joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452340
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fbb4]
cmp dword [eax + 0x30], 0
je 0x4523ea
cmp dword [ebx + 0x94], 0
jne 0x4523e4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4522d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4523e4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4523aa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4523e4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041747c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4523b9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452f4c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452f81
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404578
jmp 0x452f8e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454070
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4540b1
mov eax, esi
call fcn.0043a864
test al, al
je 0x4540b1
mov eax, dword [ebx + 0x84]
call fcn.0043a58c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4540b1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a58c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x456e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420dbc
cmp ebx, dword [ebp - 8]
jge 0x456e67
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420fdc
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420fdc
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00421008
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x456e2d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x456e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420dbc
cmp ebx, dword [ebp - 8]
jge 0x456ed3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420fdc
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420fdc
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00421008
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x456e99
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45b5d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004046f8
add esp, 0x10c
pop ebx
ret
Function at 0x45ba28
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x45bc21
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402a34
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00408c70
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x45bc34
call fcn.00404794
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402dc0
lea eax, [ebp - 0x1d0]
call fcn.00402b5c
call fcn.00402874
mov edx, 0x45bc4c
lea eax, [ebp - 0x1d0]
call fcn.00404b38
call fcn.004031f8
call fcn.00402874
push 0x45bc5c
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402a34
push dword [ebp - 0x234]
push 0x45bc6c
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00404808
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00404b38
call fcn.004031f8
call fcn.00402874
push 0x45bc78
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402a34
push dword [ebp - 0x23c]
push 0x45bc6c
push 0x45bc8c
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404808
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00404b38
call fcn.004031f8
call fcn.00402874
mov edx, 0x45bca0
lea eax, [ebp - 0x1d0]
call fcn.00404b38
call fcn.004031f8
call fcn.00402874
lea eax, [ebp - 0x1d0]
call fcn.00402e88
call fcn.00402874
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ff0
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404948
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x45bbfb
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc28
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.004044ac
lea eax, [ebp - 4]
call fcn.00404488
ret
Function at 0x40ad00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40ad09
xor ecx, ecx
jne 0x40ad09
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ad50
mov eax, dword [ebp - 0xc]
jmp 0x40adad
cmp dword [ebp - 4], 1
je 0x40ad63
cmp dword [ebp - 4], 2
je 0x40ad63
mov eax, 0xd
jmp 0x40adad
cmp dword [ebp + 0xc], 0
je 0x40ada1
cmp dword [ebp - 8], 0
je 0x40ad99
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40ad90
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x40ad97
mov eax, 0xd
jmp 0x40adad
jmp 0x40ada1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bcd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.0040c310
cmp dword [ebp + 8], 1
je 0x40bcfa
mov ecx, dword [ebp - 4]
add ecx, 0x4c
call fcn.00401ec0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x40bd10
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x70]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x6c], 0
je 0x40bd26
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x6c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004217c0
mov esp, ebp
pop ebp
ret 4
Function at 0x40e420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4652cc
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x481410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], 0
push 0x40
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0044cfe0
add esp, 0xc
mov dword [ebp - 0x64], 0x44
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp + 8]
call fcn.00413820
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004137f0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00410b30
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x8e], ax
lea ecx, [ebp - 0x8e]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.0040f9d0
mov ecx, dword [ebp + 0xc]
call fcn.004134b0
movzx edx, al
test edx, edx
jne 0x40e4f4
mov ecx, dword [ebp + 0xc]
call fcn.00401ec0
mov dword [ebp - 0x94], eax
jmp 0x40e4fe
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x94]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
call fcn.00409a90
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40e54e
mov byte [ebp - 0x8f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.004099f0
mov al, byte [ebp - 0x8f]
jmp 0x40e598
cmp dword [ebp + 0x10], 0
jne 0x40e562
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040e5b0
add esp, 4
jmp 0x40e57c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 0xc], ecx
mov byte [ebp - 0x90], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.004099f0
mov al, byte [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e5d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e420
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40e60e
xor al, al
jmp 0x40e698
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004051d0
add esp, 8
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e6a0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 4]
call fcn.0040e6c0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x15], al
movzx edx, byte [ebp - 0x15]
test edx, edx
jne 0x40e66b
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40e66b
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx edx, byte [ebp - 0x15]
test edx, edx
je 0x40e687
cmp dword [ebp + 0x1c], 0
je 0x40e687
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dl, byte [ebp - 0x15]
mov byte [ebp - 0x21], dl
lea ecx, [ebp - 4]
call fcn.0040e6e0
mov al, byte [ebp - 0x21]
mov esp, ebp
pop ebp
ret
Function at 0x40ea50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4653da
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x481410]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp - 0x80]
call fcn.0040ef90
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.004134b0
movzx eax, al
test eax, eax
je 0x40ea9e
jmp 0x40ebc6
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401ec0
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40eac6
jmp 0x40ebc6
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.004051d0
add esp, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ebf0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040ec10
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x80]
call fcn.0040f2f0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.004414a0
add esp, 8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x88]
call fcn.0040b030
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c]
call fcn.00418350
mov dword [ebp - 0x44], 0
jmp 0x40eb52
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x14]
jge 0x40ebae
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x60]
call fcn.00401ee0
mov byte [ebp - 4], 5
cmp dword [ebp - 0x44], 0
jne 0x40eb94
lea ecx, [ebp - 0x60]
call fcn.00401ec0
push eax
lea ecx, [ebp - 0x34]
call fcn.00401ec0
push eax
call fcn.0044d45b
add esp, 8
test eax, eax
je 0x40eba0
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x80]
call fcn.0040f4e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x60]
call fcn.00401100
jmp 0x40eb49
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401100
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040ec30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0044c7b8
mov esp, ebp
pop ebp
ret 8
Function at 0x4124d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x481410]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00407760
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004125e0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41253b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0040abc0
mov eax, dword [ebp - 0x224]
jmp 0x4125cc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4125a1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004124d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x412598
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0040abc0
mov eax, dword [ebp - 0x228]
jmp 0x4125cc
mov dword [ebp - 4], 0x100
jmp 0x412542
lea ecx, [ebp - 0x14]
call fcn.0040abe0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.004124a0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0040abc0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044c7b8
mov esp, ebp
pop ebp
ret 4
Function at 0x41cb50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x41cb59
xor ecx, ecx
jne 0x41cb59
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41cb7a
mov eax, 0xd
jmp 0x41cbd5
xor eax, eax
jne 0x41cb61
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41cb8b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x421c40
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466ce4
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x481410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x84]
mov dword [eax], vtable.SoftInstaller.0
mov dword [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x84]
add ecx, 0xe8
call fcn.00408f20
mov byte [ebp - 0x85], al
movzx ecx, byte [ebp - 0x85]
test ecx, ecx
jne 0x421dd3
mov ecx, dword [ebp - 0x84]
add ecx, 0xb8
call fcn.004134b0
mov byte [ebp - 0x86], al
movzx edx, byte [ebp - 0x86]
test edx, edx
jne 0x421dd3
mov eax, dword [ebp - 0x84]
add eax, 0xb8
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.00421c00
add esp, 8
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040afb0
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040dc70
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2c]
call fcn.00418350
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
call fcn.00401100
mov edx, dword [ebp - 0x84]
add edx, 0xb8
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.00421c00
add esp, 8
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x9c]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.00421c00
add esp, 8
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xa4]
call fcn.00401ec0
mov dword [ebp - 0xa8], eax
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00401100
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x64]
call fcn.00401100
jmp 0x421de2
mov dword [ebp - 4], 9
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x84]
add ecx, 0x12c
call fcn.00418350
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x84]
add ecx, 0x110
call fcn.00401100
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x84]
add ecx, 0xe8
call fcn.00408d90
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x84]
add ecx, 0xe0
call fcn.00416c40
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x84]
add ecx, 0xd8
call fcn.00404650
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x84]
add ecx, 0xb8
call fcn.00401100
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x84]
add ecx, 0x9c
call fcn.00401100
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x84]
add ecx, 0x80
call fcn.00401100
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x84]
add ecx, 0x44
call fcn.004164a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x84]
call fcn.00416400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466d6e
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x481410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x220]
call fcn.0040c860
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x228], eax
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.0044cfe0
add esp, 0xc
cmp dword [ebp - 0x228], 0
jl 0x422352
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x422352
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040c940
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c880
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040c920
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c7b8
mov esp, ebp
pop ebp
ret 8
Function at 0x423120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466fbe
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x481410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x30]
call fcn.00427e60
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004134b0
movzx eax, al
test eax, eax
jne 0x423288
push 0
lea ecx, [ebp + 8]
call fcn.00401ec0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42319c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xb7
jne 0x4231a6
jmp 0x423288
cmp dword [ebp - 0x34], 3
jne 0x423256
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x50]
call fcn.0040afb0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x6c]
push eax
call fcn.00423390
add esp, 8
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xb4]
push edx
lea ecx, [ebp - 0x30]
call fcn.00427ec0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.00401100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.00418350
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.00421c00
add esp, 8
mov dword [ebp - 0xb8], eax
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xbc]
push eax
lea ecx, [ebp + 8]
call fcn.00407fe0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.00401100
jmp 0x423283
mov byte [ebp - 0x89], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00425fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401100
mov al, byte [ebp - 0x89]
jmp 0x423372
jmp 0x423162
lea ecx, [ebp - 0x30]
call fcn.00427e80
movzx ecx, al
test ecx, ecx
jne 0x42334a
push 0
lea ecx, [ebp - 0x30]
call fcn.00427ea0
push eax
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.00421a20
add esp, 0xc
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xc4]
push edx
lea ecx, [ebp + 8]
call fcn.00407fe0
mov ecx, eax
call fcn.00401ec0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x8a], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.00401100
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x42333d
mov byte [ebp - 0xa9], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00425fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401100
mov al, byte [ebp - 0xa9]
jmp 0x423372
lea ecx, [ebp - 0x30]
call fcn.00427ee0
jmp 0x423288
mov byte [ebp - 0xaa], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00425fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401100
mov al, byte [ebp - 0xaa]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret