joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100090b8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x33ee0
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR3.0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69190
mov dword [esi + 4], 0x69291
mov dword [esi + 8], 0x69298
mov dword [esi + 0xc], 0x26e8cc
mov dword [esi + 0x10], 0x141a78
mov dword [esi + 0x14], 0x26e898
mov dword [esi + 0x18], 0x6ff17
mov dword [esi + 0x1c], fopen
mov dword [esi + 0x20], reloc.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x33ee6
mov dword [esi + 0x30], 0x8ba0
mov dword [esi + 0x34], 0x53b90
mov dword [esi + 0x38], 0x121914
mov dword [esi + 0x58], eax
mov dword [esi + 0x3c], 0x33bd3
mov dword [esi + 0x40], 0x33bd8
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
mov edx, eax
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edi, str.class_CSampStealerR3
cmp al, byte [edi + ecx]
mov edi, dword [ebp - 4]
jne 0x1000925f
inc ecx
cmp ecx, 0x15
jne 0x1000918a
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x100091be
cmp dword [esi + 0x48], eax
je 0x100091be
cmp dword [esi + 0x4c], eax
je 0x100091be
cmp dword [esi + 0x54], eax
jne 0x100091ef
mov eax, dword [edi + 0x26e8dc]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e898]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e8cc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121914]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100091a8
mov edi, dword [ebp - 4]
mov ecx, dword [0x10010828]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
test ecx, ecx
je 0x10009217
cmp dword [0x10010020], 0xe3296d
jne 0x10009231
mov eax, dword [esi + 0x44]
lea ecx, [eax + 0x131]
mov eax, dword [eax + 0x235]
mov dword [0x10010828], ecx
mov dword [0x10010020], eax
push ecx
call fcn.1000a3a9
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x20], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.100089a9
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR3_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009a64
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x34620
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR4_2.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26e9fc
mov dword [esi + 0x10], 0x141ba0
mov dword [esi + 0x14], 0x26e9c8
mov dword [esi + 0x18], 0x70667
mov dword [esi + 0x1c], reloc.KERNEL32.dll_CreateEventW
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], eax
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR4_2
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009bd8
inc edx
cmp edx, 0x17
jne 0x10009b2e
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009b62
cmp dword [esi + 0x48], eax
je 0x10009b62
cmp dword [esi + 0x4c], eax
je 0x10009b62
cmp dword [esi + 0x54], eax
jne 0x10009b93
mov eax, dword [edi + 0x26ea0c]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e9c8]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e9fc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009b4c
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10010828]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a3a9
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.100089a9
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR4_2_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009dbc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x34620
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR5.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26eb84
mov dword [esi + 0x10], 0x141d28
mov dword [esi + 0x14], 0x26eb50
mov dword [esi + 0x18], 0x70604
mov dword [esi + 0x1c], reloc.KERNEL32.dll_CreateEventW
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], eax
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR5
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009f30
inc edx
cmp edx, 0x15
jne 0x10009e86
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009eba
cmp dword [esi + 0x48], eax
je 0x10009eba
cmp dword [esi + 0x4c], eax
je 0x10009eba
cmp dword [esi + 0x54], eax
jne 0x10009eeb
mov eax, dword [edi + 0x26eb94]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26eb50]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26eb84]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009ea4
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10010828]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a3a9
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.100089a9
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR5_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x1000a0dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov ecx, dword [0x10010834]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
jmp 0x1000a101
test edx, edx
je 0x1000a15f
cmp dword [edx + 0x18], ecx
je 0x1000a107
mov edx, dword [edx]
cmp edx, eax
jne 0x1000a0f6
leave
ret
mov dword [0x1001080c], ecx
mov ecx, dword [edx + 4]
mov dword [0x1001081c], edx
mov eax, dword [ecx]
mov dword [0x10010810], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax]
mov dword [0x10010818], eax
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [0x10010814], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
leave
ret

Function at 0x1000a65a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea edi, [ecx + 0xd]
xor ebx, ebx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a66b
sub edx, esi
je 0x1000a6b8
push 0xfffffffffffffff3
pop eax
sub eax, ecx
mov esi, edi
mov dword [ebp - 4], eax
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
pop ecx
test eax, eax
jne 0x1000a6a0
mov al, byte [esi]
cmp al, 0x5f
je 0x1000a6a0
cmp al, 0xc0
jl 0x1000a69d
cmp al, 0xff
jle 0x1000a6a0
xor ebx, ebx
inc ebx
mov ecx, edi
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a6a6
mov eax, dword [ebp - 4]
sub ecx, edx
add eax, esi
cmp eax, ecx
jb 0x1000a680
mov ecx, dword [0x10010808]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp byte [eax + 0xd], 0
jne 0x1000a6cc
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x1000a71e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov esi, eax
push 0x1000e198
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000a71e
push 0x1000e198
push esi
call ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strchr]
push 0x20
lea esi, [eax + 3]
push esi
call ebx
add esp, 0x10
test eax, eax
je 0x1000a71e
push 0x19
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push edi
call ebx
add esp, 0x14
mov byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a723
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, 0x1000e19c
mov esi, eax
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000a784
push ebx
push esi
call edi
push 0x20
lea ebx, [eax + 3]
push ebx
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x10
test eax, eax
je 0x1000a784
push 0x20
call fcn.1000be20
push 0x20
push ebx
push eax
mov dword [0x10010828], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push dword [0x10010828]
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x18
mov byte [eax], 0
mov ebx, 0x1000e1a0
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000a7a9
push ebx
push esi
call edi
add eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
mov dword [0x10010020], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1000b57d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 1
jne 0x1000b601
mov eax, dword [ebp + 8]
mov dword [0x10010834], eax
push str.ashot_st
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10010824], eax
cmp dword [0x10010824], 0
jne 0x1000b601
push str.ashot_st
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10010824], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10010800], eax
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100107fc], eax
mov byte [0x100107cf], 1
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 8], 0x1000b798
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp dword [ebp + 0xc], 5
jne 0x1000b62a
push dword [0x10010834]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1000b7a7
push 0
push 0
push 0x1000accf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x850
push ebx
push ebp
push esi
mov esi, dword [esp + 0x860]
xor ebx, ebx
push 0x7f00
push ebx
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x401d10
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x30], 6
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x3c], 0x40707c
mov dword [esp + 0x40], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push ebx
push esi
push ebx
push ebx
push ebx
push 0x80000000
push ebx
push 0x80000000
push 0xcf0000
push 0x40707c
push 0x40707c
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebp, eax
cmp ebp, ebx
je 0x4011f0
mov edx, dword [esp + 0x868]
cmp edx, ebx
je 0x4011f0
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x407700
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ax, word [0x407078]
and ecx, 3
mov word [esp + 0x10], ax
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x407074]
mov word [esp + 0x12], cx
lea ecx, [esp + 0x12]
push ecx
push edx
call fcn.00402250
add esp, 8
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.install
push esi
call edi
test eax, eax
jne 0x40111d
push ebx
push ebx
push 0x5f5
jmp 0x401145
push str.uninstall
push esi
call edi
test eax, eax
jne 0x401132
push ebx
push ebx
push 0x5f6
jmp 0x401145
push str.patch
push esi
call edi
test eax, eax
jne 0x40114c
push ebx
push ebx
push 0x5f7
push ebp
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x407700
lea eax, [esp + 0x64]
push str._PostBuild___s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x4c]
push ebx
push edx
call esi
test eax, eax
je 0x4011d4
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
call edi
test eax, eax
jne 0x4011c6
lea edx, [esp + 0x44]
push edx
call ebp
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea ecx, [esp + 0x4c]
push ebx
push ecx
call esi
test eax, eax
jne 0x4011a3
push str._PostBuild__End_Program
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov eax, dword [esp + 0x44]
pop ebp
pop ebx
add esp, 0x850
ret 0x10
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x850
ret 0x10
Function at 0x4015b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x81c]
xor ebp, ebp
stosw word es:[edi], ax
push esi
mov dword [esp + 0x18], ebp
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4016b8
mov ax, word [0x407074]
mov cx, word [0x407078]
lea edx, [esp + 0x12]
xor edi, edi
push edx
push esi
mov word [esp + 0x1a], ax
mov word [esp + 0x18], cx
call fcn.00402250
mov ebx, dword [sym.imp.SHLWAPI.dll_StrTrimA]
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test esi, esi
je 0x4016b8
mov eax, edi
dec eax
je 0x401658
dec eax
je 0x40164b
dec eax
jne 0x401665
push esi
lea ecx, [esp + 0x1c]
push 0x407118
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x401665
push esi
call fcn.004024be
add esp, 4
mov ebp, eax
jmp 0x401665
push esi
call fcn.004024be
add esp, 4
mov dword [esp + 0x14], eax
lea edx, [esp + 0x12]
inc edi
push edx
push 0
call fcn.00402250
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test esi, esi
jne 0x40162a
cmp dword [esp + 0x14], 1
jne 0x4016b8
push ebp
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00401df0
add esp, 8
push str._PostBuild__UnInstallHandler_Done
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
Function at 0x401bb0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x405d6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x401c28
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x401c18
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x401c3a
jmp 0x401c2c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x401cd5
push ecx
jmp 0x401ccf
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x401ca0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401bb0
mov ebx, eax
cmp ebx, edi
jne 0x401cf1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x401c62
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x401cb3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x401cd5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x401d00
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x401cd7
Function at 0x402050
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Print debug messages
Set file attributes

Disassembly:
sub esp, 0x554
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x459]
mov byte [esp + 0x458], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x560]
test edi, edi
je 0x4020b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4020cf
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x554
ret
lea edx, [esp + 0xc]
push ebp
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x460]
push str._s.
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x114]
lea eax, [esp + 0x45c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, dword [esp + 0x568]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x402224
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [esp + 0x118], 0x10
je 0x4021b1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea ecx, [esp + 0x144]
push 0x40726c
push ecx
call edi
test eax, eax
je 0x402204
lea edx, [esp + 0x144]
push 0x407268
push edx
call edi
test eax, eax
je 0x402204
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35d]
mov byte [esp + 0x35c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x144]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x364]
push str._s_s
push edx
call esi
lea eax, [esp + 0x36c]
push ebp
push eax
call fcn.00402050
add esp, 0x18
jmp 0x402204
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x144]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
push edx
lea eax, [esp + 0x260]
push str._s_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x258]
push ecx
call ebx
lea edx, [esp + 0x258]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402129
mov eax, dword [esp + 0x10]
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x10]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x554
ret
Function at 0x4042b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407660
cmp edx, dword [eax]
je 0x4042d3
add eax, 8
inc ecx
cmp eax, 0x4076f0
jl 0x4042c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407660]
jne 0x404401
mov eax, dword [0x407f0c]
cmp eax, 1
je 0x4043db
test eax, eax
jne 0x404304
cmp dword [0x407294], 1
je 0x4043db
cmp edx, 0xfc
je 0x404401
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40433b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404db0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40437e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4064a4
push edi
call fcn.004047a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404db0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404dc0
lea eax, [ebp - 0xa0]
push 0x406484
push eax
call fcn.00404dc0
push dword [esi + 0x407664]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404dc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405a9e
add esp, 0x2c
pop edi
jmp 0x404401
lea eax, [ebp + 8]
lea esi, [esi + 0x407664]
push 0
push eax
push dword [esi]
call fcn.00402e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret