joyce8/EMBER2024-capa huggingface dataset:
Function at 0x553d80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5b69b4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x553dab
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x553df2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x553df5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x553e56
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x553e20
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x553e8f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x597835
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x597836
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x553e60
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4033bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push eax
mov ebx, ecx
mov dword [ebp - 0x60], esi
call sub.msi.dll_MsiRecordGetInteger
push eax
call fcn.00401516
add esp, 4
cmp eax, 5
jne 0x4033f7
mov al, 1
jmp 0x40355c
push edi
push esi
push 0x43016c
mov ecx, ebx
call fcn.0040176a
push esi
call fcn.00401516
xor eax, eax
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0xb4]
push 0
push eax
call fcn.00407920
add esp, 0x10
push 5
pop eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0x88], 1
mov word [ebp - 0x84], ax
call esi
push 0x4301ac
mov edi, eax
call esi
lea esi, [edi + eax + 2]
push esi
call fcn.00407eaa
pop ecx
push dword [ebp - 0x60]
mov edi, eax
push esi
push edi
call fcn.00401b13
test eax, eax
jl 0x40354b
push 0x4301b4
push esi
push edi
call fcn.00401b8c
test eax, eax
jl 0x40354b
lea eax, [ebp - 0x70]
push eax
xor esi, esi
lea eax, [ebp - 0xb4]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, ebx
test eax, eax
jne 0x4034cc
push edi
push 0x4301bc
call fcn.0040176a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebx + 0x10], eax
call fcn.00407eb5
jmp 0x403558
push dword [ebp - 0x70]
call fcn.004016f0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x55], 1
cmp eax, esi
je 0x4034f8
push edi
push 0x4301e4
mov ecx, ebx
call fcn.0040176a
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0x10], eax
mov byte [ebp - 0x55], 0
jmp 0x403537
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0x10], eax
cmp eax, esi
je 0x40352a
push eax
push 0x430204
lea eax, [ebp - 0x54]
push 0x50
push eax
call fcn.00401bc6
add esp, 0x10
push esi
lea eax, [ebp - 0x54]
push eax
jmp 0x403530
push esi
push 0x43022c
mov ecx, ebx
call fcn.0040176a
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00407eb5
mov al, byte [ebp - 0x55]
jmp 0x40355a
push edi
call fcn.00407eb5
mov dword [ebx + 0x10], 0x643
xor al, al
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 8
Function at 0x40356c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
push 0x430260
mov edi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x4035b8
push 0x430270
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4035a5
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x4035af
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4035c2
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x28]
push eax
call fcn.00401516
add esp, 4
cmp word [ebp - 0x28], 9
jne 0x403617
lea eax, [ebp - 4]
push eax
push 0x4302a0
mov ecx, edi
call fcn.00401d90
mov ecx, edi
test al, al
je 0x4035fb
push dword [ebp - 4]
push 0x4302b8
call fcn.004033bc
jmp 0x403606
push ebx
push 0x4302e0
call fcn.0040176a
cmp dword [ebp - 4], ebx
je 0x403617
push dword [ebp - 4]
call fcn.00407eb5
pop ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x430318
mov ecx, edi
call fcn.00401d90
mov ecx, edi
test al, al
je 0x40363c
push dword [ebp - 4]
push 0x430330
call fcn.004033bc
jmp 0x403647
push ebx
push 0x430358
call fcn.0040176a
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x403658
push dword [ebp - 4]
call fcn.00407eb5
pop ecx
mov al, 1
leave
ret
Function at 0x4045b1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0x431c48
push 0x431c54
mov dword [ebp - 0x40c], edi
call fcn.0040b534
pop ecx
pop ecx
mov dword [edi + 0x34], eax
test eax, eax
jne 0x4045fd
push eax
push str.ERROR:_Could_not_create_temp_file_n
mov ecx, edi
call fcn.00404380
xor eax, eax
jmp 0x4046a8
push ebx
push 0x431cc0
push eax
call fcn.0040b46f
push 0x431cc8
push esi
mov dword [ebp - 0x408], eax
call fcn.0040b46f
add esp, 0x10
cmp dword [ebp - 0x408], 0
mov ebx, eax
je 0x404699
test ebx, ebx
je 0x404687
mov esi, 0x400
jmp 0x40465a
push ebx
call fcn.0040a293
pop ecx
test eax, eax
jne 0x404687
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push edi
push 1
push eax
call fcn.0040a1dd
add esp, 0x10
cmp eax, edi
jne 0x404675
push ebx
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0040a05e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x404633
jmp 0x404687
mov ecx, dword [ebp - 0x40c]
push 0
push str.ERROR:_Could_not_write_all_bytes_to_temp_file_n
call fcn.00404380
push dword [ebp - 0x408]
call fcn.00409d25
mov edi, dword [ebp - 0x40c]
pop ecx
test ebx, ebx
je 0x4046a4
push ebx
call fcn.00409d25
pop ecx
mov eax, dword [edi + 0x34]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004076ca
leave
ret 4
Function at 0x404c0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d06
push 0x20a
call fcn.00407eaa
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
mov edi, str.InstallerLocation
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 0x105
call esi
cmp eax, 0xea
jne 0x404ca5
push ebx
call fcn.00407eb5
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x404d06
cmp dword [ebp - 0xc], 1
jne 0x404d06
cmp dword [ebp - 4], eax
jbe 0x404d06
push 0x43046c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
lea esi, [eax + ecx + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push ebx
mov edi, eax
push esi
push edi
call fcn.0040472b
test eax, eax
jl 0x404d06
push 0x43046c
push esi
push edi
call fcn.004047a6
test eax, eax
jl 0x404d06
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x404d11
push 0x43046c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404eb5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xb4], edi
call fcn.00404d16
mov ebx, eax
mov ecx, esi
test ebx, ebx
jne 0x404efa
push eax
push str.ERROR:_msiexec_not_found_
call fcn.00404380
mov dword [esi + 0x10], 2
jmp 0x4050cf
push ebx
push 0x430eac
call fcn.00404380
push edi
push 0x430ee4
mov ecx, esi
call fcn.00404380
push ebx
call fcn.004040c4
push edi
call fcn.004040c4
xor eax, eax
lea edi, [ebp - 0xc4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00407920
add esp, 0x14
push 5
pop eax
push dword [ebp - 0xb4]
mov dword [ebp - 0x108], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], ax
call edi
push ebx
mov dword [ebp - 0xac], eax
call edi
mov ecx, dword [ebp - 0xac]
lea edi, [ecx + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push ebx
push edi
push eax
mov dword [ebp - 0xac], eax
call fcn.0040472b
mov ebx, dword [ebp - 0xac]
test eax, eax
jl 0x4050c1
push 0x430f7c
push edi
push ebx
call fcn.004047a6
test eax, eax
jl 0x4050c1
push dword [ebp - 0xb4]
push edi
push ebx
call fcn.004047a6
test eax, eax
jl 0x4050c1
lea eax, [ebp - 0xc4]
push eax
xor edi, edi
lea eax, [ebp - 0x108]
push eax
push edi
push edi
push 0x4000000
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, esi
test eax, eax
jne 0x40501d
push ebx
push 0x430f80
call fcn.00404380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x10], eax
call fcn.00407eb5
jmp 0x4050ce
push dword [ebp - 0xc4]
call fcn.00404306
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xa5], 1
cmp eax, edi
je 0x405058
push ebx
push 0x430fcc
mov ecx, esi
call fcn.00404380
mov eax, dword [ebp - 0xb0]
mov dword [esi + 0x10], eax
mov byte [ebp - 0xa5], 0
jmp 0x4050a6
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0xb0]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x405099
push eax
push str.Warning:_msiexec_returned__u._r_n
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.004047e0
add esp, 0x10
push edi
lea eax, [ebp - 0xa4]
push eax
jmp 0x40509f
push edi
push str._Installation_completed_successfully._r_n
mov ecx, esi
call fcn.00404380
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00407eb5
mov al, byte [ebp - 0xa5]
pop ecx
jmp 0x4050d1
push ebx
call fcn.00407eb5
mov dword [esi + 0x10], 0x643
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 4
Function at 0x4062b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push eax
mov ebx, ecx
mov dword [ebp - 0xb0], esi
call sub.msi.dll_MsiRecordGetStringA
push eax
call fcn.004040c4
add esp, 4
cmp eax, 5
jne 0x4062ee
mov al, 1
jmp 0x406490
push edi
push esi
push 0x431f14
mov ecx, ebx
call fcn.00404380
push esi
call fcn.004040c4
xor eax, eax
lea edi, [ebp - 0xc0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00407920
add esp, 0x10
push 5
pop eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x104], edi
mov dword [ebp - 0xd8], 1
mov word [ebp - 0xd4], ax
call esi
push 0x431f8c
mov edi, eax
call esi
lea esi, [edi + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push dword [ebp - 0xb0]
mov edi, eax
push esi
push edi
call fcn.0040472b
test eax, eax
jl 0x40647f
push str.__QB
push esi
push edi
call fcn.004047a6
test eax, eax
jl 0x40647f
lea eax, [ebp - 0xc0]
push eax
xor esi, esi
lea eax, [ebp - 0x104]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, ebx
test eax, eax
jne 0x4063dc
push edi
push str.ERROR:_Could_not_create_process__s._r_n
call fcn.00404380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebx + 0x10], eax
call fcn.00407eb5
jmp 0x40648c
push dword [ebp - 0xc0]
call fcn.00404306
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa5], 1
cmp eax, esi
je 0x406417
push edi
push str.ERROR:_While_waiting_for__s._r_n
mov ecx, ebx
call fcn.00404380
mov eax, dword [ebp - 0xac]
mov dword [ebx + 0x10], eax
mov byte [ebp - 0xa5], 0
jmp 0x406465
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0xac]
mov dword [ebx + 0x10], eax
cmp eax, esi
je 0x406458
push eax
