joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477d5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477fbc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x477dbf
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00477824
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d534
cmp al, 1
jne 0x477dbf
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00477b3c
test al, al
je 0x477f4b
cmp dword [ebp - 8], 0
jge 0x477ddd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00477824
mov eax, dword [ebp - 0x210]
call fcn.00404974
cmp ebx, eax
jge 0x477e27
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00477824
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4d8c68]
and eax, 0xff
bt dword [edx], eax
jae 0x477e27
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x477e3b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00477d38
cmp ebx, dword [ebp - 8]
je 0x477f3d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x477e67
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d78c8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x477f2a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d78c8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00448f7c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d78c8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00448f7c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477f31
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x477f9e
cmp dword [ebp - 8], 0
jge 0x477f56
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00477824
mov eax, dword [ebp - 0x218]
call fcn.00404974
cmp eax, dword [ebp - 8]
jg 0x477f90
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00477824
mov eax, dword [ebp - 0x21c]
call fcn.00404974
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00477d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fc3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004046d8
ret
Function at 0x482abc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418768]
call fcn.0040506c
xor eax, eax
push ebp
push 0x482c00
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d78d4], 0
jne 0x482b0f
mov ecx, dword [0x4d8434]
mov dl, 1
mov eax, dword [0x407d40]
call fcn.0040cbec
call fcn.0040406c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030c4
mov eax, ebx
call fcn.00404f1c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x482c10
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062c4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f2c
test eax, eax
jle 0x482ba7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x482ba0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040493c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404924
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408bec
test eax, eax
jne 0x482ba0
mov ebx, 0x15
jmp 0x482bac
mov ebx, 0x10
jmp 0x482bac
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4d78d4]
call fcn.00482a14
mov eax, dword [ebp - 8]
call fcn.00482a14
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004062dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482c07
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004046d8
lea eax, [ebp - 0x10]
mov edx, dword [0x418768]
call fcn.0040513c
ret
Function at 0x496ab0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x496ab8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x496caa
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x496cc0
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404708
lea ecx, [ebp - 0x10]
mov edx, 0x496cd4
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404708
lea ecx, [ebp - 0x14]
mov edx, 0x496cec
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404708
lea ecx, [ebp - 0x18]
mov edx, 0x496d08
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404708
lea ecx, [ebp - 0x1c]
mov edx, 0x496d24
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404708
lea ecx, [ebp - 0x24]
mov edx, 0x496d3c
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408c5c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004091a4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x496d54
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x28]
call fcn.0048e414
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x496d64
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x2c]
call fcn.0048e414
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x496d7c
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004091a4
inc eax
je 0x496c4d
lea ecx, [ebp - 0x34]
mov edx, 0x496d7c
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x34]
call fcn.00409168
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aa40
fstp qword [ebp - 0x3c]
wait
call fcn.0040add0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x496c68
lea ecx, [ebp - 0x40]
mov edx, 0x496d7c
mov eax, esi
call fcn.0049493c
mov eax, dword [ebp - 0x40]
call fcn.0048e414
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x496d8c
mov eax, esi
call fcn.0049493c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496cb1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046d8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046d8
ret
Function at 0x49da3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49da96
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0049da2c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0048d080
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0048cc80
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49da9d
lea eax, [ebp - 4]
call fcn.004046b4
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x28904f65
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1a7f608f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x105f8d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 0x10]
bswap ebx
lea esp, [esp + 1]
jmp 0x105f913

Function at 0x105f901
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror esi, 0
pushal
rdtsc
sub ax, 0x2778
jle 0x105f8d7
lea esp, [esp + 3]
jmp 0x105f90e
jmp 0x105f8bf
jmp 0x105f90a
jmp 0x105fa8b
mov al, cl
jmp 0x105fa92
push word [esp + 0x15]
jp 0x105f8d5
jnp 0x105f8bf
lea esp, [esp + 3]
call fcn.0105f8d9
lea esp, [esp + 0x38]
sub esi, 0x5e028220
lea eax, reloc.WINMM.dll_midiStreamOut
xchg bl, dl
bsf edx, eax
jo 0x105f8e5
mov bh, byte [esp]
not edx
jmp 0x105f8ea
sub esi, 0x2a3df6a2
cmc
ja 0x105f9ab
bts eax, ecx
jmp 0x105f976
mov ah, 0x6a
lea esp, [esp + 4]
jmp 0x105f93a
jmp 0x105f990
rdtsc
jmp 0x105f9b0
jmp 0x105f9d7
neg ebx
add esi, dword [ebp]
neg edx
jnp 0x105f97a
mov bh, al
sub esp, 2
mov ax, 0x6d46
jmp 0x105fa44
bts eax, ecx
rdtsc
ror esi, 0
mov ebx, 0x3d6db6ab
neg dx
js 0x105f960
neg ebx
jmp 0x105f992
lea esp, [esp + 2]
jmp 0x105fa18
mov bh, al
sub esp, 2
mov ax, 0x6d46
jmp 0x105f9c1
sub esp, 4
jle 0x105f958
mov ah, 0x6a
jmp 0x105f95a
mov ebp, 0x66e073dd
mov eax, esi
lea esp, [esp + 2]
call 0x1060041
sub esi, dword [ecx + reloc.WINMM.dll_midiStreamOut]
sub esi, dword [edx + reloc.WINMM.dll_midiStreamOut]
xor esp, dword [esi - 0x45]
loope 0x105fa1e
mov bh, byte [esp]
not edx
mov al, cl
xor esi, 0x686b33b0
lea eax, [edx + edi]
mov ebx, 0xab3b9973
lea edx, [edx*4]
jmp 0x105f9f2

Function at 0x105fb60
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec bl
jo 0x105f7ff
jno 0x105f7ff
mov ecx, dword [esp]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp]
pushal
jmp 0x105f7c3
cmc
jl 0x105f824
push di
lea esp, [esp + 2]
jmp 0x105f80e
lea ebp, [esp + 0x20]
mov ebx, dword [esp]
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x105f7e9
sub esp, 0xa0
jmp 0x105f82c
push di
lea esp, [esp + 2]
jmp 0x105f80e
mov edi, esp
not eax
mov bl, cl
mov ecx, esi
push bx
jmp 0x105f865
rdtsc
dec di
jmp 0x105f7dc
pushal
lea esp, [esp + 2]
not ax
mov bh, byte [esp]
or bl, cl
sub esp, 0x12
jmp 0x105f872
setp dh
dec eax
jbe 0x105f84f
pushal
jmp 0x105f888
or bl, cl
jmp 0x105f85c
btc ax, si
jae 0x105f894
mov bx, 0x8bef
jmp 0x105f898
lea esp, [esp + 2]
not ax
mov bh, byte [esp]
jmp 0x105f86e
mov bx, 0x8bef
call fcn.0105f901
btc esi, edx
jp 0x105f849
rdtsc
dec di
mov ecx, dword [esp]
jmp 0x105f7df
jmp 0x105f8ae
push 0xf104ecec
jmp 0x105f935
pop word [esp]
push si
mov dword [esp], edi
pushfd
jmp 0x105fb3c
Function at 0x10641b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf104ecec
jmp 0x1064645
pushal
jmp 0x10640e0
lea esp, [esp + 0x27]
mov dword [esp], ebx
lea esp, [esp + 1]
mov dword [esp + 4], edx
push ebx
pop word [esp]
jmp 0x106411c
jmp 0x106419d
lea esp, [esp + 2]
mov dword [esp], ebx
push esp
pushfd
push dword [esp + 1]
jg 0x1064106
push dword [esp + 5]
push dword [esp + 9]
mov byte [esp + 0xd], dh
pop dword [esp + 1]
mov dword [esp + 8], ebp
jmp 0x106415f
push ebp
mov word [esp + 3], ax
push word [esp + 4]
jmp 0x1064184
pop dword [esp + 1]
mov dword [esp + 8], ebp
call 0x106417b
push dword [esp + 2]
push word [esp + 0xc]
mov dword [esp + 0x14], esi
pushfd
call 0x10641b6
or byte [ebx + 0xc897dc2], ch
and al, 0x88
dec esp
and al, 2
jmp 0x1064141
je 0x1064164
push dword [esp + 2]
push word [esp + 0xc]
jmp 0x10641ab
push dword [esp + 5]
push dword [esp + 9]
mov byte [esp + 0xd], dh
jmp 0x1064157
mov dword [esp + 0x14], esi
pushfd
call fcn.01064603
push word gs:[esp + 4]
jmp 0x106465b
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x1064617
mov dword [esp], edi
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0x106380c
inc bx
jmp 0x10646a2
jne 0x1064608
mov dword [esp], edi
lea esp, [esp + 2]
jmp 0x10641c0
xchg bx, ax
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x106471b
lea esp, [esp + 1]
jmp 0x106471b
jle 0x1064669
xchg bx, ax
sub esp, 0x15
jmp 0x106468c
xchg word [esp], cx
add esp, 0
jmp 0x10646ea
pushfd
jmp 0x10646ac
lea edi, [esp + 0x18]
rcl ebx, 0x18
jl 0x10647a2
jge 0x106477c
rol dword [eax + reloc.WINMM.dll_midiStreamOut], 0xf
stosd dword es:[edi], eax
retf
mov ebp, dword [esp + 0x40]
bsf ebx, edi
jb 0x10646c2
pushfd
xchg word [esp], cx
add esp, 0
call fcn.010646c5
test dword [edi - reloc.WINMM.dll_midiStreamOut], 0x66d78bd8
xchg ebx, esi
jmp 0x10648bf
push bp
sete dl
lea esp, [esp + 2]
jmp 0x10647ab
sub esp, 0xa8
jmp 0x106480d
push bp
sete dl
lea esp, [esp + 2]
jmp 0x1064787
mov esi, esp
mov ebx, dword [esp]
sub cl, 0xa8
jge 0x10647c4
jl 0x10647c4
lea edx, [ecx*4]
push dword [esp]
ret 4

Function at 0x1064e57
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ax
rdtsc
mov cx, ax
mov al, byte [esp]
xchg dword [esp], ecx
jmp 0x1064e96
push ebx
add esp, 0
setnp dh
xchg dword [esp + 4], ecx
mov dx, sp
rdtsc
jmp 0x1064e80
mov ah, ch
cmp al, bl
xchg ecx, eax
push dword [esp + 4]
ret 8
xchg edx, eax
lea edx, [ebp*4]
lea edx, [ebx + edi]
bts ax, di
lea ecx, [ecx - 0x25]
mov ah, 0xb0
jmp 0x1064e66

Function at 0x106bbce
Capabilities:
Encode data using xor

Disassembly:
call fcn.0106d629
and dword [esi - 0x48], edx
out 0x10, al
ja 0x106bbf2
cmp ch, dl
sub dword [ecx], reloc.WINMM.dll_midiStreamOut
fld dword [ecx - 0x1645fcc0]
aas
invalid
add byte [eax], al
add byte [ebp + 0x58022464], cl

Function at 0x10fad63
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10fad94
mov ecx, dword [esp + 3]
xchg dx, ax
xchg dword [esp], ecx
neg ecx
lea eax, [edx*4]
mov ecx, 0x7baadac0
jmp 0x10fadd1
adc eax, 0x19f26fd4
clc
mov cx, word [esp + 6]
mov dx, 0x66e
pop dword [esp + 4]
xchg cx, ax
jmp 0x10fad65
Function at 0x10fb4a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, dh
jmp 0x10fc0fb
mov eax, dword [esp + 1]
mov ecx, dword [esp]
mov cl, dh
rol dl, 5
pop edx
lea eax, [esp + 0x9a]
jmp 0x10fb4fe
mov ecx, 0x7cc55e35
bsf ecx, eax
push word [esp + 1]
std
mov byte [esp + 4], al
bsf ax, bx
jmp 0x10fb8ca
pop dword [esp + 2]
pop dword [esp]
mov dh, bl
pop edx
mov ecx, ebp
push esp
jmp 0x10fb958
not ch
pop dword [esp + 3]
lea eax, [ebx + ebp]
push dx
mov cx, bx
xchg ecx, edx
jmp 0x10fbbab
mov ecx, dword [esp + 0x11]
mov edx, 0x27f86c45
mov word [esp + 4], si
pop eax
lea edx, [ebp*4]
pop ax
jmp 0x10fbdc7
Function at 0x403e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4293c0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
lea eax, [esp + 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SOFTWARENVIDIA_CorporationInstaller
push 0x80000002
mov dword [esp + 0x1c], ebx
call dword [0x41d078]
test eax, eax
jne 0x4040bd
mov eax, dword [esp + 8]
push esi
mov esi, dword [0x41d07c]
push edi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push str.Logging
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], 4
call esi
push 0x103
lea ecx, [esp + 0x25]
push ebx
push ecx
mov edi, eax
mov byte [esp + 0x2c], bl
call fcn.0040d980
add esp, 0xc
cmp dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x104
jne 0x403f3e
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push str.LogPath
push ecx
call esi
test eax, eax
jne 0x403f2b
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
cmp eax, 1
jne 0x403f3e
mov eax, dword [str.C:Temp]
mov ecx, dword [0x41ea44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x10]
push edx
call dword [0x41d080]
cmp edi, ebx
jne 0x4040bb
cmp dword [esp + 0x14], 1
jne 0x4040bb
push str.GlobalNVInstallerLogFile
push ebx
push ebx
call dword [0x41d104]
cmp eax, ebx
mov dword [0x42eaf0], eax
je 0x4040bb
push 0xffffffffffffffff
push eax
call dword [0x41d09c]
push str.NVInstallerLogSharedMemory
push 8
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [0x41d100]
cmp eax, ebx
mov dword [0x42eaf4], eax
jne 0x403fd2
mov eax, dword [0x42eaf0]
push eax
call dword [0x41d0f4]
mov ecx, dword [0x42eaf0]
push ecx
call dword [0x41d094]
pop edi
pop esi
mov dword [0x42eaf0], ebx
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0040dd32
add esp, 0x11c
ret
call dword [0x41d204]
mov edx, dword [0x42eaf4]
push ebx
push ebx
push ebx
push 6
cmp eax, 0xb7
push edx
sete byte [esp + 0x23]
call dword [0x41d0fc]
cmp eax, ebx
mov dword [0x42eaec], eax
jne 0x404045
mov eax, dword [0x42eaf4]
mov esi, dword [0x41d094]
push eax
call esi
mov ecx, dword [0x42eaf0]
push ecx
mov dword [0x42eaf4], ebx
call dword [0x41d0f4]
mov edx, dword [0x42eaf0]
push edx
call esi
pop edi
pop esi
mov dword [0x42eaf0], ebx
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0040dd32
add esp, 0x11c
ret
cmp byte [esp + 0xf], bl
jne 0x404050
mov dword [eax], ebx
mov dword [eax + 4], ebx
lea eax, [esp + 0x20]
push eax
call dword [0x41d0d8]
cmp eax, 0xffffffff
jne 0x40406c
push ebx
lea ecx, [esp + 0x24]
push ecx
call dword [0x41d0f8]
lea edx, [esp + 0x20]
push edx
push str._sNVInstaller.log
push 0x42eb38
call fcn.0040dd41
mov eax, dword [esp + 0x138]
mov edx, 0x42eaf8
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x404091
mov ecx, dword [0x42eaec]
mov eax, dword [ecx]
mov dword [0x4292b8], eax
add eax, 1
mov dword [ecx], eax
mov eax, dword [0x42eaf0]
push eax
call dword [0x41d0f4]
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
pop ebx
xor ecx, esp
call fcn.0040dd32
add esp, 0x11c
ret
Function at 0x404510
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebp
push esi
push str.UninstCommandClass::CheckForUpdate_n
call fcn.00404160
mov ebp, dword [esp + 0x18]
add esp, 4
lea eax, [esp + 8]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x404541
pop esi
mov al, 1
pop ebp
add esp, 8
ret 0xc
push ebx
push edi
push esi
xor bl, bl
call fcn.0040d90b
mov ecx, dword [esp + 0x14]
add esp, 4
mov edi, eax
push edi
push esi
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x404594
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0x41ec80
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x404594
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jb 0x404594
jne 0x404596
mov ecx, dword [edx + 0xc]
cmp ecx, dword [esp + 0x24]
jae 0x404596
mov bl, 1
push edi
call fcn.0040d975
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
add esp, 8
ret 0xc
Function at 0x405440
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4293c0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x22c]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x230]
mov dword [esp + 0x14], ecx
push edi
mov ecx, ebx
jne 0x40547c
mov ecx, str.NULL
test esi, esi
mov eax, esi
jne 0x405487
mov eax, str.NULL
push ecx
push eax
push str.UninstCommandClass::NvRegEnumAndDeleteSubKeys_HKEY__s__s__n
call fcn.00404160
lea edx, [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x10], 0
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4054a6
lea edi, [esp + 0x28]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4054c0
mov ax, word [0x41ec80]
mov word [edi], ax
mov eax, ebx
mov ecx, ebx
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4054d7
lea edi, [esp + 0x28]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
jmp 0x4054f0
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4054f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x34]
push edx
push ebp
call dword [0x41d078]
test eax, eax
jne 0x4055d7
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push edx
call dword [0x41d05c]
test eax, eax
jne 0x4055cc
cmp dword [esp + 0x10], eax
jbe 0x4055cc
mov esi, dword [0x41d058]
mov ebx, dword [0x41d060]
mov edi, 0xff
lea ebx, [ebx]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x13c]
push edx
add eax, 0xffffffff
push eax
push ecx
mov dword [esp + 0x3c], edi
call esi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.00405440
test eax, eax
jne 0x4055c5
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x128]
push ecx
push edx
call ebx
sub dword [esp + 0x10], 1
jne 0x405570
mov eax, dword [esp + 0x14]
push eax
call dword [0x41d080]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040dd32
add esp, 0x21c
ret 0xc
Function at 0x4059e0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push str.UninstCommandClass::UninstallService_n
mov dword [esp + 0x18], esi
call fcn.00404160
add esp, 4
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [esp + 0x18], edi
call dword [section..rdata]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x10], ebx
je 0x405b23
push edi
call dword [0x41d0ac]
mov eax, dword [esp + 0x38]
push 0xf01ff
push eax
push ebx
call dword [0x41d004]
mov esi, eax
cmp esi, edi
je 0x405afa
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [0x41d008]
test eax, eax
mov edi, dword [0x41d0c0]
je 0x405ab4
push ebp
mov ebp, dword [0x41d00c]
mov ebx, 0x64
sub ebx, 1
cmp dword [esp + 0x20], 1
je 0x405a85
push 0x64
call edi
lea edx, [esp + 0x1c]
push edx
push esi
call ebp
test eax, eax
je 0x405a7e
test ebx, ebx
jne 0x405a60
cmp dword [esp + 0x20], 1
jne 0x405a8e
push 0x3e8
call edi
jmp 0x405aaf
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x18]
push eax
push 8
mov ecx, ebx
call entry0
push eax
push str.Error:
push ebx
call fcn.004016c0
add esp, 0x10
mov ebx, dword [esp + 0x14]
pop ebp
push esi
call dword [0x41d010]
test eax, eax
jne 0x405adf
call dword [0x41d204]
cmp eax, 0x430
mov dword [esp + 0xc], eax
jne 0x405adf
push 0x3e8
call edi
mov dword [esp + 0xc], 0
push esi
call dword [0x41d014]
push ebx
call dword [0x41d014]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
call dword [0x41d204]
cmp eax, 0x424
mov dword [esp + 0xc], eax
jne 0x405b0f
mov dword [esp + 0xc], edi
push ebx
call dword [0x41d014]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, esi
call fcn.00401780
pop edi
pop esi
mov eax, 0x427
pop ebx
add esp, 0x28
ret 4