joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ee74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48ee7e
repz ret
jmp fcn.00493927

Function at 0x491ab1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048c052
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491b64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491c0c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491c0c
mov esi, dword [fcn.00488080]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491b64
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00488084]
cmp eax, ecx
je 0x491bbd
cmp dword [0x4acb1c], ecx
je 0x491bbd
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491bbd
test ebx, ebx
je 0x491bbd
call edi
test eax, eax
je 0x491bb4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491bb4
test byte [ebp - 8], 1
jne 0x491bbd
or dword [ebp + 0x10], 0x200000
jmp 0x491bf0
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491bf0
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491c0c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491c0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ee74
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x72cf09f9
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x768847d9
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402f7e
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x42d752
call fcn.0041775a
xor edi, edi
push str.SELECT_Value_FROM_Property_WHERE_Property.Property
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], edi
call fcn.00401a51
mov esi, 0x430248
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00402c8b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
call fcn.00402d2b
push esi
lea ecx, [ebp - 0x18]
call fcn.00402c8b
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004023f5
push eax
push esi
push dword [ebp + 0xc]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
je 0x402ff1
mov ecx, dword [ebp + 8]
call fcn.00401317
jmp 0x403083
push edi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x402fe4
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.004023f5
push eax
push esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
cmp eax, edi
jne 0x402fe4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call sub.msi.dll_MsiRecordSetStreamA
cmp dword [ebp - 0x1c], edi
je 0x402fe4
call fcn.00406716
push eax
lea ecx, [ebp + 0x10]
call fcn.00401204
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call fcn.0040132b
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call sub.msi.dll_MsiRecordSetStreamA
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.004011da
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.00401787
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
cmp dword [ebp - 0x10], edi
je 0x403090
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], edi
je 0x40309d
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040103d
mov eax, dword [ebp + 8]
call fcn.00417832
ret 0xc
Function at 0x40399c
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x42d8d7
call fcn.0041775a
lea eax, [ebp - 0x10]
push eax
call fcn.004030b3
xor esi, esi
push 0x44
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.004178c0
push 0x10
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0x68], 0x44
call fcn.004178c0
mov eax, dword [ebp - 0x10]
add esp, 0x18
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040132b
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403a30
cmp dword [0x43e388], esi
je 0x403a24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
push str.InstallProduct:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x43e37c
call fcn.00401462
add esp, 0x10
mov ecx, 0x43e2d8
call fcn.00404c85
jmp 0x403a81
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x403a71
cmp dword [ebp - 0x14], 0xbc2
jne 0x403a71
cmp dword [0x43e38c], esi
jne 0x403a71
mov ecx, 0x43e2d8
mov dword [0x43e38c], 1
call fcn.004040b9
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
call fcn.00417832
ret
Function at 0x403c96
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
mov edi, ecx
call fcn.004178c0
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 0x58], 0x44
call fcn.004178c0
add edi, 8
mov eax, dword [edi]
add esp, 0x18
push dword [eax - 0xc]
mov ecx, edi
call fcn.0040132b
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403d21
cmp dword [0x43e388], esi
je 0x403d10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [edi]
push str.InstallUpdate:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x43e37c
call fcn.00401462
add esp, 0x10
mov ecx, 0x43e2d8
call fcn.00404c85
xor eax, eax
jmp 0x403da5
xor edi, edi
cmp dword [0x43e390], esi
jne 0x403d3b
push esi
push esi
push esi
push esi
push 0x42fad0
call fcn.0040dfa4
mov edi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp edi, esi
je 0x403d66
mov eax, dword [edi + 0x20]
cmp eax, esi
jne 0x403d55
xor eax, eax
jmp 0x403d58
mov eax, dword [eax + 0x20]
push esi
push esi
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edi, edi
inc edi
test eax, eax
je 0x403d93
cmp dword [ebp - 4], 0xbc2
jne 0x403d93
mov ecx, 0x43e2d8
mov dword [0x43e38c], edi
call fcn.004040b9
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x403e70
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x42e4ad
call fcn.0041775a
mov esi, ecx
push 0
lea ebx, [esi + 8]
push str.http:__
mov ecx, ebx
call fcn.004024e7
test eax, eax
je 0x403ea5
push 0
push str.ftp:__
mov ecx, ebx
call fcn.004024e7
test eax, eax
jne 0x403f24
push 0x2f
mov ecx, ebx
call fcn.0040240b
mov ecx, dword [ebx]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ecx - 0xc]
jne 0x403ec2
mov ecx, ebx
call fcn.00401233
jmp 0x403f24
lea ecx, [esi + 0x10]
push ebx
mov dword [esi + 0xc], 1
call fcn.00401415
lea edi, [esi + 0x14]
mov esi, 0x104
push esi
mov ecx, edi
call fcn.0040132b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004011da
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.00403da9
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00402d2b
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040103d
push edi
mov ecx, ebx
call fcn.00401415
call fcn.00417832
ret
Function at 0x403f2a
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x42d976
call fcn.0041775a
mov esi, ecx
call fcn.00406716
push eax
lea ecx, [ebp - 0x10]
call fcn.00401204
xor ebx, ebx
push ebx
push 0x25
mov edi, 0x104
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040132b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004011da
push str.Msi.dll
lea ecx, [ebp - 0x10]
call fcn.00402c8b
lea ecx, [esi + 4]
push edi
call fcn.0040132b
push ebx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x10]
call sub.msi.dll_MsiMessageBoxW
push 0xffffffffffffffff
lea ecx, [esi + 4]
call fcn.004011da
push str.Path
lea ecx, [ebp - 0x18]
call fcn.00401a51
push str.MSI_Updater
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401a51
push 0x43e380
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x43e2d8
mov byte [ebp - 4], 2
call fcn.00404432
lea edi, [esi + 8]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00401415
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040103d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040103d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040103d
mov ecx, esi
call fcn.00403e70
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x404070
cmp dword [esi + 0xc], ebx
jne 0x404038
push edi
mov ecx, 0x43e2d8
call fcn.00404677
test eax, eax
jne 0x404038
mov ecx, edi
call fcn.00401233
jmp 0x404070
call fcn.00406716
push eax
lea ecx, [ebp - 0x14]
call fcn.00401204
lea eax, [ebp - 0x14]
push str.__quiet__norestart__overwriteoem
push eax
mov byte [ebp - 4], 4
call fcn.00401462
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00402d2b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040103d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
call fcn.00417832
ret

Function at 0x404432
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x42d4b5
call fcn.0041775a
and dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00401317
and dword [ebp - 4], 0
push 0x7d
mov dword [ebp - 0x10], 1
pop esi
mov eax, dword [ebp + 0x14]
mov edi, dword [eax]
add esi, esi
push esi
mov ecx, ebx
call fcn.0040132b
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push edi
push esi
push eax
push 0x42f7a8
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, ebx
mov edi, eax
call fcn.004011da
inc edi
cmp esi, edi
jbe 0x40445a
mov eax, ebx
call fcn.00417832
ret 0x10
Function at 0x404677
Capabilities:
Query environment variable

Disassembly:
push 0x1c
mov eax, 0x42daba
call fcn.0041775a
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
call fcn.00401787
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
call fcn.0040132b
push esi
mov esi, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040103d
push 0xffffffffffffffff
mov ecx, edi
call fcn.004011da
lea ecx, [ebp - 0x28]
call fcn.00410a47
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov dword [ebp - 4], 1
je 0x40472f
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00410adf
test eax, eax
je 0x40472f
lea ecx, [ebp - 0x28]
call fcn.00410747
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.00410d50
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401415
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0040103d
lea ecx, [ebp - 0x28]
call fcn.00410661
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410a70
xor eax, eax
inc eax
jmp 0x40473d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410a70
xor eax, eax
call fcn.00417832
ret 4
Function at 0x404c85
Capabilities:
Get common file path

Disassembly:
push 0x18
mov eax, 0x42dae5
call fcn.0041775a
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xb0], ebx
je 0x404d82
mov eax, dword [esi + 0xd0]
cmp eax, dword [0x433130]
jne 0x404d59
call fcn.00406716
push eax
lea ecx, [ebp - 0x10]
call fcn.00401204
mov edi, 0x104
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040132b
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x404cee
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
jmp 0x404d82
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004011da
push str.BootStrap.log
lea ecx, [ebp - 0x10]
call fcn.00402c8b
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x24]
call fcn.00404bad
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x24]
push edx
lea ecx, [esi + 0xcc]
mov eax, dword [ecx]
push 0x1021
push edi
mov byte [ebp - 4], 1
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x24], vtable.CFileException.0
test eax, eax
jne 0x404d48
call fcn.0040103d
lea ecx, [edi - 0x10]
jmp 0x404ce4
call fcn.0040103d
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.0040103d
lea edi, [esi + 0xa4]
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x404d82
add esi, 0xcc
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x54]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov ecx, edi
call fcn.00401233
call fcn.00417832
ret
Function at 0x404d88
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x28
mov eax, 0x42db18
call fcn.0041775a
lea esi, [ecx + 0xc8]
mov edi, 0x104
push edi
mov ecx, esi
call fcn.0040132b
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404ea3
push 0xffffffffffffffff
mov ecx, esi
call fcn.004011da
push esi
lea ecx, [ebp - 0x10]
call fcn.00401787
xor ebx, ebx
push edi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040132b
push eax
push ebx
push 0x430e60
lea ecx, [ebp - 0x10]
call fcn.00404271
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0x10]
or edi, 0xffffffff
add ecx, 0xfffffff0
mov dword [ebp - 4], edi
call fcn.0040103d
push edi
mov ecx, esi
call fcn.004011da
lea ecx, [ebp - 0x20]
call fcn.004111a4
push ebx
push edi
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.00404bad
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push ecx
push 0x1001
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0041158b
test eax, eax
jne 0x404e44
mov ecx, esi
call fcn.00401233
jmp 0x404e86
push str.LOCALIZATION_INI
push 0x87
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x20]
call fcn.00410eda
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x34], vtable.CFileException.0
call fcn.0040103d
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0041127f
call fcn.00417832
ret
Function at 0x405296
Capabilities:
Delete file
Shutdown system

Disassembly:
push 0x20
mov eax, 0x42db98
call fcn.0041775a
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [esi + 0xf8], ebx
jne 0x4052ec
cmp dword [esi + 0xf4], ebx
je 0x4052e7
push 0x90
lea eax, [ebp - 0x1c]
push eax
call fcn.00404f3e
mov eax, dword [eax]
push ebx
push 0x10024
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call fcn.00404bf7
add esp, 0xc
cmp eax, 6
jne 0x4052ec
mov byte [ebp - 0xd], bl
jmp 0x4052f0
mov byte [ebp - 0xd], 1
test byte [ebp - 0x14], 1
je 0x405301
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040103d
cmp byte [ebp - 0xd], bl
jne 0x40539d
lea edi, [esi + 0xc8]
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x405325
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.00401233
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0xb4], ebx
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40537d
lea eax, [ebp - 0x28]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
cmp esi, ebx
je 0x40537d
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp - 0x18]
call edi
mov esi, eax
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
cmp esi, ebx
je 0x40539d
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call edi
call fcn.00417832
ret
Function at 0x405c80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x42dd31
call fcn.0041775a
mov esi, ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ebx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.RequireIE
lea ecx, [ebp - 0x24]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0x104
call fcn.00401a51
push str.Startup
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.00401a51
lea eax, [esi + 0xa8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00404432
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040103d
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0040103d
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], ebx
jne 0x405d20
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040103d
mov eax, ebx
call fcn.00417832
ret
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x34]
push ecx
mov edi, str._d._d._d._d
push edi
push eax
call fcn.00417d3e
add esp, 0x18
call fcn.00406716
push eax
lea ecx, [ebp - 0x10]
call fcn.00401204
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
mov byte [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405d7c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
jmp 0x405d0d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.0040132b
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push str.Version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
test eax, eax
je 0x405dab
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405d6f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004011da
cmp dword [ebp - 0x18], ebx
jbe 0x405d6f
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.00417d3e
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp + eax - 0x34]
mov edx, dword [ebp + eax - 0x44]
cmp ecx, edx
jb 0x405df5
ja 0x405e02
add eax, 4
cmp eax, 0x10
jl 0x405ddf
lea ecx, [edi - 0x10]
call fcn.0040103d
jmp 0x405d0a
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00405669
lea ecx, [edi - 0x10]
jmp 0x405d75
Function at 0x407778
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40779c
cmp dword [edi + 0x54], 0
jne 0x40779c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00412480
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00407739
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40cd7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40cdc4
call fcn.00412480
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40cdc4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40cde0
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040c8f5
mov esi, eax
test edi, edi
je 0x40cdde
test ebx, ebx
je 0x40cdde
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41774b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cf70]
jne 0x417755
repz ret
jmp fcn.004211fc