joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41de44
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x41df21
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d444c], 0
jne 0x41deed
lea edx, [ebp - 8]
mov eax, dword [0x4d3e28]
call fcn.00406224
push dword [ebp - 8]
lea edx, [ebp - 0xc]
mov eax, dword [0x4d3e30]
call fcn.00406224
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00405dcc
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403858
mov eax, dword [ebp - 4]
call fcn.00403998
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x4d444c], eax
mov eax, dword [0x4d444c]
xor edx, edx
mov dword [eax], edx
push ebx
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x4d444c], 0
je 0x41df04
mov eax, dword [0x4d444c]
call fcn.0041de34
mov ebx, eax
jmp 0x41df06
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41df28
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040352c
ret

Function at 0x41e6f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x41e795
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.00403700
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
xor ecx, ecx
call fcn.0041cb9c
mov ebx, eax
test bl, bl
je 0x41e77c
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e79c
lea eax, [ebp - 0x150]
call fcn.00403508
ret
Function at 0x41e9c0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x41ebaa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4d4458], 0
jne 0x41eb8f
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x41eb88
xor eax, eax
push ebp
push 0x41eb81
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x41eb6a
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x41eb64
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x4d3d88]
call fcn.00406224
mov eax, dword [ebp - 0x24]
call fcn.00403998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41ea98
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x4d3d8c]
call fcn.00406224
mov eax, dword [ebp - 0x28]
call fcn.00403998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41eacb
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x4d3d90]
call fcn.00406224
mov eax, dword [ebp - 0x2c]
call fcn.00403998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41eafe
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x41eb50
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x41eb1b
cmp eax, dword [ebp - 0x10]
je 0x41eb4c
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x41eb30
cmp eax, dword [ebp - 0x18]
je 0x41eb4c
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x41eb45
cmp eax, dword [ebp - 0x20]
je 0x41eb4c
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x41eb08
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41eb88
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x4d4458], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ebb1
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040352c
ret
Function at 0x420f00
Capabilities:
Terminate process

Disassembly:
push 0x30
mov eax, 0x4a6daf
call fcn.00490e49
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00421245
push 1
push str.msiexec.exe
lea ebx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00452340
pop ecx
pop ecx
test eax, eax
jne 0x420fbe
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.DoMsiTrackerStop:_no_msiexec.exe_currently_running
push eax
call fcn.00453c70
pop ecx
pop ecx
call fcn.004208ae
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.DoMsiTrackerStop:_uninjecting_services.exe
push eax
call fcn.00453c70
pop ecx
pop ecx
call fcn.004208ae
pop ecx
push 0
push dword [ebp + 8]
push str.services.exe
call fcn.00420c15
add esp, 8
mov esi, eax
mov eax, esp
mov dword [ebp - 0x14], esp
push esi
push str.DoMsiTrackerStop:_uninject_services.exe_returned:__d
push eax
call fcn.00453c70
add esp, 0xc
call fcn.004208ae
pop ecx
test esi, esi
jne 0x42106c
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0
call fcn.0042127d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
call fcn.00490f21
ret
mov esi, dword [ebp - 0x30]
cmp esi, dword [ebp - 0x2c]
jbe 0x420fcb
call fcn.0048c1a2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], esi
jbe 0x420fe1
call fcn.0048c1a2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x420fed
cmp eax, dword [ebp - 0x3c]
je 0x420ff2
call fcn.0048c1a2
cmp dword [ebp - 0x18], esi
je 0x420f4f
lea esi, [ebp - 0x1c]
call fcn.00424777
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
call fcn.00424777
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [eax]
test edi, edi
je 0x421048
push str.DoMsiTrackerStop:_killing_msiexec.exe_PID__d
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.004208ae
pop ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42105c
push str.DoMsiTrackerStop:_cant_open_msiexec.exe_PID__d
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.004208ae
pop ecx
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x1c]
call fcn.004212be
jmp 0x420fd4
push 0x12
pop esi
jmp 0x420f9e
Function at 0x4229f3
Capabilities:
Get system information on windows

Disassembly:
push 4
mov eax, 0x4a5b55
call fcn.00490e49
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0042048a
push 4
mov byte [ebp - 4], 1
lea ebx, [edi + 0x74]
call fcn.0047d5ba
pop ecx
cmp eax, esi
je 0x422a25
mov dword [eax], ebx
jmp 0x422a27
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004226f7
mov eax, dword [ebp + 0x10]
or dword [edi + 4], 0xffffffff
or dword [edi + 8], 0xffffffff
mov dword [edi + 0x18], eax
lea eax, [edi + 0x4c]
push eax
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x8c], esi
mov dword [edi + 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [edi + 0x68]
xor edx, edx
mov eax, 0x400000
div ecx
push dword [ebp + 0x14]
imul eax, ecx
mov dword [edi + 0x70], eax
call fcn.00466800
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, edi
call fcn.00490f21
ret 0x10
Function at 0x422b17
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x4a8064
call fcn.00490e49
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.00421197
and dword [ebp - 4], 0
push 0x5c
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [ebp - 0x14]
push eax
call fcn.004542b0
add esp, 8
mov dword [ebp - 0x18], esp
mov esi, esp
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00421360
push esi
call fcn.00469500
pop ecx
pop ecx
call fcn.004564d0
cmp dword [ebp + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ecx
mov ebx, eax
jne 0x422c32
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421360
lea esi, [ebp + 0x18]
call fcn.004543e0
pop ecx
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 2
push dword [eax]
mov eax, dword [ebp + 8]
call fcn.00465b60
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042001a
cmp esi, 0x200
jne 0x422c47
push 0
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [ebp + 0x18]
push eax
call fcn.00469500
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421360
lea esi, [ebp + 0x18]
call fcn.004543e0
pop ecx
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 3
push dword [eax]
mov eax, dword [ebp + 8]
call fcn.00465b60
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042001a
jmp 0x422c47
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.00465ba0
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x422c8c
cmp dword [ebp + 0x14], esi
je 0x422c7c
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push ecx
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [ebp + 0x18]
push eax
call fcn.00469500
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
test ebx, ebx
jne 0x422c8c
push 1
push dword [ebp - 0x14]
call fcn.0045fc00
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
call fcn.00490f21
ret
Function at 0x42371e
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x4a7b95
call fcn.00490e49
push dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], bl
call fcn.00421197
push str.VirtApp.ini
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00423c06
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4237bd
push ebx
push edi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push 1
push eax
call fcn.0048c909
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
shr esi, 1
push esi
push dword [ebp - 0x18]
call fcn.00422caa
pop ecx
pop ecx
test al, al
je 0x4237b4
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call fcn.0048c1d3
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
mov al, byte [ebp - 0xd]
call fcn.00490f21
ret

Function at 0x423e6d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4a737c
call fcn.00490e49
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x4d19b4
mov dword [ebp - 4], ebx
call fcn.004226f7
lea eax, [ebp + 8]
mov esi, 0x4d17c0
push eax
mov ecx, esi
call fcn.004226f7
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00421360
lea edi, [ebp - 0x14]
call fcn.00453b80
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004226f7
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00423b81
mov edi, 0x4b11ac
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00422611
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0xd], bl
je 0x423f0d
push edi
mov ecx, esi
call fcn.00423c06
mov esi, dword [0x4d17c0]
call fcn.00456520
push dword [0x4d17c0]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423f5a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.00421197
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4b9320
mov byte [ebp - 4], 3
call fcn.00421197
push 3
mov byte [ebp - 4], bl
call fcn.00458060
add esp, 0xc
push 0x4d17e8
call fcn.0042470b
mov esi, 0x4b04e0
push esi
mov ecx, 0x4d17c4
call fcn.004214a8
push esi
mov ecx, 0x4d17cc
call fcn.004214a8
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00421197
push 0x4d1800
call fcn.00424c97
call fcn.00442340
call fcn.004373e0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
inc eax
call fcn.00490f21
ret
Function at 0x425998
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x425a2e
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x425a20
test ecx, ecx
jle 0x425a2e
jmp 0x425a25
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x425a2e
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425b8b
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4a6785
call fcn.00490e49
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, str.Cameyo
push ebx
mov dword [ebp - 0x18], esi
call fcn.00421197
lea eax, [ebp - 0x10]
push eax
call fcn.00453400
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
push 0x10
call fcn.0047d5ba
mov edi, eax
pop ecx
cmp edi, esi
je 0x425bf2
lea ecx, [edi + 8]
call fcn.0042048a
lea ecx, [edi + 0xc]
call fcn.0042048a
mov dword [0x4d1750], edi
jmp 0x425bf8
mov dword [0x4d1750], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4b11ac
call fcn.00421197
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.00421197
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00421197
mov eax, dword [ebp - 0x14]
push eax
call fcn.00453400
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.00453850
add esp, 0xc
call fcn.004255af
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x4258b8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x425c87
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x425c73
mov eax, dword [ebp - 0x34]
call fcn.00490f21
ret 4
Function at 0x4295f9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4a5808
call fcn.00490e49
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.0047dccb
push eax
lea ecx, [ebp - 0x10]
call fcn.00434103
mov dword [ebp - 4], ebx
push dword [0x4d19d8]
mov edi, str.SoftwareVOS_s
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00453c70
mov esi, str.IntegratedLnk
push esi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00424585
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 9
mov byte [ebp - 4], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.0046c1c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0042001a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [ebp - 0x14], ebx
je 0x429695
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, ebx
call fcn.00490f21
ret
mov dword [ebp - 0x18], ebx
mov eax, 0x514
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.0042049e
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00423c25
cmp dword [ebp - 0x14], ebx
jne 0x4296ea
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00421360
call fcn.00457070
inc dword [ebp - 0x18]
pop ecx
jmp 0x429698
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x4d19d8]
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00453c70
push esi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.00424585
add esp, 0x18
mov byte [ebp - 4], 4
push dword [eax]
call fcn.0046c1c0
push eax
call fcn.00455070
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
xor ebx, ebx
inc ebx
jmp 0x429682
Function at 0x429746
Capabilities:
Delete directory
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4a57c5
call fcn.00490e49
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.0047dccb
push eax
lea ecx, [ebp - 0x10]
call fcn.00434103
mov dword [ebp - 4], ebx
push dword [0x4d19d8]
mov edi, str.SoftwareVOS_s
lea eax, [ebp - 0x24]
push edi
push eax
mov dword [ebp - 0x20], 1
call fcn.00453c70
mov esi, str.IntegratedNewDirs
push esi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00424585
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 9
mov byte [ebp - 4], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.0046c1c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0042001a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [ebp - 0x14], ebx
je 0x4297e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, ebx
call fcn.00490f21
ret
mov dword [ebp - 0x18], ebx
mov eax, 0x514
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
call fcn.0042049e
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x24]
push ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00423c25
cmp dword [ebp - 0x14], ebx
je 0x429827
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x14], ebx
je 0x4297ec
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x4d19d8]
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00453c70
push esi
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 3
call fcn.00424585
add esp, 0x18
mov byte [ebp - 4], 4
push dword [eax]
call fcn.0046c1c0
push eax
call fcn.00455070
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov ebx, dword [ebp - 0x20]
jmp 0x4297d6

Function at 0x429d91
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x4a464a
call fcn.00490e49
and dword [ebp - 4], 0
push 0x4b3048
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00424585
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [ebp + 8]
push 0x4b304c
call fcn.00451e00
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.00490f21
ret
Function at 0x429e69
Capabilities:
Set file attributes

Disassembly:
push 8
mov eax, 0x4a4627
call fcn.00490e49
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push 0x4b04e0
call fcn.00421197
push 3
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x429f14
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ebx, eax
cmp ebx, esi
je 0x429efc
mov esi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push ebx
mov edi, 0x458d30
push edi
push 3
push dword [ebp - 0x10]
call esi
push ebx
push edi
push 0xe
push dword [ebp - 0x10]
call esi
push ebx
push edi
push 0x10
push dword [ebp - 0x10]
call esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x429f09
push str.Cannot_commit_to_target_file__write_permission_required_
jmp 0x429f01
push str.Cannot_begin_to_update_target_file
mov ecx, dword [ebp + 8]
call fcn.004214a8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x429f21
mov ecx, dword [ebp + 8]
push str.Cannot_open_source_file
call fcn.004214a8
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [ebp + 8]
call fcn.00490f21
ret