joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8bb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
mov edi, edx
test ebp, ebp
jle 0x4a8ca2
dec ebp
shr ebp, 3
inc ebp
jmp 0x4a8be0
movzx eax, byte [esi]
mov byte [edi], al
movzx ecx, byte [esi + 1]
mov byte [edi + 1], cl
movzx edx, byte [esi + 2]
mov byte [edi + 2], dl
movzx eax, byte [esi + 3]
mov byte [edi + 3], al
movzx ecx, byte [esi + 4]
mov byte [edi + 4], cl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx ecx, byte [esi + 7]
mov byte [edi + 7], cl
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x14], eax
mov ecx, edi
lea eax, [ebx + 0x80]
mov dword [esp + 0x10], edx
call fcn.004a8240
movzx ecx, byte [ebx + 0x100]
xor byte [edi], cl
movzx edx, byte [ebx + 0x101]
xor byte [edi + 1], dl
movzx eax, byte [ebx + 0x102]
xor byte [edi + 2], al
movzx ecx, byte [ebx + 0x103]
xor byte [edi + 3], cl
movzx edx, byte [ebx + 0x104]
xor byte [edi + 4], dl
movzx eax, byte [ebx + 0x105]
xor byte [edi + 5], al
movzx ecx, byte [ebx + 0x106]
xor byte [edi + 6], cl
movzx edx, byte [ebx + 0x107]
xor byte [edi + 7], dl
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esi, 8
add edi, 8
sub ebp, 1
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x104], ecx
jne 0x4a8be0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0xc
ret

Function at 0x4a90c0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
push ebx
push ebp
mov ebp, dword [edi + 4]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0xc], 0
cmp dx, word [eax + 6]
jae 0x4a918d
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x4a912e
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x4a9173
mov ecx, dword [edi + 0x30]
mov edx, dword [esi - 4]
mov eax, dword [edi + 0x1c]
push ecx
push 4
push 0x1000
add edx, ebp
push ebx
push edx
call eax
add esp, 0x14
test eax, eax
je 0x4a919f
mov eax, dword [esi - 4]
push ebx
add eax, ebp
push 0
push eax
mov dword [esi - 8], eax
call fcn.0052e300
jmp 0x4a9170
mov ecx, dword [esi + 4]
add ecx, eax
cmp dword [esp + 0x18], ecx
jb 0x4a9197
mov edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x1c]
push edx
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebp
push eax
call ecx
add esp, 0x14
test eax, eax
je 0x4a919f
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, dword [esp + 0x14]
mov ebx, dword [esi - 4]
push edx
add ebx, ebp
push eax
push ebx
call fcn.00530500
mov dword [esi - 8], ebx
add esp, 0xc
mov ecx, dword [edi]
mov eax, dword [esp + 0xc]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0xc], eax
jl 0x4a90e8
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4a9260
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x38]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x18], edx
test esi, esi
jne 0x4a92a4
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x4a929d
mov esi, dword [eax + 0x20]
jmp 0x4a92a4
test bl, bl
jns 0x4a92a4
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp si, word [eax + 6]
jae 0x4a9384
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x38]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ebp
test edi, edi
jne 0x4a92f9
mov ecx, dword [ebx]
test cl, 0x40
je 0x4a92f2
mov edi, dword [eax + 0x20]
jmp 0x4a92f9
test cl, cl
jns 0x4a92f9
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x4a9332
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x4a9332
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.004a91b0
test eax, eax
je 0x4a93a5
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x4a935e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x4a934b
test dword [esp + 0x20], 0x2000000
je 0x4a934b
or dword [esp + 0x20], eax
jmp 0x4a9358
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x4a92d4
lea ecx, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x24], 1
call fcn.004a91b0
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4ab110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58df73
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, 0x10
lea esi, [edi + 4]
cmp dword [edi + 0x18], ebx
jb 0x4ab151
mov eax, dword [esi]
jmp 0x4ab153
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4ab172
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0
mov eax, dword [0x5ef5f4]
mov dword [ebp - 0x14], 0xffffffff
test eax, eax
jne 0x4ab18e
call fcn.00404b70
push str.WriteSql_1
call fcn.0047b0e0
add esp, 4
cmp dword [edi + 0x18], ebx
jb 0x4ab1a4
mov ecx, dword [esi]
jmp 0x4ab1a6
mov ecx, esi
add edi, 0x1c
push edi
mov eax, 2
call fcn.004aa3c0
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ab1d0
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00405bb0
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004923c0
add esp, 4
mov ebx, 8
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], ebx
jb 0x4ab209
mov esi, dword [eax + 4]
jmp 0x4ab20c
lea esi, [eax + 4]
mov edx, dword [0x5ef5f4]
test edx, edx
jne 0x4ab21b
call fcn.00404b70
push esi
push str.WriteSql_2
call fcn.0047b0e0
add esp, 8
cmp dword [ebp - 0x38], ebx
jb 0x4ab23a
mov eax, dword [ebp - 0x4c]
push eax
call fcn.005273b8
add esp, 4
xor ecx, ecx
xor esi, esi
mov byte [ebp - 4], cl
cmp dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x4c], cx
jb 0x4ab261
mov edx, dword [ebp - 0x30]
push edx
call fcn.005273b8
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.004aa490
mov ecx, dword [0x5ef5f4]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x4ab27e
call fcn.00404b70
push str.WriteSql_3
call fcn.0047b0e0
mov eax, dword [edi + 4]
add esp, 4
cmp eax, esi
je 0x4ab29e
push esi
call fcn.0051de60
add esp, 4
mov dword [edi + 4], esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x5ef5f4]
test ecx, ecx
jne 0x4ab2b4
call fcn.00404b70
push str.WriteSql_4
call fcn.0047b0e0
xor eax, eax
add esp, 4
cmp dword [ebp - 0x14], eax
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1c90
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp], 0
cmp dword [0x5eb9e0], 0
push esi
je 0x4b1cf2
mov eax, dword [0x5f0898]
test eax, eax
je 0x4b1cbe
push eax
call dword [0x5eba38]
add esp, 4
lea eax, [esp + 0x10]
push eax
mov eax, 0x14
call fcn.004af630
mov eax, dword [0x5f0898]
add esp, 4
test eax, eax
je 0x4b1ce3
push eax
call dword [0x5eba40]
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4b1d01
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
push 0x14
call dword [0x5eba08]
add esp, 4
mov esi, eax
jmp 0x4b1ce7
cmp dword [0x5eb9e4], 0
je 0x4b1d45
mov eax, dword [0x5ebae8]
test eax, eax
je 0x4b1d21
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4b1d45
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x4b1c60
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.0052e132
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4b1d55
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x4b1d6d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4dfa90
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4dfb12
mov esi, dword [eax + 4]
movzx edx, byte [eax]
test esi, 0x200
jne 0x4dfb12
cmp edx, 0x25
je 0x4dfb9a
cmp edx, 0x9c
je 0x4dfb9a
cmp edx, 0x5e
je 0x4dfad4
cmp edx, 0x9d
jne 0x4dfb19
cmp byte [eax + 0x26], 0x5e
jne 0x4dfb2e
mov eax, dword [eax + 8]
push eax
mov eax, dword [edi]
movzx ecx, byte [eax + 0x42]
push ecx
push edi
xor eax, eax
call fcn.004f0560
add esp, 0xc
mov ebp, eax
test ebp, ebp
je 0x4dfb12
cmp dword [ebp + 0xc], 0
jne 0x4dfb12
mov ecx, dword [edi]
mov eax, dword [ebp]
movzx edx, byte [ecx + 0x42]
push eax
push edx
push edi
mov eax, ebp
call fcn.004f0560
add esp, 0xc
test eax, eax
jne 0x4dfb12
xor ebp, ebp
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edx, 0x9a
je 0x4dfb2e
cmp edx, 0x98
je 0x4dfb2e
cmp edx, 0x3d
jne 0x4dfb33
cmp dword [eax + 0x2c], ebp
jne 0x4dfbac
test esi, 0x100
je 0x4dfb12
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4dfb4f
test dword [edx + 4], 0x100
je 0x4dfb4f
mov eax, edx
jmp 0x4dfb9d
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4dfb92
test esi, 0x800
jne 0x4dfb92
mov edi, dword [eax]
xor edx, edx
test edi, edi
jle 0x4dfb92
lea esi, [eax + 8]
lea esp, [esp]
mov ecx, dword [esi]
test dword [ecx + 4], 0x100
jne 0x4dfb8b
inc edx
add esi, 0x18
cmp edx, edi
jl 0x4dfb70
mov edi, dword [esp + 0x14]
mov eax, ebx
jmp 0x4dfb9d
lea edx, [edx + edx*2]
mov ebx, dword [eax + edx*8 + 8]
mov edi, dword [esp + 0x14]
mov eax, ebx
jmp 0x4dfb9d
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4dfa9e
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
movsx edx, word [eax + 0x20]
test edx, edx
jl 0x4dfb12
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 4]
shl edx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [edi]
movzx edx, byte [ecx + 0x42]
push 0
push edx
call fcn.004f0700
add esp, 8
jmp 0x4dfaea
Function at 0x4ea0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov dword [esp + 0x14], eax
xor edi, edi
cmp dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
jle 0x4ea205
cmp edi, 2
mov esi, edi
jge 0x4ea110
xor esi, 1
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4ea130
mov eax, dword [ebx + 0x10]
mov edx, esi
shl edx, 4
mov eax, dword [edx + eax]
call fcn.004b27e0
test eax, eax
jne 0x4ea1f6
mov ecx, dword [ebx + 0x10]
shl esi, 4
mov esi, dword [esi + ecx + 0xc]
mov edi, dword [esi + 0x14]
add esi, 8
test edi, edi
je 0x4ea17b
mov cl, byte [ebp]
xor eax, eax
mov edx, ebp
test cl, cl
je 0x4ea16b
nop
movzx ecx, cl
movzx ecx, byte [ecx + 0x59cdd8]
add ecx, eax
imul ecx, ecx, 0x9e3779b1
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4ea150
xor edx, edx
div dword [esi]
mov ebx, dword [edi + edx*8 + 4]
mov esi, dword [edi + edx*8]
lea eax, [edi + edx*8]
jmp 0x4ea181
mov ebx, dword [esi + 8]
mov esi, dword [esi + 4]
test esi, esi
je 0x4ea1e2
movzx edx, byte [ebp]
movzx eax, byte [edx + 0x59cdd8]
mov dword [esp + 0x18], eax
mov ecx, dword [ebx + 0xc]
mov dl, byte [ecx]
movzx eax, dl
movzx eax, byte [eax + 0x59cdd8]
dec esi
sub eax, dword [esp + 0x18]
jne 0x4ea1dc
mov edi, ebp
sub edi, ecx
mov edi, edi
test dl, dl
je 0x4ea1d8
movzx eax, byte [edi + ecx + 1]
movzx ebp, byte [eax + 0x59cdd8]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x59cdd8]
sub eax, ebp
mov ebp, dword [esp + 0x24]
je 0x4ea1b0
jmp 0x4ea1dc
test eax, eax
je 0x4ea1e7
mov ebx, dword [ebx]
test esi, esi
jne 0x4ea194
mov ebx, 0x5f08b8
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4ea244
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
inc edi
cmp edi, dword [esp + 0x14]
mov dword [esp + 0x10], edi
jl 0x4ea106
mov al, byte [ebp]
movzx edx, al
movzx edx, byte [edx + 0x59cdd8]
sub edx, 0x73
mov ecx, ebp
jne 0x4ea242
mov edx, str.sqlite_master
sub edx, ebp
test al, al
je 0x4ea24c
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x59cdd8]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x59cdd8]
sub edi, esi
je 0x4ea220
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x4ea260
neg eax
sbb eax, eax
jmp 0x4ea269
test eax, eax
je 0x4ea242
call fcn.004b27e0
test eax, eax
jne 0x4ea242
mov ebp, str.sqlite_temp_master
mov dword [esp + 0x24], ebp
jmp 0x4ea0f6
Function at 0x4ea410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [eax + 0x14]
push ebp
push edi
xor ebp, ebp
xor edi, edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], ebx
test ebx, ebx
jle 0x4ea542
mov eax, dword [eax + 0x10]
mov dword [esp + 0x10], eax
push esi
cmp ebp, 2
mov eax, ebp
jge 0x4ea43f
xor eax, 1
mov ecx, dword [esp + 0x14]
