joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c00
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45eb4e
call fcn.0043f27d
push 0x467648
mov ecx, 0x481168
call fcn.004029d3
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x409c3d
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.004047d4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
jmp 0x40f9b0
lea ecx, [ebp - 0x38]
call fcn.00435f1b
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46765c
lea edi, [ebp - 0x38]
call fcn.004014ea
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.004014ea
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.004188ce
cmp dword [ebp - 0x30], ebx
pop ecx
pop ecx
jle 0x409d37
mov edi, 0x48113c
push 0x467660
mov ecx, edi
call fcn.00424850
test eax, eax
je 0x409d1c
push str.LI_SKIP_EULA
mov ecx, edi
call fcn.00424850
test eax, eax
je 0x409d1c
cmp dword [ebp - 0x30], 1
jle 0x409d1c
cmp dword [ebp - 0x30], ebx
jg 0x409cbe
jmp fcn.004307d8
mov ecx, dword [ebp - 0x34]
push 0x467690
call fcn.0040443b
test eax, eax
jne 0x409d1c
cmp dword [ebp - 0x30], 1
jle 0x409cb9
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
lea ecx, [esi + 0x98]
call fcn.0040acf3
push ebx
mov byte [esi + 0xac], 1
mov eax, dword [0x48107c]
push ebx
push 0x401
push dword [eax + 0x30]
mov dword [eax + 0x58], ebx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [0x481138]
cmp eax, ebx
je 0x409d1c
push ebx
push ebx
push 0x467608
push eax
call fcn.00416da5
cmp byte [esi + 0xac], bl
jne 0x409d37
cmp dword [ebp - 0x30], ebx
jle 0x409cb9
push dword [ebp - 0x34]
lea ecx, [esi + 0x98]
call fcn.0040acf3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004360cc
call fcn.0043f355
ret

Function at 0x409d49
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45eb4e
call fcn.0043f27d
push 0x467648
mov ecx, 0x481168
call fcn.004029d3
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x409d85
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.004047d4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
jmp 0x40f9b0
lea ecx, [ebp - 0x38]
call fcn.00435f1b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46765c
lea edi, [ebp - 0x38]
call fcn.004014ea
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.004014ea
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
call fcn.004188ce
cmp byte [esi + 0xac], 0
pop ecx
pop ecx
mov edi, ebx
je 0x409dd4
push 2
pop edi
mov ebx, dword [ebp - 0x30]
jmp 0x409e1f
test edi, edi
jl 0x409e35
cmp edi, dword [ebp - 0x30]
jge 0x409e35
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x409e1e
push str.CProgressPage
push eax
call fcn.0040a97a
test al, al
pop ecx
pop ecx
je 0x409e07
push esi
call fcn.00409f7e
cmp edi, dword [ebp - 0x30]
jge 0x409e35
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
push eax
lea ecx, [esi + 0x98]
call fcn.0040acf3
inc edi
cmp edi, ebx
jb 0x409dd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004360cc
call fcn.0043f355
ret
jmp fcn.004307d8
Function at 0x40cb1e
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x45d1ba
call fcn.0043f27d
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0x26
jne 0x40ccec
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.004052fc
mov byte [ebp - 4], 1
mov esi, 0x465e5c
push esi
push 0x468118
lea eax, [ebp - 0x10]
push eax
call fcn.0040d3ff
push esi
push 0x46811c
lea eax, [ebp - 0x10]
push eax
call fcn.0040d3ff
lea ecx, [ebp - 0x30]
call fcn.00435f1b
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x466ea0
lea edi, [ebp - 0x30]
call fcn.004014ea
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004052fc
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004188ce
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.004015a9
xor edi, edi
cmp dword [ebp - 0x28], ebx
jle 0x40cc3a
push edi
lea ecx, [ebp - 0x30]
call fcn.0040d5dc
push eax
lea ecx, [ebp - 0x14]
call fcn.004052fc
mov byte [ebp - 4], 5
cmp edi, 3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
jl 0x40cd1b
xor esi, esi
cmp eax, ebx
jle 0x40cc28
lea ecx, [esi + 1]
cmp eax, ecx
jle 0x40cc06
lea eax, [ebp - 0x14]
call fcn.004088d1
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404043
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.004088d1
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404043
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
inc esi
inc esi
cmp esi, eax
jl 0x40cbeb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401b2a
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x40cbc0
lea ecx, [ebp - 0x18]
call fcn.0040897a
mov byte [ebp - 4], 6
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x468120
push eax
call fcn.00402001
add esp, 0xc
call fcn.00418887
neg al
mov dword [ebp - 0x14], ebx
sbb eax, eax
and eax, 0x200
add eax, 0x20006
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40ccbd
lea ecx, [ebp - 0x14]
call fcn.00409100
cmp eax, ebx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jne 0x40ccbd
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push ebx
push str.DeploymentFlags
push ecx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14]
call fcn.00409100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b2a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004360cc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401b2a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401b2a
call fcn.0043f355
ret 4
lea esi, [eax - 1]
mov ecx, esi
lea eax, [ebp - 0x14]
call fcn.004088d1
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00404043
mov eax, esi
cmp eax, ebx
jg 0x40cd00
jmp 0x40cc28
Function at 0x40d61e
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x45e41a
call fcn.0043f2b0
lea ecx, [ebp - 0x2c]
call fcn.004308e3
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040897a
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.00408a41
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
push 0x468224
lea ecx, [ebp - 0x18]
call fcn.004183cf
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x40d697
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.0041a460
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401b2a
or dword [ebp - 4], 0xffffffff
call fcn.004308f9
mov eax, dword [ebp - 0x20]
jmp 0x40d71a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
call fcn.00427160
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x40d66d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40d6c0
and dword [ebp - 0x18], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x1c]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401ac5
push str..exe
mov ecx, esi
call fcn.004092d0
push dword [esi]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40d66d
call fcn.00403147
mov dword [ebp - 0x20], eax
jmp 0x40d66d
call fcn.0043f355
ret 0x14
Function at 0x40f300
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x47b038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x465e5c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f360
push 0x800
call eax
test eax, eax
jne 0x40f359
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40f365
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40f365
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40f4d9
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.0043d395
add esp, 0xc
test eax, eax
jne 0x40f4bd
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043f390
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043da49
push 0x468758
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043da49
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x430]
jmp 0x40f4c4
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40f42d
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043af43
leave
ret
Function at 0x40f77a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00435133
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40f79b
xor eax, eax
jmp 0x40f7ae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f797
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x410717
Capabilities:
Terminate process

Disassembly:
push 0x40c
mov eax, 0x45e4d3
call fcn.0043f2e6
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
je 0x4107e0
mov eax, dword [0x481138]
cmp eax, ebx
je 0x410755
push ebx
push ebx
push eax
mov esi, edi
call fcn.00417059
push 0x461614
mov ecx, edi
call fcn.004313bd
test eax, eax
jne 0x410775
push 0x46643c
mov ecx, edi
call fcn.004313bd
test eax, eax
je 0x4107e0
mov eax, dword [edi]
push ebx
push 0x200
lea ecx, [ebp - 0x410]
push ecx
mov ecx, edi
call dword [eax + 0xc]
xor esi, esi
inc esi
test eax, eax
lea eax, [ebp - 0x414]
push eax
push 0x480fb8
je 0x4107b2
call fcn.0040f4e6
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push 0x10
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x4107c4
call fcn.0040f4e6
mov dword [ebp - 4], esi
mov eax, dword [eax]
push 0x10
push eax
push str.Out_of_memory_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00401b2a
push esi
call fcn.0043dee3
mov eax, dword [ebp - 0x414]
xor esi, esi
inc esi
mov dword [eax + 0xac], esi
mov dword [0x481068], esi
mov esi, dword [0x480fd8]
call fcn.00409a9a
cmp edi, ebx
je 0x410818
push dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push edi
call fcn.00436f02
mov ebx, eax
mov eax, ebx
call fcn.0043f369
ret 8
Function at 0x411352
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x45b506
call fcn.0043f2e6
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
mov dword [ebp - 0x3c], edi
je 0x41146f
cmp byte [edi + 0x41], bl
je 0x41146f
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x41138a
xor al, al
jmp 0x411471
lea esi, [ebp - 0x30]
call fcn.004110af
mov dword [ebp - 4], ebx
lea eax, [edi + 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0041112e
mov esi, eax
call fcn.0041119f
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0041112e
mov esi, eax
call fcn.0041119f
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x4113ef
dec eax
je 0x4113f2
dec eax
dec eax
jne 0x41145b
mov bl, 1
jmp 0x41145b
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.0041112e
mov esi, eax
call fcn.0041119f
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x411437
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.0041112e
mov esi, eax
call fcn.0041119f
push eax
call fcn.0043d78d
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x411459
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x4113eb
test ecx, ecx
jne 0x41139b
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.004110e7
mov edi, dword [ebp - 0x3c]
jmp 0x41139b
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004129e1
mov al, bl
jmp 0x411471
mov al, 1
call fcn.0043f369
ret

Function at 0x412b8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412bf1
cmp dword [ebp + 0xc], 1
je 0x412bca
cmp dword [ebp + 0xc], 2
je 0x412bca
push 0xd
pop eax
jmp 0x412bf1
test edi, edi
mov eax, dword [ebp - 4]
je 0x412beb
test eax, eax
je 0x412be7
test al, 1
jne 0x412bc5
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x412beb
jmp 0x412bc5
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x412cf4
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x45de2d
call fcn.0043f27d
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x412d3c
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.004091a1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x412d22
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.00435219
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.00435219
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.004360cc
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041440d
call fcn.0043f355
ret

Function at 0x413375
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x45b27f
call fcn.0043f27d
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4133b7
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4133b7
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401b2a
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043f355
ret
Function at 0x4183cf
Capabilities:
Get common file path

Disassembly:
push 0x24
mov eax, 0x45b067
call fcn.0043f2b0
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.004308e3
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.00401635
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.0040897a
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.0040d5fb
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x418444
call fcn.00403147
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b2a
or dword [ebp - 4], 0xffffffff
call fcn.004308f9
mov eax, esi
jmp 0x418567
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040548c
lea ecx, [ebp - 0x18]
call fcn.0040897a
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.0040d5fb
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x41849e
call fcn.00403147
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b2a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b2a
mov dword [ebp - 4], ebx
jmp 0x418438
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040548c
lea eax, [ebp - 0x1c]
push eax
call fcn.00408a41
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x4184fe
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a460
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b2a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b2a
mov dword [ebp - 4], ebx
jmp 0x41855f
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.0040157f
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a460
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b2a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b2a
mov dword [ebp - 4], ebx
call fcn.004308f9
xor eax, eax
jmp 0x418567
call fcn.004308f9
mov eax, dword [ebp - 0x24]
call fcn.0043f355
ret

Function at 0x41856d
Capabilities:
Accept command line arguments

Disassembly:
push 0x18
mov eax, 0x45b02d
call fcn.0043f2b0
mov edi, ecx
call fcn.00401635
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x4185a0
call fcn.00403147
jmp 0x41860b
lea ecx, [ebp - 0x24]
call fcn.004308e3
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
push dword [esi]
mov ecx, edi
call fcn.0040157f
or dword [ebp - 4], 0xffffffff
call fcn.004308f9
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
neg eax
sbb eax, eax
and eax, 0x5ffefffe
add eax, 0xa0010002
jmp 0x41860b
call fcn.0043f355
ret
Function at 0x418611
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x45be85
call fcn.0043f27d
lea ecx, [ebp - 0x10]
call fcn.0040897a
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041856d
xor ecx, ecx
test eax, eax
setge cl
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
mov esi, ecx
call fcn.0043f390
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push edi
push 0x1000000
push edi
neg esi
push edi
sbb esi, esi
and esi, dword [ebp - 0x10]
push edi
call fcn.0040d549
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.0040548c
cmp esi, edi
jne 0x4186a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401b2a
mov eax, edi
call fcn.0043f355
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x20]
jmp 0x418695
Function at 0x418a11
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x45cbf6
call fcn.0043f2e6
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.00408dd4
mov ecx, dword [ebp - 0x22c]
push 0x465e5c
call fcn.004014ea
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.004014ea
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x418c2d
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x418c2d
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x418c11
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.004014ea
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.0040897a
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x418bf3
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.004014ea
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.00418976
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401ada
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b2a
lea edi, [ebp - 0x220]
call fcn.00408dd4
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0040443b
test eax, eax
jne 0x418bf3
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.004014ea
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.00418976
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401ac5
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b2a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401b2a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.00401b2a
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x418ac3
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00401b2a
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401b2a
mov eax, dword [ebp - 0x22c]
call fcn.0043f369
ret