joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea0c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004bb0d0
mov eax, dword [0x542af0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x101c], ecx
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.004b5c90
add esp, 0xc
push 0x514d64
mov edx, dword [ebp - 0x101c]
add edx, 0xa8
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.00404270
add esp, 0xc
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x800
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebp - 0x1018]
call fcn.00402ea0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
lea eax, [ebp + edx*2 - 0x1010]
push eax
call fcn.004b5b92
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4ea19e
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1014], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 1]
mov dword [ebp - 4], ecx
jmp 0x4ea164
mov eax, dword [ebp - 0x1014]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004b5b83
mov esp, ebp
pop ebp
ret
Function at 0x4ea3f0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8df3
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x542af0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x30]
call fcn.00407be0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4ea482
cmp dword [ebp - 0x3c], 0x6f
je 0x4ea482
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402990
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bb0
mov eax, dword [ebp + 8]
jmp 0x4ea5b7
mov eax, dword [ebp - 0x38]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ea4c3
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402990
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bb0
mov eax, dword [ebp + 8]
jmp 0x4ea5b7
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4ea50a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402990
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bb0
mov eax, dword [ebp + 8]
jmp 0x4ea5b7
lea ecx, [ebp - 0x34]
call fcn.00402e80
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_02X_02X_02X_02X_02X
lea edx, [ebp - 0x34]
push edx
call fcn.00407660
add esp, 0x20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x34]
call fcn.004072f0
push eax
lea ecx, [ebp - 0x30]
call fcn.00407bc0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402990
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00402ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5b83
mov esp, ebp
pop ebp
ret
Function at 0x4ea6d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8fa2
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x542af0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4ea7e7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x14]
call fcn.00402e80
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
push str._r_n_d__02d__02d__02d:_02d:_02d._03d_:__s
lea ecx, [ebp - 0x14]
push ecx
call fcn.004061c0
add esp, 0x28
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x290], 0xffffffff
je 0x4ea7b5
lea ecx, [ebp - 0x14]
call fcn.00403360
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x28c
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x38]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402ea0
jmp 0x4ea7d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x29c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eae70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9613
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x542af0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x24c]
call fcn.00402e80
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004b5c90
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4eaf8d
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4eaf8d
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x250]
jne 0x4eaf69
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x258], ecx
jmp 0x4eaf80
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4eaf4d
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], 0
jbe 0x4eb00e
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4eb00e
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4eb00e
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x258]
jne 0x4eafea
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.00403850
jmp 0x4eb001
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4eafc8
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004020d0
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00402ea0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5b83
mov esp, ebp
pop ebp
ret 4
Function at 0x4eba60
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x290], 0xffffffff
je 0x4ebac2
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x28c]
mov edx, dword [eax + 0x48]
call edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.004956e0
jmp 0x4ebae4
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.004072b0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00401280
push eax
lea ecx, [ebp - 8]
call fcn.00405850
movzx ecx, al
test ecx, ecx
je 0x4ebb35
push 0x3e8
lea ecx, [ebp - 8]
call fcn.00495790
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ebb33
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00495790
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4ebad6
mov ecx, dword [ebp - 0x1c]
call fcn.004eb060
mov ecx, dword [ebp - 0x1c]
call fcn.004e9ed0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
call fcn.00497b21
mov esp, ebp
pop ebp
ret
Function at 0x4ede00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CPoster.0
mov ecx, dword [ebp - 4]
mov dword [ecx + method.DuiLib::CContainerUI.virtual_0], vtable.CPoster.1.0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3fc], 0
je 0x4ede51
push 0x64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ede51
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
add ecx, 0x3f8
call fcn.00402ea0
mov ecx, dword [ebp - 4]
add ecx, 0x3f4
call fcn.00402ea0
mov ecx, dword [ebp - 4]
add ecx, 0x3f0
call fcn.00402ea0
mov ecx, dword [ebp - 4]
call sym.QiyiInstaller.exe_public_virtual:_void___thiscall_DuiLib::CContainerUI::destructor_void_
mov esp, ebp
pop ebp
ret
Function at 0x406987
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov ebx, 0x80070057
cmp dword [ebp + 0x14], esi
je 0x406a11
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x4069d7
cmp eax, 0xea
je 0x4069d7
cmp eax, esi
jle 0x406a0b
and eax, 0xffff
or eax, 0x80070000
jmp 0x406a0b
mov ebx, dword [ebp - 4]
shr ebx, 1
inc ebx
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.0040527d
mov edi, eax
pop ecx
cmp edi, esi
jne 0x4069f5
mov ebx, 0x8007000e
jmp 0x406a11
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040684e
mov ebx, eax
cmp ebx, esi
jge 0x406a1a
push edi
call fcn.004052cb
pop ecx
xor edi, edi
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x406a23
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
cmp eax, esi
je 0x406a2f
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
cmp eax, esi
je 0x406a3b
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18

Function at 0x406cc1
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, eax
mov edi, ecx
mov esi, 0x80070057
je 0x406d7f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + esi + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x406d02
mov esi, 0x8007000e
jmp 0x406d6f
inc esi
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x406d1b
call fcn.00404e35
mov esi, eax
jmp 0x406d6f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x406d5d
cmp eax, 2
je 0x406d5d
cmp eax, 3
je 0x406d59
cmp eax, 4
je 0x406d45
jbe 0x406d3e
cmp eax, 6
jbe 0x406d5d
mov esi, 0x80070057
jmp 0x406d6f
neg edi
sbb edi, edi
and edi, 0x7ff8fffb
add edi, 0x80070005
mov esi, edi
jmp 0x406d6f
xor esi, esi
jmp 0x406d6f
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fffb
add ebx, 0x80070005
mov esi, ebx
cmp dword [ebp - 4], 0
je 0x406d7f
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401661
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
xor esi, esi
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_memset
push 0x44
lea eax, [ebp - 0x58]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop esi
je 0x4016ca
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4016cf
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
mov esi, 0x400
push edi
lea eax, [ebp - 0x408]
push esi
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x408]
push str.msi.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x808]
push eax
push esi
lea eax, [ebp - 0x408]
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401754
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x808]
push 0x4061d4
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401754
mov edx, dword [ebp - 4]
mov eax, 0x20000
mov ecx, dword [edx + 8]
cmp ecx, eax
ja 0x401751
jne 0x401754
cmp dword [edx + 0xc], 0xa280000
jb 0x401754
push 1
pop edi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40175a
Capabilities:
Check os version
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
push ebx
push esi
mov esi, 0x94
push edi
push esi
lea eax, [ebp - 0x94]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x4017ac
cmp dword [ebp - 0x8c], 2
jne 0x4017ac
mov dword [0x407758], 1
mov esi, dword [ebp + 0xc]
push esi
push 0x400
call fcn.004010bd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
push str.instmsi.exe
push esi
call ebx
cmp dword [ebp - 0x84], 1
push esi
jne 0x4017dd
push str.WI_WIN32_INSTALLER
push 0x66
jmp 0x4017e4
push str.WI_WINNT_INSTALLER
push 0x67
push dword [ebp + 8]
call fcn.00401598
mov edi, eax
add esp, 0x10
test edi, edi
je 0x401849
push esi
lea eax, [ebp - 0x494]
push str.__s___C:_msiinst.exe__delayreboot_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x494]
push eax
call fcn.00401661
add esp, 0x10
mov ecx, 0xbc2
test eax, eax
je 0x401824
cmp eax, ecx
jne 0x401849
push 1
cmp eax, ecx
pop edi
jne 0x401849
push str.REBOOT
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x401849
push str._REBOOTFORCE_JAVAREBOOT1
push dword [ebp + 0x10]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401857
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [0x407758], esi
je 0x401878
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
pop esi
jmp 0x4018c6
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018d4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
push 0
push str.InstallerLocation
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4018b9
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4018d4
push str.msiexec.exe
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, esi
pop esi
leave
ret

Function at 0x4019d6
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.00401909
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str._sSun_
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x10
push 0
push esi
call ebx
push esi
push str._sJava_
push esi
call edi
add esp, 0xc
push 0
push esi
call ebx
mov ebp, 0x406068
push str.1.5.0_15
push ebp
push esi
push str._s_s_s
push esi
call edi
add esp, 0x14
push 0
push esi
call ebx
push str.1.5.0_15
push ebp
push esi
push str._s_s_s.msi
push esi
call edi
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402bdf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
and dword [ebp - 4], 0
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x402c96
cmp dword [ebp - 0x94], 6
je 0x402c91
cmp dword [ebp - 0x94], 5
jne 0x402c96
cmp dword [ebp - 0x90], 1
jae 0x402c91
lea eax, [ebp - 0x84]
test eax, eax
je 0x402c82
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x402c82
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x402c82
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push str.Service_Pack__d
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp - 0x90], 0
jne 0x402c96
cmp dword [ebp - 4], 2
jb 0x402c96
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x402c9a
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x404448
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x114
push esi
xor esi, esi
push edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x1c]
mov edi, 0x20019
push eax
push edi
push esi
push str.SOFTWARE
push 0x80000002
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x402cf5
lea ecx, [ebp - 0x18]
call fcn.00402411
mov ecx, dword [ebp - 0x1c]
cmp eax, esi
mov dword [ebp - 0x18], ecx
je 0x402d15
lea ecx, [ebp - 0x10]
call fcn.00402411
lea ecx, [ebp - 0x14]
call fcn.00402411
cmp dword [ebp - 0x18], esi
je 0x402d67
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402d67
push edi
push str.JavaSoft
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402e7a
test eax, eax
jne 0x402d3d
push edi
push str.Java_Runtime_Environment
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.00402e7a
test eax, eax
je 0x402d6e
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x402d50
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x14], esi
je 0x402d5d
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x18], esi
je 0x402d67
push dword [ebp - 0x18]
call edi
xor eax, eax
jmp 0x402e6c
push ebx
lea eax, [ebp - 0x120]
push 0x40775c
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
pop ecx
mov ebx, 0x80
lea eax, [ebp - 0xa0]
push ebx
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 1
call edi
test eax, eax
jne 0x402e3e
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
test eax, eax
pop ecx
jle 0x402e09
lea eax, [ebp - 0xa0]
push str.1.5.0_15
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x402e09
lea eax, [ebp - 0xa0]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 3
pop ecx
jbe 0x402e09
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov dword [ebp - 0x20], 1
pop ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xa0]
push ebx
push ecx
push eax
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x402daa
cmp dword [ebp - 0x20], esi
je 0x402e3e
lea eax, [ebp - 0x120]
push eax
push 0x4060f0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
je 0x402e52
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x14], esi
je 0x402e5f
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x18], esi
je 0x402e69
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret