joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007748
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0x170a
mov dword [0x1001af84], 0
mov dword [0x1001af88], 0
mov dword [0x1001af94], 0
mov dword [0x1001af7c], 0x170a
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x100078c2
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1001af84], edx
add ecx, 0xffffe6ec
mov dword [0x1001af7c], ecx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x1001af88], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1001af8c], cl
mov dword [0x1001af7c], 0x11c7
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1001af7c]
add edx, 0xffffd940
mov dword [0x1001af7c], edx
mov cl, byte [0x1001af8c]
mov edx, dword [0x1001af88]
mov byte [edi + edx], cl
mov dword [0x1001af80], 0x1a03
mov edx, dword [0x1001af84]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1001af88]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1001af94], ebx
mov dword [0x1001af80], 0xd2d
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], cl
mov dword [0x1001af80], 0x1454
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x38], ebx
je 0x100078c2
mov eax, dword [0x1001af7c]
mov ecx, dword [0x1001af84]
mov edx, dword [0x1001af88]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
jmp 0x100077b3
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007c05
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x100092ec]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x1001af7c]
add ebx, 0x247
mov dword [0x1001af7c], ebx
mov dword [0x1001af80], 0x1a1d
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.100070fa
mov dword [0x1001af7c], 0x8c5
call fcn.1000807a
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.100078ca
mov ecx, dword [0x1001af7c]
mov edx, ecx
add edx, 0xfffff45b
mov dword [0x1001af7c], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0
je 0x10007d56
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
add ecx, 0xd9b
mov dword [0x1001af7c], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.10007a55
mov eax, dword [ebp - 0x48]
mov word [eax], 0x5a4d
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x44], ecx
mov dword [0x1001af7c], 0xcb7
mov dword [0x1001af80], 0xfffffa1f
add ecx, 0x22dd
mov esi, dword [ebp - 0x48]
cmp esi, 0
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
je 0x10007d4b
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007e9c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [0x1001af7c], 0xfba
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [0x1001af7c], 0xb30
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x10007f3e
jmp 0x10007f5c
xor eax, eax
mov dword [0x1001af7c], 0x187b
mov dword [ebp - 0x20], eax
jmp 0x10008029
mov dword [0x1001af7c], 0xcfb
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x26], dx
mov eax, 1
mov cx, word [ebp - 0x26]
cmp cx, 0x6c
mov dword [ebp - 0x20], eax
je 0x10008029
jmp 0x10007ef8
mov eax, dword [ebp - 0x1c]
mov dword [0x1001af80], 0xb13
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
je 0x10007fa1
jmp 0x10007ef8
mov dword [0x1001af7c], 0x9a7
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x10007ee0
jmp 0x10007f3e
mov dword [0x1001af7c], 0x1cec
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10007fcd
jmp 0x10007ef8
mov dword [0x1001af80], 0x7b7
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x6f
je 0x10007f83
jmp 0x10007ef8
mov dword [0x1001af7c], 0x14d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10007ef8
mov dword [0x1001af7c], 0xffffef9a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10007ef8
mov dword [0x1001af80], 0x2308
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10007f0c
jmp 0x10007ef8
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7488066f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xe9f4aa0
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x7fb1320e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5d775d86
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4027f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x451afb
call fcn.0043baf1
lea ecx, [ebp - 0x1c]
call fcn.0042b3a8
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402a21
or dword [ebp - 4], 0xffffffff
call fcn.0042b3be
and dword [ebp - 0x18], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4028f8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4028ef
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x4028f8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4028f8
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, edi
je 0x4028bb
cmp word [esi], bx
jne 0x4028b7
cmp dword [ebp - 0x20], ebx
je 0x4028b1
push dword [ebp - 0x20]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
call fcn.0040298b
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
jmp 0x4028b7
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x402887
or dword [ebp - 4], 0xffffffff
jmp 0x4028f6
mov dword [ebp - 0x18], 1
jmp 0x402900
call fcn.00403049
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x402923
call fcn.0043bb96
ret 4
Function at 0x40c4ea
Capabilities:
Move file

Disassembly:
push 0x24
mov eax, 0x453448
call fcn.0043baf1
lea ecx, [ebp - 0x30]
call fcn.0042b3a8
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0041596f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.00408408
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
push 0x45cc88
lea ecx, [ebp - 0x14]
call fcn.00413511
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x40c566
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.00415805
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004102dc
or dword [ebp - 4], 0xffffffff
call fcn.0042b3be
mov eax, dword [ebp - 0x1c]
call fcn.0043bb96
ret 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
call fcn.004190c0
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x40c539
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40c58f
and dword [ebp - 0x14], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x18]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401aad
push str..exe
mov ecx, esi
call fcn.00408681
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40c539
call fcn.00403049
mov dword [ebp - 0x1c], eax
jmp 0x40c539
Function at 0x40d906
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x46dd08]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Calling_SetDllDirectory_n
call ebx
push 0x45ae5c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d966
push 0x800
call eax
test eax, eax
jne 0x40d95f
push str.Failed_to_SetDefaultDlLDirectories_n
jmp 0x40d96b
push str.Succeeded_to_SetDefaultDlLDirectories_n
jmp 0x40d96b
push str.Failed_to_load_SetDefaultDlLDirectories_n
call ebx
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40dadf
push esi
push edi
lea esi, [ebp + eax*2 - 0x428]
mov edi, 0x103
sub edi, eax
mov word [esi], 0x5c
inc esi
inc esi
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x468], str.BCRYPT.DLL
mov dword [ebp - 0x464], str.RSAENH.DLL
mov dword [ebp - 0x460], str.CRYPT32.DLL
mov dword [ebp - 0x45c], str.MSASN1.DLL
mov dword [ebp - 0x458], str.USERENV.DLL
mov dword [ebp - 0x454], str.WINTRUST.DLL
mov dword [ebp - 0x450], str.GDIPLUS.DLL
mov dword [ebp - 0x44c], str.MSI.DLL
mov dword [ebp - 0x448], str.OLEACC.DLL
mov dword [ebp - 0x444], str.OLEDLG.DLL
mov dword [ebp - 0x440], str.RICHED20.DLL
mov dword [ebp - 0x43c], str.VERSION.DLL
mov dword [ebp - 0x438], str.WINHTTP.DLL
mov eax, dword [ebp - 0x42c]
push dword [ebp + eax*4 - 0x468]
push edi
push esi
call fcn.00439be1
add esp, 0xc
test eax, eax
jne 0x40dac3
mov esi, str.Loading
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x20a
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20e]
push eax
movsw word es:[edi], word [esi]
call fcn.00436ad0
lea eax, [ebp - 0x428]
push eax
mov esi, 0x10e
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00439b67
push 0x45d0d0
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00439b67
add esp, 0x24
lea eax, [ebp - 0x220]
push eax
call ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x430]
jmp 0x40daca
push str.Failed_to_append_filename_on_system_path_n
call ebx
inc dword [ebp - 0x42c]
cmp dword [ebp - 0x42c], 0xd
jb 0x40da33
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00435f5a
leave
ret
Function at 0x40db23
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x453580
call fcn.0043bb27
cmp byte [ebx + 0xc8], 0
jne 0x40dc2e
mov eax, dword [ebx + 0xa8]
xor esi, esi
cmp eax, esi
jne 0x40dc27
lea ecx, [ebp - 0x24]
call fcn.0041596f
mov dword [ebp - 4], esi
push dword [ebx + 0xb8]
lea eax, [ebp - 0x24]
push str.SOFTWARESlimWare_Utilities_Inc_sRegistration
push eax
call fcn.00401fc7
add esp, 0xc
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040856f
cmp eax, esi
jne 0x40dbf7
push str.LI_UPDATE
mov ecx, 0x472b34
call fcn.00417160
test eax, eax
je 0x40dbb3
lea eax, [ebx + 0xdc]
push 0x45a9cc
push eax
call fcn.0040eee4
test eax, eax
pop ecx
pop ecx
je 0x40dbf7
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 3
push esi
push str.InstallationID
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40dbf7
lea eax, [ebx + 0xdc]
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x472b30]
test ecx, ecx
je 0x40dc0f
push eax
call fcn.00412e50
mov ecx, dword [0x472b30]
test ecx, ecx
je 0x40dc0f
push 0
push 1
push str.InstallerFinished
call fcn.00412eee
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004085ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004102dc
mov byte [ebx + 0xc8], 1
call fcn.0043bbaa
ret

Function at 0x40dc34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00430198
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x40dc55
xor eax, eax
jmp 0x40dc68
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40dc51
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebp
ret 8
Function at 0x40ee7d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40eee0
cmp dword [ebp + 0xc], 1
je 0x40eeb9
cmp dword [ebp + 0xc], 2
je 0x40eeb9
push 0xd
pop eax
jmp 0x40eee0
test edi, edi
mov eax, dword [ebp - 4]
je 0x40eeda
test eax, eax
je 0x40eed6
test al, 1
jne 0x40eeb4
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40eeda
jmp 0x40eeb4
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40efcb
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x452f96
call fcn.0043babe
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x40f013
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.004085d0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x40eff9
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.0043027e
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.0043027e
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.00431069
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004107f9
call fcn.0043bb96
ret

Function at 0x40f5d0
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x450a69
call fcn.0043babe
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RememberTempFile.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40f612
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40f612
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.004102dc
or dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.CProgressPageProxy::Caller.0
call fcn.0043bb96
ret
Function at 0x413511
Capabilities:
Get common file path

Disassembly:
push 0x28
mov eax, 0x451233
call fcn.0043baf1
mov edi, ecx
lea ecx, [ebp - 0x34]
call fcn.0042b3a8
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.00401693
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.0041596f
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.0040c4c7
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413587
call fcn.00403049
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004102dc
or dword [ebp - 4], 0xffffffff
call fcn.0042b3be
mov eax, esi
call fcn.0043bb96
ret
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040537f
lea ecx, [ebp - 0x18]
call fcn.0041596f
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.0040c4c7
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4135e1
call fcn.00403049
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004102dc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004102dc
mov dword [ebp - 4], ebx
jmp 0x41357a
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040537f
lea eax, [ebp - 0x1c]
push eax
call fcn.00408408
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x41364c
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00415805
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004102dc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004102dc
mov dword [ebp - 4], ebx
call fcn.0042b3be
mov eax, dword [ebp - 0x24]
jmp 0x413581
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.004015dd
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.00415805
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004102dc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004102dc
mov dword [ebp - 4], ebx
call fcn.0042b3be
xor eax, eax
jmp 0x413581

Function at 0x4136c8
Capabilities:
Accept command line arguments

Disassembly:
push 0xc
mov eax, 0x45089c
call fcn.0043baf1
mov edi, ecx
call fcn.00401693
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x4136f8
mov eax, 0x80004005
jmp 0x413732
and dword [ebp - 4], 0
push dword [esi]
mov ecx, edi
call fcn.004015dd
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x413732
call fcn.0043bb96
ret
Function at 0x413738
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x4511f9
call fcn.0043babe
lea ecx, [ebp - 0x10]
call fcn.0041596f
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004136c8
xor ecx, ecx
test eax, eax
setge cl
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
mov esi, ecx
call fcn.00436ad0
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push edi
push 0x1000000
push edi
neg esi
push edi
sbb esi, esi
and esi, dword [ebp - 0x10]
push edi
call fcn.0040c44d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.0040537f
cmp esi, edi
jne 0x4137d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004102dc
mov eax, edi
call fcn.0043bb96
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x20]
jmp 0x4137bc