
xor eax, eax
add esp, 0x14
inc eax
jmp 0x41ed1c
xor eax, eax
mov ecx, dword [ebp + 0x3f8c]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0x3f90
leave
ret

Function at 0x41ee5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [ebp + eax*2 - 0x20e], 0x5c
je 0x41eea6
push 0x479d68
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0040266c
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0044c18b
leave
ret
Function at 0x41eec1
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0xe4
lea ebp, [esp - 4]
mov eax, dword [0x487ba4]
xor eax, ebp
mov dword [ebp + 0xe4], eax
push 0xc
mov eax, 0x46ba93
call fcn.00451557
mov eax, dword [ebp + 0xf0]
mov dword [ebp - 0x14], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
push 0xc6
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push edi
push eax
call fcn.00451670
add esp, 0xc
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers_
lea esi, [ebp]
mov dword [ebp - 0x18], edi
call fcn.004070da
cmp dword [ebp + 0x10c], 8
mov eax, dword [ebp + 0xf8]
jae 0x41ef30
lea eax, [ebp + 0xf8]
push 0x64
push eax
lea eax, [ebp + 0x1c]
push 0x64
push eax
call fcn.0044c19a
mov eax, dword [ebp + 4]
add esp, 0x10
cmp dword [ebp + 0x18], 8
jae 0x41ef4d
lea eax, [ebp + 4]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x20106
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x41ef9b
lea eax, [ebp + 0x1c]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp + 0x1c]
push eax
push 1
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x41efa7
lea eax, [ebp + 4]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x20206
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41efe9
lea eax, [ebp + 0x1c]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp + 0x1c]
push eax
push 1
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea esi, [ebp]
call fcn.00401e74
push edi
push 1
lea esi, [ebp + 0xf4]
call fcn.00401e74
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe4]
xor ecx, ebp
call fcn.0044c18b
add ebp, 0xe8
leave
ret
Function at 0x421398
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x46e995
call fcn.00451557
mov edi, ecx
mov eax, dword [ebp + 8]
sub eax, 0x111
push 1
pop ebx
je 0x421487
sub eax, 0x7f53
je 0x42145c
dec eax
je 0x421436
dec eax
je 0x421426
dec eax
je 0x42140c
sub eax, 0x155
je 0x4213ed
sub eax, 0x604
jne 0x421574
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call fcn.004237ae
jmp 0x42156f
mov dword [edi + 0x3a0], ebx
call fcn.00422c2c
mov eax, edi
call fcn.00423732
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x42156f
xor esi, esi
push esi
push esi
push 0x8064
call fcn.00427880
push esi
push esi
push 0x8065
jmp 0x421568
call fcn.00421aca
mov eax, edi
call fcn.00423732
push ebx
push ebx
jmp 0x4214af
mov eax, edi
call fcn.004218dc
xor eax, eax
push eax
push eax
push edi
push 0x422c1b
push eax
push eax
call fcn.00450f0e
add esp, 0x18
mov dword [edi + 0x3ac], eax
jmp 0x42156f
xor eax, eax
cmp dword [edi + 0x3a8], eax
jne 0x42156f
push eax
push eax
push edi
push 0x422c0d
push eax
push eax
call fcn.00450f0e
add esp, 0x18
mov dword [edi + 0x3a8], eax
jmp 0x42156f
cmp dword [ebp + 0xc], 0x208
jne 0x42156f
mov eax, dword [edi + 0x3c4]
mov byte [edi + 0x7c5], bl
cmp eax, 2
jne 0x4214bb
mov eax, edi
call fcn.00423732
push ebx
push 0
mov ecx, edi
call fcn.0042753d
jmp 0x42156f
cmp eax, ebx
jne 0x421537
mov eax, dword [edi + 0x3cc]
push ecx
sub eax, 0x10
mov dword [ebp + 0xc], esp
mov esi, esp
call fcn.004021f2
add eax, 0x10
mov dword [esi], eax
push dword [edi + 0x3c8]
call fcn.0041e1c6
pop ecx
pop ecx
test eax, eax
jne 0x421547
push 0x40
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push str.Information
push eax
call fcn.0040266c
and dword [ebp - 4], 0
push ecx
mov dword [ebp + 8], esp
mov esi, esp
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.tipmsg_close
push eax
call fcn.0040266c
push esi
push dword [edi + 0x390]
call fcn.0040dcb9
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
mov ecx, edi
call fcn.004235a4
cmp eax, ebx
je 0x421547
jmp 0x42156f
cmp eax, 3
jne 0x421547
mov ecx, dword [edi + 0x38c]
call fcn.0041b2b4
push ebx
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 0xc], esp
push str.closetype
call fcn.004070da
call fcn.00413d06
push 0
push 0
push 0x81bc
mov ecx, edi
call fcn.00427880
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, ebx
call fcn.0045162f
ret 0x10