joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41568c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xcc
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00413fdb
push 0x40
mov dword [ebp + 0x54], eax
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00450020
mov dword [ebp + 0x44], esi
xor eax, eax
lea edi, [ebp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x477808
lea ecx, [ebp + 0x58]
stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x44
call fcn.00406c25
xor edi, edi
inc edi
cmp dword [ebp + 0x54], 0x20
jne 0x415745
push str.yydesktopshortcut_x86.exe
push 0x477d7c
push str.7.0.0.1
add ebx, 8
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00406c47
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x58]
call fcn.004067b7
push esi
push edi
lea ecx, [ebp + 0x28]
call fcn.004064d9
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.004064d9
lea ecx, [ebp + 0xc]
jmp 0x4157a7
cmp dword [ebp + 0x54], 0x40
jne 0x4157ae
push str.yydesktopshortcut_x86.exe
push 0x477d7c
push str.7.0.0.1
add ebx, 8
lea eax, [ebp + 0x28]
push ebx
push eax
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00406c47
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x58]
call fcn.004067b7
push esi
push edi
lea ecx, [ebp + 0xc]
call fcn.004064d9
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.004064d9
lea ecx, [ebp + 0x28]
push esi
push edi
call fcn.004064d9
cmp dword [ebp + 0x70], 8
mov eax, dword [ebp + 0x5c]
jae 0x4157ba
lea eax, [ebp + 0x5c]
lea ecx, [ebp + 0x44]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4157e3
push dword [ebp + 0x54]
push str.YYSetupCore::_runLiveShow__CreateProcess_fail._sysBits_d
call fcn.0044f300
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp + 0x58]
call fcn.004064d9
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x78
leave
ret
Function at 0x4157ff
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1ec]
sub esp, 0x26c
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x1e8], eax
push ebx
push esi
mov esi, dword [ebp + 0x1f4]
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x415830
mov eax, dword [edi]
jmp 0x415832
mov eax, edi
push eax
push str.open_url__s
call fcn.0044f300
xor eax, eax
push 0x206
mov word [ebp - 0x20], ax
xor ebx, ebx
lea eax, [ebp - 0x1e]
push ebx
push eax
call fcn.00450020
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x477808
push str.http_shellopencommand
push 0x80000000
mov dword [ebp - 0x44], 0x208
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00406c25
push ebx
mov ebx, str.iexplore.exe
push ebx
lea ecx, [ebp - 0x3c]
call fcn.00414294
cmp eax, 0xffffffff
je 0x4158db
cmp dword [esi + 0x18], 8
jb 0x4158ac
mov eax, dword [edi]
jmp 0x4158ae
mov eax, edi
push eax
push str._IE__open_url__s
call fcn.0044f300
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x4158c3
mov edi, dword [edi]
push 5
push 0x47ad34
push edi
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x415926
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00450020
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x74], str.open
jb 0x41590b
mov eax, dword [edi]
mov dword [ebp - 0x70], eax
jmp 0x41590e
mov dword [ebp - 0x70], edi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x64], 0xa
mov dword [ebp - 0x6c], 0x47ad34
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.004064d9
mov ecx, dword [ebp + 0x1e8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x1ec
leave
ret 4
Function at 0x41594c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push str..lnk
mov edi, 0x477d7c
push edi
push eax
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x298], ecx
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c47
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004064d9
push 0x24c
lea eax, [ebp - 0x288]
push ebx
push eax
mov dword [ebp - 0x28c], ebx
call fcn.00450020
mov eax, dword [ebp - 0x38]
add esp, 0xc
cmp dword [ebp - 0x24], 8
jae 0x4159cd
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x290], eax
cmp eax, 0xffffffff
je 0x415a84
test byte [ebp - 0x28c], 0x10
jne 0x415a5d
lea eax, [ebp - 0x260]
push eax
push edi
push dword [ebp - 0x294]
lea eax, [ebp - 0x2b4]
push eax
call fcn.00406c47
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00406c47
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x2b4]
call fcn.004064d9
cmp dword [esi + 0x18], 8
jb 0x415a36
mov eax, dword [esi + 4]
jmp 0x415a39
lea eax, [esi + 4]
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
jae 0x415a45
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov ecx, dword [ebp - 0x298]
call fcn.00414d18
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004064d9
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4159ea
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004064d9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
leave
ret 8
Function at 0x415c37
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x284
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
xor eax, eax
push 0x208
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x64], ebx
call fcn.00450020
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push str._APPDATA_MicrosoftInternet_ExplorerQuick_Launch
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x415da7
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c25
push str.YY.exe
