joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462b24
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4e3bf8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x462b6a
cmp word [ebx], dx
jne 0x462b6a
or byte [eax + edi + 0x28], 4
jmp 0x462b6f
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x462cd2
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x462cb2
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x462bb0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x462be6
cmp eax, edx
jae 0x462bf4
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x462b8b
jmp 0x462cd2
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462cad
cmp dword [ebp - 0x18], 0
je 0x462cad
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4e3bf8]
test byte [eax + edi + 0x28], 0x48
je 0x462c83
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x462c47
mov word [esi], cx
jmp 0x462c7e
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4e3bf8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4e3bf8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4e3bf8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x462cd2
pop eax
cmp word [ebp - 4], ax
jne 0x462c93
cmp esi, ebx
jne 0x462c93
mov word [esi], ax
jmp 0x462ccf
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00462350
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x462cd2
push 0xd
pop eax
jmp 0x462c8e
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4e3bf8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x462ccc
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x462cd2
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x467bba
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47d358
push 0x47d350
push str.FlsAlloc
push 0x1f
call fcn.00467a25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x467bee
push dword [ebp + 8]
mov ecx, esi
call dword [0x4782cc]
call esi
jmp 0x467bf4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x467c38
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47d368
push 0x47d360
push str.FlsGetValue
push 0x21
call fcn.00467a25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x467c6f
push dword [ebp + 8]
mov ecx, esi
call dword [0x4782cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x467c77
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47d370
push 0x47d368
push str.FlsSetValue
push 0x22
call fcn.00467a25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x467cb1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4782cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x46babb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x46bb58
push ebx
push esi
call fcn.0046ba84
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0046ba18
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x46bb05
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x46bb57
push edi
push eax
call fcn.00464d57
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x46bb25
call fcn.00463549
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x46bb56
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0046ba18
add esp, 0x20
test eax, eax
jne 0x46bb44
push edi
call fcn.00463549
jmp 0x46bb4c
push ebx
call fcn.00463549
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x46bb5b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x46bb6c
pop esi
ret
push ebx
push edi
push esi
call fcn.0046ba84
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00464d57
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x46bb94
push ebx
push esi
push edi
call fcn.0044efd0
add esp, 0xc
push 0
call fcn.00463549
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x46c2ee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046be09

Function at 0x46ed65
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004626ec
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46edd4
cmp esi, dword [ebp - 4]
je 0x46edcf
cmp dword [ebp + 0xc], 0
je 0x46edcf
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x46edac
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0046e8b7
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x46edd6
xor eax, eax
inc eax
jmp 0x46edd6
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x46ee3b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49401c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004626ec
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004626ec
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x46eeb2
cmp word [ecx], dx
je 0x46eeb2
mov eax, dword [0x47da54]
push edi
dec eax
push eax
push 0x47d940
call fcn.0046edda
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x46ef25
cmp word [eax], dx
je 0x46ef25
mov eax, dword [edi]
test eax, eax
je 0x46eed6
cmp word [eax], dx
je 0x46eed6
lea eax, [ebp - 0x10]
push eax
call fcn.0046e7bd
jmp 0x46eedf
lea eax, [ebp - 0x10]
push eax
call fcn.0046e858
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x46ef4f
mov eax, dword [0x47d93c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x47d630
call fcn.0046edda
add esp, 0xc
test al, al
je 0x46ef4f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x46ef1a
cmp word [eax], di
je 0x46ef1a
lea eax, [ebp - 0x10]
push eax
call fcn.0046e7bd
pop ecx
jmp 0x46ef51
lea eax, [ebp - 0x10]
push eax
call fcn.0046e858
jmp 0x46ef17
mov eax, dword [edi]
test eax, eax
je 0x46ef3c
cmp word [eax], dx
je 0x46ef3c
lea eax, [ebp - 0x10]
push eax
call fcn.0046e772
pop ecx
jmp 0x46ef4f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x46f01a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0046ec5f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x46f01a
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x46f01a
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x46f01a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46efa7
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00467e53
test ebx, ebx
je 0x46f015
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00467e53
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46f01a
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46f01a
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00473f29
add esp, 0x10
xor eax, eax
inc eax
jmp 0x46f01c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439352
leave
ret
Function at 0x474485
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00474401
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4745f4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4745f4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4745a9
jg 0x4744e1
test eax, eax
je 0x47459f
push 1
push 0x1000
call fcn.00468c10
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x474504
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x474596
push 0x8000
push ebx
call fcn.0045d7ba
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x47452d
jg 0x474528
cmp ecx, 0x1000
jb 0x47452d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00464217
add esp, 0x10
cmp eax, 0xffffffff
je 0x474572
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x474528
jl 0x474559
test ecx, ecx
jne 0x47451a
push dword [ebp - 0xc]
push ebx
call fcn.0045d7ba
push esi
call fcn.00463549
add esp, 0xc
xor ebx, ebx
jmp 0x474602
cmp byte [edi + 0x24], 0
je 0x474589
cmp dword [edi + 0x20], 5
jne 0x474589
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x474594
mov ebx, dword [edi + 0x18]
jmp 0x474596
xor ebx, ebx
push esi
call fcn.00463549
pop ecx
jmp 0x474602
test ecx, ecx
jg 0x47456b
jl 0x4745a9
test eax, eax
jae 0x47456b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00462350
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4745c9
cmp byte [edi + 0x1c], 0
je 0x47456b
jmp 0x4745fa
push ebx
call fcn.0046cc35
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x47456b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x474602
cmp byte [edi + 0x1c], 0
je 0x4745ff
mov ebx, dword [edi + 0x18]
jmp 0x474602
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00462350
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40533f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
inc esi
dec esi
inc ebp
cmp byte [edi + 0x36], al
add esp, 4
pop esi
push ebx
xor ebx, 0x11d43
xor ebx, 0x1153c
pop ebx
push esi
or esi, 0x10d09
pop esi
mov dword [ebp - 0xab8], 0
push eax
or eax, 0x60fb
or eax, 0x12137
call 0x40532c
add byte [ebx], dh
cmp al, byte [ebp + ecx*2 + 0x45]
cmp dword [edx], esi
dec esi
add esp, 4
call 0x40533f
add byte [eax + 0x3c], dl
cmp edi, dword [edi]
cmp esi, dword [esi]
xor eax, 0x83473f4c
les eax, [eax + ebx*2]
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
invalid
invalid
mov dh, bh
invalid
Function at 0x405c93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x405c93
add byte [eax + 0x3c], al
xor eax, 0x8333504e
les eax, [edx + ebx*2]
push edi
push ebx
add esp, 4
add edi, 0x114e7
or edi, 0x9a7
or edi, 0x11b14
jmp 0x405cb7
pop edi
cmp dword [ebp - 0x750], 0
jne 0x405d02
push esi
push ecx
add esp, 4
or esi, 0x10143
pop esi
push ecx
push edx
add esp, 4
jmp 0x405cdb
or ecx, 0x11725
and ecx, 0x2796
pop ecx
push ebx
jmp 0x405cf2
pop ebx
mov dword [ebp - 0x79c], 0
jmp 0x406829
push esi
push eax
add esp, 4
xor esi, 0x3f78
jmp 0x405d13
pop esi
push edi
push ecx
add esp, 4
or edi, 0x145e6
and edi, 0x14d85
pop edi
push edx
xor edx, 0x132b
add edx, 0x39e7
pop edx
mov eax, dword [ebp - 0x750]
mov al, 0xf8
invalid
dec dword [ebx - 0x7276e7b8]
loopne 0x405d3d
invalid
inc edi
test dword [eax + 0xfffff8], esp
add byte [eax], al
add byte [ebx - 0x31f6b], cl
dec dword [ecx - 0x15ef6b]
inc dword [ebx - 0x15ef43]
inc dword [eax]
jne 0x405d73
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x406064
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x405d9b
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x406064
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x405dcd
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x406064
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x405df2
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x406064
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x196c], ecx
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
Function at 0x406c06
Capabilities:
Get number of processors

Disassembly:
mov dword [ebp - 0x514], ecx
push edi
push ebx
add esp, 4
sub edi, 0x4ed9
call 0x406b1b
add byte [ebx + 0x46], cl
cmp bh, byte [ebx]
push eax
inc edx
inc edi
inc esi
cmp eax, dword [ebx - 0x307efb3c]
int1
cmp dword [ecx], eax
add byte [edi + 0x50], bl
or eax, 0xec27
add byte [ecx + 0x1606dc8], al
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
or ebx, 0xe984
and ebx, 0xda14
pop ebx
push eax
push edx
add esp, 4
add eax, 0x15
xor eax, 0x180c7
pop eax
push ecx
push esi
add esp, 4
add ecx, 0xf56d
and ecx, 0x10ad5
pop ecx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push eax
call 0x406bf6
add byte [eax + 0x3f], cl
cmp eax, 0x4d4c3b45
inc edx
inc esi
add esp, 4
call 0x406c06
add byte [edi + 0x4b414c3f], dh
add esp, 4
xor eax, 0xd120
jmp 0x406c17
pop eax
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406c35
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406c8f
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406b5d
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406b5d
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406c79
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406c83
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406cd8
push eax
and eax, 0x47a6
and eax, 0xe760
sub eax, 0x5292
jmp 0x406cb0
pop eax
push ecx
or ecx, 0xca1b
jmp 0x406cc1
pop ecx
push edi
xor edi, 0x4fea
pop edi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406d40
push eax
push ebx
add esp, 4
jmp 0x406ce5
pop eax
push ebx
push ecx
add esp, 4
add ebx, 0x9a6f
pop ebx
push edx
push ecx
add esp, 4
add edx, 0x4c84
and edx, 0x16196
add edx, 0x13682
pop edx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d36
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b01
mov dword [ebp - 0x2fc], 0
Function at 0x431c46
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x51bda9
call fcn.004f21c7
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x23c], ebx
test byte [0x5875b4], 1
push 7
mov dword [ebp - 0x240], edi
pop esi
jne 0x431c97
or dword [0x5875b4], 1
xor eax, eax
push 0x529148
mov dword [0x5875b0], esi
mov dword [0x5875ac], ebx
mov word [0x58759c], ax
call fcn.004e9f4f
pop ecx
cmp byte [0x586ca8], 1
jne 0x431cb3
push 0x587598
mov esi, edi
call fcn.004250eb
mov eax, edi
jmp 0x431d90
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x587598
test eax, eax
je 0x431d7b
xor eax, eax
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x21c]
call fcn.0040dcc8
pop ecx
pop ecx
test al, al
je 0x431d69
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040dd87
pop ecx
pop ecx
test al, al
jne 0x431d54
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040df58
pop ecx
pop ecx
jmp 0x431d56
mov al, 1
cmp al, bl
je 0x431d69
push 0xffffffffffffffff
push ebx
push edi
lea eax, [ebp - 0x238]
call fcn.00404bcd
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x238]
call fcn.00404e82
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x586ca8], 1
call fcn.004250eb
mov eax, esi
call fcn.004f224a
ret
Function at 0x442a8c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x442aa7
xor eax, eax
jmp 0x442ba4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x442aa0
push edi
call fcn.00405f50
pop ecx
test eax, eax
jne 0x442ac8
cmp dword [ebp + 0x10], ebx
je 0x442aa0
push edi
call dword [ebp + 0x10]
jmp 0x442aa0
cmp dword [ebp + 8], ebx
je 0x442ada
push dword [ebp + 8]
call fcn.004e73fa
pop ecx
mov esi, eax
jmp 0x442adc
xor esi, esi
push edi
call fcn.004e73fa
mov dword [esp], 0x582e91
lea esi, [eax + esi + 4]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004eb416
pop ecx
pop ecx
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x442aa0
cmp dword [ebp + 8], ebx
je 0x442b27
push dword [ebp + 8]
push edi
push 0x540158
push esi
push eax
call fcn.004ef4ec
add esp, 0x14
jmp 0x442b37
push edi
push str.__s_
push esi
push eax
call fcn.004ef4ec
add esp, 0x10
push 0x40
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.004e7380
xor eax, eax
mov dword [esp + 0x1c], ebx
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [esp + 0x50], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x44], 0x44
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
je 0x442b98
push dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x10]
call edi
push dword [esp + 0xc]
call fcn.004e85e3
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442f35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
je 0x442fb6
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x442fad
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x442fad
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x442fa6
push ebx
call fcn.004eaa86
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x442fa6
push ebx
push dword [ebp + 8]
push eax
call fcn.004ea300
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x442ff3
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x53c890
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x442fea
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
push dword [ebp - 4]
call fcn.004e8476
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x443389
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp word [0x585d80], 0
push esi
push edi
mov esi, 0x585d80
jne 0x4433cb
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x207
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [0x585f88], 0
mov edi, 0x104
jne 0x4433ee
push esi
push 0x53aeb4
push edi
push 0x585f88
call fcn.004250b8
add esp, 0x10
cmp word [0x586190], 0
jne 0x443404
push esi
push edi
mov edx, 0x586190
call fcn.00424ffd
pop edi
pop esi
leave
ret