joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x63c], ecx
call fcn.00403bc0
add esp, 4
mov dword [ebp - 0x638], eax
test eax, eax
jne 0x40a267
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x222]
push edx
mov word [ebp - 0x224], cx
call fcn.00411f50
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x42a]
push ecx
mov word [ebp - 0x42c], ax
call fcn.00411f50
add esp, 0xc
push 0x104
lea edx, [ebp - 0x634]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x634]
push 0x5c
push eax
call fcn.0040a8a1
lea edx, [ebp - 0x634]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.0040a83e
add esp, 0x14
push 0x41c6d8
lea ecx, [ebp - 0x224]
push 0x104
push ecx
call fcn.0040b2c5
xor eax, eax
lea ebx, [ebp - 0x1c]
add esp, 0xc
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov esi, 0x424648
sub ebx, 0x42474c
cmp word [esi], 0
je 0x40a1d7
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x42c]
push 0x104
push eax
call fcn.0040a83e
add esp, 0xc
push esi
lea ecx, [ebp - 0x42c]
push 0x104
push ecx
call fcn.0040b2c5
lea edx, [ebp - 0x42c]
add esp, 0xc
push edx
lea edi, [ebp - 0x1c]
call fcn.00403130
add esp, 4
test eax, eax
je 0x40a1d7
mov ecx, 0x14
lea eax, [esi + 0x104]
jmp 0x40a1c0
mov edx, dword [ebx + eax]
cmp edx, dword [eax]
jne 0x40a1d7
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x40a1c0
xor eax, eax
mov word [esi], ax
add esi, 0x118
sub ebx, 0x118
cmp esi, 0x424bc0
jl 0x40a164
mov ebx, dword [ebp - 0x63c]
mov edi, dword [ebp + 8]
mov esi, 0x424648
lea ecx, [ecx]
cmp word [esi], 0
je 0x40a21e
mov ecx, dword [esi + 0x100]
mov dword [0x424d54], ecx
push edi
push ebx
mov ecx, esi
call fcn.00403e10
add esp, 8
add esi, 0x118
cmp esi, 0x424bc0
jl 0x40a200
push 0x424d58
lea edx, [ebp - 0x224]
push 0x104
push edx
call fcn.0040b2c5
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40a261
mov dword [ebp - 0x638], 2
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a82f
mov esp, ebp
pop ebp
ret
Function at 0x40a6e0
Capabilities:
Get file attributes
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x40a755
push 0
push 0
push 3
push 0
push 3
push connect
push esi
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
jne 0x40a724
mov dword [ebp - 8], edi
jmp 0x40a744
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40a73a
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], ebx
cmp edi, dword [ebp + 0x10]
jne 0x40a755
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x200000
call fcn.0040ad88
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, eax
push edi
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x200000
call fcn.00404690
add esp, 8
test eax, eax
je 0x40a81c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040a8cf
add esp, 4
call fcn.0040a8e1
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
fmul qword [0x420c60]
fmul qword [0x420c88]
fadd qword [0x420c80]
call fcn.00415c60
mov ebx, dword [ebp - 8]
lea ebx, [ebx + edi]
mov esi, eax
call fcn.004019a0
mov eax, dword [ebp - 8]
lea ebx, [esi + eax]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
call fcn.00404460
mov esi, eax
cmp esi, 0xffffffff
je 0x40a815
push 0
lea ecx, [ebp + 0x10]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [ebp + 0x10]
cmp eax, ebx
mov ebx, 1
je 0x40a802
mov ebx, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 1
cmp ebx, 1
je 0x40a81c
mov dword [ebp - 0x10], 0
push edi
call fcn.0040ae1c
mov eax, dword [ebp - 0x10]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a82f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422044]
jne 0x40a839
repz ret
jmp fcn.0040c564
Function at 0x41452e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c88f
and dword [ebp - 0x14], 0
cmp dword [0x4245d8], 0
mov dword [ebp - 0x18], eax
jne 0x4145e1
push 0x41b318
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414689
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b30c
push ebx
call edi
test eax, eax
je 0x414689
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x41b2fc
push ebx
mov dword [0x4245d8], eax
call edi
push eax
call esi
push 0x41b2e8
push ebx
mov dword [0x4245dc], eax
call edi
push eax
call esi
push 0x41b2cc
push ebx
mov dword [0x4245e0], eax
call edi
push eax
call esi
mov dword [0x4245e8], eax
test eax, eax
je 0x4145e1
push 0x41b2b4
push ebx
call edi
push eax
call esi
mov dword [0x4245e4], eax
mov eax, dword [0x4245e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41463a
cmp dword [0x4245e8], ecx
je 0x41463a
push eax
call esi
push dword [0x4245e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41463a
test ebx, ebx
je 0x41463a
call edi
test eax, eax
je 0x414631
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414631
test byte [ebp - 8], 1
jne 0x41463a
or dword [ebp + 0x10], 0x200000
jmp 0x41466d
mov eax, dword [0x4245dc]
cmp eax, dword [ebp - 0x18]
je 0x41466d
push eax
call esi
test eax, eax
je 0x41466d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41466d
mov eax, dword [0x4245e0]
cmp eax, dword [ebp - 0x18]
je 0x41466d
push eax
call esi
test eax, eax
je 0x41466d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4245d8]
call esi
test eax, eax
je 0x414689
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41468b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a82f
leave
ret
Function at 0x403c20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [esi + 0x46eaa8]
mov word [ebp - 0x14], ax
add eax, 2
cmp dword [esi + 0x46eaa8], 0xfffe
mov word [ebp - 0x12], ax
mov eax, dword [esi + 0x46eaac]
mov dword [ebp - 0x10], eax
ja 0x403cc6
lea eax, [ebp - 0xc]
mov ecx, 0xfffffffd
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea edx, [ebp - 0x14]
call fcn.004103a0
mov edi, eax
test edi, edi
js 0x403cc6
lea eax, [ebp - 0x2c]
push eax
push 0x10100
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x403cab
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x403cc6
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword ds:[ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
add esi, 8
cmp esi, 0x20
jb 0x403c40
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004218f3
mov esp, ebp
pop ebp
ret
Function at 0x404040
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.004051c0
mov edi, eax
test edi, edi
je 0x404062
cmp dword [edi], 0
jne 0x4040d5
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word ds:[ebp - 0x28], 9
mov eax, 0x46ecf8
mov ecx, 0x46ecf0
cmovne ecx, eax
call fcn.00411c20
mov edi, eax
test edi, edi
je 0x404090
cmp dword [edi], 0
jne 0x4040d5
mov ecx, str.C:Program_FilesSystemInformer_
call fcn.00406a00
mov edx, dword [0x46fcb4]
mov esi, eax
add esi, esi
lea ecx, [esi + 0xa]
call fcn.004060a0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
push esi
push str.C:Program_FilesSystemInformer_
mov dword [edi + 4], ecx
mov dword [edi], esi
mov word [ecx + esi], ax
push dword [edi + 4]
call fcn.00423710
add esp, 0xc
test edi, edi
je 0x40415a
mov ecx, dword [edi]
test ecx, ecx
je 0x40415a
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0x466468
cmp ecx, 2
jb 0x404111
mov eax, dword [edi + 4]
lea edx, [ebp - 0x38]
add ecx, 0xfffffffe
mov dword [ebp - 0x30], 2
add eax, ecx
lea ecx, [ebp - 0x30]
push 1
mov dword [ebp - 0x2c], eax
call fcn.00406b00
test al, al
jne 0x40415a
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 2
mov ecx, edi
mov dword [ebp - 0x2c], 0x466468
call fcn.00407080
mov esi, eax
test esi, esi
je 0x404133
lock inc dword [esi - 4]
lea ecx, ds:[edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x404148
call fcn.00406180
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004218f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004218f3
mov esp, ebp
pop ebp
ret
Function at 0x404420
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov dword [ebp - 0x50], edi
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x40444e
cmp dword [eax], 0
je 0x40444e
mov eax, dword [eax + 4]
jmp 0x404453
mov eax, str.KSystemInformer
push eax
mov edx, 0x24
lea ecx, [ebp - 0x48]
call fcn.00415300
test eax, eax
js 0x404546
mov esi, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004153a0
nop word [eax + eax]
test eax, eax
js 0x40453b
cmp dword [ebp - 0x24], 1
je 0x40453b
mov edi, 0x3c
lea eax, ds:[ebp - 0x44]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4044b9
cmp dword [0x46ead8], 0xffffffff
jb 0x4044b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, ds:[ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
push 0x24
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x404513
cmp dword [0x46ead8], 0xffffffff
jae 0x404502
mov eax, dword fs:[0x18]
mov esi, dword [ebp - 0x48]
mov eax, dword [eax + 0x34]
jmp 0x404508
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00414d40
test eax, eax
js 0x404519
cmp dword [ebp - 0x24], 1
je 0x404538
lea edx, [ebp - 0x58]
mov dword [ebp - 0x58], 0xff676980
mov dword [ebp - 0x54], 0xffffffff
call fcn.00413420
sub edi, 1
jne 0x404497
mov edi, dword [ebp - 0x50]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x404557
cmp dword [eax], 0
je 0x404557
mov eax, dword [eax + 4]
jmp 0x40455c
mov eax, str.KSystemInformer
push eax
mov edx, 0x10000
lea ecx, [ebp - 0x48]
call fcn.00415300
test eax, eax
js 0x4045d2
mov esi, dword [ebp - 0x48]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4045cb
cmp dword [0x46ead8], 0xffffffff
jae 0x404593
mov eax, dword fs:[0x18]
mov esi, dword [ebp - 0x48]
mov eax, dword [eax + 0x34]
jmp 0x404599
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00414d40
mov ecx, eax
test ecx, ecx
jns 0x4045cb
and eax, 0xfff0000
xor bl, bl
cmp eax, 0x70000
jne 0x4045be
movzx eax, cx
jmp 0x4045c8
push ecx
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov dword [edi + 0x28], eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword ds:[ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret
Function at 0x404600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
sub esp, 0xc
mov esi, ecx
push 0x46eac8
push ecx
lea ecx, [ebp - 8]
call fcn.004106a0
test eax, eax
js 0x40467a
mov ecx, dword [esi + 0x18]
mov edx, str.SystemInformer.exe
call fcn.00405520
mov esi, eax
test esi, esi
je 0x404671
mov ecx, dword [esi]
lea eax, [ebp - 0x10]
add ecx, 2
xorps xmm0, xmm0
push ecx
push dword [esi + 4]
movlpd qword [ebp - 0x10], xmm0
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404671
call fcn.00406180
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004218f3
mov esp, ebp
pop ebp
ret
Function at 0x404fc0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x24], eax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x28], edx
push eax
push 0x44255c
push 1
push 0
push 0x4425ac
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x405168
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x44257c
push eax
mov esi, dword [eax]
mov esi, dword [esi]
mov ecx, esi
call dword [0x44227c]
call esi
test eax, eax
js 0x405168
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x44258c
push eax
mov esi, dword [eax]
mov esi, dword [esi]
mov ecx, esi
call dword [0x44227c]
call esi
test eax, eax
js 0x4050f2
mov ecx, ebx
call fcn.00406a00
mov esi, eax
xorps xmm0, xmm0
add esi, esi
mov eax, 0x1f
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x20], ax
lea eax, [esi + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword ds:[ebp - 0x18], eax
test eax, eax
je 0x4050bc
lea ecx, [esi + 2]
push ecx
push 0
push eax
call fcn.004235b0
add esp, 0xc
push esi
push ebx
push dword [ebp - 0x18]
call fcn.00423710
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x20]
add esp, 0xc
mov esi, dword [eax]
push ecx
push 0x4663f8
push eax
mov esi, dword [esi + 0x18]
mov ecx, esi
call dword [0x44227c]
call esi
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x44227c]
call esi
mov eax, dword ds:[ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x44227c]
call esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_PropVariantClear]
mov eax, dword [ebp - 8]
push dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x44227c]
call esi
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x28]
push 0
push ebx
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x44]
mov ecx, esi
call dword [0x44227c]
nop
call esi
mov eax, dword [ebp - 8]
push ebx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x44227c]
call esi
test eax, eax
js 0x405168
mov ecx, edi
call fcn.00410bc0
test al, al
je 0x405150
mov ecx, edi
call fcn.00410c60
mov eax, dword ds:[ebp - 0x10]
push 1
push edi
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x44227c]
call esi
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40517f
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44227c]
call esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x405196
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44227c]
call esi
push 0
push edi
push 5
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret 8
Function at 0x4051c0
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x46eaac
nop word [eax + eax]
movzx eax, word [esi + 0x46eaa8]
mov word [ebp - 0x10], ax
add eax, 2
cmp dword [esi + 0x46eaa8], 0xfffe
mov word [ebp - 0xe], ax
mov eax, dword [esi + ebx]
mov dword [ebp - 0xc], eax
ja 0x40524f
lea eax, [ebp - 0x14]
mov ecx, 0xfffffffd
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea edx, [ebp - 0x10]
call fcn.004103a0
mov edi, eax
test edi, edi
js 0x40524f
lea eax, [ebp - 0x2c]
push eax
push 0x20119
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40524b
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jns 0x40526a
add esi, 8
cmp esi, 0x20
jb 0x4051e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004218f3
mov esp, ebp
pop ebp
ret
mov ecx, dword ds:[ebp - 8]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1e
mov dword [ebp - 0xc], str.InstallLocation
call fcn.00412820
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret
Function at 0x4052c0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x46e040]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], 0x12
mov dword [esp + 0x10], str.SiMutant_
mov dword [esp + 0x50], 0x12
cmp dword [esi], 0x12
mov eax, dword [esi + 4]
mov dword [esp + 0x54], eax
jb 0x405316
push 1
lea edx, [esp + 0x10]
lea ecx, [esp + 0x54]
call fcn.00406b00
test al, al
je 0x405316
mov bl, byte [esp + 0xb]
jmp 0x405392
cmp dword [esi], 0x1c
mov eax, dword [esi + 4]
mov dword [esp + 0x50], 0x1c
mov dword [esp + 0x54], str.SiSetupMutant_
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x1c
jae 0x40533e
xor bl, bl
jmp 0x405353
push 1
lea edx, [esp + 0x54]
lea ecx, [esp + 0x10]
call fcn.00406b00
mov bl, al
test bl, bl
jne 0x405392
cmp dword [esi], 0x1e
mov ecx, dword [esi + 4]
mov dword [esp + 0x50], 0x1e
mov dword [esp + 0x54], str.SiViewerMutant_
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x1e
jb 0x4054f8
push 1
lea edx, [esp + 0x54]
lea ecx, [esp + 0x10]
call fcn.00406b00
test al, al
je 0x4054f8
movzx eax, word [esi]
mov word [esp + 0x5c], ax
add eax, 2
cmp dword [esi], 0xfffe
mov word [esp + 0x5e], ax
mov eax, dword [esi + 4]
mov dword [esp + 0x60], eax
ja 0x4054f8
mov dword ds:[esp + 0x20], 0x18
call fcn.00413160
mov dword [esp + 0x24], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0x40
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call dword [sym.imp.ntdll.dll_NtOpenMutant]
nop dword [eax + eax]
test eax, eax
js 0x4054f8
push 0
push 8
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
nop dword [eax]
test eax, eax
js 0x4054ee
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 0
cmp ecx, dword [eax + 0x20]
je 0x4054ee
test bl, bl
je 0x405474
push 0
push 0x18
lea eax, [esp + 0x40]
push eax
push 0
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, dword [esp + 0x18]
test eax, eax
js 0x405474
cmp dword [esp + 0x4c], ecx
je 0x4054df
push ecx
mov edx, 0x101001
lea ecx, [esp + 0x10]
call fcn.0040f140
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00414b40
test eax, eax
je 0x4054ad
push 0
push 0x1388
push 1
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4054ee
push 1
push eax
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0xfd050f80
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x60], 0xffffffff
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4054ee
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x64]
mov al, 1
pop esi
pop ebx
xor ecx, esp
call fcn.004218f3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4055e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push edi
test ecx, ecx
je 0x40560e
mov ecx, dword [ecx + 4]
jmp 0x405610
xor ecx, ecx
sub esp, 8
lea edx, [ebp - 0x2c]
call fcn.00410080
nop dword [eax + eax]
test eax, eax
js 0x4056df
push 0
push 0
push 0x60
push 5
push 7
push 0x80
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], 0
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x38], 0x40
push eax
push 0x120116
lea eax, [ebp - 0x20]
mov dword [ebp - 0x34], 0
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov ecx, dword [ebp - 0x28]
mov esi, eax
test ecx, ecx
je 0x4056a2
push ecx
mov ecx, dword fs:[0x18]
push 0
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
test esi, esi
js 0x4056df
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push 0
push 0
push dword [ebp + 8]
mov esi, edi
push dword [ebp - 0x24]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x4056d4
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x18], eax
jne 0x4056d4
mov bl, 1
test esi, esi
je 0x4056df
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret 4
Function at 0x405700
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.0043f4b0
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor al, al
mov dword [ebp - 0x1140], edx
mov byte [ebp - 0x1131], al
mov dword [ebp - 0x1138], 0
push esi
push edi
test ecx, ecx
je 0x40573b
mov edx, dword [ecx + 4]
jmp 0x40573d
xor edx, edx
push ecx
push 0x60
push 1
push 7
push 0x80
push 0
push 0x120089
lea ecx, [ebp - 0x1138]
call fcn.004108e0
mov ebx, dword [ebp - 0x1138]
test eax, eax
js 0x40583a
push 5
push 0x18
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x113c]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x40583a
movq xmm0, qword [ebp - 0x1018]
lea ecx, [ebp - 0x1130]
movups xmm1, xmmword [ebp - 0x1028]
movq qword [ebp - 0x1018], xmm0
call fcn.00412a80
movaps xmm0, xmm1
psrldq xmm1, 0xc
psrldq xmm0, 8
movd esi, xmm0
movd edi, xmm1
mov eax, esi
or eax, edi
je 0x40581e
nop dword [eax + eax]
push 0
push 0
push 0x1000
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x40583a
push dword [ebp - 0x100c]
lea edx, [ebp - 0x1008]
lea ecx, [ebp - 0x1130]
call fcn.00412ae0
sub esi, dword [ebp - 0x100c]
mov eax, esi
sbb edi, 0
or eax, edi
jne 0x4057d0
mov edx, dword [ebp - 0x1140]
lea ecx, [ebp - 0x1130]
sub esp, 8
call fcn.00412b80
mov byte [ebp - 0x1131], al
jmp 0x405840
mov al, byte [ebp - 0x1131]
test ebx, ebx
je 0x405851
push ebx
call dword [sym.imp.ntdll.dll_NtClose]
mov al, byte [ebp - 0x1131]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret