joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
mov eax, dword [0x828208]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], edx
push 0x2c03f1f
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0
mov dword [esi + 0x48], eax
lea eax, [esp + 0x30]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x409632
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
mov dword [esp + 0x30], eax
call esi
push 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 0
call esi
mov dword [esp + 0x38], eax
jmp 0x409636
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, 0x55555556
imul ecx
mov eax, 0x66666667
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
imul ebp
mov eax, ecx
sar edx, 1
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cdq
sub eax, edx
mov edi, eax
mov eax, ebp
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x30]
add edi, dword [esp + 0x2c]
push 0
cdq
sub eax, edx
push 0
mov esi, eax
mov eax, ebx
push 0
push 0
cdq
push ebx
sub eax, edx
sar esi, 1
push ebp
sar eax, 1
sub esi, eax
add esi, dword [esp + 0x48]
push esi
push edi
push 0xc00000
push dword [esp + 0x38]
push str.UiCanvasClass
push 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebp, dword [esp + 0x18]
mov dword [ebp + 0x40], eax
test eax, eax
je 0x40977a
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x28]
mov eax, 0x55555556
mov ebx, dword [esp + 0x20]
mov ecx, esi
sub ecx, ebx
imul ecx
mov eax, dword [esp + 0x24]
push 0
push 0
mov edi, edx
push 0
push dword [ebp + 0x40]
shr edi, 0x1f
add edi, edx
lea ecx, [edi + edi]
sub esi, ecx
sub eax, ecx
mov ecx, dword [esp + 0x2c]
sub esi, ebx
push esi
sub eax, ecx
push eax
lea eax, [ebx + edi]
push eax
lea eax, [ecx + edi]
push eax
push 0x40800000
push 0x4da4c2
push str.UiProgressClass
push 0x20000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp + 0x44], eax
test eax, eax
je 0x40977a
push ebp
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea esi, [ebp + 0x20]
push esi
push dword [ebp + 0x44]
call dword [sym.imp.USER32.dll_GetClientRect]
add dword [esi], 2
add dword [ebp + 0x24], 2
add dword [ebp + 0x28], 0xfffffffe
add dword [ebp + 0x2c], 0xfffffffe
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [ebp + 0x40]
call esi
push 1
push dword [ebp + 0x44]
call esi
push dword [ebp + 0x40]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
call esi
push dword [ebp + 0x44]
call esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048980e
add esp, 0x34
ret
Function at 0x40a110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a170
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a170
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40a162
nop word [eax + eax]
cmp esi, edx
jae 0x40a170
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40a150
cmp esi, edx
jae 0x40a170
cmp word [esi], 0
je 0x40a170
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40ab20
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x828208]
xor eax, esp
mov dword [esp + 0x10], eax
cmp byte [0x848ae9], 0
push esi
je 0x40abdc
cmp dword [0x828d20], 0xffffffff
je 0x40abdc
push str.GlobalDELL_BIOS_FLASH_LOGGING_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
movzx ecx, byte [0x848ae9]
mov esi, eax
xor eax, eax
test esi, esi
push 0xffffffffffffffff
cmove ecx, eax
push esi
mov byte [0x848ae9], cl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40abd5
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x10]
push eax
movzx eax, word [esp + 0x12]
push eax
movzx eax, word [esp + 0x14]
push eax
movzx eax, word [esp + 0x10]
push eax
movzx eax, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1a]
push eax
push str.BIOS_flash_finished_at__d__d__d_at__d:_02d:_02d_n_n
push 0x848ae0
call fcn.0040abf0
add esp, 0x20
push dword [0x828d20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x828d20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.0048980e
add esp, 0x18
ret
Function at 0x40abf0
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1014
call fcn.0048a3a0
mov eax, dword [0x828208]
xor eax, esp
mov dword [esp + 0x1010], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], ebx
push esi
push edi
test ebx, ebx
je 0x40ad9c
mov al, byte [ebx + 9]
mov cl, al
test al, al
je 0x40acf1
cmp byte [ebx + 0x49], 0
je 0x40acf1
cmp byte [0x875c2a], 0
jne 0x40acf1
cmp dword [0x828d20], 0xffffffff
je 0x40acf1
push 0x867ae0
mov byte [0x875c2a], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [0x867ae0]
sub ecx, dword [0x8489d0]
mov eax, dword [0x867ae4]
sbb eax, dword [0x8489d4]
push 0
push 0x3e8
push eax
push ecx
call fcn.004b8690
push dword [0x8489dc]
push dword [0x8489d8]
push edx
push eax
call fcn.004b8970
push 0
push 0x3e8
mov ebx, edx
mov dword [esp + 0x18], eax
push ebx
push eax
call fcn.0048a3d0
mov esi, edx
mov edi, eax
mov ecx, 0x3e8
mov eax, esi
mul ecx
mov edx, 0x3e8
mov ecx, eax
mov eax, edi
mul edx
add ecx, edx
mov edx, dword [esp + 0x10]
sub edx, eax
sbb ebx, ecx
push ebx
mov ebx, dword [esp + 0x18]
push edx
push esi
push edi
push str.__d._03ds_
push ebx
call fcn.0040abf0
mov cl, byte [ebx + 9]
add esp, 0x18
mov byte [0x875c2a], 0
test cl, cl
je 0x40ad9c
cmp dword [0x828d20], 0xffffffff
je 0x40ad9c
push str.GlobalDELL_BIOS_FLASH_LOGGING_MUTEX
push 0
push 0x1f0001
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edi, eax
test edi, edi
jne 0x40ad29
mov byte [ebx + 9], al
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ad98
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040a090
lea esi, [esp + 0x1c]
add esp, 4
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40ad50
push 0
lea eax, [esp + 0x14]
sub esi, ecx
push eax
push esi
lea eax, [esp + 0x24]
push eax
push dword [0x828d20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ad98
cmp dword [esp + 0x10], esi
jne 0x40ad98
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.0048980e
mov esp, ebp
pop ebp
ret
mov byte [ebx + 9], 0
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048980e
mov esp, ebp
pop ebp
ret
Function at 0x40ae50
Capabilities:
Access the windows event log

Disassembly:
sub esp, 8
cmp byte [0x848ae0], 0
push esi
mov esi, edx
je 0x40b03d
push ebx
push ebp
push edi
push 0x4db464
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push dword [0x4db780]
mov dword [esp + 0x1c], eax
push 0x875af0
call ebp
add esp, 0xc
xor ecx, ecx
mov al, byte [ecx + 0x875af0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x87288f], al
test al, al
jne 0x40ae90
push 0x8487d0
push dword [0x4db784]
push 0x875af0
call ebp
mov edx, 0x875af0
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40aec0
mov ebx, 0x872890
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40aed1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x24], al
je 0x40af79
push 0x86c004
push dword [0x4db788]
push 0x875af0
call ebp
mov edx, 0x875af0
add esp, 0xc
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40af10
sub edx, esi
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40af20
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x86c004
push 0x84ae34
push dword [0x4db78c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x875af0
call ebp
mov edx, 0x875af0
add esp, 0x10
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40af57
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40af63
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x848aec]
push dword [0x4db790]
push 0x875af0
call ebp
mov edx, 0x875af0
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40af96
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40afa2
movzx eax, word [esp + 0x1c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push dword [0x4db794]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x875af0
call ebp
mov edx, 0x875af0
add esp, 0x10
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40afd6
sub edx, esi
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x40afe0
mov ecx, edx
mov dword [esp + 0x10], 0x872890
shr ecx, 2
lea eax, [esp + 0x10]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0
push eax
push 0
mov ecx, edx
mov eax, 1
and ecx, 3
cmp word [esp + 0x28], 0
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x24]
mov ecx, 4
push 0
push 0
cmove eax, ecx
push 0
movzx eax, ax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x417760
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x34c
mov eax, dword [0x828208]
xor eax, esp
mov dword [esp + 0x344], eax
push ebx
push ebp
push esi
push edi
push 0x4dd128
mov esi, ecx
lea eax, [esp + 0x254]
push esi
push 0x4dad74
push eax
call fcn.00402130
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41787a
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
lea eax, [esp + 0x3c]
push eax
push esi
lea eax, [esp + 0x158]
push 0x4dad74
push eax
call fcn.00402130
add esp, 0x10
cmp dword [esp + 0x10], 0x10
jne 0x417859
mov ecx, 0x4dc178
lea eax, [esp + 0x3c]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x417810
test dl, dl
je 0x41780c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x417810
add eax, 2
add ecx, 2
test dl, dl
jne 0x4177f0
xor eax, eax
jmp 0x417815
sbb eax, eax
or eax, 1
test eax, eax
je 0x417863
mov eax, 0x4dd12c
lea ecx, [esp + 0x3c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417842
test dl, dl
je 0x41783e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417842
add ecx, 2
add eax, 2
test dl, dl
jne 0x417822
xor eax, eax
jmp 0x417847
sbb eax, eax
or eax, 1
test eax, eax
je 0x417863
lea ecx, [esp + 0x150]
call fcn.00417760
jmp 0x417863
lea eax, [esp + 0x150]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push edi
call ebp
test eax, eax
jne 0x4177c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x354]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048980e
add esp, 0x34c
ret
Function at 0x41ee10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9688
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x828208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x4d1128
push 1
push 0
push 0x4d1138
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x41ee9b
mov eax, dword [ebp - 0x10]
push edi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
js 0x41ee9b
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41eeaf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422040
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalSALOMON_DOCK_MUL_INSTANCE_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x86c1b0], eax
test eax, eax
je 0x422076
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x86c1b0]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [0x86c1b0], ecx
mov eax, ecx
ret
Function at 0x42c870
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x14]
push eax
push dword [esp + 0x20]
mov eax, dword [esi + 8]
push ebp
push esi
call eax
add esp, 0x10
test eax, eax
jne 0x42c90c
push ebx
mov ecx, 0x4000
push edi
nop dword [eax]
mov eax, dword [esp + 0x18]
mov edi, ebp
mov ebx, dword [esp + 0x10]
mov eax, dword [eax]
test ebx, ebx
je 0x42c8e8
cmp ebx, 0x4000
mov esi, ebx
cmova esi, ecx
xor edx, edx
test esi, esi
jle 0x42c8de
movzx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x8306a8]
cmp edx, esi
jl 0x42c8c1
mov ecx, 0x4000
add edi, esi
sub ebx, esi
jne 0x42c8b0
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [esi + 8]
push ebp
push esi
call eax
add esp, 0x10
mov ecx, 0x4000
test eax, eax
je 0x42c8a0
pop edi
pop ebx
xor ecx, ecx
cmp eax, 1
pop esi
cmove eax, ecx
pop ebp
pop ecx
ret

Function at 0x42c920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x8306a0], 0
jne 0x42c96f
push ebx
push esi
push edi
xor ebx, ebx
nop
xor eax, eax
mov esi, ebx
mov edi, 8
nop dword [eax]
mov edx, eax
mov ecx, esi
shr edx, 1
xor ecx, eax
mov eax, edx
dec edi
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sar esi, 1
test edi, edi
jg 0x42c940
mov dword [ebx*4 + 0x8306a8], eax
inc ebx
cmp ebx, 0x100
jl 0x42c930
pop edi
pop esi
pop ebx
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
ret

Function at 0x42c980
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [ebp]
test ebx, ebx
je 0x42c9d5
mov ecx, 0x4000
push esi
nop dword [eax]
cmp ebx, 0x4000
mov esi, ebx
cmova esi, ecx
xor edx, edx
test esi, esi
jle 0x42c9ce
movzx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x8306a8]
cmp edx, esi
jl 0x42c9b1
mov ecx, 0x4000
add edi, esi
sub ebx, esi
jne 0x42c9a0
pop esi
pop edi
mov dword [ebp], eax
pop ebp
pop ebx
ret
Function at 0x42d970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0042e7a0
test eax, eax
je 0x42dabd
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0048ff50
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.0042ef50
add esp, 8
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0042e800
add esp, 8
test eax, eax
je 0x42daaa
push 0x44
push 0
lea eax, [ebp - 0x15c]
push eax
call fcn.0048ff50
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x15c], 0x44
push str.C9632CF058AE4321B6B0B5EA39B710FE
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0049cd97
add esp, 0xc
push 0x4c17c8
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0049cd97
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x15c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42da97
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42daa8
call fcn.0042eac0
call fcn.0042e9f0
mov eax, 3
jmp 0x42dace
jmp 0x42dabb
call fcn.0042eac0
call fcn.0042e9f0
mov eax, 3
jmp 0x42dace
jmp 0x42dac2
call fcn.00430060
call fcn.0042eac0
call fcn.0042e9f0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret

Function at 0x42e800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x42e810
cmp dword [ebp + 0xc], 0
jne 0x42e817
xor eax, eax
jmp 0x42e8d9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4c14c4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e844
mov dword [0x830ad0], 6
xor eax, eax
jmp 0x42e8d9
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x42e863
cmp dword [ebp - 4], 0x104
jae 0x42e863
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 1]
cmp eax, 0x5c
je 0x42e884
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x4c14cc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049cd97
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x4c14d4
call fcn.0042d470
add esp, 8
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42e8e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x42e8f0
cmp dword [ebp + 0xc], 0
jne 0x42e8f7
xor eax, eax
jmp 0x42e9ba
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4c14dc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e924
mov dword [0x830ad0], 6
xor eax, eax
jmp 0x42e9ba
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x42e943
cmp dword [ebp - 4], 0x104
jae 0x42e943
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 1]
cmp eax, 0x5c
je 0x42e964
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x4c14e4
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0049cd97
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4c14f4
call fcn.0042d470
add esp, 8
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0x5c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42e9f0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0048ff50
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0048ff50
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.0042e800
add esp, 8
test eax, eax
je 0x42eaa0
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42ea7a
push 0xff
push 0x4c1570
call fcn.00422a30
add esp, 8
jmp 0x42eaad
push 0x4c1504
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0049cd97
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret
Function at 0x42eac0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0048ff50
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0048ff50
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.0042e8e0
add esp, 8
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42eb49
push 0xff
push 0x4c1588
call fcn.00422a30
add esp, 8
jmp 0x42ec8d
push str.DBUtilDrv2.Sys
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0049cd97
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42eba5
push 0xff
push 0x4c15a0
call fcn.00422a30
add esp, 8
jmp 0x42ec8d
push str.DBUtilDrv2.inf
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0049cd97
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42ec01
push 0xff
push 0x4c15b8
call fcn.00422a30
add esp, 8
jmp 0x42ec8d
push str.DBUtilDrv2.cat
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.0049cd97
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42ec5a
push 0xff
push 0x4c15d0
call fcn.00422a30
add esp, 8
jmp 0x42ec8d
push str.WdfCoinstaller01009.dll
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0049cd97
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret
Function at 0x42eca0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042d470
add esp, 8
add eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00499bf8
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42ece0
mov eax, 1
jmp 0x42ed83
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042e700
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00499884
add esp, 0xc
test eax, eax
je 0x42ed3a
push 0xff
push 0x4c15e8
call fcn.00422a30
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.00499bdd
add esp, 4
mov dword [ebp - 4], 0
mov eax, 0xff
jmp 0x42ed83
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov ecx, 0x414
mov word [ebp - 0x1c], cx
mov dword [ebp - 0x1a], 0
mov dword [ebp - 0x16], 0
mov dword [ebp - 0x12], 0x4c14a1
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret