joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb98]
sub esp, 0xc18
mov eax, dword [0x4431c0]
xor eax, ebp
mov dword [ebp + 0xb94], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x6c], ax
xor edi, edi
lea eax, [ebp - 0x6a]
push edi
push eax
call fcn.0041c7e0
xor eax, eax
mov esi, 0x1fe
push esi
mov word [ebp + 0x794], ax
lea eax, [ebp + 0x796]
push edi
push eax
mov dword [ebp - 0x80], 0x800
call fcn.0041c7e0
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x43978c
mov ebx, str.86D4B82A_ABED_442A_BE86_96357B70F4FE
push ebx
mov dword [ebp - 0x78], 0x200
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x40213c
push str.Qbyrd_Toolbar
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40208c
push str.Search_Results_Toolbar
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40213c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x794]
push eax
push 0x439844
push ebx
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x40213c
push 5
lea eax, [ebp + 0x794]
push str.1.7.1
push eax
call fcn.0041a83a
add esp, 0xc
test eax, eax
jne 0x40213c
mov dword [ebp - 0x70], edi
mov ebx, 0xf003f
call fcn.00411341
test eax, eax
je 0x4020da
mov ebx, 0xf013f
lea eax, [ebp - 0x70]
push eax
push ebx
push edi
push str.SOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEFSourceList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40213c
push esi
mov word [ebp + 0x994], ax
lea eax, [ebp + 0x996]
push edi
push eax
call fcn.0041c7e0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x994]
push eax
push edi
push edi
mov esi, 0x439910
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402156
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0xb94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004195bf
add ebp, 0xb98
leave
ret
push str.Ask_Toolbar.msi
lea eax, [ebp + 0x994]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402179
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40213e
xor eax, eax
push 2
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x74]
push eax
push 1
push edi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
inc edi
jmp 0x40216c
Function at 0x402890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4431c0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREAsk.com.tmpGeneral
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402923
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x439a88
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40291a
lea eax, [ebp - 0x74]
push eax
push esi
call fcn.0041a0c8
pop ecx
pop ecx
test eax, eax
je 0x40291a
mov bl, 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x194]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004195bf
add ebp, 0x198
leave
ret
Function at 0x406ab2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret

Function at 0x4070d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x4090], eax
je 0x407130
cmp dword [esi + 0x6c], eax
jbe 0x407130
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ebx, [esi + 0x88]
lea edx, [esi + 0x4094]
mov eax, edx
call fcn.00406a95
mov edi, dword [esi + 0x40a0]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
push eax
mov ecx, edx
call fcn.00406ab2
mov al, byte [ebp - 0xc]
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x4070fa
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x40714f
or dword [ebp - 8], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x407233
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
cmp ebx, edi
jne 0x40724d
push 0xffffffffffffff9a
pop eax
jmp 0x407401
cmp dword [ebx + 0x2c], edi
je 0x407245
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x4072aa
cmp dword [ebx + 0x84], edi
jne 0x4072aa
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x407288
mov esi, ebx
call fcn.004070d0
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
push ebp
call fcn.00415775
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
pop ecx
pop ecx
test edi, edi
je 0x40726b
cmp edi, 1
jne 0x4072aa
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x4072c2
test edi, edi
jne 0x4072c2
mov esi, ebx
call fcn.004070d0
cmp eax, 0xffffffff
jne 0x4072c2
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x4072e4
cmp dword [ebx + 0x84], 0
jne 0x4072fe
lea eax, [ebx + 0x30]
push eax
call fcn.00415ee6
and dword [ebx + 0x68], 0
pop ecx
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x4072fe
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0xc]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.00406bea
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.00406bea
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x40733f
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.00406bea
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x10]
push 4
add esi, 0x18
pop edx
call fcn.00406bea
test edi, edi
jne 0x407367
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.00406b13
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.00419b13
pop ecx
test edi, edi
jne 0x4073f3
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x40739e
or edi, 0xffffffff
jmp 0x4073da
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x10]
push 4
pop esi
mov edi, ebx
call fcn.00406ba1
mov edi, eax
pop ecx
test edi, edi
jne 0x4073da
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.00406ba1
mov edi, eax
pop ecx
test edi, edi
jne 0x4073da
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00406ba1
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x4073f3
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
add esp, 0xc
ret
Function at 0x4075ca
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x81c0]
mov eax, 0x8240
call fcn.0042bb20
mov eax, dword [0x4431c0]
xor eax, ebp
mov dword [ebp + 0x81bc], eax
push ebx
lea eax, [ebp - 0x54]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x43b018
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x4d], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40771d
push 0x206
mov word [ebp + 0x7fb4], ax
lea eax, [ebp + 0x7fb6]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x7fb4]
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x64], 0x104
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x58], ebx
je 0x407714
push edi
xor edi, edi
cmp dword [ebp - 0x58], ebx
jbe 0x407713
push ebx
push ebx
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4076f6
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x16
jbe 0x4076f6
mov ecx, str.GenericAskToolbar.dll
lea eax, [ebp + eax*2 - 0x76]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4076ed
cmp dx, bx
je 0x4076e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4076ed
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4076c7
xor eax, eax
jmp 0x4076f2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4076fe
inc edi
cmp edi, dword [ebp - 0x58]
jb 0x407688
jmp 0x407713
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407713
mov byte [ebp - 0x4d], 1
pop edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x81bc]
mov al, byte [ebp - 0x4d]
xor ecx, ebp
pop ebx
call fcn.004195bf
add ebp, 0x81c0
leave
ret
Function at 0x407736
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00410782
test eax, eax
je 0x407756
push str.SoftwareAppDataLowSoftwareAskToolbar
jmp 0x40775b
push str.SoftwareAskToolbar
push SysReAllocString
call fcn.00410b02
pop ecx
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ebx
je 0x407771
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push str.CLSIDD4027C7F_154A_4066_A1AD_4243D8127440InprocServer32
push SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 8], ebx
je 0x4077c9
push 0x410
call fcn.0041874e
pop ecx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4077c0
push esi
call fcn.0041a129
pop ecx
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov dword [ebp - 0xc], 0x80004005
cmp esi, ebx
je 0x407803
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x407803
push 0x43b240
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4077f7
call eax
mov dword [ebp - 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xc], ebx
jge 0x407807
or dword [ebp - 4], 2
push esi
call fcn.0041137a
pop ecx
pop edi
test al, al
jne 0x407817
or dword [ebp - 4], 4
cmp esi, ebx
je 0x407822
push esi
call fcn.0041a129
pop ecx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x408655
Capabilities:
Create directory
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push edi
push 0
push 0
mov esi, eax
mov byte [esp + 0x17], 0
call ebp
mov edi, eax
test edi, edi
jbe 0x4086d9
push ebx
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041874e
pop ecx
mov ebx, eax
push ebx
push edi
call ebp
push ebx
push esi
call fcn.00405b2b
push ebx
call fcn.0041a129
mov dword [esp], str.APNLogs
push esi
call fcn.0040576e
cmp dword [esi + 0x18], 8
pop ebx
jb 0x4086b7
mov esi, dword [esi + 4]
jmp 0x4086ba
add esi, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jg 0x4086d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4086d9
mov byte [esp + 0xf], 1
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x40a04c
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x431d4a
call fcn.0041cd86
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], edi
cmp dword [edi + 0x3c], ebx
je 0x40a16c
cmp byte [edi + 0x42], bl
je 0x40a16c
mov eax, dword [edi]
mov esi, 0xffff
push esi
call dword [eax + 4]
movzx eax, ax
cmp si, ax
jne 0x40a08b
xor al, al
jmp 0x40a16e
lea esi, [ebp - 0x30]
call fcn.00409cb0
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x40a0f0
dec eax
je 0x40a0f3
dec eax
dec eax
jne 0x40a15c
mov bl, 1
jmp 0x40a15c
mov byte [edi + 0x42], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x40a138
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
push eax
call fcn.0041ad15
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x40a15a
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x42], 0
je 0x40a0ec
test ecx, ecx
jne 0x40a09c
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00409ce8
mov edi, dword [ebp - 0x3c]
jmp 0x40a09c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004059be
mov al, bl
jmp 0x40a16e
mov al, 1
call fcn.0041cdd0
ret
Function at 0x40e041
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x4321e9
call fcn.0041cd86
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], cx
push 0x43a3b8
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40e0f3
push 0x20006
mov ecx, str.Macro
call fcn.0041089a
pop ecx
mov dword [ebp - 0x34], eax
cmp eax, edi
je 0x40e0c6
push dword [ebp - 0x30]
call ebx
add eax, eax
push eax
push dword [ebp - 0x30]
push 1
push edi
push str.version
push dword [ebp - 0x34]
call esi
mov dword [ebp - 0x38], 1
push 0x20006
mov ecx, str.Update
call fcn.0041089a
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x40e0f3
push edi
push edi
push 1
push edi
push str.UpdatePath
push eax
call esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040e13a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x38], edi
je 0x40e118
push dword [ebp - 0x3c]
call ebx
add eax, eax
push eax
push dword [ebp - 0x3c]
push 1
push edi
push str.version
push dword [ebp - 0x34]
call esi
cmp dword [ebp - 0x34], edi
je 0x40e126
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00405f67
mov eax, dword [ebp - 0x30]
call fcn.0041cdd0
ret
Function at 0x40e13a
Capabilities:
Initialize iwebbrowser2
Set registry value

Disassembly:
push 0x3c
mov eax, 0x431c0d
call fcn.0041cd1d
lea eax, [ebp - 0x10]
xor edi, edi
push eax
xor ebx, ebx
mov dword [ebp - 0x10], edi
call fcn.004109db
pop ecx
test eax, eax
je 0x40e1b1
and dword [ebp - 0x10], 0xfffffffe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0x20006
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettingsD4027C7F_154A_4066_A1AD_4243D8127440
push SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e1b1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push edi
push str.Flags
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e1a1
inc esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x40e1b1
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jl 0x40e260
lea eax, [ebp - 0x14]
push eax
push 0x43332c
push 4
push edi
push 0x43333c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 0x14], edi
je 0x40e25a
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x28]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call esi
push str.D4027C7F_154A_4066_A1AD_4243D8127440
lea esi, [ebp - 0x18]
call fcn.0040dfab
push 8
pop eax
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x18]
push 0xb
mov word [ebp - 0x38], ax
pop eax
lea edx, [ebp - 0x48]
push edx
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
push edx
or eax, 0xffffffff
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x38]
push edx
mov dword [ebp - 0x30], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xdc]
xor ebx, ebx
test eax, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
setge bl
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, ebx
call fcn.0041cdbc
ret
Function at 0x40e9aa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
call fcn.0040e901
push 0x3c
xor edi, edi
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0041c7e0
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x30], str.MsiExec.exe
mov dword [ebp - 0x2c], str._x_86D4B82A_ABED_442A_BE86_96357B70F4FE__q_REBOOTReallySuppress_UPGRADE_UNINSTALL1
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 8], edi
je 0x40ea21
push 0xea60
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ea21
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], edi
jne 0x40ea21
xor eax, eax
inc eax
jmp 0x40ea23
xor eax, eax
pop edi
leave
ret
Function at 0x40f855
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x431d4a
call fcn.0041cd86
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], edi
cmp dword [edi + 0x3c], ebx
je 0x40f96e
cmp byte [edi + 0x41], bl
je 0x40f96e
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40f88d
xor al, al
jmp 0x40f970
lea esi, [ebp - 0x30]
call fcn.00409cb0
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x40f8f2
dec eax
je 0x40f8f5
dec eax
dec eax
jne 0x40f95e
mov bl, 1
jmp 0x40f95e
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x40f93a
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.00409d2c
mov esi, eax
call fcn.0040a8f0
push eax
call fcn.0041ad15
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x40f95c
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x40f8ee
test ecx, ecx
jne 0x40f89e
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00409ce8
mov edi, dword [ebp - 0x3c]
jmp 0x40f89e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004059be
mov al, bl
jmp 0x40f970
mov al, 1
call fcn.0041cdd0
ret

Function at 0x410782
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x4431c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
xor ebx, ebx
xor eax, eax
push 0xfe
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push ebx
push eax
mov dword [ebp - 0xa8], 0x11c
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.0041c7e0
xor eax, eax
mov word [ebp + 0x6c], ax
mov word [ebp + 0x6e], ax
mov word [ebp + 0x70], ax
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp + 0x72], bl
mov byte [ebp + 0x73], bl
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop ebx
test eax, eax
je 0x41080e
cmp dword [ebp - 0xa4], 5
jbe 0x41080e
xor eax, eax
inc eax
jmp 0x410810
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004195bf
add ebp, 0x78
leave
ret