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00406c47
mov eax, dword [ebp - 0x40]
add esp, 0xc
cmp dword [ebp - 0x2c], 8
jae 0x415cbc
lea eax, [ebp - 0x40]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x415cd9
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.0041594c
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 7
call fcn.004062f0
push str.User_PinnedStartMenu
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406c47
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.004067b7
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.004064d9
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x415d23
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x415d3a
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041594c
push str.User_PinnedTaskBar
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00406c47
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.004067b7
push esi
push ebx
lea ecx, [ebp - 0x80]
call fcn.004064d9
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x415d71
lea eax, [ebp - 0x24]
push eax
call edi
pop edi
test eax, eax
je 0x415d89
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041594c
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004064d9
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.004064d9
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004064d9
mov ecx, dword [ebp + 0x200]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x204
leave
ret
Function at 0x4160c4
Capabilities:
Terminate process

Disassembly:
push 0x47b0e8
push dword [esp + 8]
call fcn.0040985e
pop ecx
pop ecx
test eax, eax
je 0x4160f3
push 0
push 0
push 0x8259
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push str.YYSetupDecompressor::_quitYY__post_message__WM_APP__601__to_YY_for_quit.
call fcn.0044f300
pop ecx
push esi
push dword [esp + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x416118
push str.YYSetupDecompressor::_quitYY__OpenProcess_return_NULL__YY_already_quit.
call fcn.0044f300
pop ecx
jmp 0x41613f
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41613f
push str.YYSetupDecompressor::_quitYY__WaitForSingleObject_time_out__will_terminate_process.
call fcn.0044f300
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret 4

Function at 0x416143
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0x4794f0
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x416168
push str.YYSetupDecompressor::_load7zDataFromResource__Find_resource_yy.7z__fail.
call fcn.0044f300
pop ecx
xor eax, eax
jmp 0x416199
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x416187
push str.YYSetupDecompressor::_load7zDataFromResource__Load_resource_yy.7z__fail.
call fcn.0044f300
pop ecx
xor eax, eax
jmp 0x416198
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x416520
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str..old
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00406c47
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x416552
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x416565
lea eax, [ebp - 0x1c]
cmp dword [esi + 0x18], 8
jb 0x416570
mov esi, dword [esi + 4]
jmp 0x416573
add esi, 4
push eax
push esi
call fcn.0040833d
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004064d9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fa41
leave
ret 4
Function at 0x416870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x228
mov dword [ebp - 0x6b8], eax
xor esi, esi
lea eax, [ebp - 0x280]
push esi
push eax
mov dword [ebp - 0x6b4], ecx
call fcn.00450020
add esp, 0xc
push esi
push 2
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x284]
push ecx
push eax
mov dword [ebp - 0x6b0], eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4169d6
mov edi, str.YY.exe
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x58]
call fcn.00406c25
push edi
lea ecx, [ebp - 0x20]
call fcn.00406c25
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408a8c
pop ecx
pop ecx
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x20]
inc bl
call fcn.004064d9
test bl, bl
je 0x4169af
push 0x424
lea eax, [ebp - 0x6a8]
push esi
push eax
call fcn.00450020
add esp, 0xc
push dword [ebp - 0x27c]
mov dword [ebp - 0x6ac], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x6ac]
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00406c25
mov eax, dword [ebp - 0x6b4]
add eax, 0x2c
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c47
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408a8c
add esp, 0x14
push esi
push 1
test eax, eax
je 0x4169f5
lea ecx, [ebp - 0x3c]
call fcn.004064d9
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.004064d9
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x6b0]
call sub.KERNEL32.dll_Process32NextW
push esi
push 1
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.004064d9
cmp ebx, esi
jne 0x4168de
push dword [ebp - 0x6b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
leave
ret 4
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x6b8]
mov dword [ecx], eax
lea ecx, [ebp - 0x3c]
call fcn.004064d9
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.004064d9
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.004064d9
mov al, 1
jmp 0x4169e4

Function at 0x416a61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
call fcn.00416143
mov edi, eax
test edi, edi
jne 0x416a8b
push str.YYSetupDecompressor::_decompress___load7zDataFromResource_fail.
call fcn.0044f300
pop ecx
xor al, al
jmp 0x416abf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
je 0x416a9b
lea ecx, [esi + 0x24]
jmp 0x416a9d
xor ecx, ecx
push ebx
push ecx
push dword [esi + 0x28]
lea ecx, [esi + 0x2c]
push ecx
push dword [ebp - 4]
push eax
call fcn.004167fe
add esp, 0x14
push edi
mov ecx, esi
mov bl, al
call fcn.0041619d
mov al, bl
pop ebx
pop edi
pop esi
leave
ret
Function at 0x416ac3
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
mov eax, ecx
push edi
lea edi, [eax + 0x2c]
lea eax, [ebp - 0x34]
push edi
push eax
mov dword [ebp - 0x38], edi
call fcn.00409a8e
push str.temp
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406c47
lea eax, [ebp - 0x18]
push eax
call fcn.0040963b
mov eax, dword [ebp - 0x14]
add esp, 0x18
push 8
pop ebx
cmp dword [ebp], ebx
jae 0x416b19
lea eax, [ebp - 0x14]
push eax
push str.YYSetupCore::cleanUpFile__delete_temp_directory__s
call fcn.0044f300
push str.updatefiles
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00406c47
lea eax, [ebp + 4]
push eax
call fcn.0040963b
mov eax, dword [ebp + 8]
add esp, 0x18
cmp dword [ebp + 0x1c], ebx
jae 0x416b4d
lea eax, [ebp + 8]
push eax
mov esi, str.YYSetupCore::cleanUpFile__Delete_temp_directory__s
push esi
call fcn.0044f300
lea eax, [ebp + 0x20]
push edi
push eax
call fcn.00409b2b
lea eax, [ebp + 0x20]
push eax
call fcn.0040963b
mov eax, dword [ebp + 0x24]
add esp, 0x14
cmp dword [ebp + 0x38], ebx
jae 0x416b7a
lea eax, [ebp + 0x24]
push eax
push str.YYSetupCore::cleanUpFile__strUpdateCachePath_s
call fcn.0044f300
push str.oem.txt
lea eax, [ebp + 0x58]
push edi
push eax
call fcn.00406c47
push str.ProductInfo.txt
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00406c47
mov eax, dword [ebp + 0x5c]
add esp, 0x20
cmp dword [ebp + 0x70], ebx
jae 0x416bb4
lea eax, [ebp + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
mov eax, dword [ebp + 0x5c]
cmp dword [ebp + 0x70], ebx
jae 0x416bc8
lea eax, [ebp + 0x5c]
push eax
push esi
call fcn.0044f300
mov eax, dword [ebp + 0x40]
pop ecx
pop ecx
cmp dword [ebp + 0x54], ebx
jae 0x416bdc
lea eax, [ebp + 0x40]
push eax
call edi
mov eax, dword [ebp + 0x40]
cmp dword [ebp + 0x54], ebx
jae 0x416bea
lea eax, [ebp + 0x40]
push eax
push esi
call fcn.0044f300
push dword [ebp - 0x38]
call fcn.0040bbae
push str.YYSetupCore::cleanUpFile__clean_single_directory_old_files.
call fcn.0044f300
push dword [ebp - 0x38]
call fcn.0040c26a
push str.YYSetupCore::cleanUpFile__clean_old_directories_before_install.
call fcn.0044f300
add esp, 0x18
xor edi, edi
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp + 0x3c]
call fcn.004064d9
push edi
push esi
lea ecx, [ebp + 0x58]
call fcn.004064d9
push edi
push esi
lea ecx, [ebp + 0x20]
call fcn.004064d9
push edi
push esi
lea ecx, [ebp + 4]
call fcn.004064d9
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.004064d9
push edi
push esi
lea ecx, [ebp - 0x34]
call fcn.004064d9
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x78
leave
ret
Function at 0x4170e7
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x6a4
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x620], eax
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
cmp dword [eax + 0x40], ebx
je 0x4172e6
cmp dword [eax + 0x44], 8
jb 0x41711d
mov eax, dword [eax + 0x30]
jmp 0x417120
add eax, 0x30
push 0x477d7c
push str.7.0.0.1
push eax
lea ecx, [ebp - 0x54]
call fcn.004098b6
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041639a
add esp, 0xc
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0041639a
mov ecx, dword [ebp - 0x58]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00408309
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
call fcn.00408309
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x3dc]
push ebx
push eax
call fcn.00450020
add esp, 0xc
lea eax, [ebp + 0x3d8]
push eax
push dword [ebp - 0x54]
mov dword [ebp + 0x3d8], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4172d2
mov dword [ebp - 0x64], 0x5c
push 0x424
lea eax, [ebp - 0x4c]
push ebx
push eax
mov dword [ebp - 0x50], ebx
call fcn.00450020
add esp, 0xc
push dword [ebp + 0x3e0]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
mov dword [ebp - 0x50], 0x428
call sub.KERNEL32.dll_Module32FirstW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x1d0]
push eax
lea ecx, [ebp + 0x604]
call fcn.00406c25
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp + 0x604]
call fcn.00414022
cmp eax, 0xffffffff
je 0x4172ab
lea ecx, [ebp - 0x59]
push ecx
inc eax
push eax
push ebx
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp - 0x80]
call fcn.00406a3d
cmp dword [ebp - 0x68], 8
mov eax, dword [ebp - 0x7c]
jae 0x417237
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x58]
call fcn.004098b6
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064d9
push dword [ebp - 0x58]
lea ecx, [ebp - 0x60]
call fcn.004161c5
test eax, eax
jne 0x4172a0
push dword [ebp + 0x3e0]
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x4172a0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 0x1c
push 7
pop ecx
lea esi, [ebp + 0x604]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x417293
push str.Terminate__s_success._n
jmp 0x417298
push str.Terminate__s_fail._n
call fcn.0044f300
add esp, 0x20
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.00408309
lea eax, [ebp + 0x3d8]
push eax
push dword [ebp - 0x54]
call sub.KERNEL32.dll_Process32NextW
push ebx
push 1
lea ecx, [ebp + 0x604]
mov esi, eax
call fcn.004064d9
cmp esi, ebx
jne 0x4171ab
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.00408309
mov ecx, dword [ebp + 0x620]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x624
leave
ret
Function at 0x41745f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push str.YYSetupDecompressor::_syncDecompress_begin__silence_model_.
mov esi, ecx
call fcn.0044f300
and dword [ebp - 8], 0
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00416870
test al, al
je 0x41749a
push str.YYSetupDecompressor::_syncDecompress___isYYRunning_return_true.
call fcn.0044f300
pop ecx
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x4174f5
push edi
mov ecx, esi
call fcn.004170e7
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov byte [ebp - 8], 0
call fcn.00416143
mov edi, eax
test edi, edi
je 0x4174e9
mov ecx, esi
call fcn.00416ac3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push dword [esi + 0x28]
lea ecx, [esi + 0x2c]
push ecx
push dword [ebp - 4]
push eax
call fcn.004167fe
add esp, 0x14
push edi
mov ecx, esi
mov byte [ebp - 8], al
call fcn.0041619d
mov ecx, dword [esi + 0x28]
push dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
leave
ret

Function at 0x41794e
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x41987a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x507a98], 0
jne 0x419912
push esi
push 0x503a10
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00450020
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xffffffffffffffff
push eax
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045183e
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00451827
lea eax, [ebp - 0x20c]
push str._disablemempool
push eax
call fcn.00450b8c
add esp, 0x20
pop esi
test eax, eax
je 0x419908
mov byte [0x507a94], 1
mov dword [0x507a98], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044fa41
leave
ret