joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6691f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.6691f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6691f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6691f06a
add dl, dl
jne 0x6691f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6691f0dc
xor eax, eax
add dl, dl
jne 0x6691f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6691f17d
add dl, dl
jne 0x6691f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6691f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6691f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6691f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6691f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6691f075
mov eax, 1
add dl, dl
jne 0x6691f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6691f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6691f0e1
sub eax, ebx
mov ebx, 1
jne 0x6691f128
mov ecx, 1
add dl, dl
jne 0x6691f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6691f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6691f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6691f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6691f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6691f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6691f136
cmp eax, 0x7d00
jae 0x6691f16d
cmp eax, 0x500
jb 0x6691f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6691f075
cmp eax, 0x7f
ja 0x6691f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6691f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6691f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6691f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5261c3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x526202
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x526202
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x526202
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x526202
cmp dword [ecx + 0x74], 0xe
jbe 0x526202
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x526428
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x52644f
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x526452
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00526404
pop esi
leave
ret 8

Function at 0x5323f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x53241d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x53241d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x24753236
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x12f5575
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x64d81efa
Capabilities:
Encode data using xor

Disassembly:
popal
mov bl, 0xdd
mov eax, 0xea37b773
cmpsd dword [esi], dword es:[edi]

Function at 0x6515c3a4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6515c3ae
pushal
call 0x6515c3b4
pop ebp
sub ebp, 0x10
sub ebp, 0x3dc3a4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x6515c3d8
ret
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x6515c3e1
mov eax, 0x3dc3a4
add eax, ebp
add eax, 0x63
mov ecx, 0x5e6
mov edx, 0x2b97bd95
xor byte [eax], dl
inc eax
dec ecx
jne 0x6515c3f8
jmp 0x6515c40b
push ds
pop eax
push ds
sbb al, 0xa9
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
adc al, 0x54
insd dword es:[edi], dx
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
pop eax
sub eax, 0x9595959e
das
mov ebp, 0x62959595
ja 0x6515c3be
pop ebp
push ds
adc al, 0x99
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
push eax
lds ebx, [eax]
int1
mov cl, 0x69
sbb al, 0x91
mov cl, 0xfd
jge 0x6515c42a
wait
xchg ebp, eax
std
sub edx, edx
mov edx, 0xb1b99495
std
retf
Function at 0x40150b
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [ebp + 0xc], eax
jne 0x401582
lea ecx, [ebp - 0x20]
call fcn.00401ac1
and byte [ebp - 0xc], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, 0x104
mov dword [ebp - 8], ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004062bc
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x10]
call fcn.0040176d
lea ecx, [ebp - 0x20]
call fcn.0040184c
push 1
push dword [ebp - 0x1c]
push 0
push str.http:__consumer.installshield.com
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.0040172f
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x401589
Capabilities:
Contain obfuscated stackstrings
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
push 0x91
call edi
test al, 1
je 0x4016b0
push 0xa0
call edi
test ah, 0x80
je 0x4016b0
push 0xa2
call edi
test ah, 0x80
je 0x4016b0
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x36]
mov byte [ebp - 0x64], 0x44
mov byte [ebp - 0x63], 0x65
mov byte [ebp - 0x62], 0x76
mov byte [ebp - 0x61], 0x65
mov byte [ebp - 0x60], 0x6c
mov byte [ebp - 0x5f], 0x70
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 0x64
mov byte [ebp - 0x5c], 0x20
mov byte [ebp - 0x5b], 0x62
mov byte [ebp - 0x5a], 0x79
mov byte [ebp - 0x59], 0x20
mov byte [ebp - 0x58], 0x52
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x74
mov byte [ebp - 0x55], 0x65
mov byte [ebp - 0x54], 0x73
mov byte [ebp - 0x53], 0x68
mov byte [ebp - 0x52], 0x20
mov byte [ebp - 0x51], 0x50
mov byte [ebp - 0x50], 0x61
mov byte [ebp - 0x4f], 0x72
mov byte [ebp - 0x4e], 0x69
mov byte [ebp - 0x4d], 0x6b
mov byte [ebp - 0x4c], 0x68
mov byte [ebp - 0x4b], 0xa
mov byte [ebp - 0x4a], 0xa
mov byte [ebp - 0x49], 0x44
mov byte [ebp - 0x48], 0x65
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], 0x69
mov byte [ebp - 0x45], 0x63
mov byte [ebp - 0x44], 0x61
mov byte [ebp - 0x43], 0x74
mov byte [ebp - 0x42], 0x65
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x20
mov byte [ebp - 0x3f], 0x74
mov byte [ebp - 0x3e], 0x6f
mov byte [ebp - 0x3d], 0x20
mov byte [ebp - 0x3c], 0x4e
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x72
mov byte [ebp - 0x39], 0x61
mov byte [ebp - 0x38], 0x6c
mov byte [ebp - 0x37], 0x69
rep stosd dword es:[edi], eax
push 0x408
push dword [esi + 4]
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x64]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x401d0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
xor ebx, ebx
cmp dword [0x41e760], ebx
push esi
push edi
jne 0x401e5c
lea ecx, [ebp - 0x18]
call fcn.00401eac
push 0x20019
push str.Typeliba681f238_74bb_4807_b940_a80197ecbbe61.00win32
push SysReAllocStringLen
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], 0x41a3ec
mov dword [ebp - 4], ebx
call fcn.00401e6e
mov eax, 0x104
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
call fcn.004062bc
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ebx
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x41e75c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040176d
cmp esi, ebx
jne 0x401dbd
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402085
push eax
lea ecx, [ebp - 0x18]
call fcn.00401ec0
lea ecx, [ebp - 0x38]
call fcn.0040172f
push str._ispmres.dll
jmp 0x401df5
lea eax, [ebp - 0x13c]
push str.InstallShieldUpdateService_ispmres.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.00401ef8
add esp, 0x10
lea ecx, [ebp - 0x18]
push eax
call fcn.00401ec0
lea ecx, [ebp - 0x2c]
call fcn.0040172f
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402818
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x401e0b
xor esi, esi
jmp 0x401e37
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00415750
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [ebp - 4], ebx
mov dword [0x41e760], eax
je 0x401e54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x18]
call fcn.0040172f
mov eax, dword [0x41e760]
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401ef8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401f70
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0xc], 0x104
mov eax, str.CommonFilesDir
je 0x401f50
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
lea eax, [ebp - 0x130]
push eax
je 0x401fa0
lea ecx, [ebp - 0x2c]
call fcn.00401fe9
push 1
lea ecx, [ebp - 0x2c]
pop ebx
mov dword [ebp - 0x2c], 0x41a3ec
push 0x41d0f4
call fcn.004025c0
jmp 0x401fb5
lea ecx, [ebp - 0x1c]
call fcn.00401fe9
push 2
mov dword [ebp - 0x1c], 0x41a3ec
pop ebx
lea eax, [ebp - 0x1c]
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.0040204f
test bl, 2
mov dword [edi], 0x41a3ec
je 0x401fd6
lea ecx, [ebp - 0x1c]
and ebx, 0xfffffffd
call fcn.0040172f
test bl, 1
je 0x401fe3
lea ecx, [ebp - 0x2c]
call fcn.0040172f
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x4031a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004030db
lea ecx, [ebp - 0x10]
call fcn.0040184c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4031ca
mov bl, 1
jmp 0x4031cc
xor bl, bl
lea ecx, [ebp - 0x10]
call fcn.0040172f
mov al, bl
pop ebx
leave
ret
Function at 0x40554e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
lea esi, [ecx + 4]
xor edi, edi
neg ecx
sbb ecx, ecx
push edi
and ecx, esi
push edi
push ecx
call fcn.00414da2
add esp, 0xc
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, esi
call fcn.0040194e
mov eax, dword [0x41e798]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
mov dword [ebp - 4], eax
call edi
push eax
push 0xb
call edi
push eax
mov ebx, 0x80
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 1
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41e798]
push 0
push 0x32
mov dword [ebp - 4], eax
call edi
push eax
push 0x31
call edi
push eax
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 0
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x1c]
call fcn.00401794
push dword [0x41e778]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x41a3e0
push 0x62
call fcn.00401af1
lea ecx, [ebp - 0x1c]
call fcn.0040184c
push dword [ebp - 0x18]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [esi]
call ebx
mov eax, dword [ebp - 8]
push dword [0x41e778]
cmp byte [eax + 0x1c], 0
je 0x405665
push 0x46
lea ecx, [ebp - 0x1c]
call fcn.00401af1
lea ecx, [ebp - 0x1c]
call fcn.0040184c
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f2
mov dword [ebp - 8], eax
push dword [esi]
call edi
push dword [ebp - 8]
push eax
call ebx
push 2
push dword [esi]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
jmp 0x4056a3
push 0x3c
lea ecx, [ebp - 0x1c]
call fcn.00401af1
lea ecx, [ebp - 0x1c]
call fcn.0040184c
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f2
mov dword [ebp - 8], eax
push dword [esi]
call edi
push dword [ebp - 8]
push eax
call ebx
push 1
push dword [esi]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [esi]
call edi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41e778]
lea ecx, [ebp - 0x1c]
push 0x52
call fcn.00401af1
lea ecx, [ebp - 0x1c]
call fcn.0040184c
mov eax, dword [ebp - 0x18]
push 2
push dword [esi]
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
push eax
call ebx
push dword [0x41e778]
lea ecx, [ebp - 0x1c]
push 0x55
call fcn.00401af1
lea ecx, [ebp - 0x1c]
call fcn.0040184c
mov eax, dword [ebp - 0x18]
push 1
push dword [esi]
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
push eax
call ebx
lea ecx, [ebp - 0x1c]
call fcn.004017a8
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405b01
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 0x28]
call edi
cmp dword [esp + 0x10], eax
jne 0x405b28
push 3
pop edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [esi + 0x1c], edi
jmp 0x405b62
push dword [esi + 0x78]
call edi
cmp dword [esp + 0x10], eax
jne 0x405b62
lea edi, [esi + 0xc4]
push ebx
mov ecx, edi
call fcn.0040184c
mov ebx, dword [edi + 4]
mov ecx, edi
call fcn.0040184c
push 1
push ebx
push 0
push dword [edi + 4]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebx
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x405f33
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret 4

Function at 0x406217
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [ebp + 0xc], eax
jne 0x40628e
lea ecx, [ebp - 0x20]
call fcn.00401ac1
and byte [ebp - 0xc], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, 0x104
mov dword [ebp - 8], ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004062bc
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x10]
call fcn.0040176d
lea ecx, [ebp - 0x20]
call fcn.0040184c
push 1
push dword [ebp - 0x1c]
push 0
push str.http:__consumer.installshield.com
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.0040172f
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x407286
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push edi
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040204f
xor ebx, ebx
mov ecx, str.__set
cmp word [str.__set], bx
mov dword [ebp - 0x18], 0x41a3ec
mov eax, ecx
je 0x4072b7
inc eax
inc eax
cmp word [eax], bx
jne 0x4072b0
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402790
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00405426
cmp word [0x41d5c0], bx
mov ecx, 0x41d5c0
mov eax, ecx
je 0x4072e7
inc eax
inc eax
cmp word [eax], bx
jne 0x4072e0
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402790
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, ecx
cmp word [ecx], bx
je 0x407309
inc eax
inc eax
cmp word [eax], bx
jne 0x407302
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402790
cmp word [0x41d5bc], bx
mov ecx, 0x41d5bc
mov eax, ecx
je 0x40732e
inc eax
inc eax
cmp word [eax], bx
jne 0x407327
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402790
push dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 7]
mov byte [ebp - 8], bl
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push 0x41d5b8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040289e
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00415790
push 0x10
lea eax, [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.00415790
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.0040184c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x18]
call fcn.0040172f
pop edi
pop ebx
leave
ret 0xc

Function at 0x4073b7
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040204f
xor esi, esi
mov eax, str.__del
cmp word [str.__del], si
mov dword [ebp - 0x10], 0x41a3ec
mov ecx, eax
je 0x4073e7
inc ecx
inc ecx
cmp word [ecx], si
jne 0x4073e0
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402790
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00405426
push 0x44
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.00415790
push 0x10
lea eax, [ebp - 0x20]
push esi
push eax
mov dword [ebp - 0x64], 0x44
call fcn.00415790
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.0040184c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x10]
call fcn.0040172f
pop esi
leave
ret 4
Function at 0x407493
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
xor ebx, ebx
mov esi, 0x41e830
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x104
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.004062bc
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], eax
call fcn.0040176d
cmp dword [ebp - 4], ebx
je 0x40754f
push dword [ebp - 4]
call fcn.0041577f
pop ecx
mov dword [ebp - 8], eax
push eax
lea ecx, [ebp - 0x20]
push dword [ebp - 4]
mov dword [ebp - 0x20], 0x104
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x18], esi
push ebx
mov dword [ebp - 0x14], ebx
call fcn.004062bc
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.0040176d
cmp esi, ebx
je 0x407546
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x41d5e8
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407546
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
shr eax, 0x10
cmp ax, 3
jb 0x407546
push dword [ebp - 8]
call fcn.00415745
pop ecx
xor eax, eax
jmp 0x407552
push dword [ebp - 8]
call fcn.00415745
pop ecx
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x407556
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push 0x20019
xor ebx, ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00401e6e
push 0x14
lea ecx, [ebp - 0x2c]
pop eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x41a3dc
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
call fcn.004062bc
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], ebx
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2c]
call fcn.00406295
cmp dword [ebp - 0x10], ebx
je 0x4075db
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x4075f6
lea ecx, [ebp - 0x1c]
call fcn.004017a8
cmp dword [ebp - 4], ebx
je 0x4075f1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop eax
jmp 0x407619
mov eax, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x1c]
movzx esi, word [eax]
sub esi, 0x30
call fcn.004017a8
cmp dword [ebp - 4], ebx
je 0x407616
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret