joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b2a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push eax
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [esp + 0x10], 9
push 0
sete al
mov dword [0x4b0478], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x49ce28]
movss dword [0x4ac90c], xmm0
call dword [sym.imp.USER32.dll_ReleaseDC]
cvtdq2ps xmm0, xmmword [0x49cea0]
mov edx, 0x1a
mov dword [0x4b0658], 0x11b
mov ecx, edx
mov dword [0x4b0660], 0x91
mov eax, ecx
mov esi, 0x35
mov edi, eax
mov dword [0x4b0668], 0x5a
mov dword [0x4b0670], 0x67
movss xmm4, dword [0x4ac90c]
shufps xmm4, xmm4, 0
mulps xmm0, xmm4
mov dword [0x4b0678], 0x83
movd xmm3, eax
movd xmm1, edx
movd xmm2, esi
cvttps2dq xmm0, xmm0
mov dword [0x4b0680], 0x67
mov dword [0x4b0688], 0x67
mov dword [0x4b0690], 0x6d
punpckldq xmm1, xmm3
movd dword [0x4b0658], xmm0
psrldq xmm0, 4
movd dword [0x4b0660], xmm0
psrldq xmm0, 4
movd dword [0x4b0668], xmm0
psrldq xmm0, 4
movd dword [0x4b0670], xmm0
movd xmm0, ecx
punpckldq xmm2, xmm0
punpckldq xmm2, xmm1
cvtdq2ps xmm0, xmm2
movd xmm3, edi
mulps xmm0, xmm4
movd xmm1, eax
cvttps2dq xmm0, xmm0
movd dword [0x4b065c], xmm0
psrldq xmm0, 4
movd dword [0x4b0664], xmm0
psrldq xmm0, 4
movd dword [0x4b066c], xmm0
psrldq xmm0, 4
movd dword [0x4b0674], xmm0
cvtdq2ps xmm0, xmmword [0x49ceb0]
mulps xmm0, xmm4
cvttps2dq xmm0, xmm0
movd dword [0x4b0678], xmm0
psrldq xmm0, 4
movd dword [0x4b0680], xmm0
psrldq xmm0, 4
movd dword [0x4b0688], xmm0
psrldq xmm0, 4
movd dword [0x4b0690], xmm0
movd xmm0, eax
movd xmm2, eax
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
cvtdq2ps xmm0, xmm2
pop edi
pop esi
mulps xmm0, xmm4
cvttps2dq xmm0, xmm0
movd dword [0x4b067c], xmm0
psrldq xmm0, 4
movd dword [0x4b0684], xmm0
psrldq xmm0, 4
movd dword [0x4b068c], xmm0
psrldq xmm0, 4
movd dword [0x4b0694], xmm0
mov esp, ebp
pop ebp
ret
Function at 0x43c320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480b80
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x43c380
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.Installer
push 0x4907c0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push str.Software_ls_ls
push eax
call fcn.004040a0
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
add esp, 0x10
push 0x20119
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402f70
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x43c411
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.ShowUpdateDlg
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43c411
cmp dword [ebp - 0x18], 4
jne 0x43c411
cmp dword [0x4b0498], eax
je 0x43c40d
cmp dword [ebp - 0x14], eax
jne 0x43c40d
lea edi, [eax + 1]
jmp 0x43c417
xor edi, edi
jmp 0x43c417
mov edi, dword [0x4b0498]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43c433
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x43c43e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43cd10
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
xor edx, edx
and esi, 0x3ff
mov edi, 0x3ff
xor eax, eax
nop word [eax + eax]
mov cx, word [eax + 0x4ac960]
and cx, di
cmp si, cx
je 0x43cd57
add eax, 0x24
inc edx
cmp eax, 0x1d4
jb 0x43cd30
pop edi
mov dword [0x4b048c], 0
pop esi
ret
pop edi
mov dword [0x4b048c], edx
pop esi
ret
Function at 0x43d570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2011f
push 0
push 0
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43d5a8
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4b048c]
push esi
mov esi, dword [ebp - 4]
lea eax, [eax + eax*8]
mov edx, dword [eax*4 + 0x4ac968]
test edx, edx
jne 0x43d5c6
mov eax, 0xd
jmp 0x43d5f9
mov ecx, edx
push edi
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43d5d0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.Language
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
push ebx
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x43d60c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43d620
Capabilities:
Set registry value

Disassembly:
mov ecx, str.SoftwareEssentwareInstaller
call fcn.0043d570
cmp word [0x4b0604], 0
jne 0x43d652
cmp word [0x4b0606], 0
jne 0x43d652
cmp word [0x4b0608], 0
jne 0x43d652
cmp word [0x4b060a], 0
je 0x43d65c
mov ecx, str.SoftwareEssentwarePckeeper
call fcn.0043d570
cmp word [0x4b060c], 0
jne 0x43d684
cmp word [0x4b060e], 0
jne 0x43d684
cmp word [0x4b0610], 0
jne 0x43d684
cmp word [0x4b0612], 0
je 0x43d68e
mov ecx, str.SoftwareEssentwarePCKAV
jmp fcn.0043d570
ret

Function at 0x43d8e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480cc5
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], edx
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 2
push 0
mov dword [ebp - 0x128], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jb 0x43d988
sub esp, 8
push dword [ebp - 0x128]
push ecx
push ebx
push edi
push dword [ebp - 0x12c]
push esi
call fcn.0043de70
jmp 0x43d999
push ecx
push dword [ebp - 0x128]
push ecx
push ebx
push edi
push ecx
push esi
call fcn.0043da70
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x43d9c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480cf5
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
push esi
jb 0x43da3f
call fcn.0043e7e0
jmp 0x43da44
call fcn.0043e6b0
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x43f170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481056
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0045b910
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x43f284
push 0x490710
lea ecx, [ebp - 0x220]
call fcn.00403ac0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00402e10
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x220]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43f221
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403ac0
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00402e10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x43f26a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x4907c0
mov ecx, esi
call fcn.00408350
push 0x4913ac
mov ecx, esi
call fcn.00408350
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x43f2a0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481098
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00403450
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x43f2e6
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043f170
test eax, eax
js 0x43f422
push str.release_notes.txt
lea ecx, [ebp - 0x10]
call fcn.00408350
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x40], xmm0
push 0
push 0x80
push 2
lea ecx, [ebp - 0x40]
call fcn.004467a0
push eax
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
je 0x43f3e4
mov ecx, dword [ebx]
lea edx, [ebp - 0x14]
push 0
mov dword [ebp - 0x14], 0
push edx
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43f3a2
test esi, esi
je 0x43f390
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00446630
mov esi, 1
jmp 0x43f44e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Write_release_notes_file_FAILED:_err___i
push 3
push 3
push 0x67
push str.UpdateChecker::SaveReleaseNotes
push str.UpdateChecker.cpp
lea ecx, [ebp - 0x24]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
test esi, esi
je 0x43f418
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00446630
jmp 0x43f44c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Open_release_notes_file_FAILED:_err___i
push 3
push 3
push 0x6a
push str.UpdateChecker::SaveReleaseNotes
push str.UpdateChecker.cpp
lea ecx, [ebp - 0x24]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00446630
jmp 0x43f44c
push eax
push str.GetProgramDataPath_FAILED:_hr__0x_x
push 3
push 3
push 0x6d
push str.UpdateChecker::SaveReleaseNotes
push str.UpdateChecker.cpp
lea ecx, [ebp - 0x24]
call fcn.00457220
push eax
call fcn.004573f0
mov edi, dword [ebp - 0x10]
add esp, 0x14
xor esi, esi
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x43f46d
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4408a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d710
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x1c]
mov dword [esi], vtable.CInstActionBase.0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0x28], 1
test eax, eax
je 0x440904
push 0xffffffffffffffff
push eax
call ebx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x440904
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], 0
push 0xffffffffffffffff
push dword [esi + 0x20]
call ebx
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 0x64]
or ebx, 0xffffffff
sub edx, 0x10
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x440931
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x4c]
mov eax, ebx
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44094b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x48]
sub edx, 0x10
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x440963
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x24]
call fcn.00426ce0
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x440982
push eax
call edi
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x440993
push eax
call edi
mov dword [esi + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4409b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cef8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00403450
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4409f8
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x440a2e
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00403880
mov esi, dword [ebp - 0x14]
push esi
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esi - 8]
push esi
call fcn.0045ed24
add esp, 8
test eax, eax
js 0x440b04
cmp eax, dword [esi - 8]
jg 0x440b04
xor ecx, ecx
mov dword [esi - 0xc], eax
push 1
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x14]
push 0x4913ac
call fcn.00409770
test edi, edi
jne 0x440a7a
xor ecx, ecx
jmp 0x440a8f
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440a80
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x14]
call fcn.00409770
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push esi
movq qword [ebp - 0x1c], xmm0
call fcn.0044ad10
test eax, eax
jne 0x440ab5
xor edi, edi
jmp 0x440ad1
movzx eax, word [ebp - 0x1c]
cmp eax, ebx
ja 0x440acc
jne 0x440ac8
movzx eax, word [ebp - 0x1a]
cmp eax, dword [ebp + 8]
jae 0x440acc
xor edi, edi
jmp 0x440ad1
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x440af0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004039a0
int3

Function at 0x440b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0045b910
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x440b95
mov ecx, esi
call fcn.00403750
push 0x4907c0
lea eax, [ebp - 0x210]
push eax
push str._ls_ls_
push esi
call fcn.004040a0
add esp, 0x10
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
push eax
push str.SHGetFolderPath_FAILED__hr___i
push 3
push 3
push 0x4f
push str.CInstActionBase::GetManufactureDataFolder
push str.InstActionBase.cpp
lea ecx, [ebp - 0x21c]
call fcn.00457220
push eax
call fcn.004573f0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x440bd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4812a8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x38
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x3c
push 0
push eax
call fcn.0045b910
mov ebx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x58], 0x40
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x440c41
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test edx, edx
je 0x440c7c
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440c61
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.004039c0
jmp 0x440c8d
lea eax, [ebp - 0x10]
push str._q__norestart
push eax
call fcn.004040a0
add esp, 8
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x48], esi
mov dword [edi + 0x54], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x440d42
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 0
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp + 8], eax
test eax, eax
jne 0x440d42
lea eax, [ebp + 8]
mov dword [ebp + 8], 0xffffffff
push eax
push dword [ebp - 0x24]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x440d37
mov eax, dword [ebp + 8]
cmp eax, 0xbc2
jne 0x440cfc
call fcn.0043ca80
mov eax, dword [ebp + 8]
mov edi, 1
jmp 0x440d06
test eax, eax
mov ecx, 1
cmove edi, ecx
push dword [0x4b0490]
lea ecx, [ebp - 0x20]
push eax
push ebx
push str.Prerequisite_install_path__retCode__RebootRequired_:__s___u___i
push 1
push 3
push 0x8b
push str.CInstActionBase::PackageInstall
push str.InstActionBase.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x1c
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x440d44
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x440d63
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x440ef0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x28], 1
test eax, eax
je 0x440f28
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x440f28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], 0
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x440f40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d388
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov eax, dword [edi + 0x50]
test eax, eax
jne 0x4410c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x10], eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x10]
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x440fa7
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00403750
mov ecx, dword [edi + 0x4c]
lea edx, [ebp - 0x38]
call fcn.00428520
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
mov esi, dword [ebp - 0x38]
test eax, eax
je 0x440fe4
mov edi, dword [edi + 0x50]
jmp 0x4410a3
push 0
push esi
push dword [edi + 0x4c]
lea ecx, [edi + 0x24]
call fcn.00426e30
mov ebx, eax
test ebx, ebx
je 0x441028
cmp ebx, 1
je 0x441023
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x14]
call fcn.0042f230
cmp dword [edi + 8], 0
je 0x44101e
mov ebx, 0x2710
mov dword [edi + 0x50], ebx
mov edi, ebx
jmp 0x4410a3
neg ebx
mov dword [edi + 0x50], ebx
mov edi, dword [edi + 0x50]
jmp 0x4410a3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
test eax, eax
je 0x44103f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [edi + 0x50]
jmp 0x4410a3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
push ebx
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, dword [edi + 0xc]
test eax, eax
cmovne ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x48]
sub eax, dword [ebx + 0x10]
push eax
push edi
push str.Presequisite__s_DOWNLOADED__time_spent:__u__size:__u
push 1
push 3
push 0x108
push str.CInstActionBase::Download
push str.InstActionBase.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x1c
mov dword [ebx + 0x50], 0x2710
mov edi, 0x2710
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4410c2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret