joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ba0
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x42faec
call fcn.00419b39
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.00408a1f
push eax
lea ecx, [ebp - 0x220]
call fcn.00401212
xor ebx, ebx
push ebx
lea ecx, [esi + 8]
push 0x4334d8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x22c], ecx
call fcn.00403606
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 1
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x230], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040867b
pop ecx
mov dword [ebp - 0x228], eax
cmp eax, ebx
je 0x403c4d
mov ecx, dword [ebp - 0x230]
add ecx, ecx
push ecx
push ebx
push eax
call fcn.00419e20
add esp, 0xc
push dword [ebp - 0x228]
push dword [ebp - 0x230]
call esi
cmp eax, ebx
seta al
cmp al, bl
jne 0x403c5d
push dword [ebp - 0x228]
call fcn.00408686
jmp 0x403dec
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.00419e20
push str.TRANSFORMS_
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0041a028
push dword [ebp - 0x228]
call fcn.0041968b
mov esi, eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0041968b
lea esi, [esi + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040867b
add esp, 0x24
mov dword [ebp - 0x224], eax
cmp eax, ebx
je 0x403d01
lea ecx, [esi + esi]
push ecx
push ebx
push eax
call fcn.00419e20
push dword [ebp - 0x228]
push esi
push dword [ebp - 0x224]
call fcn.0041a028
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x224]
call fcn.00419fab
add esp, 0x24
mov eax, dword [ebp - 0x234]
cmp eax, 0xffffffff
jne 0x403d3b
mov eax, dword [edi]
xor esi, esi
cmp dword [eax - 0xc], ebx
jne 0x403d2d
lea eax, [ebp - 0x220]
push str.TRANSFORMS__
push eax
call fcn.00401480
pop ecx
pop ecx
jmp 0x403dc0
push eax
push dword [ebp - 0x224]
push str.TRANSFORMS__s_s_
jmp 0x403db1
mov ecx, dword [ebp - 0x22c]
add eax, 0xa
push eax
push 0x22
call fcn.004035d2
mov esi, eax
mov eax, dword [edi]
inc esi
cmp dword [eax - 0xc], ebx
jne 0x403d6d
push eax
lea eax, [ebp - 0x220]
push 0x43346c
push eax
call fcn.00401480
add esp, 0xc
jmp 0x403dc0
mov ecx, dword [ebp - 0x22c]
push esi
push 0x5c
call fcn.004035d2
cmp eax, 0xffffffff
jne 0x403da4
push dword [ebp - 0x228]
lea eax, [ebp - 0x220]
push dword [edi]
push dword [ebp - 0x224]
push str._s_s__s_
push eax
call fcn.00401480
add esp, 0x14
jmp 0x403dc0
push dword [edi]
push dword [ebp - 0x224]
push 0x43344c
lea eax, [ebp - 0x220]
push eax
call fcn.00401480
add esp, 0x10
push dword [ebp - 0x220]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.00403865
mov dword [ebp - 4], ebx
push dword [ebp - 0x224]
call fcn.00408686
push dword [ebp - 0x228]
call fcn.00408686
pop ecx
pop ecx
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00401039
call fcn.00419b95
ret 4
Function at 0x40433c
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x42fbd8
call fcn.00419a9a
xor edi, edi
push str.SELECT_Value_FROM_Property_WHERE_Property.Property
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], edi
call fcn.00401ab4
mov esi, 0x433858
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00403eab
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
push eax
call fcn.00403b20
push esi
lea ecx, [ebp - 0x18]
call fcn.00403eab
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040233a
push eax
push esi
push dword [ebp + 0xc]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
je 0x4043b5
mov ecx, dword [ebp + 8]
call fcn.00401326
jmp 0x404447
push edi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x4043a8
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0040233a
push eax
push esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
cmp eax, edi
jne 0x4043a8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call sub.msi.dll_MsiRecordSetStreamA
cmp dword [ebp - 0x1c], edi
je 0x4043a8
call fcn.00408a1f
push eax
lea ecx, [ebp + 0x10]
call fcn.00401212
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call fcn.00401344
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call sub.msi.dll_MsiRecordSetStreamA
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.004011e5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.004017c0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401039
cmp dword [ebp - 0x10], edi
je 0x404454
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], edi
je 0x404461
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401039
mov eax, dword [ebp + 8]
call fcn.00419b72
ret 0xc
Function at 0x4051ac
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x42fde7
call fcn.00419a9a
xor esi, esi
cmp dword [0x44241c], esi
je 0x4051cc
call fcn.00404e79
jmp 0x4052ac
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x14], esi
call fcn.00404477
push 0x44
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00419e20
push 0x10
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0x68], 0x44
call fcn.00419e20
mov eax, dword [ebp - 0x10]
add esp, 0x18
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00401344
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405258
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push str.InstallProduct:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x4423fc
call fcn.00401480
add esp, 0x10
mov ecx, 0x442358
call fcn.0040678d
mov eax, dword [ebp - 0x14]
mov dword [0x442474], eax
jmp 0x4052a1
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x14]
cmp eax, 0xbc2
jne 0x40528c
cmp dword [0x442410], esi
jne 0x40528c
mov dword [0x442410], 1
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x442474], eax
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401039
call fcn.00419b72
ret
Function at 0x4054b9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
mov edi, ecx
call fcn.00419e20
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 0x58], 0x44
call fcn.00419e20
add edi, 8
mov eax, dword [edi]
add esp, 0x18
push dword [eax - 0xc]
mov ecx, edi
call fcn.00401344
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405541
cmp dword [0x44240c], esi
je 0x405533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [edi]
push str.InstallUpdate:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x4423fc
call fcn.00401480
add esp, 0x10
mov ecx, 0x442358
call fcn.0040678d
xor eax, eax
jmp 0x4055bb
xor edi, edi
cmp dword [0x442414], esi
jne 0x40555b
push esi
push esi
push esi
push esi
push 0x433048
call fcn.00410350
mov edi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp edi, esi
je 0x405586
mov eax, dword [edi + 0x20]
cmp eax, esi
jne 0x405575
xor eax, eax
jmp 0x405578
mov eax, dword [eax + 0x20]
push esi
push esi
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edi, edi
inc edi
test eax, eax
je 0x4055a9
cmp dword [ebp - 4], 0xbc2
jne 0x4055a9
mov dword [0x442410], edi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4055e2
Capabilities:
Identify system language via api

Disassembly:
push 0x7c
mov eax, 0x42fe40
call fcn.00419a9a
mov esi, ecx
mov eax, dword [esi + 8]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x405678
cmp dword [esi + 0xc], 0
je 0x405675
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
xor edi, edi
movzx eax, ax
inc edi
cmp ax, di
je 0x405623
cmp ax, 0xd
je 0x405623
xor eax, eax
jmp 0x405625
mov eax, edi
push 0
push eax
lea ecx, [ebp - 0x88]
call fcn.004017e1
and dword [ebp - 4], 0
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401430
add esi, 0x14
push esi
lea ecx, [ebp - 0x10]
call fcn.00401430
lea ecx, [ebp - 0x88]
call fcn.00409878
cmp eax, edi
jne 0x405671
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00401856
mov eax, edi
jmp 0x405678
xor edi, edi
jmp 0x40565e
xor eax, eax
inc eax
call fcn.00419b72
ret
Function at 0x40567e
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x430d82
call fcn.00419a9a
mov esi, ecx
push 0
lea ebx, [esi + 8]
push str.http:__
mov ecx, ebx
call fcn.00403606
test eax, eax
je 0x4056b3
push 0
push str.ftp:__
mov ecx, ebx
call fcn.00403606
test eax, eax
jne 0x405732
push 0x2f
mov ecx, ebx
call fcn.004035ad
mov ecx, dword [ebx]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ecx - 0xc]
jne 0x4056d0
mov ecx, ebx
call fcn.0040123a
jmp 0x405732
push ebx
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 1
call fcn.00401494
lea edi, [esi + 0x14]
mov esi, 0x104
push esi
mov ecx, edi
call fcn.00401344
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004011e5
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.004055bf
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004040a4
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401039
push edi
mov ecx, ebx
call fcn.00401494
call fcn.00419b72
ret

Function at 0x405738
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x42fe86
call fcn.00419a9a
mov esi, ecx
call fcn.00408a1f
push eax
lea ecx, [ebp - 0x10]
call fcn.00401212
xor ebx, ebx
push ebx
push 0x25
mov edi, 0x104
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00401344
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004011e5
push str.Msi.dll
lea ecx, [ebp - 0x10]
call fcn.00403eab
lea ecx, [esi + 4]
push edi
call fcn.00401344
push ebx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x10]
call sub.msi.dll_MsiMessageBoxW
push 0xffffffffffffffff
lea ecx, [esi + 4]
call fcn.004011e5
push str.Path
lea ecx, [ebp - 0x18]
call fcn.00401ab4
push str.MSI_Updater
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401ab4
push 0x442400
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x442358
mov byte [ebp - 4], 2
call fcn.00405d71
lea edi, [esi + 8]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00401494
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401039
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401039
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401039
mov ecx, esi
call fcn.0040567e
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x40587e
cmp dword [esi + 0xc], ebx
jne 0x405846
push edi
mov ecx, 0x442358
call fcn.00405fb9
test eax, eax
jne 0x405846
mov ecx, edi
call fcn.0040123a
jmp 0x40587e
call fcn.00408a1f
push eax
lea ecx, [ebp - 0x18]
call fcn.00401212
lea eax, [ebp - 0x18]
push str.__quiet__norestart__overwriteoem
push eax
mov byte [ebp - 4], 4
call fcn.00401480
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
push dword [esi - 0xc]
mov ecx, edi
push esi
call fcn.00403b20
lea ecx, [esi - 0x10]
call fcn.00401039
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401039
call fcn.00419b72
ret
Function at 0x4059e2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx eax, ax
cmp ax, 1
je 0x405a02
cmp ax, 0xd
jne 0x405a09
or dword [ebp + 0xc], 0x100000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x442358
call fcn.004119fe
add esp, 0x10
pop ebp
ret

Function at 0x405ac4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x440fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x11c
xor edi, edi
lea eax, [ebp - 0x120]
push edi
push eax
call fcn.00419e20
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x405b19
cmp dword [ebp - 0x118], 2
jne 0x405b19
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00419a8b
leave
ret

Function at 0x405d71
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x42f74f
call fcn.00419a9a
and dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00401326
and dword [ebp - 4], 0
push 0x7d
mov dword [ebp - 0x10], 1
pop esi
mov eax, dword [ebp + 0x14]
mov edi, dword [eax]
add esi, esi
push esi
mov ecx, ebx
call fcn.00401344
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push edi
push esi
push eax
push 0x432808
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, ebx
mov edi, eax
call fcn.004011e5
inc edi
cmp esi, edi
jbe 0x405d99
mov eax, ebx
call fcn.00419b72
ret 0x10

Function at 0x405fb9
Capabilities:
Query environment variable

Disassembly:
push 0x1c
mov eax, 0x42ffe6
call fcn.00419a9a
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
call fcn.004017c0
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
call fcn.00401344
push esi
mov esi, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401039
push 0xffffffffffffffff
mov ecx, edi
call fcn.004011e5
lea ecx, [ebp - 0x28]
call fcn.00412e7b
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov dword [ebp - 4], 1
je 0x406071
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00412f13
test eax, eax
je 0x406071
lea ecx, [ebp - 0x28]
call fcn.00412b7b
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.00413184
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401494
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401039
lea ecx, [ebp - 0x28]
call fcn.00412a95
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412ea4
xor eax, eax
inc eax
jmp 0x40607f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412ea4
xor eax, eax
call fcn.00419b72
ret 4
Function at 0x406576
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430053
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.0041a0a0
mov eax, dword [0x440fd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1050], ecx
call fcn.0040123a
xor ebx, ebx
mov dword [ebp - 0x103c], ebx
mov esi, dword [esi]
lea ecx, [ebp - 0x103c]
mov dword [ebp - 4], ebx
call fcn.0040233a
push eax
push ebx
push esi
call sub.msi.dll_MsiOpenProductW
test eax, eax
jne 0x406715
push str.SELECT__Message__FROM__Error__WHERE_Error.Error
lea ecx, [ebp - 0x1048]
call fcn.00401ab4
push 9
xor eax, eax
pop ecx
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0xa
stosw word es:[edi], ax
push 0x14
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0041a3bd
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1048]
call fcn.00403eab
mov dword [ebp - 0x1040], ebx
mov dword [ebp - 0x1044], ebx
mov esi, dword [ebp - 0x1048]
mov edi, dword [ebp - 0x103c]
lea ecx, [ebp - 0x1040]
mov byte [ebp - 4], 3
call fcn.0040233a
push eax
push esi
push edi
call sub.msi.dll_MsiEnumClientsA
test eax, eax
jne 0x4066e1
push ebx
push dword [ebp - 0x1040]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x4066e1
mov esi, dword [ebp - 0x1040]
lea ecx, [ebp - 0x1044]
call fcn.0040233a
push eax
push esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x4066e1
push 0xffe
mov word [ebp - 0x1038], ax
lea eax, [ebp - 0x1036]
push ebx
push eax
call fcn.00419e20
add esp, 0xc
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1038]
push eax
push 1
push dword [ebp - 0x1044]
mov dword [ebp - 0x104c], 0x800
call sub.msi.dll_MsiRecordSetStreamA
test eax, eax
jne 0x4066e1
mov ecx, dword [ebp - 0x1050]
lea eax, [ebp - 0x1038]
push eax
call fcn.00401a16
cmp dword [ebp - 0x1044], ebx
je 0x4066f4
push dword [ebp - 0x1044]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x1040], ebx
je 0x406707
push dword [ebp - 0x1040]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x1048]
add ecx, 0xfffffff0
call fcn.00401039
cmp dword [ebp - 0x103c], ebx
je 0x406728
push dword [ebp - 0x103c]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419a8b
leave
ret
Function at 0x40678d
Capabilities:
Get common file path

Disassembly:
push 0x18
mov eax, 0x43008b
call fcn.00419a9a
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xb4], ebx
je 0x40688a
mov eax, dword [esi + 0xf0]
cmp eax, dword [0x436db8]
jne 0x406861
call fcn.00408a1f
push eax
lea ecx, [ebp - 0x10]
call fcn.00401212
mov edi, 0x104
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00401344
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4067f6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401039
jmp 0x40688a
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004011e5
push str.BootStrap.log
lea ecx, [ebp - 0x10]
call fcn.00403eab
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x24]
call fcn.0040652c
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x24]
push edx
lea ecx, [esi + 0xec]
mov eax, dword [ecx]
push 0x1021
push edi
mov byte [ebp - 4], 1
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x24], vtable.CFileException.0
test eax, eax
jne 0x406850
call fcn.00401039
lea ecx, [edi - 0x10]
jmp 0x4067ec
call fcn.00401039
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00401039
lea edi, [esi + 0xa4]
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x40688a
add esi, 0xec
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x54]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov ecx, edi
call fcn.0040123a
call fcn.00419b72
ret
Function at 0x406890
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x28
mov eax, 0x4300be
call fcn.00419a9a
lea esi, [ecx + 0xe8]
mov edi, 0x104
push edi
mov ecx, esi
call fcn.00401344
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4069ab
push 0xffffffffffffffff
mov ecx, esi
call fcn.004011e5
push esi
lea ecx, [ebp - 0x10]
call fcn.004017c0
xor ebx, ebx
push edi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00401344
push eax
push ebx
push 0x4346d4
lea ecx, [ebp - 0x10]
call fcn.00405b54
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0x10]
or edi, 0xffffffff
add ecx, 0xfffffff0
mov dword [ebp - 4], edi
call fcn.00401039
push edi
mov ecx, esi
call fcn.004011e5
lea ecx, [ebp - 0x20]
call fcn.004135d8
push ebx
push edi
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.0040652c
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push ecx
push 0x1001
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.004139bf
test eax, eax
jne 0x40694c
mov ecx, esi
call fcn.0040123a
jmp 0x40698e
push 0x4346b0
push 0x87
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041330e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x34], vtable.CFileException.0
call fcn.00401039
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.004136b3
call fcn.00419b72
ret

Function at 0x406a5c
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x42fa28
call fcn.00419a9a
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
xor ebx, ebx
xor esi, esi
call fcn.00401ab4
mov eax, dword [ebp - 0x14]
mov edi, dword [eax - 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406ada
mov eax, dword [ebp + 0x18]
cmp eax, 1
je 0x406ab1
cmp eax, 2
je 0x406ab1
push edi
jmp 0x406ab5
lea ecx, [edi + edi]
push ecx
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x406aff
mov edi, 0x4423fc
push str.Failed_to_register_value:
mov ecx, edi
call fcn.00401a16
push dword [ebp + 0x14]
mov ecx, edi
call fcn.00403eab
mov ecx, 0x442358
call fcn.0040678d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401039
mov eax, esi
call fcn.00419b72
ret