joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d559
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.004adf37
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d5b3
push 0x80004005
call fcn.0048b8e9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.004adf37
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d5e6
push 0x80004005
call fcn.0048b8e9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d499
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d684
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d638
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d658
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048c919
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
invalid
invalid

Function at 0x4a1005
Capabilities:
Encode data using xor

Disassembly:
ret
js 0x4a0fa3
and byte [eax], 0xf3
or dword [edi], 0x29
nop
mov byte [ebx + 0x2d74da0e], 0x6e
mov ecx, 0xc19db211
cmp eax, 0x9f4308bc
call 0xcb778094
invalid
Function at 0x4a3dd9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c51f7
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e24
push 0x80004005
call fcn.004a2ba9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c51f7
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e54
push 0x80004005
call fcn.004a2ba9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c51f7
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e81
push 0x80004005
call fcn.004a2ba9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a35d9
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a35d9
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af0e7
Capabilities:
Encode data using xor

Disassembly:
push 0x3d
mov bh, 0x85
xchg edx, eax
ret 0x5b19
push cs
movsb byte es:[edi], byte [esi]
and ebx, ecx
lds ecx, [ebx - 0x2b8e7584]
lodsd eax, dword [esi]
or edx, dword [eax - 0x37]
and byte [esi], 0x2b
std
sub dword [edx + 0x5a88063f], eax
adc edi, dword [0xa2d81ab3]
inc edx
dec eax
mov byte [0xf4c3ec4a], al
add dword [esi + 3], edi
jle 0x4af0ec
jle 0x4af0ec
inc edi
faddp st(5)
jno 0x4af0c1
lds esi, [ecx - 0x2e]
mov dword [0x75b87c93], eax
adc al, 0x8c
jge 0x4af0b8
rcl byte [eax + edx*4], 0x57
pushfd
mov bl, 0x49
add ch, byte [ecx - 0x17004a1b]
rcl byte [ebx], 0xfc
push ecx
mov edi, 0xab471a0b
or ebx, dword [edx]
inc edi
stosd dword es:[edi], eax
xor byte [ebx - 0x7d742574], dh
xchg esp, esp
xchg edi, eax
fimul dword [ebx - 0x681b787e]
pop ds
or byte [esi], al
push es
xchg edx, eax
wait
xor eax, dword [eax + 0x3e]
rcl dword [edi - 0x59688931], cl
mov bh, 0x25
push ebp
mov ebp, 0x501cce33
cmp byte [esi - 0x7e], bl
sub eax, 0x3be0d27a
mov ebx, 0x6d982554
or eax, 0x82ef9da6
jnp 0x4af111
cmp byte [ebp - 0x4c], ch
add byte [ebx + 0x6279ab53], ah
sahf
push fs
imul ch
jns 0x4af10a
in eax, dx
sbb dword [esi + 0xd], esp
out dx, al
inc eax
push es
popal
cli
sbb eax, 0x3cefd2b
mov byte [eax], ah
lodsd eax, dword [esi]
sbb al, 0x60
or al, 0x60
xor byte [ecx], 0x7e
sub al, 0xb0
push 0xe3003011
mov bh, 0xcf
inc eax
jmp 0x4af119

Function at 0x4b458b
Capabilities:
Encode data using xor

Disassembly:
push edx
ja 0x4b45b8
in eax, dx
add eax, dword [ebx - 8]
and ebx, dword [ebx]
xchg edx, esp
xchg esi, eax
scasd eax, dword es:[edi]
dec edi
push ds
xor byte [ecx - 0x6a573232], ah
cmc
or dword [ecx], ebx
adc dword [esi], esi
adc esp, esi
pushfd
fmul qword [esp + edi*8 + 0x5a]
je 0x4b45f7
sbb dword [edi + 0x1bc64e03], esi
mov bh, 0x1e
hlt
adc dword [ecx - 0x74f93cc5], edi
xor cl, 0xce
xlatb
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
or ebx, dword [ebp - 0xb]
js 0x4b4666
mov ecx, 0x2a2d625e
xchg ebx, eax
in eax, dx
invalid
sar dword [ebx + 0x433f9f67], 0xa4
dec esp
cli
lahf
salc
daa
mov ebp, 0xa0277f53
xor dword [ecx], ebp
in eax, 0x4a
mov eax, dword [0xcf8f90ca]
and al, 0x1b
pop ecx
sbb dword [ecx - 0x66e06f48], esp
dec ebp
dec esi
dec byte [ebp + 0x26eff06a]
in al, 0x9a
leave
test dword [edx], edx
pop esi
invalid
Function at 0x401690
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREASUSUPIODRV
push 0x80000002
call edi
test eax, eax
jne 0x40175d
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.Version
push ecx
call esi
mov edx, dword [esp + 8]
push str.RefCount
push edx
call esi
mov eax, dword [esp + 8]
push str.ReleaseTime
push eax
call esi
mov ecx, dword [esp + 8]
push str.InstalledTime
push ecx
call esi
mov edx, dword [esp + 8]
push str.UninFile
push edx
call esi
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREASUS
push 0x80000002
call edi
test eax, eax
jne 0x40175d
mov eax, dword [esp + 0x10]
push str.UPIODRV
test eax, eax
je 0x401749
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
mov ecx, dword [esp + 8]
push ecx
call esi
xor eax, eax
pop edi
pop esi
pop ecx
ret

Function at 0x401770
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x400
lea eax, [esp + 0x300]
push esi
push edi
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 0x40c]
test eax, eax
je 0x4017d8
mov eax, dword [0x4167c8]
lea edx, [esp + 8]
test eax, eax
mov edi, str._syswow64
jne 0x4017ad
mov edi, str._system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIO.sys
jmp 0x40180a
mov edi, str._system
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIO.vxd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x308]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x108]
push ecx
push edx
push eax
lea ecx, [esp + 0x214]
push str._s_sdrivers_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0x208]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x400
ret
Function at 0x401880
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40189f
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4018e9
xor eax, eax
add esp, 0x14
ret
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x401940
Capabilities:
Create service
Start service

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
test eax, eax
push esi
push edi
je 0x401a2c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x401972
pop edi
pop esi
add esp, 0x100
ret
push 0xf01ff
push str.AsUpIO
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4019f9
mov eax, dword [0x4167c8]
push str.AsUpIO.sys
test eax, eax
je 0x4019a3
lea eax, [esp + 0xc]
push str.SysWow64drivers_s
push eax
jmp 0x4019ad
lea ecx, [esp + 0xc]
push str.system32drivers_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
push 0
push 0
push 0
push 0
push 0
push edx
push 1
push 1
push 1
push 0xf01ff
push str.AsUpIO
push str.AsUpIO
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x4019f9
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x100
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x401a20
pop edi
xor eax, eax
pop esi
add esp, 0x100
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x100
ret

Function at 0x401a90
Capabilities:
Stop service

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
test eax, eax
push esi
push edi
jne 0x401aa8
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401b00
push 0xf01ff
push str.AsUpIO
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x401af9
lea eax, [esp + 8]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x401b10
Capabilities:
Copy file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x700
lea eax, [esp + 0x400]
push esi
push edi
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x508]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esp + 0x70c]
test eax, eax
je 0x401be3
mov eax, dword [0x4167c8]
lea edx, [esp + 8]
test eax, eax
je 0x401b8a
mov edi, str._syswow64
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIo64.sys
jmp 0x401bb8
mov edi, str._system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIo32.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x308]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIO.sys
jmp 0x401c3e
mov edi, str._system
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIO.vxd
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x308]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.AsUpIO.vxd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x408]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x308]
push ecx
push edx
push eax
lea ecx, [esp + 0x214]
push str._s_sdrivers_s
push ecx
call esi
lea edx, [esp + 0x11c]
lea eax, [esp + 0x51c]
push edx
push eax
lea ecx, [esp + 0x624]
push str._s_s
push ecx
call esi
add esp, 0x24
lea edx, [esp + 0x208]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x208]
push 0
lea ecx, [esp + 0x60c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
add esp, 0x700
ret
Function at 0x401ce0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREASUSUPIODRV
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401dd5
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.Version
push eax
mov dword [esp + 0x20], 4
call edi
lea ecx, [esp + 8]
lea edx, [esi + 0x84]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.RefCount
push ecx
mov dword [esp + 0x20], 4
call edi
lea edx, [esp + 8]
lea eax, [esi + 4]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.ReleaseTime
push edx
mov dword [esp + 0x20], 0x40
call edi
lea eax, [esp + 8]
lea ecx, [esi + 0x44]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.InstalledTime
push eax
mov dword [esp + 0x20], 0x40
call edi
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
add esi, 0x88
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push 0
push str.UninFile
push eax
mov dword [esp + 0x20], 0xff
call edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x401de0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SOFTWAREASUSUPIODRV
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401e3b
cmp eax, 2
jne 0x401f28
lea ecx, [esp + 4]
lea edx, [esp]
push ecx
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREASUSUPIODRV
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401f28
mov eax, dword [esp + 0x90]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
test eax, eax
jbe 0x401e68
mov ecx, dword [esp + 8]
lea eax, [esp + 0x98]
push 4
push eax
push 4
push 0
push str.RefCount
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x401e87
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push str.Version
push eax
call esi
lea edi, [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401eb8
lea edi, [esp + 0x58]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [esp + 8]
dec ecx
push ecx
lea ecx, [esp + 0x5c]
push ecx
push 1
push eax
push str.InstalledTime
push edx
call esi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401eea
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push 1
push 0
push str.ReleaseTime
push ecx
call esi
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401f24
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x9c]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.UninFile
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x401f30
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 8]
push esi
xor ebx, ebx
xor esi, esi
push eax
push 0x20008
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40203c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push edx
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0
mov byte [esp + 0x49], 5
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40203c
mov ecx, dword [esp + 0xc]
push ebp
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push ecx
mov dword [esp + 0x24], ebx
call edi
mov edx, dword [esp + 0x10]
push edx
call fcn.0040a08e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push 2
push edx
call edi
test eax, eax
je 0x402020
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
jbe 0x402020
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebp, [esi + 4]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push eax
push ecx
call ebx
test eax, eax
jne 0x402018
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x401ffd
jmp 0x402020
mov dword [esp + 0x1c], 1
push esi
call fcn.0040a0b7
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [esp + 0x1c]
pop edi
xor ebx, ebx
pop ebp
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x40204b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x40666d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x415d78
cmp edx, dword [eax]
je 0x40668f
add eax, 8
inc ecx
cmp eax, 0x415e08
jl 0x406680
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x415d78]
jne 0x4067bd
mov eax, dword [0x418864]
cmp eax, 1
je 0x406797
test eax, eax
jne 0x4066c0
cmp dword [0x4157a0], 1
je 0x406797
cmp edx, 0xfc
je 0x4067bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4066f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004050f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004051e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40673a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004051e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4118c4
push edi
call fcn.00404ff0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004050f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405100
lea eax, [ebp - 0xa0]
push 0x4118a4
push eax
call fcn.00405100
push dword [esi + 0x415d7c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040815b
add esp, 0x2c
pop edi
jmp 0x4067bd
lea eax, [ebp + 8]
lea esi, [esi + 0x415d7c]
push 0
push eax
push dword [esi]
call fcn.004051e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40f0eb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40f119
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40f137
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040f051
jmp 0x40f137
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40f137
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040f051
test edi, edi
mov eax, edi
jne 0x40f121
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8