joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405670
Capabilities:
Check if file exists
Copy file
Delete registry value
Get file attributes
Set registry value

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 2
call fcn.00405560
mov ebx, dword [esp + 0x124]
push 0x5c
push ebx
mov edi, eax
mov dword [esp + 0x1c], 0
call fcn.00404190
mov esi, eax
lea eax, [esp + 0x20]
push eax
call fcn.004054f0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x10
test esi, esi
jne 0x4056c1
lea ecx, [esp + 0x14]
push 0x412250
push ecx
call ebp
mov esi, ebx
lea edx, [esp + 0x14]
push esi
push edx
call ebp
mov eax, dword [esp + 0x124]
test eax, eax
jne 0x4056e8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40576b
cmp byte [esi], 0x5c
jne 0x4056ee
inc esi
push esi
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [esp + 0x14]
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405752
push esi
call dword [sym.imp.GDI32.dll_AddFontResourceA]
test eax, eax
je 0x405752
test edi, edi
mov ebp, 1
je 0x40573f
mov ebx, dword [esp + 0x11c]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebp
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40576f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x11c]
push edx
push eax
push 0x1e
call fcn.00405e30
add esp, 0xc
mov ebp, dword [esp + 0x10]
test edi, edi
je 0x40577a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x405790
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x740
push ebx
push ebp
push esi
lea eax, [esp + 0x30]
push edi
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
xor ebp, ebp
call fcn.00403390
mov esi, dword [esp + 0x758]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x13c]
push 0x104
push edx
push 0x402650
push str.Font
push esi
mov byte [esp + 0x358], bl
mov byte [esp + 0x254], bl
mov byte [esp + 0x150], bl
call edi
lea eax, [esp + 0x34]
lea ecx, [esp + 0x23c]
push eax
push 0x104
push ecx
push 0x402650
push str.FontAlt
push esi
call edi
lea edx, [esp + 0x34]
lea eax, [esp + 0x340]
push edx
push 0x104
push eax
push 0x402650
push str.FontAlt2
push esi
call edi
lea ecx, [esp + 0x34]
lea edx, [esp + 0x20]
push ecx
push 0x14
push edx
push 0x402650
push str.Force
push esi
call edi
mov al, byte [esp + 0x20]
cmp al, 0x59
je 0x405857
cmp al, 0x79
mov dword [esp + 0x10], ebx
jne 0x40585f
mov dword [esp + 0x10], 1
cmp byte [esp + 0x138], bl
jne 0x40587e
cmp byte [esp + 0x23c], bl
jne 0x40587e
cmp byte [esp + 0x340], bl
je 0x4059f8
lea eax, [esp + 0x34]
lea ecx, [esp + 0x64c]
push eax
push 0x104
push ecx
push 0x402650
push str.Path
push esi
call edi
test eax, eax
je 0x4059f8
lea edx, [esp + 0x34]
lea eax, [esp + 0x548]
push edx
push 0x104
push eax
push 0x402650
push str.Version
push esi
call edi
test eax, eax
je 0x4059f8
lea ecx, [esp + 0x548]
push ecx
call fcn.004053e0
add esp, 4
lea edx, [esp + 0x444]
mov edi, eax
mov dword [esp + 0x14], ebx
push 0x4151c0
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x444]
push 0x412250
push eax
call esi
lea ecx, [esp + 0x64c]
lea edx, [esp + 0x444]
push ecx
push edx
call esi
mov al, byte [esp + 0x340]
mov byte [esp + 0x34], bl
cmp al, bl
je 0x40594a
lea eax, [esp + 0x34]
lea ecx, [esp + 0x340]
push eax
push ecx
call fcn.004055a0
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x405998
cmp byte [esp + 0x23c], bl
je 0x405970
lea edx, [esp + 0x34]
lea eax, [esp + 0x23c]
push edx
push eax
call fcn.004055a0
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40599c
jmp 0x405974
mov esi, dword [esp + 0x18]
cmp byte [esp + 0x138], bl
je 0x4059c3
lea ecx, [esp + 0x34]
lea edx, [esp + 0x138]
push ecx
push edx
call fcn.004055a0
add esp, 8
test eax, eax
je 0x4059c3
jmp 0x40599c
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x10], ebx
je 0x4059f8
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.004050c0
add esp, 0xc
test eax, eax
je 0x4059c3
cmp dword [esp + 0x14], edi
jae 0x4059f8
cmp ebp, ebx
je 0x4059d0
lea eax, [esp + 0x340]
jmp 0x4059e2
cmp esi, ebx
lea eax, [esp + 0x23c]
jne 0x4059e2
lea eax, [esp + 0x138]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x444]
push ecx
push edx
push eax
call fcn.00405670
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x740
ret
Function at 0x405d10
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x1014
call fcn.00408a10
mov eax, dword [0x4162dc]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
jne 0x405d35
pop esi
mov eax, 1
pop ebx
add esp, 0x1014
ret
lea eax, [esp + 0x14]
mov byte [esp + 8], bl
push eax
push 0x20008
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405d72
pop esi
pop ebx
add esp, 0x1014
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 0x1000
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [esp + 0x14]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x405daa
pop esi
xor eax, eax
pop ebx
add esp, 0x1014
ret
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x405dd6
pop esi
pop ebx
add esp, 0x1014
ret
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
push edi
jbe 0x405e0f
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x28]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
push ecx
push edx
call ebx
test eax, eax
jne 0x405e0a
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x405dee
jmp 0x405e0f
mov ebp, 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x1014
ret
Function at 0x4068e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
push esi
push edi
xor edi, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
call fcn.00404580
mov esi, dword [esp + 0x21c]
cmp esi, edi
jne 0x406a21
cmp dword [0x416804], edi
jne 0x406a2a
lea eax, [esp + 0x114]
push eax
call fcn.00404ae0
add esp, 4
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x406a21
push ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
mov esi, 0x400
call fcn.00403390
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add esp, 4
push esi
push 0x40
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea edx, [esp + 0x18]
mov ebx, eax
push edx
push esi
push ebx
push str.ProductFeatures
call ebp
cmp eax, 0x3fe
jb 0x406999
push ebx
add esi, esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
cmp esi, 0x8000
ja 0x406999
push esi
push 0x40
call edi
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push str.ProductFeatures
call ebp
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x40696a
push str.MsiQueryFeatureStateA
mov esi, ebx
call fcn.004078f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test esi, esi
je 0x4069fe
mov al, byte [esi]
test al, al
je 0x4069fe
cmp al, 0x3b
je 0x4069e6
push 0x3d
push esi
call fcn.00404120
add esp, 8
inc eax
test ebp, ebp
mov esi, eax
je 0x4069e6
lea edx, [esp + 0x11c]
push esi
push edx
call ebp
cmp eax, 4
jne 0x4069e6
mov dword [esp + 0x10], 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
test eax, eax
lea esi, [esi + ecx + 1]
je 0x4069ae
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
pop ebx
je 0x406a1a
pop edi
xor eax, eax
pop esi
add esp, 0x210
ret
mov esi, dword [esp + 0x21c]
mov eax, dword [0x416804]
test eax, eax
je 0x406a44
mov eax, dword [esp + 0x220]
push eax
push esi
call fcn.00406070
add esp, 8
pop edi
pop esi
add esp, 0x210
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406a5e
call fcn.00403ea0
test eax, eax
jne 0x406a5e
pop edi
pop esi
add esp, 0x210
ret
mov ecx, dword [esp + 0x220]
push ecx
push esi
call fcn.00406070
add esp, 8
pop edi
pop esi
add esp, 0x210
ret
Function at 0x4070c0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push 0x40
call edi
mov ebp, dword [esp + 0x14]
mov ebx, eax
push ebp
push esi
push ebx
push 0x4124c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0x3fe
jb 0x40711c
push ebx
add esi, esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jg 0x407120
push esi
push 0x40
call edi
mov ebx, eax
push ebp
push esi
push ebx
push 0x4124c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x4070ef
test ebx, ebx
jne 0x407133
push 0x1b
push 0
call fcn.00403f30
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, ebx
mov ebp, 1
test esi, esi
je 0x407178
mov al, byte [esi]
test al, al
je 0x407178
cmp al, 0x3b
je 0x407164
push 0x3d
push esi
call fcn.00404120
inc eax
mov esi, eax
push esi
call fcn.00403300
push esi
call fcn.00407040
add esp, 0x10
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ebp, ebp
lea esi, [esi + ecx + 1]
jne 0x40713a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x4071b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, 0x400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push 0x40
call edi
mov ebp, dword [esp + 0x120]
mov ebx, eax
push ebp
push esi
push ebx
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0x3fe
jb 0x407215
push ebx
add esi, esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jg 0x407219
push esi
push 0x40
call edi
mov ebx, eax
push ebp
push esi
push ebx
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x4071e8
test ebx, ebx
jne 0x407226
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov esi, ebx
mov al, byte [esi]
test al, al
je 0x40724f
cmp al, 0x3b
je 0x40723b
push esi
call fcn.00405a60
add esp, 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [esi + ecx + 1]
test esi, esi
jne 0x407228
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x41680c]
mov edi, 1
test eax, eax
jne 0x4073d7
mov eax, dword [0x416814]
test eax, eax
jne 0x4073d7
mov eax, dword [0x416810]
test eax, eax
jne 0x4073d7
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x414fb4
lea eax, [esp + 0x1c]
push 0x104
xor edx, edx
push eax
push 0x402650
mov word [esp + 0x20], dx
push str.Display
push str.Display
mov byte [esp + 0x2a], dl
call esi
test eax, eax
je 0x40735e
lea ecx, [esp + 0x18]
push 0x14
push ecx
call fcn.00404080
add esp, 8
test eax, eax
jne 0x407353
lea edx, [esp + 0x18]
push 0x15
push edx
call fcn.00404080
add esp, 8
test eax, eax
jne 0x407353
lea eax, [esp + 0x18]
push 0x16
push eax
call fcn.00404080
add esp, 8
test eax, eax
je 0x407305
mov byte [esp + 0x10], 0x62
mov dword [0x416814], edi
jmp 0x40735e
lea ecx, [esp + 0x18]
push 0x17
push ecx
call fcn.00404080
add esp, 8
test eax, eax
je 0x407325
mov byte [esp + 0x10], 0x72
mov dword [0x416814], edi
jmp 0x40735e
lea edx, [esp + 0x18]
push 0x18
push edx
call fcn.00404080
add esp, 8
test eax, eax
je 0x407345
mov byte [esp + 0x10], 0x66
mov dword [0x416810], edi
jmp 0x40735e
push 0x1a
push 0
call fcn.00403f30
add esp, 8
jmp 0x40735e
mov byte [esp + 0x10], 0x6e
mov dword [0x41680c], edi
push 0x414fb4
lea eax, [esp + 0x1c]
push 0x104
push eax
push 0x402650
push str.CompletionNotice
push str.Display
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x4073a4
mov al, byte [esp + 0x18]
cmp al, 0x79
je 0x407398
cmp al, 0x59
je 0x407398
cmp al, 0x31
jne 0x4073a4
lea ecx, [esp + 0x10]
push 0x4124cc
push ecx
call esi
mov al, byte [esp + 0x10]
test al, al
je 0x4073d7
mov edx, dword [0x4124c8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], edx
call esi
mov eax, dword [esp + 0x124]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00404500
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x4073f0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x416830]
sub esp, 0x30c
test eax, eax
push esi
je 0x40740d
mov eax, 1
pop esi
add esp, 0x30c
ret
mov esi, dword [esp + 0x314]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push 0x104
push 0x4163e8
push 0x402650
push str.Type
push str.Logging
call edi
push esi
lea eax, [esp + 0x214]
push 0x104
push eax
push str._TEMP_
push str.Path
push str.Logging
call edi
push esi
lea ecx, [esp + 0x110]
push 0x104
push ecx
push str.SetupLog__.txt
push str.Template
push str.Logging
call edi
lea edx, [esp + 8]
lea eax, [esp + 0x10c]
push edx
lea ecx, [esp + 0x214]
push eax
push ecx
call fcn.004038e0
add esp, 0xc
test eax, eax
pop edi
je 0x4074ac
lea edx, [esp + 4]
push edx
call fcn.00407190
add esp, 4
pop esi
add esp, 0x30c
ret
mov al, byte [esp + 4]
test al, al
je 0x4074cf
lea eax, [esp + 4]
push eax
push 0x1c
push 0
call fcn.00404020
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x30c
ret
push esi
push 0x23
push 0
call fcn.00404020
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x30c
ret

Function at 0x4074f0
Capabilities:
Get file attributes
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push edi
push 0x414fb4
call fcn.00403300
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
test eax, eax
je 0x40754d
push 0x5c
push 0x414fb4
call fcn.00404120
add esp, 8
test eax, eax
jne 0x40754d
push 0x414fb4
push 0x4151c0
lea eax, [esp + 0x10]
push str._s_s
push eax
call edi
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x414fb4
call ebx
push 0x414fb4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x414fb4
call fcn.004073f0
add esp, 4
test eax, eax
je 0x4076a7
mov eax, dword [0x4167f4]
push esi
test eax, eax
jne 0x4075a4
mov eax, dword [0x41683c]
test eax, eax
jne 0x4075a4
mov eax, dword [0x4167e8]
test eax, eax
jne 0x4075a4
mov eax, dword [0x4167ec]
test eax, eax
jne 0x4075a4
mov eax, dword [0x416800]
test eax, eax
jne 0x4075a4
mov eax, dword [0x416840]
test eax, eax
je 0x4075b7
push 0x415bc8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x40766e
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x414fb4
push 0x104
push 0x415bc8
push 0x402650
push 0x41253c
push 0x41253c
call esi
test eax, eax
jne 0x407605
push 0x414fb4
push 0x104
push 0x415bc8
push 0x402650
push str.database
push str.setup
call esi
test eax, eax
je 0x40766e
push 0x415bc8
call fcn.00403300
add esp, 4
test eax, eax
je 0x407657
cmp byte [0x415bc8], 0x5c
je 0x407657
push 0x3a
push 0x415bc8
call fcn.00404120
add esp, 8
test eax, eax
jne 0x407657
push 0x415bc8
push 0x4151c0
lea edx, [esp + 0x14]
push str._s_s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0x415bc8
call ebx
push 0x415bc8
call fcn.004032b0
add esp, 4
mov dword [0x4167f4], 1
push 0x414fb4
call fcn.004070c0
add esp, 4
test eax, eax
pop esi
je 0x4076a7
mov ecx, dword [esp + 0x110]
push ecx
push 0x414fb4
call fcn.004071b0
add esp, 8
test eax, eax
je 0x4076a7
pop edi
mov eax, 1
pop ebx
add esp, 0x104
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x407700
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x158
lea eax, [esp + 0x54]
push esi
push eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x14
call fcn.00403390
add esp, 4
lea ecx, [esp + 0x58]
lea edx, [esp + 0x30]
push ecx
push 0x14
push edx
push str.5.00.0000.0000
push str.Version
push 0x4109fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x407766
xor esi, esi
jmp 0x4077da
lea ecx, [esp + 8]
lea edx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40778f
xor esi, esi
jmp 0x4077da
lea edx, [esp + 0x20]
lea eax, [esp + 0x30]
push edx
push eax
call fcn.004076c0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x4c]
push ecx
push edx
call fcn.004076c0
mov eax, dword [esp + 0x20]
add esp, 0x10
xor esi, esi
cmp eax, 5
jne 0x4077da
xor eax, eax
mov ecx, dword [esp + eax + 0x20]
mov edx, dword [esp + eax + 0x10]
cmp ecx, edx
jg 0x4077d5
jl 0x4077da
add eax, 4
cmp eax, 0x10
jl 0x4077bd
jmp 0x4077da
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x4077e9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x158
ret

Function at 0x407800
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x1a0
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x10]
mov esi, 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4078e0
cmp dword [esp + 0x20], 2
jne 0x4078e0
cmp dword [esp + 0x14], 5
jb 0x4078e0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
and eax, 0x3ff
cmp eax, 0x11
je 0x40786a
cmp eax, 0x12
je 0x40786a
cmp eax, 0x2a
je 0x40786a
cmp eax, 0x1e
jne 0x4078e0
lea ecx, [esp + 0xa4]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xa4]
push str.OLEAUT32.DLL
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0xac]
push 0
push edx
call fcn.004045a0
add esp, 0x10
test eax, eax
je 0x4078c7
mov eax, dword [esp + 0xc]
cmp eax, 0x20028
ja 0x4078d2
jne 0x4078c7
cmp dword [esp + 8], 0x11a20000
jae 0x4078d2
pop edi
xor eax, eax
pop esi
add esp, 0x1a0
ret
pop edi
mov eax, 1
pop esi
add esp, 0x1a0
ret
mov eax, esi
pop edi
pop esi
add esp, 0x1a0
ret

Function at 0x4078f0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4162e0]
sub esp, 0x208
test eax, eax
jne 0x407945
lea eax, [esp + 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp]
push str.MSI.DLL
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4162e0], eax
add esp, 0x208
ret
Function at 0x407b20
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x60c
mov dl, byte [0x402650]
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], dl
mov byte [esp + 0x21c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x118], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
mov dword [esp + 0x10], ebp
push eax
call fcn.00403470
add esp, 4
lea ecx, [esp + 0x118]
push 0x104
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407c76
mov edx, dword [esp + 0x620]
lea eax, [esp + 0x118]
push edx
push eax
lea ecx, [esp + 0x224]
push str.__s___s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ebp
push edx
push ebp
push 0x2001b
push ebp
push ebp
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x407c25
lea eax, [esp + 0x21c]
push eax
call ebx
inc eax
lea ecx, [esp + 0x21c]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x20]
push ebp
push edx
push eax
call edi
test eax, eax
je 0x407c71
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0x2001b
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call esi
test eax, eax
jne 0x407c76
lea edx, [esp + 0x21c]
push edx
call ebx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x220]
push eax
push 1
lea ecx, [esp + 0x20]
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x407c76
mov ebp, 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407c85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x60c
ret
Function at 0x407ca0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0xa8
lea eax, [esp + 0x14]
mov dword [esp], 0
push eax
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x24], 2
jne 0x407d42
lea ecx, [esp]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x407ce7
add esp, 0xa8
ret
lea edx, [esp + 8]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x407d04
add esp, 0xa8
ret
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x407d37
add esp, 0xa8
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0xa8
ret

Function at 0x407d60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x360
mov al, byte [0x402650]
push esi
push edi
mov byte [esp + 0x5c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.oa4514.exe
lea ecx, [esp + 0x268]
push str.Launching__s
push ecx
stosb byte es:[edi], al
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [0x41680c]
mov dword [esp + 0x18], 0x44
test eax, eax
mov dword [esp + 0x44], 0x40
je 0x407dd4
lea edx, [esp + 0x5c]
push str.__q__m
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x416818]
test eax, eax
je 0x407ded
lea eax, [esp + 0x5c]
push 0x4125c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x160]
push ecx
push str.oa4514.exe
push str.SUPPORT
push 0x4151c0
push str.__s_s_s__s
push edx
call esi
add esp, 0x18
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x160]
push eax
push ecx
push 0
push 0
push 0x20
push 1
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x407e4b
pop edi
mov eax, 1
pop esi
add esp, 0x360
ret
push str.oa4514.exe
lea eax, [esp + 0x268]
push str.Failed_to_launch__s
push eax
call esi
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 0x360
ret