joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword es:[sym.imp.KERNEL32.dll_GetShortPathNameA]
sub eax, 2
mov edx, dword [ecx]
imul eax, edx
cmp al, 0x7c
jne 0x407116
lea eax, [esp + 4]
push eax
push esp
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
cmp eax, dword [edx + ebp]
je 0x407158
mov eax, 0x407111
lea eax, [edx + eax]
push ebp
push eax
push 0
call sub.KERNEL32.dll_EnumResourceTypesW
push esi
jmp 0x407158
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, es:[eax + 0x78968c]
sub eax, 0x783648
xacquire lock add dword es:[edx - 0x1b4], eax
pop ecx
add esp, 0x10
mov eax, 0
mov dx, cs
push dx
push ecx
retf
add byte [eax], al
add byte [eax], al
inc ebp
mov ecx, 0xacaa716a
in eax, dx
or eax, 0xbfb2297d
or dword [ecx + 0x6e944e0c], ecx
add al, byte gs:[eax]
cmp dword [eax - 0x18c77304], ecx
div byte [ebx]
add ebx, edi
pop esi
inc edx
add byte [edx - 0x4582e283], dl
loop 0x4071ec
call 0xc6be47
xchg dword [ecx + esi*2 - 0x57485d53], edi
mov ecx, 0xf2b55be0
fbld tbyte [eax]
add byte [ebx + 0x78], dl
push 0xae000671
fistp word [ebx + 0x64]
inc ebx
imul ecx, dword [ebp - 0x1769bacd], 0xeda8c14f
pop es
xchg ebx, eax
imul ebp, dword [0x84e14ccf], 0
into
outsd dx, dword [esi]
adc al, 0x16
nop
imul dword [esp + ecx*4 + 0x7f]
shr edi, cl
mov eax, dword [0xe8f3b707]
scasb al, byte es:[edi]
inc ebp
nop
mov edi, 0x145c93d2
xchg ecx, eax
sbb dword [ebx - 0x1a], 0xffffffaa
mov edi, 0xf27457c5
test eax, 0x294a0739
inc ebp
xchg esi, eax
mov word [esi - 0x71], ss
pop ss
inc esi
add byte [edi + 0x42], bl
add byte [ecx + 0x76fe3928], cl
int 0xb6
inc edx
insb byte es:[edi], dx
invalid
mov dword [eax], ebp
cmp esi, edi
jbe 0x4071bf
mov dh, 0xf2
inc edx
add byte [edi + 0x7d198507], al
jb 0x4071f0
iretd
Function at 0x40e23e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test eax, 0xff0000
nop
jmp 0x40f85d
add ecx, dword [ebx + 0x3c]
stc
jb 0x40e178
add byte [eax], al
add byte [ebx - 0x74f80000], dh
rcl byte [edi - 0x41]
in eax, 0x40
add byte [edi + 0xc3243c], al
add byte [ebx - 0x7a], cl
mov bl, 0x8b
mov eax, dword [eax]
nop
jmp 0x40d3a9
pushal
stc
jb 0x40f653
add al, dh
push 0x6800
pop esp
insd dword es:[edi], dx
pop esi
push edi
mov edi, 0x40f617
xchg dword [esp], edi
ret
mov ecx, ebx
stc
jb 0x40d950
add byte [edi - 0x58], bl
add byte [edi + 0x3f90086], bh
push edi
mov edi, 0x40df4e
xchg dword [esp], edi
ret
Function at 0x401447
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4014a4
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x40149c
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004013aa
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4014aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.004274b7
mov esi, eax
pop ecx
test esi, esi
je 0x4014f8
xor edx, edx
test ebx, ebx
jbe 0x4014f8
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x4014e2
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405443
Capabilities:
Get file size

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40544f
mov eax, 0x4364dc
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
ja 0x40548d
cmp esi, 0xffffffff
je 0x405489
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x405489
push esi
call eax
xor al, al
jmp 0x4054a6
mov ecx, dword [esp + 8]
cmp esi, 0xffffffff
mov dword [ecx], eax
je 0x4054a4
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4054a4
push esi
call eax
mov al, 1
pop esi
ret 4
Function at 0x406cff
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov ecx, eax
call fcn.0041c2a6
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x406d40
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.00406d95
test eax, eax
jne 0x406d8c
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x406d5c
push esi
push edi
mov ecx, ebx
call fcn.00406d95
test eax, eax
jne 0x406d8c
push 0x442430
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.00420999
add esp, 0xc
test eax, eax
jge 0x406d8c
push edi
push esi
push 4
call fcn.00420999
add esp, 0xc
test eax, eax
jge 0x406d8c
xor eax, eax
jmp 0x406d8f
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x407ae8
Capabilities:
Copy file
Create thread

Disassembly:
mov eax, 0x43340e
call fcn.00427498
sub esp, 0x428
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00407cff
test al, al
je 0x407b1b
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x407ca8
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x433]
mov byte [ebp - 0x434], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x434]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.00407d27
mov edi, 0x400
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push edi
push ebx
mov dword [esi + 0x90], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push edi
mov dword [esi + 0x94], eax
push dword [esi + 0x90]
lea eax, [ebp - 0x434]
push 0xffffffffffffffff
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push dword [esi + 0x94]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x2c
call fcn.004274b7
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x407bba
push 4
push esi
push dword [esi + 0x90]
mov ecx, eax
call fcn.00407cb8
jmp 0x407bbc
xor eax, eax
mov dword [esi + 0x98], eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push esi
push 0x407a9c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 4
mov dword [ebp - 0x10], edi
call fcn.004274b7
mov dword [eax], edi
pop ecx
mov edi, 0xff
mov dword [ebp + 8], eax
push edi
push 0xffffffffffffffff
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
mov dword [ebp + 0xc], eax
jne 0x407c44
push 1
push ebx
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x407c3b
cmp dword [ebp - 0x30], 0x8032
jne 0x407c2f
mov ecx, dword [esi + 0x98]
call fcn.0040812a
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x407c08
push edi
push 0xffffffffffffffff
push ebx
push dword [ebp + 8]
jmp 0x407bf8
push dword [ebp + 8]
call fcn.00426aeb
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop ecx
push dword [esi + 0x90]
call edi
push dword [esi + 0x94]
call edi
mov esi, dword [esi + 0x98]
pop edi
cmp esi, ebx
je 0x407c7d
lea ecx, [esi + 8]
call fcn.00407e83
push esi
call fcn.00426aeb
pop ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x407c87
xor eax, eax
jmp 0x407ca8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x14], ebx
setge al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4080bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x4080d5
xor esi, esi
jmp 0x408102
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00427bc0
xor eax, eax
mov esi, esp
push eax
push eax
and byte [esi], 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x408120
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x64
jl 0x4080c7
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cd2f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40cd3b
mov eax, 0x4364dc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40cd4f
test al, 0x10
jne 0x40cd4f
push 1
pop eax
ret
xor eax, eax
ret

Function at 0x40f6c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f71f
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x442d0c
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f716
mov byte [0x443d0c], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40f959
Capabilities:
Hide graphical window

Disassembly:
push dword [0x443d1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40f985
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x443d1c]
call esi
push 0
push dword [0x443d14]
call esi
pop esi
ret
Function at 0x40f986
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x443d1c]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.0041c0fc
cmp dword [eax], 1
je 0x40f9f0
cmp dword [eax + 4], ebx
je 0x40fa45
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40fa45
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x443d1c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41035b
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x444778
push edi
push esi
call fcn.00410ed5
test eax, eax
pop ecx
jne 0x4104a8
mov eax, dword [ebp + 0x20]
mov ecx, dword [0x444778]
push 0x44476c
mov dword [eax], ecx
call fcn.00410e40
test eax, eax
pop ecx
jne 0x4104a8
mov ebx, dword [ebp + 0x1c]
mov eax, dword [0x44476c]
mov dword [ebx], eax
cmp dword [0x444778], 1
jne 0x4103ae
xor eax, eax
jmp 0x4104a8
lea eax, [ebp - 4]
push eax
push 0x444770
call fcn.00410347
test eax, eax
jne 0x4104a8
mov eax, dword [0x444778]
shl eax, 2
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [0x44477c], eax
jne 0x4103ed
push 0xfffffffffffffffc
pop eax
jmp 0x4104a8
push esi
call fcn.00410f5e
mov edi, eax
pop ecx
test edi, edi
je 0x410423
push dword [0x44477c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x44477c]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4104a6
movzx eax, word [ebp + 0x18]
push eax
mov dword [0x444768], ebx
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov dword [0x44455c], eax
movzx eax, word [ebp + 0x14]
push 0x4106c7
push dword [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
mov eax, dword [0x44455c]
test eax, eax
je 0x410466
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp edi, 1
jne 0x41046f
xor edi, edi
jmp 0x410477
cmp edi, 2
jne 0x410477
or edi, 0xffffffff
mov eax, dword [0x44477c]
test eax, eax
je 0x41049f
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x44477c]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx]
mov dword [0x44476c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41097f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ee
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x410b06
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
call esi
push 0x3ef
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x410b06
push edi
call ebx
cmp dword [ebp - 4], eax
jge 0x4109f1
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push edi
call esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x410b06
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.004111e5
push 1
push 0x43d858
push esi
mov edi, eax
call fcn.004111e5
push esi
push dword [ebp - 8]
movzx ebx, ax
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp + 8], 0
movzx esi, di
add esi, ebx
shr edi, 0x10
test esi, esi
mov dword [ebp - 0x14], edi
je 0x410b06
test edi, edi
je 0x410b06
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jge 0x410a90
mov edi, esi
push 1
sub edi, eax
add edi, ebx
add esi, ebx
pop ebx
mov dword [ebp - 4], esi
mov dword [ebp + 8], ebx
jmp 0x410a96
mov edi, dword [ebp + 8]
push 1
pop ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jge 0x410aa6
add eax, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x410b06
mov esi, dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x2c
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
sub eax, edi
push dword [ebp - 4]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x2c
push eax
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 0x34]
push 1
push dword [ebp - 0xc]
lea eax, [edi + edi]
sub ecx, eax
push dword [ebp - 4]
push dword [ebp - 0x30]
push ecx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41288b
Capabilities:
Check os version

Disassembly:
mov eax, 0x4340a0
call fcn.00427498
sub esp, 0x3e8
push ebx
push esi
lea eax, [ebp - 0xe8]
push edi
mov dword [ebp - 0x10], ecx
push eax
mov dword [ebp - 0xe8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xe4], 5
jne 0x4129e7
cmp dword [ebp - 0xe0], 2
jne 0x4129e7
cmp byte [ebp - 0x4e], 1
je 0x4129e7
push 0x43dbe0
push dword [ebp + 8]
call fcn.00427d60
pop ecx
pop ecx
test eax, eax
push 1
je 0x4129d5
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call fcn.004014ff
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
je 0x4129c7
mov al, byte [ebp + 0xb]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x24], al
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x4c]
push eax
push 0x2c
mov byte [ebp - 4], 1
call fcn.004185a0
mov dword [ebp - 0x14], ebx
xor esi, esi
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x4129bc
mov eax, dword [ebp - 0x1c]
push 0x28
sub eax, ecx
pop edi
cdq
idiv edi
cmp dword [ebp - 0x14], eax
jae 0x4129bc
add ecx, esi
call fcn.004016f0
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1ec]
push str.dotnetfxsp1.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2f0]
push 1
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.00415d4d
test eax, eax
je 0x412999
inc dword [ebp - 0x14]
add esi, edi
jmp 0x412938
mov ecx, dword [ebp - 0x10]
call fcn.00417fbc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00418b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040191f
xor eax, eax
jmp 0x4129d6
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00418b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040191f
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
push 0x43dbe0
push dword [ebp + 8]
call fcn.00427d60
pop ecx
test eax, eax
pop ecx
jne 0x4129d3
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x3f4]
push 1
push eax
push str.dotnetfxsp1.exe
call fcn.00415d4d
test eax, eax
jne 0x4129d3
mov ecx, dword [ebp - 0x10]
call fcn.00417fbc
jmp 0x4129b8
Function at 0x413075
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
mov eax, 0x4340f4
call fcn.00427498
sub esp, 0x118
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
push 1
pop esi
cmp ecx, 0x2000
mov dword [eax], esi
je 0x4130f0
cmp ecx, 0xbc2
je 0x4130f0
xor ebx, ebx
cmp ecx, 0x800704c7
je 0x4130b7
cmp ecx, 0x642
jne 0x4130c3
cmp dword [ebp + 0x18], ebx
je 0x4130c3
mov dword [eax], ebx
jmp 0x4131ea
cmp ecx, ebx
je 0x4131ea
cmp ecx, 0x1008
je 0x4131ea
mov ecx, dword [ebp - 0x10]
mov dword [0x445424], 0x66d
call fcn.00417fbc
xor eax, eax
jmp 0x4131ec
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
mov ecx, dword [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0x43ddf0
push str.DotNetDelayReboot
push dword [0x4365e4]
call fcn.00401046
mov ecx, eax
add ecx, 0x4020
call fcn.004025bc
cmp byte [ebp - 0x20], 0x59
mov byte [ebp + 0x17], bl
je 0x41313b
cmp byte [ebp - 0x20], 0x79
jne 0x41313f
mov byte [ebp + 0x17], 1
call fcn.004211df
test eax, eax
jne 0x413161
cmp dword [ebp + 8], 0xbc2
jne 0x413156
cmp byte [ebp + 0x17], bl
je 0x413161
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x41316b
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x18], ebx
mov dword [eax + 0x38], esi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], ebx
call fcn.0040f736
test eax, eax
jne 0x4131db
push 0x40
lea edi, [ebp - 0x123]
pop ecx
mov byte [ebp - 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp + 0xc], ebx
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 0x18], ebx
pop edi
je 0x4131ea
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x413d18
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x43417b
call fcn.00427498
sub esp, 0x5c0
and byte [ebp - 0x5cc], 0
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x5cb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5cc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0xf]
push 1
push eax
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x64]
call fcn.004014ff
and dword [ebp - 4], 0
mov eax, 0x43deb4
mov ecx, eax
mov dword [ebp - 0x3c], 0x43647c
test ecx, ecx
mov dword [ebp - 0x1c], 0x436474
jne 0x413d8c
mov eax, 0x442434
lea ecx, [ebp - 0xd]
push 0
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040b6e0
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.0041846f
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0040191f
or edi, 0xffffffff
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x64]
push eax
mov byte [ebp - 4], 2
call fcn.004016f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, edi
je 0x413e88
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x413e66
lea eax, [ebp - 0xd]
push 1
push eax
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004014ff
lea eax, [ebp - 0xe]
push 1
push eax
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 3
call fcn.004014ff
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.0041846f
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 3
call fcn.0040191f
lea ecx, [ebp - 0x3c]
call fcn.004016f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.0040191f
lea eax, [ebp - 0x1cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413de4
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x413e88
push esi
call eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], edi
call fcn.0040191f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4