joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b9d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov esi, eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x41ba8e
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 1
jbe 0x41ba82
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea edi, [ebx + 2]
mov dword [ebp - 4], eax
push edi
call fcn.00430224
mov esi, eax
add esp, 4
test esi, esi
je 0x41ba76
push edi
push 0
push esi
call fcn.00435780
push ebx
push dword [ebp - 4]
push esi
call fcn.004330d0
add esp, 0x18
cmp byte [esi], 0
jne 0x41ba4c
xor ecx, ecx
jmp 0x41ba5a
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ba51
sub ecx, edx
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.004066b0
push esi
call fcn.00430edc
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xe
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41baa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41bb3f
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 1
jbe 0x41bb33
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ebx, [edi + 2]
mov dword [ebp - 4], eax
push ebx
call fcn.00430224
mov esi, eax
add esp, 4
test esi, esi
je 0x41bb27
push ebx
push 0
push esi
call fcn.00435780
push edi
push dword [ebp - 4]
push esi
call fcn.004330d0
mov ecx, dword [ebp + 8]
add esp, 0x18
push esi
call fcn.00404490
push esi
call fcn.00430edc
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xe
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bb50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
mov eax, dword [0x4624c8]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
test edi, edi
je 0x41bd43
cmp word [edi], si
je 0x41bd43
push edi
lea eax, [esp + 0x46c]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
lea eax, [esp + 0x468]
push 0x45771c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41bbe0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
mov ecx, 0x457470
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41bc16
test dx, dx
je 0x41bc12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41bc16
add eax, 4
add ecx, 4
test dx, dx
jne 0x41bbf0
xor eax, eax
jmp 0x41bc1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41bcf1
mov ecx, 0x457720
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41bc56
test dx, dx
je 0x41bc52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41bc56
add eax, 4
add ecx, 4
test dx, dx
jne 0x41bc30
xor eax, eax
jmp 0x41bc5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41bcf1
push edi
lea eax, [esp + 0x264]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x10], 0x10
je 0x41bcc3
lea ecx, [esp + 0x260]
call fcn.0041bb50
mov esi, eax
test esi, esi
je 0x41bcf1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41bd0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x41bd16
cmp esi, 0x12
jne 0x41bbe0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
cmp esi, 0x12
cmove esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x674]
mov eax, 3
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41bd60
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x41bdbb
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret

Function at 0x41bdf0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41be2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80040002
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x41be76
xor esi, esi
jmp 0x41be7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41be8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41c2e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push 0x44
lea eax, [ebp - 0x5c]
mov esi, ecx
push 0
push eax
call fcn.00435780
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41c357
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41c3c5
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
push esi
push 0x104
push edi
call fcn.004319e1
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.00430d5f
mov esp, ebp
pop ebp
ret

Function at 0x41c3f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov bl, 1
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x41c44d
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
setne bl
test bl, bl
je 0x41c49b
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
test esi, esi
je 0x41c49b
movzx eax, word [esi]
test ax, ax
je 0x41c49b
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathGetCharTypeW]
lea esp, [esp]
test bl, bl
je 0x41c488
push eax
call edi
test al, 0xb
movzx eax, word [esi + 2]
setne bl
add esi, 2
test ax, ax
jne 0x41c470
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41c4b0
Capabilities:
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov byte [ebp - 0x20d], 0
push ebx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], ebx
xor esi, esi
push 0x104
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x220], esi
call fcn.004319e1
push str..bak
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00431c47
add esp, 0x18
push esi
push esi
push 4
push esi
push esi
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41c63c
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x300000
jbe 0x41c5f6
push esi
push esi
push 4
push esi
push esi
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x218], eax
cmp eax, 0xffffffff
je 0x41c5fe
push esi
push esi
lea eax, [edi - 0x300000]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x8000
call fcn.00430224
add esp, 4
mov edi, eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0x8000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c5c1
push 0
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x214]
push edi
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c5cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x41c5d6
cmp dword [ebp - 0x214], 0
ja 0x41c587
push edi
call fcn.00430edc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
mov byte [ebp - 0x20d], 1
push dword [ebp - 0x218]
call edi
jmp 0x41c604
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
cmp byte [ebp - 0x20d], 0
pop edi
je 0x41c62a
test esi, esi
jne 0x41c62a
push 1
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41c660
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44999e
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4624c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [0x466594]
test al, 1
jne 0x41c6c1
or eax, 1
mov dword [0x466594], eax
push ecx
push str.advapi32.dll
mov ecx, 0x466598
mov dword [ebp - 4], 0
call fcn.00406da0
push 0x44b270
call fcn.0043100c
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x466578]
test eax, eax
jne 0x41c705
push str.RegDeleteKeyExW
mov ecx, 0x466598
call fcn.00406ed0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x466578], eax
test eax, eax
jne 0x41c705
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x20106
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c730
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00435780
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [ebp - 0x14]
push 0
push 0
push 0xa
push eax
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push str.Checking_if_OS__d._d_SP_d_is_greater_equal_than__d._d_SP_d
push 0x453cac
push 0x463614
call fcn.00419150
mov eax, dword [ebp - 0x124]
add esp, 0x24
cmp eax, 0xa
jbe 0x41c7b9
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
jne 0x41c7d1
mov eax, dword [ebp - 0x120]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41daf0
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
push str.____Caching_MSI
push 0x453cac
push 0x463614
mov esi, ecx
call fcn.00419150
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push esi
call dword [sym.imp.msi.dll_MsiSourceListClearAllW]
test eax, eax
jne 0x41dbcc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41db4f
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
lea eax, [ebp - 0x264]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.______Copying_to_cache
push 0x453cac
push 0x463614
call fcn.00419150
add esp, 0xc
lea eax, [ebp - 0x264]
push 1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.______Adding_to_source_list
push 0x453cac
push 0x463614
call fcn.00419150
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.msi.dll_MsiIsProductElevatedW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x41e830
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x4624c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x26c], 7
mov dword [ebp - 0x270], 0
mov word [ebp - 0x280], ax
lea esi, [edi + 0xa8]
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], 8
jb 0x41e892
mov eax, dword [esi]
jmp 0x41e894
mov eax, esi
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push eax
call dword [sym.imp.msi.dll_MsiSourceListClearAllW]
test eax, eax
jne 0x41e9fc
cmp dword [edi + 0x2c], 8
lea esi, [edi + 0x18]
jb 0x41e8b6
mov esi, dword [esi]
mov ecx, dword [ebx + 4]
push str.IIF_CACHELOC
call fcn.00419790
push eax
lea eax, [ebp - 0x268]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
lea eax, [ebp - 0x268]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.____Removing_from_cache
push 0x453cac
push 0x463614
call fcn.00419150
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebx + 4]
lea eax, [ebp - 0x298]
push 1
push eax
lea ecx, [edi + 0x4c]
call fcn.0041a510
mov esi, eax
lea eax, [ebp - 0x280]
cmp eax, esi
je 0x41e96a
cmp dword [ebp - 0x26c], 8
jb 0x41e941
push dword [ebp - 0x280]
call fcn.004213f0
add esp, 4
xor eax, eax
mov dword [ebp - 0x26c], 7
push esi
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x270], 0
mov word [ebp - 0x280], ax
call fcn.00407f70
cmp dword [ebp - 0x284], 8
jb 0x41e981
push dword [ebp - 0x298]
call fcn.004213f0
add esp, 4
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x280]
cmovae eax, dword [ebp - 0x280]
push eax
lea eax, [ebp - 0x60]
push eax
push str.__Uninstalling_product_code__s__Properties__s
push 0x453cac
push 0x463614
call fcn.00419150
add esp, 0x14
mov edx, ebx
mov ecx, edi
call fcn.0041dbe0
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x280]
cmovae eax, dword [ebp - 0x280]
push eax
push 2
push 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.msi.dll_MsiGetFileVersionA]
mov esi, eax
test esi, esi
je 0x41ea1e
cmp esi, 0xbc2
je 0x41ea1e
cmp byte [edi + 0xf8], 0
je 0x41ea1e
push esi
push str.____Result_code_was__d_but_ignore_error_is_set
jmp 0x41ea0a
cmp dword [esi + 0x14], 8
jb 0x41ea04
mov esi, dword [esi]
push esi
push str.____Upgrade_code__s_is_not_installed
push 0x453cac
push 0x463614
call fcn.00419150
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x26c], 8
jb 0x41ea35
push dword [ebp - 0x280]
call fcn.004213f0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
Function at 0x421720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x4624c8]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
mov dword [0x465c88], edi
mov dword [0x465c84], edi
mov dword [0x465d00], 0xffffffff
mov dword [0x465d04], 0xffffffff
mov dword [0x465d08], 0xffffffff
mov dword [0x465d0c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4218a8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x421870
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov dword [0x465c88], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x465c84], eax
lea eax, [esp + 0x228]
push eax
push 0xffffffffffffffff
push 0x4214b0
push 0x421500
push 0x421480
push 0x421430
push 0x421400
push fcn.004213f0
push 0x4213e0
call dword [sym.imp.Cabinet.dll_FDICreate]
mov esi, eax
add esp, 0x24
test esi, esi
je 0x421887
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x228], eax
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.004319e1
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push edi
push 0x421520
push edi
push 0x454928
push 0x454928
push esi
call dword [sym.imp.Cabinet.dll_FDICopy]
add esp, 0x1c
test eax, eax
jne 0x421866
mov edi, dword [esp + 0x228]
add edi, 0xb000
push esi
call dword [sym.imp.Cabinet.dll_FDIDestroy]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x228]
add eax, 0xb000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00430d5f
mov esp, ebp
pop ebp
ret

Function at 0x421930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a183
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4624c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CDialog.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x14], ecx
mov word [ecx], ax
push eax
push 0x453a78
mov byte [ebp - 4], 1
call fcn.00406140
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], SysReAllocString
mov dword [esi + 0x1c], SysReAllocString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4