joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f41a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [eax]
push ebx
push esi
push edi
sub eax, 0x10
call fcn.00409bcb
mov edi, eax
add edi, 0x10
xor ebx, ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
jmp 0x40f4bc
mov ecx, dword [edi - 0xc]
lea eax, [esp + 0x14]
lea edx, [esi + 1]
push eax
sub ecx, edx
lea eax, [esp + 0x10]
call fcn.00408be5
mov eax, dword [edi - 0xc]
sub eax, esi
push esi
lea ecx, [esp + 0x10]
call fcn.0040881c
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push edi
push 0x80000001
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [esp + 0x18], ebx
je 0x40f4d3
mov esi, dword [esp + 0x14]
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40f4dc
inc dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
je 0x40f4b4
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebx
lea eax, [esi - 0x10]
call fcn.004045dc
push 0x5c
lea esi, [esp + 0x10]
call fcn.00408b4f
mov esi, eax
cmp esi, ebx
jge 0x40f441
jmp 0x40f4f8
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
jmp 0x40f4f3
cmp dword [esp + 0x18], ebx
je 0x40f4f0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebx
lea eax, [esi - 0x10]
call fcn.004045dc
lea eax, [edi - 0x10]
call fcn.004045dc
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f70e
Capabilities:
Get file size

Disassembly:
mov eax, dword [eax]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f73d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40f755
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test esi, esi
je 0x40f753
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x40f8c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0x64], 0x44
call fcn.004315c0
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], bl
cmp byte [ebp + 0x18], bl
je 0x40f903
lea esi, [ebp - 0xc]
call fcn.00422303
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [edx - 0xc]
neg ecx
sbb ecx, ecx
and ecx, edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x64]
push edx
push ebx
push ebx
push dword [ebp + 0x14]
push ebx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40f94a
lea esi, [ebp - 0xc]
call fcn.004222e7
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
cmp dword [ebp + 0x10], ebx
je 0x40f966
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x40f93b

Function at 0x40f973
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push edi
push 0x38
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.004315c0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x400
cmp dword [ebp + 0xc], ebx
je 0x40f9a8
mov dword [ebp - 0x38], 0x440
push esi
mov esi, dword [edi]
push edi
call fcn.0040a456
pop ecx
test al, al
je 0x40f9b9
add esi, 8
xor eax, eax
cmp byte [ebp + 0x10], bl
mov dword [ebp - 0x2c], esi
sete al
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
je 0x40f9db
mov dword [ebp - 0x28], eax
mov eax, edi
lea edi, [ebp + 0x10]
call fcn.00409e5a
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
mov esi, edi
call fcn.0040a456
pop ecx
test al, al
je 0x40f9fb
lea esi, [edi + 8]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
jne 0x40fa1b
lea eax, [edi - 0x10]
call fcn.004045dc
pop edi
mov al, bl
pop ebx
leave
ret
cmp dword [ebp + 0xc], ebx
je 0x40fa3c
cmp dword [ebp - 4], ebx
je 0x40fa4a
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], ebx
je 0x40fa4a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x40fa0d
Function at 0x40fce0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
push 8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40fd1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40fddf
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x18], ebx
call esi
cmp eax, ebx
jne 0x40fd66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40fdd2
push dword [ebp - 0x18]
call fcn.004315aa
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push edi
push 1
push dword [ebp - 0x14]
call esi
cmp eax, ebx
je 0x40fdd2
cmp dword [ebp - 0x18], ebx
je 0x40fdd2
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40fdd8
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x1c]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push edi
call fcn.004315b5
cmp dword [ebp - 0x14], 0
pop ecx
je 0x40fdce
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x40fdef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call fcn.004315b5
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x40fded
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043159b
leave
ret

Function at 0x40fdfe
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40fe25
push eax
jmp 0x40fe5f
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40fe56
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp + 8]
je 0x40fe74
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40fe3e
test esi, esi
je 0x40fe65
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043159b
leave
ret
push edi
mov edi, dword [ebp - 0x228]
test esi, esi
je 0x40fe86
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
jmp 0x40fe67
Function at 0x41017c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
mov dword [ebp - 0x414], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 0x410]
push ecx
mov edi, 0x3ff
push edi
lea ecx, [ebp - 0x40c]
push ecx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x410], ebx
push eax
jmp 0x410215
mov eax, dword [ebp - 0x410]
mov byte [ebp + eax - 0x40c], bl
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x414]
call fcn.0040aa6d
push ebx
lea eax, [ebp - 0x410]
push eax
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x41c]
call esi
cmp dword [ebp - 0x410], ebx
jne 0x4101e0
mov edi, dword [ebp - 0x414]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x410252
lea ecx, [eax - 2]
lea edx, [ebp - 0x414]
mov eax, edi
call fcn.00408c5c
call fcn.004087db
mov eax, dword [ebp - 0x414]
add eax, 0xfffffff0
call fcn.004045dc
cmp dword [ebp - 0x41c], ebx
je 0x410266
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043159b
leave
ret
Function at 0x410db9
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov ebx, eax
push 0x44ccd4
lea eax, [ebp - 4]
call fcn.004044e8
lea esi, [ebx + 0x20]
mov edx, esi
lea ecx, [ebp - 4]
call fcn.0040a189
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 4]
call fcn.0041ab34
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], 0
pop ecx
je 0x410e26
mov esi, dword [esi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
lea eax, [edi - 0x10]
call fcn.004045dc
mov al, bl
jmp 0x410ec9
push 0x459f04
mov eax, ebx
lea edi, [ebp - 0x90]
call fcn.004238bf
push esi
lea eax, [ebx + 8]
push eax
mov ecx, edi
call fcn.004239cb
mov esi, eax
mov eax, dword [ebx + 4]
cmp byte [eax + 0x39], 0
je 0x410e5b
call fcn.00405eeb
mov edi, dword [ebp - 4]
xor bl, bl
jmp 0x410e17
test esi, esi
je 0x410eae
cmp byte [0x45aed4], 0
je 0x410eae
push esi
lea eax, [ebp - 0xc]
call fcn.004204b9
pop ecx
push dword [eax]
lea eax, [ebp - 8]
push str.Downloading_of_updates_failed._Error:
call fcn.00416bf9
push eax
call fcn.00416c0a
push eax
call fcn.00416c0a
push eax
mov eax, 0x45aea4
call fcn.00415f87
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.004045dc
lea edi, [ebp - 0x90]
call fcn.00405eeb
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
test esi, esi
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41363a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x60]
push ebx
push esi
sub eax, 0x10
call fcn.00409bcb
add eax, 0x10
lea ebx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.0040f015
mov eax, dword [0x45a180]
mov esi, 0x45a180
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00404304
mov eax, dword [0x45a180]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [ebp - 8]
add eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp + 8]
push esi
push dword [ebp - 4]
push eax
call fcn.00409682
xor ebx, ebx
add esp, 0x10
cmp byte [0x45aed4], bl
je 0x4136d7
push dword [ebp + 8]
lea eax, [ebp + 0xc]
call fcn.00416bf9
push eax
call fcn.00416c0a
push eax
mov eax, 0x45aea4
call fcn.00415f87
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004045dc
cmp byte [edi + 0x10], bl
je 0x4136e7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x413702
mov eax, dword [edi]
call fcn.0041575c
mov eax, dword [edi]
push ebx
call fcn.00415635
push 0x30
push eax
lea eax, [ebp + 8]
push eax
call fcn.004156aa
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
lea eax, [esi - 0x10]
call fcn.004045dc
pop esi
pop ebx
leave
ret 8
Function at 0x416067
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push edi
lea ebx, [eax + 0x28]
xor edi, edi
mov dword [ebp - 0x80], eax
cmp dword [ebx], edi
jne 0x4161bb
push esi
lea esi, [eax + 0x20]
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jne 0x4160e9
push 0x208
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x74], cx
lea eax, [ebp - 0x74]
push eax
push esi
call fcn.004044c5
push 0x2e
call fcn.00408b4f
mov ecx, eax
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
sub eax, ecx
push ecx
mov ecx, esi
call fcn.0040881c
push str..log
push esi
call fcn.004020a2
mov esi, dword [esi]
push edi
push 0x80
push 4
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, ebx
call fcn.00408d3b
cmp dword [ebx], 0xffffffff
je 0x4161aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416136
mov eax, dword [ebx]
test eax, eax
je 0x416167
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x416167
test eax, eax
jne 0x4161aa
mov eax, dword [ebx]
test eax, eax
je 0x4161aa
push 2
pop ecx
push 0
lea edx, [ebp - 0x78]
push edx
push ecx
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x7c], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebx], 0
je 0x4161ba
mov edi, dword [ebp - 0x80]
lea eax, [edi + 0x24]
mov esi, edi
call fcn.004161d4
mov eax, dword [0x45a180]
mov ecx, 0x45a180
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0x78]
mov dword [ebp - 0x78], eax
call fcn.004161f9
mov eax, esi
mov esi, edi
call fcn.004161d4
mov eax, dword [ebp - 0x78]
add eax, 0xfffffff0
call fcn.004045dc
jmp 0x4161ba
mov eax, dword [ebx]
test eax, eax
je 0x4161ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx], 0
pop esi
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043159b
add ebp, 0x198
leave
ret 4

Function at 0x4161d4
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ecx
ret
Function at 0x416b29
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
call fcn.0040ee83
test al, al
jne 0x416be1
push str.ProgramFilesFolder
push edi
call fcn.00408f22
mov esi, str.AppDataFolder
test eax, eax
je 0x416b82
push str.ProgramFiles
push edi
call fcn.00415554
pop ecx
pop ecx
test al, al
jne 0x416b82
push esi
push edi
call fcn.00408f22
test eax, eax
jne 0x416be1
push esi
push edi
call fcn.00408f22
neg eax
sbb al, al
inc al
push 0
pop eax
mov word [ebp - 0x7c], ax
mov eax, str.APPDATA
jne 0x416ba2
mov eax, str.PROGRAMFILES
push 0x104
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jbe 0x416bc1
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x7c], ax
inc esi
xor eax, eax
mov word [ebp + esi*2 - 0x7c], ax
cmp word [ebp - 0x7c], ax
je 0x416bd8
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.004044c5
xor eax, eax
test esi, esi
setne al
jmp 0x416be3
xor al, al
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.0043159b
add ebp, 0x190
leave
ret

Function at 0x416de2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x45aed4], 0
push esi
mov esi, eax
je 0x416e19
push dword [esi]
lea eax, [ebp - 4]
call fcn.00416bf9
push eax
call fcn.00416c0a
push eax
mov eax, 0x45aea4
call fcn.00415f87
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
cmp byte [0x4595a4], 0
je 0x416e7d
cmp byte [ebp + 8], 0
push edi
push 0x10
pop edi
je 0x416e31
mov edi, 0x40010
push dword [esi]
lea eax, [ebp - 4]
call fcn.004044e8
mov eax, dword [0x45a180]
mov ecx, 0x45a180
call dword [eax + 0xc]
mov esi, eax
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
add esi, 0x10
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
call fcn.00410a09
add esp, 0xc
lea eax, [esi - 0x10]
call fcn.004045dc
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
pop edi
jmp 0x416e85
push dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
leave
ret

Function at 0x41764e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
push esi
add ebx, 0x18
mov eax, dword [ebx]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [eax - 0xc], edi
je 0x417676
lea esi, [ebp - 0xc]
call fcn.004095a0
xor esi, esi
cmp dword [ebp - 8], edi
jle 0x41769b
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.00409616
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
cmp esi, dword [ebp - 8]
jl 0x41767d
lea esi, [ebp - 0xc]
call fcn.00408d52
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417a86
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, eax
mov eax, dword [0x45a180]
mov esi, 0x45a180
push edi
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x45a180]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x45a180]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebx + 0x14]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0040bc48
lea eax, [ebp - 4]
lea edi, [ebp - 0xc]
call fcn.004087db
push 0x452d9c
xor ecx, ecx
lea esi, [ebp - 4]
call fcn.00408b1e
test eax, eax
jne 0x417b01
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov eax, edi
push eax
call fcn.004044c5
push 0x44b8b0
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00408c92
pop ecx
lea ecx, [ebp + 0xc]
call fcn.00408cc4
mov eax, dword [ebp - 0x10]
pop ecx
add eax, 0xfffffff0
call fcn.004045dc
push 0
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0040a62d
add esp, 0xc
push str.instname_target.msi
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x10]
lea esi, [ebx + 0x18]
call fcn.00408cc4
pop ecx
mov edi, esi
call fcn.004087db
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004045dc
push str.instname_custom.mst
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x10]
lea edi, [ebx + 0x1c]
call fcn.00408cc4
pop ecx
call fcn.004087db
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [esi]
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x417ba4
mov esi, dword [ebp + 8]
mov ecx, 0x45a180
call fcn.004045c1
jmp 0x417bfc
push 0x44bd38
lea eax, [ebp - 0x10]
call fcn.004044e8
add ebx, 0x10
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00418017
mov bl, al
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004045dc
test bl, bl
je 0x417bea
push edi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.00417eb9
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [edi]
sub eax, 0x10
call fcn.00409bcb
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.004045dc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4187a3
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x128]
sub esp, 0x1a8
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp + 0x124], eax
mov eax, dword [ebp + 0x130]
push ebx
push esi
xor ebx, ebx
push ebx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4187f6
xor al, al
jmp 0x41890c
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
cmp ecx, 0x4f
mov dword [ebp - 0x78], eax
jle 0x41880d
lea eax, [eax + ecx*2 - 0x9e]
mov dword [ebp - 0x78], eax
push edi
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x80], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
jne 0x41883c
cmp dword [ebp - 0x80], 0xc8
jbe 0x4188fb
mov eax, dword [0x45a180]
mov ecx, 0x45a180
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
je 0x4188a2
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jge 0x41886a
push 0x80070057
call fcn.0040459d
cmp word [eax], 0x22
je 0x4188a2
push 0x20
xor ecx, ecx
call fcn.00408af4
cmp eax, 0xffffffff
je 0x4188a2
push 0x22
lea eax, [ebp - 0x70]
call fcn.00409a8e
mov esi, dword [esi]
push dword [esi - 0xc]
lea eax, [ebp - 0x70]
push esi
call fcn.00402288
push 0x22
lea eax, [ebp - 0x70]
call fcn.00409a8e
jmp 0x4188ac
mov eax, esi
lea edi, [ebp - 0x70]
call fcn.004087db
mov esi, dword [ebp - 0x7c]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
je 0x4188ca
jl 0x418860
cmp word [eax], 0x20
je 0x4188ca
push 0x20
lea eax, [ebp - 0x70]
call fcn.00409a8e
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x70]
call fcn.00402288
mov esi, dword [ebp - 0x70]
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push ebx
push dword [ebp - 0x78]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.004045dc
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, ebx
sete al
pop edi
mov ecx, dword [ebp + 0x124]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043159b
add ebp, 0x128
leave
ret