joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100181a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100181b3
pop dword [ebp - 0x20]
mov eax, 0x6d01e5d9
add eax, 0xa2ff9bda
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xdaa62660
sub dword [ebp - 0x30], 0x8c53e115
mov dword [ebp - 0x2c], 0x4c546e2c
sub dword [ebp - 0x2c], 0x1a2121e7
mov dword [ebp - 0x28], 0x45959406
sub dword [ebp - 0x28], 0xf9494fd8
mov dword [ebp - 0x24], 0xe3162c97
add dword [ebp - 0x24], 0x1ce9d369
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb1d7ab4
add dword [ebp - 0x30], 0x6954eea2
mov dword [ebp - 0x2c], 0x205c5048
add dword [ebp - 0x2c], 0x2110112d
mov dword [ebp - 0x28], 0x70097cc8
add dword [ebp - 0x28], 0xf365efa4
mov dword [ebp - 0x24], 0x5fe7ca6e
add dword [ebp - 0x24], 0xa0183592
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x442dce92
add eax, 0xcbd451ae
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x33de0
push 0
call eax
mov ecx, 0x1990a7c4
sub ecx, 0x199070ce
mov esi, eax
mov edi, 0xba8fef32
add edi, 0x55732cce
add edi, dword [ebp - 0x20]
mov edx, 0x1abe19ce
add edx, 0x27fb48f1
add dword [ebp - 8], 0xdde38164
mov ebx, dword [edi]
xor dword [ebp - 4], edi
xor ebx, edx
add dword [ebp - 0x18], 0xddd295bf
mov dword [esi], ebx
add dword [ebp - 4], 0x61b3778e
add esi, 4
add edi, 4
loop 0x100182d0
add eax, 0xfbfbea27
add eax, 0x404e484
xor ebx, ebx
add ebx, eax
add eax, 0x638bcef5
add eax, 0x9c743110
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4078e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7d88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], edx
mov byte [esp + 0xc], dl
mov dword [esp + 0x30], edx
lea edx, [esp + 8]
push edx
push eax
call fcn.0043e487
cmp dword [esp + 0x20], 0x10
mov esi, eax
jb 0x40794c
mov eax, dword [esp + 0xc]
push eax
call fcn.004462ff
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004974ba
add esp, 0x2c
ret 4

Function at 0x40b3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b3e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b424
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40b420
lea ebx, [ebx]
cmp esi, eax
jae 0x40b424
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40b410
cmp esi, eax
jb 0x40b42a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00497680
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004974ba
add esp, 0x108
ret
Function at 0x410510
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4c86d4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CHtmlCtrl.0
mov eax, dword [esi + 0x150]
push eax
mov dword [esp + 0x18], 2
call fcn.0040b500
add esp, 4
test eax, eax
je 0x410566
mov eax, dword [esi + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x154]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410588
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x150]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4105aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x130]
call fcn.00410250
mov eax, dword [esi + 0x118]
sub eax, 0x10
mov byte [esp + 0x14], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4105dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0xf4]
sub eax, 0x10
mov byte [esp + 0x14], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004644e7
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x410b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00497680
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x410bb4
cmp eax, 0x104
ja 0x410bb4
mov ecx, esi
push edi
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x410b90
sub ecx, edi
pop edi
cmp eax, ecx
jae 0x410bb4
mov eax, dword [esp + 0x114]
lea edx, [esp + 4]
push edx
push eax
push esi
call fcn.00497fe1
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x108]
xor edx, edx
cmp eax, 0xffffffff
setne dl
pop esi
xor ecx, esp
mov eax, edx
call fcn.004974ba
add esp, 0x108
ret
Function at 0x411886
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
push eax
push ebp
push str.Looking_for_ICE_window_using_findWindowMsg_d_and_iAmWindowMsg_d
push 0x20
push 0x519518
call fcn.00402450
mov ecx, dword [esp + 0x50]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebp
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x411985
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [esp + 0x30], eax
call esi
mov edi, eax
call esi
mov ebx, eax
lea esp, [esp]
mov eax, dword [esp + 0x38]
cmp eax, 0xffffffff
je 0x4118e5
sub edi, dword [esp + 0x30]
cmp edi, eax
jae 0x411985
push 1
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x41191c
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x14], eax
je 0x41195e
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
mov edi, eax
sub eax, ebx
cmp eax, 0x1388
jbe 0x4118d0
push str.Didnt_get_message_from_setup_or_stub.__Rebroadcasting_message
push 1
push 0x519518
call fcn.00402450
add esp, 0xc
call esi
mov ecx, dword [esp + 0x3c]
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebp
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4118d0
mov edx, dword [esp + 0x18]
push edx
push str.Found_window:__d
push 1
push 0x519518
call fcn.00402450
mov eax, dword [esp + 0x28]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x414c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00497680
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x414ca0
mov eax, dword [esi + 4]
jmp 0x414ca3
lea eax, [esi + 4]
push 0
lea ecx, [esp + 8]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 4]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414cc0
sub eax, edx
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00402160
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004974ba
add esp, 0x108
ret
Function at 0x4156b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4c89d6
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0x254]
mov dword fs:[0], eax
mov esi, dword [esp + 0x264]
lea eax, [esp + 0x14c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x4d]
push ebx
push ecx
mov byte [esp + 0x54], bl
call fcn.00497680
push 0x104
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0042e361
add esp, 0x18
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
lea ecx, [esp + 0x4c]
push ecx
push str.Setting_cuurent_dir_to__s_before_launching__s
push 0x20
push 0x519518
call fcn.00402450
mov eax, esi
add esp, 0x14
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415767
sub eax, edi
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00402160
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push 0x4d5834
push eax
mov dword [esp + 0x268], ebx
call fcn.00414e80
add esp, 0xc
mov edi, 0x10
mov byte [esp + 0x25c], 2
cmp dword [esp + 0x28], edi
jb 0x4157b9
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004462ff
add esp, 4
push 1
push 0x4d5834
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00407b80
cmp byte [esi], 0x22
jne 0x4157f7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4157e3
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.00402160
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], edi
jae 0x415805
lea eax, [esp + 0x30]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push eax
call fcn.00439bf1
add esp, 0x1c
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x14c]
push eax
push str.Setting_back_current_dir_to__s
push 0x20
push 0x519518
call fcn.00402450
add esp, 0x10
cmp dword [esp + 0x44], edi
jb 0x415852
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004462ff
add esp, 4
mov ecx, dword [esp + 0x254]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004974ba
add esp, 0x250
ret 4
Function at 0x418960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c8ec1
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, dword [esp + 0x80]
xor ebx, ebx
mov dword [esp + 0x14], ebx
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4d41fc
mov ecx, esi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x3c], esi
mov byte [esi + 4], bl
call fcn.00402160
mov ebp, 1
cmp dword [0x52b874], ebp
mov dword [esp + 0x78], ebx
mov dword [esp + 0x14], ebp
jle 0x418ace
mov eax, dword [0x52b878]
mov ecx, dword [eax + ebp*4]
mov eax, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4189f0
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00402160
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x58]
push 0x4d5834
push edx
mov dword [esp + 0x84], 1
call fcn.00414e80
push 0x4d5834
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x90], 2
call fcn.00407fb0
add esp, 0x18
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x84], 3
call fcn.00407a90
mov edi, 0x10
cmp dword [esp + 0x50], edi
jb 0x418a69
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004462ff
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x6c], edi
jb 0x418a8c
mov edx, dword [esp + 0x58]
push edx
call fcn.004462ff
add esp, 4
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
mov byte [esp + 0x78], bl
cmp dword [esp + 0x30], edi
jb 0x418ab3
mov eax, dword [esp + 0x1c]
push eax
call fcn.004462ff
add esp, 4
push 1
push 0x4d580c
mov ecx, esi
call fcn.00407b80
inc ebp
cmp ebp, dword [0x52b874]
jl 0x4189d2
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4
Function at 0x422470
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
call fcn.004280af
test eax, eax
jne 0x422637
call fcn.00427e1f
test eax, eax
jne 0x422637
call fcn.00427e01
test eax, eax
jne 0x422637
mov ecx, dword [esi + 0x98]
push 1
push str.DisablePnPBalloonTips
push 0x4d4294
call fcn.00411110
test eax, eax
je 0x422637
push 0
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocString
mov dword [esp + 0x1c], 0
call fcn.00429833
add esp, 0x18
test eax, eax
jne 0x42261d
add esi, 0x4e4
cmp dword [esp + 0x14], eax
je 0x42256b
cmp dword [esi], 0xffffffff
jne 0x422520
mov ecx, dword [esp + 4]
push str.EnableBalloonTips
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x422609
push eax
push str.Error_deleting_EnableBalloonTips_value.__error_d
jmp 0x4225fa
mov edx, dword [esp + 4]
push 4
push esi
push 4
push 0
push str.EnableBalloonTips
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x422609
push eax
mov eax, dword [esi]
push eax
push str.Error_resetting_EnableBalloonTips_value_to__d.__error_d
push 8
push 0x519518
call fcn.00402450
mov ecx, dword [esp + 0x18]
add esp, 0x14
push ecx
call fcn.00429cef
add esp, 4
pop esi
add esp, 0xc
ret 4
mov eax, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push 0
push str.EnableBalloonTips
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4225ba
mov ecx, dword [esi]
push ecx
push str.EnableBalloonTips_value_existed__0x_x.
push 0x20
push 0x519518
call fcn.00402450
jmp 0x4225d2
push eax
push str.Could_not_read_EnableBalloonTips_value.__error_d
push 0x20
push 0x519518
call fcn.00402450
mov dword [esi], 0xffffffff
mov eax, dword [esp + 0x14]
add esp, 0x10
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.EnableBalloonTips
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x422609
push eax
push str.Error_setting_EnableBalloonTips_value.__error_d
push 8
push 0x519518
call fcn.00402450
add esp, 0x10
mov ecx, dword [esp + 4]
push ecx
call fcn.00429cef
add esp, 4
pop esi
add esp, 0xc
ret 4
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push str.Could_not_open_key__s.__error_d
push 8
push 0x519518
call fcn.00402450
add esp, 0x14
pop esi
add esp, 0xc
ret 4
Function at 0x422800
Capabilities:
Resume thread

Disassembly:
push esi
push str.CUSBDevicePNPDialog::CreatePNPFinishEventWaitThread___n
push 2
push 0x519518
mov esi, ecx
call fcn.00402450
mov eax, dword [esi + 0x668]
add esp, 0xc
test eax, eax
je 0x42289f
push 0
push 4
push 0
push 0
push esi
push 0x422440
call fcn.0045a1d8
mov dword [esi + 0x468], eax
test eax, eax
jne 0x422859
push str.AfxBeginThread_returned_NULL_for__waitForEventThread
push 8
push 0x519518
call fcn.00402450
add esp, 0xc
mov eax, 0x5a4
pop esi
ret
mov dword [eax + 0x28], 0
mov esi, dword [esi + 0x468]
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x42289f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str._waitForEventThread__ResumeThread___returned__1__error___d
push 8
push 0x519518
call fcn.00402450
add esp, 0x10
mov eax, 0x80004005
test esi, esi
je 0x4228b6
mov eax, esi
pop esi
ret
push str.CUSBDevicePNPDialog::CreatePNPFinishEventWaitThread___n
push 4
push 0x519518
call fcn.00402450
add esp, 0xc
or eax, 0xffffffff
pop esi
ret
Function at 0x422f20
Capabilities:
Check for time delay via gettickcount
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c9db8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x48]
lea ebp, [esi + 8]
call ebx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1c], al
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004409bb
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x422f9a
lea eax, [esp + 0x1c]
push eax
push str.Before_call_to_SetupDiCallClassInstaller_for__s_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0x10
push ebp
push edi
push 5
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
mov esi, eax
push esi
push str.Called_SetupDiCallClassInstaller___result_was__d_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0x10
call fcn.0043fb48
mov eax, dword [0x5298c0]
test eax, eax
je 0x422fe5
push 0x2710
call eax
push eax
push str.After_call_to_CMP_WaitNoPendingInstallEvents___error_was__d_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0x10
call ebx
sub eax, dword [esp + 0x14]
cmp eax, 0x64
jae 0x423024
push str.GetTickCount___t_100_so_sleep_for_1_seconds__n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x423034
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x42303c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x1c]
mov edi, 0x10
cmp dword [esp + 0x30], edi
jae 0x42304f
lea eax, [esp + 0x1c]
push esi
push eax
push str.Deleted_DeviceID_s___error_was__d_n_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0x14
cmp dword [esp + 0x30], edi
jb 0x423078
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004462ff
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004974ba
add esp, 0x30
ret 8
Function at 0x427ce0
Capabilities:
Check os version

Disassembly:
cmp dword [0x529368], 0
jne 0x427d95
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov edi, 0x529368
push edi
mov dword [0x529368], 0x9c
call esi
test eax, eax
jne 0x427d18
push edi
mov dword [0x529368], 0x94
call esi
push 0x4d6f18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x427d50
push str.IsWow64Process
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x427d49
push 0x529364
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x52936c]
mov cl, byte [0x529402]
push 2
pop edx
pop edi
pop esi
cmp eax, 5
jne 0x427d7c
cmp dword [0x529370], edx
jne 0x427d95
cmp cl, 1
jne 0x427d95
mov dword [0x529370], 1
cmp eax, 6
jne 0x427d95
cmp dword [0x529370], 0
jne 0x427d95
cmp cl, 1
je 0x427d95
mov dword [0x529370], edx
ret

Function at 0x429dba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, eax
push esi
shr eax, 4
push edi
push dword [esp + 0x14]
and ebx, 0xf
inc eax
movzx eax, ax
push eax
push 6
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x429e16
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x429e16
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x429e16
mov edi, eax
xor ecx, ecx
movzx eax, word [edi]
inc edi
inc edi
test ax, ax
je 0x429e10
movzx esi, ax
cmp ecx, ebx
je 0x429e1c
lea edi, [edi + esi*2]
inc ecx
cmp ecx, 0x10
jl 0x429dfc
xor eax, eax
pop edi
pop esi
pop ebx
ret
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044630a
pop ecx
mov ebx, eax
test ebx, ebx
je 0x429e4f
push esi
push edi
lea eax, [esi + 1]
push eax
push ebx
call fcn.0049b499
add esp, 0x10
xor eax, eax
mov word [ebx + esi*2], ax
mov eax, ebx
jmp 0x429e18
Function at 0x42e640
Capabilities:
Get common file path

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x42e699
call fcn.004280af
test eax, eax
jne 0x42e699
push edi
push eax
push eax
push 0x8023
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x42e699
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42e67a
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.00410cf0
mov dword [esp], str.HPInstaller_
push dword [esp + 0x10]
push edi
call fcn.00498c94
add esp, 0xc
xor eax, eax
inc eax
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x42e69d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x42e6ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00429311
push eax
push str.GetFileVersionInfoSize_failed_with__s_n
push 0x80
push 0x519518
call fcn.00402450
add esp, 0x14
xor eax, eax
xor edx, edx
jmp 0x42e7ae
push eax
call fcn.0044630a
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x42e70d
push str.Can_not_allocate_memory._n
push 0x519518
call fcn.00426fe1
pop ecx
pop ecx
jmp 0x42e6e3
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42e744
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00429311
push eax
push str.GetFileVersionInfo_failed_with__s_n
push 0x519518
call fcn.00426fe1
push dword [ebp - 4]
call fcn.00446315
jmp 0x42e6e0
push ebx
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4d5334
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42e784
cmp dword [ebp - 0xc], esi
je 0x42e784
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edi
xor edi, edi
xor ecx, ecx
push ebx
or edi, eax
or esi, ecx
call fcn.00446315
pop ecx
mov eax, edi
mov edx, esi
pop edi
jmp 0x42e7ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00429311
push eax
push str.VerQueryValue_failed_with__s_n
push 0x519518
call fcn.00426fe1
push ebx
call fcn.00446315
add esp, 0x14
xor eax, eax
xor edx, edx
pop ebx
pop esi
leave
ret