shl eax, 4
mov esi, dword [eax + ecx + 0xc]
add eax, ecx
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4ea463
mov eax, dword [eax]
call fcn.004b27e0
test eax, eax
jne 0x4ea525
mov edi, dword [esi + 0x24]
test edi, edi
je 0x4ea4ab
mov edx, dword [esp + 0x24]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4ea49b
jmp 0x4ea480
movzx ecx, cl
movzx ecx, byte [ecx + 0x59cdd8]
add ecx, eax
imul ecx, ecx, 0x9e3779b1
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4ea480
xor edx, edx
div dword [esi + 0x18]
mov ebx, dword [edi + edx*8]
lea eax, [edi + edx*8]
mov edi, dword [eax + 4]
jmp 0x4ea4b1
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x4ea515
mov edx, dword [esp + 0x24]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x59cdd8]
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0xc]
mov dl, byte [ecx]
movzx eax, dl
movzx eax, byte [eax + 0x59cdd8]
dec ebx
sub eax, dword [esp + 0x18]
jne 0x4ea50b
mov esi, dword [esp + 0x24]
sub esi, ecx
test dl, dl
je 0x4ea507
movzx eax, byte [esi + ecx + 1]
movzx ebp, byte [eax + 0x59cdd8]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x59cdd8]
sub eax, ebp
je 0x4ea4e3
jmp 0x4ea50b
test eax, eax
je 0x4ea53c
mov edi, dword [edi]
test ebx, ebx
jne 0x4ea4c7
mov ebp, dword [esp + 0x10]
mov edi, 0x5f08b8
mov edi, dword [edi + 8]
test edi, edi
jne 0x4ea532
mov ebx, dword [esp + 0x1c]
inc ebp
cmp ebp, ebx
mov dword [esp + 0x10], ebp
jl 0x4ea435
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
mov ebp, dword [esp + 0x10]
jmp 0x4ea51a
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x522b20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58b170
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x10], eax
xor edx, edx
mov eax, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
mov word [esp + 0x30], dx
lea esi, [eax + 2]
jmp 0x522b80
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x522b80
sub eax, esi
sar eax, 1
push eax
push ecx
lea esi, [esp + 0x34]
call fcn.00406150
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x5c], edi
call fcn.0048c030
mov byte [esp + 0x58], 1
cmp dword [esp + 0x44], 8
mov ecx, dword [esp + 0x30]
jae 0x522bbc
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14]
push edx
push 0x5aa94c
call fcn.004931f0
mov esi, dword [esp + 0x28]
add esp, 8
cmp esi, dword [esp + 0x24]
jbe 0x522bdd
call fcn.00527d8a
mov edi, dword [esp + 0x14]
mov ebx, esi
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x20], esi
jbe 0x522bf2
call fcn.00527d8a
test edi, edi
je 0x522bfc
cmp edi, dword [esp + 0x14]
je 0x522c01
call fcn.00527d8a
cmp ebx, esi
je 0x522cd4
test edi, edi
jne 0x522c2b
call fcn.00527d8a
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x522c1e
call fcn.00527d8a
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
jb 0x522c2f
mov edx, dword [eax]
jmp 0x522c31
mov eax, dword [edi]
jmp 0x522c14
mov edx, eax
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x522c36
sub eax, esi
sar eax, 1
push eax
push edx
mov edx, dword [esp + 0x18]
xor eax, eax
call fcn.00403c00
cmp eax, 0xffffffff
jne 0x522c78
test edi, edi
jne 0x522c74
call fcn.00527d8a
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x522c6c
call fcn.00527d8a
add ebx, 0x1c
jmp 0x522be3
mov eax, dword [edi]
jmp 0x522c62
mov eax, dword [esp + 0x20]
xor esi, esi
cmp eax, esi
je 0x522ca0
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
push ecx
call fcn.00404ef0
mov edx, dword [esp + 0x24]
add esp, 4
push edx
call fcn.005273b8
add esp, 4
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.005273b8
add esp, 4
cmp dword [esp + 0x44], 8
jb 0x522ccd
mov ecx, dword [esp + 0x30]
push ecx
call fcn.005273b8
add esp, 4
mov eax, 1
jmp 0x522d2b
mov eax, dword [esp + 0x20]
test eax, eax
je 0x522cfa
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
push edx
call fcn.00404ef0
mov eax, dword [esp + 0x24]
add esp, 4
push eax
call fcn.005273b8
add esp, 4
mov ecx, dword [esp + 0x14]
xor eax, eax
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.005273b8
add esp, 4
cmp dword [esp + 0x44], 8
jb 0x522d29
mov edx, dword [esp + 0x30]
push edx
call fcn.005273b8
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005273c3
mov esp, ebp
pop ebp
ret 4
Function at 0x523630
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.0052e300
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x52368a
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005273c3
add esp, 0x108
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
je 0x5236bd
push 0
push 0
push eax
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
jne 0x5236c1
xor al, al
jmp 0x5236e1
lea edx, [esp + 8]
push edx
call fcn.00523700
lea eax, [esp + 8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5236d5
mov al, 1
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0x108
ret 4

Function at 0x5237d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
push ecx
push 9
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
xor bl, bl
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x523821
xor al, al
jmp 0x5238bf
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x5238b6
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22]
push edx
mov dword [esp + 0x1c], 0x104
mov word [esp + 0x24], cx
call fcn.0052e300
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.InstallLocation
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5238af
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
mov bl, 1
sub edx, ecx
jmp 0x5238a0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x5238a0
mov edx, dword [esp + 8]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
mov al, bl
mov ecx, dword [esp + 0x220]
pop edi
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0x21c
ret 4
Function at 0x525690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x58b588
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x7c]
xor edi, edi
push edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x14]
push eax
push 0x58fa2c
push 3
push edi
push 0x59b570
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x525837
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x1c]
mov dword [esp + 0x20], edi
call eax
xor eax, eax
lea edx, [esp + 0x7c]
push edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x28
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp dword [esp + 0x7c], edi
je 0x525807
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x74]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.00525400
test eax, eax
je 0x5257e9
mov edx, dword [esp + 0x3c]
xor ecx, ecx
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], cx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x525793
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x24]
call fcn.00406150
mov edx, esi
push edx
push ebx
mov dword [esp + 0x70], edi
call fcn.00403a90
mov dword [esp + 0x68], 0xffffffff
cmp dword [esp + 0x34], 8
jb 0x5257d6
mov eax, dword [esp + 0x20]
push eax
call fcn.005273b8
add esp, 4
xor ecx, ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], cx
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x5257f8
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x3c]
cmp eax, edi
je 0x525807
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x64
mov dword [esp + 0x18], eax
jg 0x52581f
cmp dword [esp + 0x7c], edi
jne 0x525707
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoFreeAllLibraries]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x5c
ret 0x10

Function at 0x5273c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ea2c4]
jne 0x5273cd
repz ret
jmp fcn.0053340d