joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f4b7
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e88a
call sub.msvcrt.dll__EH_prolog
sub esp, 0x3c
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x424974
push 1
push esi
push 0x424a44
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f623
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_Win32_OperatingSystem
push 0x423fa0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f61c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f633
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f633
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x48]
push edx
push esi
push str.InstallDate
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call fcn.0040f41d
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
push esi
call dword [0x63d164]
push eax
call dword [0x63d0fc]
mov esi, eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x38]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x32]
push eax
push str._d__d__d__d:_d:_d
push esi
call dword [0x63cf8c]
mov ecx, dword [ebp + 8]
add esp, 0x20
push esi
call fcn.0040e564
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f630
push 0x423fd4
jmp 0x40f628
push 0x423fdc
mov ecx, dword [ebp + 8]
call fcn.0040e564
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f640
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e89c
call sub.msvcrt.dll__EH_prolog
sub esp, 0x24
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x424974
push 1
push esi
push 0x424a44
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.rootSecurityCenter2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f748
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_AntiVirusProduct
push 0x424050
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f741
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f758
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f758
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x30]
push edx
push esi
push str.displayName
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push dword [ebp - 0x28]
call fcn.0040f984
pop ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.0040e564
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f755
push 0x424070
jmp 0x40f74d
push str.Unknown
mov ecx, dword [ebp + 8]
call fcn.0040e564
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x411612
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41ebd8
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e59b
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e59b
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040e59b
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0040e59b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412c9f
Capabilities:
Create thread

Disassembly:
mov eax, 0x41f05b
call sub.msvcrt.dll__EH_prolog
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 2
call fcn.00411cc9
test byte [0x63cf28], 1
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 3
je 0x412cd5
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e622
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040e622
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e622
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e622
mov esi, 0x3e8
jmp 0x412d28
push esi
call dword [0x63cfa4]
cmp dword [0x63cf28], 2
jae 0x412d21
inc dword [0x63cf28]
push ebx
push ebx
lea eax, [ebp - 0x54]
push eax
push 0x411b8f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
push 0x42419a
call fcn.0040e564
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
call fcn.00411d15
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040113a
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], bl
call fcn.0040e5cf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414075
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41f3cf
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
inc esi
push 0x4243bc
lea ecx, [ebp + 0x70]
mov dword [ebp - 4], esi
call fcn.0040e79b
push eax
call sub.msvcrt.dll_strtok_s
add esp, 0xc
xor ebx, ebx
push ebx
push 0x4243c0
lea ecx, [ebp + 0x64]
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x14], ebx
call fcn.0040e79b
push eax
call dword [0x63d098]
test eax, eax
je 0x4140cd
mov edi, esi
push ebx
push 0x4243d0
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
call dword [0x63d098]
test eax, eax
je 0x4140eb
mov edi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jmp 0x41426a
cmp edi, ebx
je 0x4141fd
lea eax, [ebp - 0x80]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x80]
cmp byte [ebp - 0x80], bl
je 0x414255
push 0x3e8
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x14], ebx
je 0x414157
cmp eax, 2
jne 0x414157
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a8]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414173
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a8]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x468]
push eax
call fcn.0040fbb0
add esp, 0xc
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a8]
push ebx
push dword [ebp + 0x88]
lea eax, [ebp - 0x468]
push edi
push dword [ebp + 0x84]
lea ecx, [ebp + 0x58]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push dword [ebp - 0x10]
push eax
call fcn.0040e79b
push eax
push 0x424163
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
push esi
call dword [0x63d020]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x414113
jmp 0x414255
push ebx
push dword [ebp + 0x88]
lea ecx, [ebp + 0x64]
push ebx
push dword [ebp + 0x84]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push eax
call fcn.0040e79b
push eax
lea ecx, [ebp + 0x58]
call fcn.0040e79b
push eax
push 0x424166
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
lea eax, [ebp - 0x18]
push eax
push 0x424408
push ebx
call sub.msvcrt.dll_strtok_s
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4140f3
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f78b
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040113a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.004115c2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418e89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b1b0]
jne 0x418e93
repz ret
jmp fcn.0041bb7f
Function at 0x41c356
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004187ac
and dword [ebp - 0x14], 0
cmp dword [0x63dd7c], 0
mov dword [ebp - 0x18], eax
jne 0x41c409
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41c4b1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41c4b1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x63dd7c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x63dd80], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x63dd84], eax
call edi
push eax
call esi
mov dword [0x63dd8c], eax
test eax, eax
je 0x41c409
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x63dd88], eax
mov eax, dword [0x63dd88]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41c462
cmp dword [0x63dd8c], ecx
je 0x41c462
push eax
call esi
push dword [0x63dd8c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41c462
test ebx, ebx
je 0x41c462
call edi
test eax, eax
je 0x41c459
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41c459
test byte [ebp - 8], 1
jne 0x41c462
or dword [ebp + 0x10], 0x200000
jmp 0x41c495
mov eax, dword [0x63dd80]
cmp eax, dword [ebp - 0x18]
je 0x41c495
push eax
call esi
test eax, eax
je 0x41c495
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41c495
mov eax, dword [0x63dd84]
cmp eax, dword [ebp - 0x18]
je 0x41c495
push eax
call esi
test eax, eax
je 0x41c495
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x63dd7c]
call esi
test eax, eax
je 0x41c4b1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41c4b3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418e89
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x438c92
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
add ecx, 0xcf0a6d22
or ecx, ecx
call fcn.00438cb8
mov ebx, ecx
inc ecx
xor dword [esi], edx
inc ecx
inc esi
inc ebx
inc ebx
cmp esi, edi
jne fcn.00438c92
dec ebx
ret
Function at 0x401070
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x458c00], 0
push esi
push edi
mov edi, edx
jne 0x40112b
push ebx
mov dword [0x458c00], 1
xor ebx, ebx
mov edx, ebx
shl edx, 0x18
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovns esi, eax
lea eax, [esi + esi]
mov edx, eax
xor edx, 0x4c11db7
test esi, esi
cmovns edx, eax
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovns esi, eax
lea eax, [esi + esi]
mov edx, eax
xor edx, 0x4c11db7
test esi, esi
cmovns edx, eax
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovns esi, eax
lea eax, [esi + esi]
mov edx, eax
xor edx, 0x4c11db7
test esi, esi
cmovns edx, eax
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovns esi, eax
lea eax, [esi + esi]
mov edx, eax
xor edx, 0x4c11db7
test esi, esi
cmovns edx, eax
mov dword [ebx*4 + 0x458c08], edx
inc ebx
cmp ebx, 0x100
jb 0x401091
pop ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x401151
movsx eax, byte [edi]
lea edi, [edi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
movzx eax, dl
xor ecx, dword [eax*4 + 0x458c08]
sub esi, 1
jne 0x401132
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x401310
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1364
call fcn.00440990
mov eax, dword [0x452040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1354]
mov byte [ebp - 0x350], 0
push eax
push 0xf003f
push 0
push 0x4497b9
push closesocket
mov ebx, 1
mov byte [ebp - 0x22c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x1354]
mov esi, eax
mov dword [ebp - 0x135c], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, str.__the_Registry_n
mov dword [ebp - 0x1354], 0x104
test esi, esi
mov byte [ebp - 0x108], 0
mov eax, 0x448908
cmovne eax, ecx
mov dword [ebp - 0x1360], eax
lea eax, [ebp - 0x1358]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x401442
lea eax, [ebp - 0x1354]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x1364]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 0x1358]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1358]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401442
cmp dword [ebp - 0x1354], esi
je 0x401442
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x454]
push str._sis_chk_perm___._0
push eax
call edi
lea eax, [ebp - 0x454]
push 0x448924
push eax
call fcn.00422887
add esp, 0x14
test eax, eax
je 0x401442
push eax
call fcn.00422ada
lea eax, [ebp - 0x454]
push eax
call fcn.00422d12
add esp, 8
mov esi, ebx
jmp 0x40145c
lea eax, [ebp - 0x108]
xor esi, esi
push eax
lea eax, [ebp - 0x350]
push str.__the_program_directory_located_at:__s_n
push eax
call edi
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4014b6
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x454]
push str._sis_chk_perm___._0
push eax
call edi
lea eax, [ebp - 0x454]
push 0x448924
push eax
call fcn.00422887
add esp, 0x14
test eax, eax
je 0x4014b6
push eax
call fcn.00422ada
lea eax, [ebp - 0x454]
push eax
call fcn.00422d12
add esp, 8
jmp 0x4014d0
lea eax, [ebp - 0x108]
xor ebx, ebx
push eax
lea eax, [ebp - 0x22c]
push str.__the_system_directory_located_at:__s_n
push eax
call edi
add esp, 0xc
cmp dword [ebp - 0x135c], 0
jne 0x4014f7
test esi, esi
je 0x4014f7
test ebx, ebx
je 0x4014f7
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f127
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x350]
push eax
push dword [ebp - 0x1360]
lea eax, [ebp - 0x1350]
push str.You_have_no_sufficient_access_permissions_to_install_this_software._n_nIn_particular_you_have_no_read_write_access_permission_to:_n_s_s_s_nPlease_fix_the_problem_and_run_setup_again.
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x1350]
push 0
push str.Error:
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f127
mov esp, ebp
pop ebp
ret
Function at 0x404110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x452040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x4580b4]
push esi
mov esi, ecx
mov dword [ebp - 0x114], esi
test esi, esi
je 0x4042d6
test ebx, ebx
je 0x4042d6
lea eax, [ebp - 0x10c]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4041a3
push 0x459be8
push dword [ebp - 0x10c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4041a3
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x40419c
mov eax, dword [ebp - 0x110]
push dword [ebp - 0x10c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, 0x459be8
jmp 0x4041a5
xor ecx, ecx
lea edx, [ebp - 0x108]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4041b0
push edi
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4041c5
mov ax, word [0x448c04]
mov edx, esi
mov word [edi], ax
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4041e0
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4041f0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x404210
mov eax, dword [str..lnk]
mov dword [ecx], eax
mov al, byte [0x448df0]
mov byte [ecx + 4], al
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404230
sub ecx, edx
je 0x40424b
nop dword [eax + eax]
cmp byte [ebx + ecx], 0x5c
je 0x4042b2
sub ecx, 1
jne 0x404240
xor esi, esi
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x108]
sub esp, 0x18
push esi
push ecx
push eax
mov ecx, ebx
call fcn.0040c4a0
add esp, 0x24
pop edi
test eax, eax
jns 0x404295
call fcn.00409d00
push 0x10
push str.ERROR:
push str.Could_not_create_desktop_item_
push dword [0x4580e8]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4580f4], 1
test esi, esi
je 0x4042f8
push esi
call fcn.00427f49
add esp, 4
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f127
mov esp, ebp
pop ebp
ret
lea edi, [ecx + 1]
push edi
call fcn.00429ee5
push edi
mov esi, eax
push ebx
push esi
call fcn.0042f102
add esp, 0x10
test edi, edi
je 0x40424d
mov byte [edi + esi - 1], 0
jmp 0x40424d
push 0x10
push str.ERROR:
push str.Could_not_create_desktop_item_
push dword [0x4580e8]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4580f4], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f127
mov esp, ebp
pop ebp
ret
Function at 0x4043f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4580f4], 0
mov eax, ecx
push esi
mov esi, edx
mov dword [ebp - 4], eax
je 0x40440e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x458020], 0
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
jne 0x404442
push ecx
push esi
push 1
push eax
call fcn.0042963d
add esp, 0x10
cmp eax, esi
jae 0x4044e7
pop ebx
mov dword [0x4580f4], 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
push ecx
call fcn.0042929c
mov edi, 0x163e00
add esp, 4
mov ecx, edi
sub ecx, eax
mov eax, 0
sbb eax, edx
js 0x40446c
jg 0x404468
cmp ecx, 0xffff
jbe 0x40446c
mov edi, esi
jmp 0x40447d
push dword [ebx]
call fcn.0042929c
sub edi, eax
add esp, 4
cmp edi, esi
cmova edi, esi
push dword [ebx]
push edi
push 1
push dword [ebp - 4]
call fcn.0042963d
add esp, 0x10
cmp eax, edi
jae 0x40449e
mov ecx, 1
mov dword [0x4580f4], ecx
jmp 0x4044a4
mov ecx, dword [0x4580f4]
test ecx, ecx
jne 0x4044e4
sub esi, edi
je 0x4044e6
mov ecx, ebx
call fcn.00404310
cmp dword [0x4580f4], 0
jne 0x4044e4
push dword [ebx]
mov eax, dword [ebp - 4]
push esi
add eax, edi
push 1
push eax
call fcn.0042963d
add esp, 0x10
cmp eax, esi
jae 0x4044e6
pop edi
pop ebx
mov dword [0x4580f4], 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x452040]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
push 0x448bc8
push ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
call fcn.00422887
mov edi, eax
add esp, 8
test edi, edi
jne 0x4045f1
push ebx
push str.DoRealCopy16:_Couldnt_open_source__s
push dword [0x458068]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.ERROR:
push dword [0x458068]
push dword [0x4580e8]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4580f4], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0041f127
mov esp, ebp
pop ebp
ret
push 0x448924
push esi
call fcn.00422887
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x404658
push esi
push str.DoRealCopy16:_Couldnt_create_file__s
push dword [0x458068]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.ERROR:
push dword [0x458068]
push dword [0x4580e8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov dword [0x4580f4], 1
call fcn.00422ada
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0041f127
mov esp, ebp
pop ebp
ret
push edi
push 0x1000
push 1
push dword [0x458068]
call fcn.0042963d
push ebx
mov esi, eax
push esi
push 1
push dword [0x458068]
call fcn.00427931
add esp, 0x20
cmp esi, 0x1000
je 0x404658
push edi
call fcn.00422f48
add esp, 4
test eax, eax
jne 0x4046a1
push ebx
call fcn.00422f48
add esp, 4
test eax, eax
je 0x4046ab
mov dword [0x4580f4], 1
push edi
call fcn.00422ada
add esp, 4
push ebx
call fcn.00422ada
add esp, 4
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x14]
call fcn.00426b4a
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x58]
push esi
mov dword [esp + 0x34], ecx
call fcn.00429eda
push esi
push str.copy__s
call fcn.00402880
mov ecx, dword [esp + 0x74]
add esp, 0x18
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041f127
mov esp, ebp
pop ebp
ret