joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019d5
Capabilities:
Query environment variable
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
call fcn.00401046
mov ebp, eax
mov esi, 0x400
push esi
push 0
lea edi, [ebp + 0x410]
push edi
call fcn.00412770
add esp, 0xc
mov ebx, 0x4253a0
push 0x426180
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [0x41d468]
push dword [0x41d464]
call edi
lea eax, [ebp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ae3
lea eax, [ebp + 0x810]
push esi
push 0
push eax
call fcn.00412770
add esp, 0xc
lea eax, [ebp + 0x810]
push 0x426180
push esi
push eax
push ebx
push dword [0x41d470]
push dword [0x41d464]
call edi
lea eax, [ebp + 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ae3
lea eax, [ebp + 0x10]
push esi
push 0
push eax
call fcn.00412770
add esp, 0xc
lea eax, [ebp + 0x10]
push 0x426180
push esi
push eax
push ebx
push dword [0x41d46c]
push dword [0x41d464]
call edi
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ae3
push 2
lea eax, [esp + 0x16]
push 0
push eax
call fcn.00412770
add esp, 0xc
lea eax, [esp + 0x12]
push 0x426180
push 2
push eax
push ebx
push dword [0x41d474]
push dword [0x41d464]
call edi
lea eax, [esp + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x401aea
xor eax, eax
jmp 0x401bfb
and dword [ebp + 0xc], 0
cmp dword [0x427050], 0
jne 0x401b12
lea eax, [esp + 0x12]
push 0x421148
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401b12
mov dword [ebp + 0xc], 1
and byte [esp + 0x14], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [esp + 0x15]
push 0x426180
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
push ebx
push dword [0x41d478]
push dword [0x41d47c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
mov dword [ebp + 0x1014], 0x1f40
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401b71
lea eax, [esp + 0x14]
push eax
call fcn.00412985
pop ecx
mov dword [ebp + 0x1014], eax
lea edi, [ebp + 0x1018]
push ebx
push edi
call fcn.004127d0
pop ecx
test eax, eax
pop ecx
jne 0x401bd0
push 0x426180
push esi
push edi
push ebx
push dword [0x41d480]
push dword [0x41d464]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call fcn.00412977
pop ecx
mov ebx, eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp + 0x1420], 5
je 0x401bd0
push 1
push edi
push 0x421144
mov ecx, ebp
call fcn.0040bfed
add ebp, 0x1420
cmp dword [ebp], 0
jne 0x401bf8
push 0x426180
push 0
push dword [0x41d484]
push dword [0x41d464]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp], eax
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x402253
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x40226c
xor esi, esi
jmp 0x402299
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00412fd0
xor eax, eax
mov esi, esp
push eax
push eax
and byte [esi], 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4022bb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4022b2
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x64
jl 0x40225e
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40525b
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x41c4a0
call fcn.00412df4
sub esp, 0x5a4
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
push edi
cmp byte [edi], 0x30
jne 0x405293
mov esi, dword [sym.imp.USER32.dll_CharNextA]
call esi
mov cl, byte [eax]
cmp cl, 0x78
je 0x4052d2
cmp cl, 0x58
je 0x4052d2
push edi
call fcn.00412a10
pop ecx
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
push 0x452
call fcn.00401754
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00401797
test eax, eax
je 0x40539b
mov ecx, dword [ebp + 0x10]
call fcn.0040bbc3
test eax, eax
je 0x4052dd
push 0x4253a4
jmp 0x4052e6
push eax
call esi
push eax
call fcn.00405218
jmp 0x405298
mov ecx, dword [ebp + 0x10]
call fcn.0040b533
push eax
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
and byte [ebp - 0x5b0], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x5af]
rep stosd dword es:[edi], eax
push dword [0x421c28]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x5b0]
push eax
call fcn.0040dae4
lea eax, [ebp - 0x5b0]
mov esi, str.Languages
push eax
push ebx
push str.Count
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
xor edi, edi
test ebx, ebx
jbe 0x40539b
push edi
push 0x421474
lea eax, [ebp - 0xac]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x2c]
push 0x13
push eax
lea eax, [ebp - 0xac]
push 0x4253a0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40539b
lea eax, [ebp - 0x2c]
push eax
call fcn.00405218
pop ecx
mov ecx, dword [ebp + 8]
cmp ecx, eax
je 0x4053ba
inc edi
cmp edi, ebx
jb 0x405346
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040178c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp + 0xc]
push 1
pop esi
mov dword [eax], ecx
jmp 0x40539d
Function at 0x40571b
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
mov eax, 0x41c4d3
call fcn.00412df4
sub esp, 0x730
push esi
lea eax, [ebp - 0x33c]
push edi
mov esi, 0x104
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x33c]
push 0x4214bc
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x73c]
push 0x400
push eax
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x73c]
lea ecx, [ebp - 0x238]
push eax
call fcn.0040c902
and dword [ebp - 4], 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x238]
push dword [0x421c28]
call fcn.0040cb5d
test eax, eax
je 0x4057d2
lea eax, [ebp - 0x110]
add edi, 4
push eax
push esi
push edi
push 0x4253a0
push str.PASSWORD
push 0x4214ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.0040ca40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4057ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405846
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x42604c
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40583d
mov byte [0x426150], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40592d
Capabilities:
Hide graphical window

Disassembly:
push dword [0x42616c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405959
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x42616c]
call esi
push 0
push dword [0x426160]
call esi
pop esi
ret
Function at 0x40595a
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x42616c]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.0040b4e2
cmp dword [eax], 1
je 0x4059c4
cmp dword [eax + 4], ebx
je 0x405a19
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405a19
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x42616c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40600d
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00406a5e
test eax, eax
pop ecx
jne 0x40616a
mov esi, 0x4267a8
push esi
call fcn.00406af5
test eax, eax
pop ecx
jne 0x40616a
mov eax, dword [ebp + 0x20]
mov ecx, dword [0x4267a8]
push 0x42679c
mov dword [eax], ecx
call fcn.00406aae
test eax, eax
pop ecx
jne 0x40616a
mov ebx, dword [ebp + 0x1c]
mov eax, dword [0x42679c]
mov dword [ebx], eax
cmp dword [0x4267a8], 1
jne 0x406070
xor eax, eax
jmp 0x40616a
lea eax, [ebp + 8]
push eax
push 0x4267a0
call fcn.00405ff9
test eax, eax
jne 0x40616a
mov eax, dword [0x4267a8]
shl eax, 2
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [0x4267ac], eax
jne 0x4060af
push 0xfffffffffffffffc
pop eax
jmp 0x40616a
push esi
call fcn.00406b1d
mov edi, eax
pop ecx
test edi, edi
je 0x4060e5
push dword [0x4267ac]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4267ac]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406168
movzx eax, word [ebp + 0x18]
push eax
mov dword [0x426798], ebx
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov dword [0x42658c], eax
movzx eax, word [ebp + 0x14]
push 0x40630a
push dword [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
mov eax, dword [0x42658c]
test eax, eax
je 0x406128
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp edi, 1
jne 0x406131
xor edi, edi
jmp 0x406139
cmp edi, 2
jne 0x406139
or edi, 0xffffffff
mov eax, dword [0x4267ac]
test eax, eax
je 0x406161
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4267ac]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx]
mov dword [0x42679c], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4065bf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ee
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x406746
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
call esi
push 0x3ef
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x406746
push edi
call ebx
cmp dword [ebp - 4], eax
jge 0x406631
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push edi
call esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x406746
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.00406c61
push 1
push 0x421530
push esi
mov edi, eax
call fcn.00406c61
push esi
push dword [ebp - 8]
movzx ebx, ax
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp + 8], 0
movzx esi, di
add esi, ebx
shr edi, 0x10
test esi, esi
mov dword [ebp - 0x14], edi
je 0x406746
test edi, edi
je 0x406746
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jge 0x4066d0
mov edi, esi
push 1
sub edi, eax
add edi, ebx
add esi, ebx
pop ebx
mov dword [ebp - 4], esi
mov dword [ebp + 8], ebx
jmp 0x4066d6
mov edi, dword [ebp + 8]
push 1
pop ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jge 0x4066e6
add eax, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x406746
mov esi, dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x2c
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
sub eax, edi
push dword [ebp - 4]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x2c
push eax
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 0x34]
push 1
push dword [ebp - 0xc]
lea eax, [edi + edi]
sub ecx, eax
push dword [ebp - 4]
push dword [ebp - 0x30]
push ecx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406aae
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x426694
lea eax, [ebp - 0x14]
push 0x13
push eax
push 0x4253a0
push str.Default
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x406add
push 0xfffffffffffffffa
pop eax
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x421548
push eax
call fcn.00413960
add esp, 0xc
xor eax, eax
leave
ret
Function at 0x406af5
Capabilities:
Read .ini file

Disassembly:
push 0x426694
push 0
push str.Count
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 6
add eax, 0xfffffffa
ret

Function at 0x406b1d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
cmp dword [edi], esi
jbe 0x406b9d
push esi
push 0x421474
lea eax, [ebp - 0x94]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x14]
push 0x426694
push 0x13
push eax
lea eax, [ebp - 0x94]
push 0x4253a0
push eax
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x406b9a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push 0x421548
push eax
call fcn.00413960
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [eax + esi*4], ecx
inc esi
cmp esi, dword [edi]
jb 0x406b34
jmp 0x406b9d
push 0xfffffffffffffffa
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4084db
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe20
and byte [ebp - 0x20], 0
push ebx
push esi
push edi
mov ebx, ecx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f]
and byte [ebp - 0x620], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x61f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Msi.DLL
call fcn.0040d54f
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.0040dd2a
add esp, 0x14
test eax, eax
jge 0x4086d3
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.0040b4e2
mov ecx, ebx
mov esi, eax
call fcn.004082a3
test eax, eax
je 0x4085f8
cmp dword [esi], 2
jne 0x4085f1
call fcn.0040dfb1
test eax, eax
jne 0x408584
mov eax, 0x4b2
push eax
mov dword [0x42704c], eax
call fcn.0040d394
pop ecx
push 1
jmp 0x4086d5
and byte [ebp - 0x420], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
mov esi, 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4085c6
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.00407f9e
test eax, eax
je 0x4085ea
lea eax, [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4085f1
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.00407f9e
test eax, eax
jne 0x4085f1
push 2
jmp 0x4086d5
xor eax, eax
jmp 0x4086d6
cmp dword [esi + 0x14], 2
jne 0x40861f
cmp dword [esi + 8], 4
jne 0x40861f
mov eax, 0x47e
push 0
push eax
mov dword [0x42704c], eax
call fcn.0040d394
pop ecx
pop ecx
push 3
jmp 0x4086d5
mov esi, 0x400
push 0x426180
lea eax, [ebp - 0xe20]
push esi
push eax
push 0x4253a0
push dword [0x41d578]
push dword [0x41d570]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0xe20], 0x79
je 0x4086ce
cmp byte [ebp - 0xe20], 0x59
je 0x4086ce
and byte [ebp - 0x420], 0
mov ebx, 0xff
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x41f]
mov edx, 0x4b7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
push esi
push eax
push edx
mov dword [0x42704c], edx
call fcn.0040d474
and byte [ebp - 0xa20], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xa20]
push eax
call fcn.0040d23c
add esp, 0x10
or eax, 0xffffffff
jmp 0x4086d6
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4086dd
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edx, ecx
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
mov esi, dword [ebp + 0xc]
mov byte [ebp + 0xf], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov dword [esi], ebx
stosb byte es:[edi], al
call fcn.00401046
add eax, 0x10
push eax
push str.2.0.2600.0
call fcn.0040dd2a
pop ecx
test eax, eax
pop ecx
jge 0x408730
push dword [ebp + 8]
push str.__s___q
jmp 0x40873c
push dword [ebp + 8]
mov byte [ebp + 0xf], 1
push str.__s___c:_msiinst__delayrebootq_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.0040ddba
mov edi, eax
cmp edi, ebx
je 0x40880e
cmp edi, 0xbc2
je 0x408786
push ebx
push edi
mov dword [0x42704c], 0x484
call fcn.0040d2ae
pop ecx
mov eax, edi
pop ecx
jmp 0x408810
cmp byte [ebp + 0xf], bl
je 0x408808
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 8]
mov dword [esi], 2
mov dword [ebp + 8], ebx
call fcn.00407509
test eax, eax
jne 0x4087f8
push 0x40
lea edi, [ebp - 0x20b]
pop ecx
mov byte [ebp - 0x20c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 8], ebx
je 0x40880e
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40880e
mov dword [esi], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x408817
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x41c57c
call fcn.00412df4
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00401046
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, 0x426180
xor ebx, ebx
push esi
push ebx
push str.ScriptDriven
push dword [0x41d570]
call edi
sub eax, ebx
je 0x408855
dec eax
je 0x40886b
dec eax
je 0x408875
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x10], 1
cmp byte [ebp + 8], bl
je 0x40889b
push esi
push ebx
push dword [0x41d5a0]
push dword [0x41d5b0]
call edi
cmp eax, 2
je 0x4088a0
mov ecx, dword [ebp - 0x18]
call fcn.00409844
test al, al
je 0x4088a0
push 1
pop eax
jmp 0x408857
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
push ebx
lea eax, [ebp + 8]
push ebx
push eax
push 0x421758
push 0x41da08
call fcn.004046a5
test eax, eax
jge 0x4088de
mov eax, dword [ebp + 8]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x4088d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 1
pop ebx
jmp 0x4089dd
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push 0x4219e0
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 2
call dword [ecx]
cmp eax, ebx
jl 0x40899c
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 3
call dword [ecx + 0x1c]
test eax, eax
jge 0x40891b
push dword [ebp - 0x14]
jmp 0x408996
xor eax, eax
lea edi, [ebp - 0x2b]
mov byte [ebp - 0x2c], bl
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
push 0x14
push eax
push 0x4253a0
push dword [0x41d59c]
push dword [0x41d570]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408956
xor edi, edi
jmp 0x408982
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00412fd0
mov edi, esp
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x18]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.0040dd2a
pop ecx
cmp eax, 1
pop ecx
push dword [ebp - 0x14]
jne 0x4089b6
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x4088c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4088c6
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x4089cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x4089dd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x408857