push str.Warning:_install_runtime_returned__u._r_n
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.004047e0
add esp, 0x10
push esi
lea eax, [ebp - 0xa4]
push eax
jmp 0x40645e
push esi
push str._Installation_of_runtime_completed_successfully._r_n
mov ecx, ebx
call fcn.00404380
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00407eb5
mov al, byte [ebp - 0xa5]
jmp 0x40648e
push edi
call fcn.00407eb5
mov dword [ebx + 0x10], 0x643
xor al, al
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 8
Function at 0x406bc4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x3c]
mov byte [ebp - 0x255], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 7
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
mov ebx, eax
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
and dword [ebp - 0x264], 0
pop ecx
pop ecx
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x264]
push eax
push ebx
push esi
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x406c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x10], eax
mov byte [ebp - 0x255], 0
jmp 0x406d34
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x406c68
xor ecx, ecx
mov word [eax], cx
push ebx
push esi
push dword [ebp - 0x25c]
call fcn.0040472b
push 0x430ad8
push esi
push ebx
call fcn.004047a6
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
je 0x406d34
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x25c]
mov ecx, edi
call fcn.00406107
test al, al
jne 0x406cca
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x25c]
mov ecx, edi
call fcn.0040499a
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x406cfe
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x25c]
mov ecx, edi
call fcn.00406107
test al, al
jne 0x406cfe
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x25c]
mov ecx, edi
call fcn.0040499a
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call esi
test eax, eax
jne 0x406cd2
mov edi, dword [edi + 0x40]
test edi, edi
je 0x406d28
push 0x430ae4
push 0x7d00
push edi
call fcn.004047a6
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call fcn.00407eb5
push dword [ebp - 0x25c]
call fcn.00407eb5
mov al, byte [ebp - 0x255]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret
Function at 0x406d5c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax], 0
sub esp, 0x30
push edi
mov edi, ecx
test byte [edi + 0x50], 1
jne 0x406ef0
cmp dword [edi + 0x5c], 1
jle 0x406ef0
push ebx
push esi
push 0xa0
call fcn.00407eaa
pop ecx
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
movzx eax, ax
movzx ebx, si
mov esi, 0x3ff
mov dword [ebp - 0x2c], eax
and eax, esi
xor ecx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
and ebx, esi
cmp dword [edi + 0x5c], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jle 0x406e47
push dword [ebp - 4]
mov ecx, edi
call fcn.00404150
push dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
and eax, esi
mov ecx, edi
mov dword [ebp - 0x28], eax
call fcn.0040559d
push dword [ebp - 0x20]
mov ecx, edi
push 0x430ae8
call fcn.00404380
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp edx, dword [ebp - 0x24]
jne 0x406e11
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
jne 0x406e1b
mov dword [ebp - 0x14], eax
cmp edx, dword [ebp - 0x2c]
jne 0x406e23
mov dword [ebp - 0x18], eax
cmp ecx, dword [ebp - 0x30]
jne 0x406e2b
mov dword [ebp - 0x1c], eax
mov ecx, dword [edi + 0x58]
test ecx, ecx
je 0x406e39
cmp edx, ecx
jne 0x406e39
mov dword [ebp - 8], eax
inc eax
cmp eax, dword [edi + 0x5c]
mov dword [ebp - 4], eax
jl 0x406dd5
xor ecx, ecx
or eax, 0xffffffff
pop esi
pop ebx
cmp dword [edi + 0x58], ecx
je 0x406e65
cmp dword [ebp - 8], eax
jne 0x406e6a
push ecx
push str.Warning:_Language_chosen_with_parameter__lang_not_found._r_n
mov ecx, edi
call fcn.00404380
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp - 8], eax
je 0x406e7c
push ecx
push str.Info:_Found_language_chosen_with_parameter__lang._r_n
mov ecx, edi
call fcn.00404380
push dword [ebp - 8]
jmp 0x406edb
push ecx
mov ecx, edi
cmp dword [ebp - 0x10], eax
je 0x406e93
push str.Info:_Found_user_default_language._r_n
call fcn.00404380
push dword [ebp - 0x10]
jmp 0x406edb
cmp dword [ebp - 0x14], eax
je 0x406ea7
push str.Info:_Found_user_default_primary_language._r_n
call fcn.00404380
push dword [ebp - 0x14]
jmp 0x406edb
cmp dword [ebp - 0x18], eax
je 0x406ebb
push str.Info:_Found_system_default_language._r_n
call fcn.00404380
push dword [ebp - 0x18]
jmp 0x406edb
cmp dword [ebp - 0x1c], eax
je 0x406ecf
push str.Info:_Found_system_default_primary_language._r_n
call fcn.00404380
push dword [ebp - 0x1c]
jmp 0x406edb
push str.Info:_Use_default_language_from_ini_file._r_n
call fcn.00404380
push 0
mov ecx, edi
call fcn.00404150
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov dword [ecx], eax
call fcn.00407eb5
pop ecx
mov al, 1
pop edi
leave
ret 4

Function at 0x4076ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437118]
jne 0x4076d4
repz ret
jmp fcn.0040dc1c