joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e560
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00414120
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42e599
jmp 0x42e6fc
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42e5d5
jmp 0x42e6f6
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00422b70
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42e6e7
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.004082c0
add esp, 4
mov dword [ebp - 0x10], eax
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00409030
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [edi], 0xa5
mov byte [edi + 1], 0x4b
mov byte [edi + 2], 0x41
mov byte [edi + 3], 0x79
mov byte [edi + 4], 0x48
mov byte [edi + 5], 0x44
mov byte [edi + 6], 0x4d
mov byte [edi + 7], 0x7f
mov byte [edi + 8], 0x4a
mov byte [edi + 9], 0x81
mov byte [edi + 0xa], 0x44
mov byte [edi + 0xb], 0x49
mov byte [edi + 0xc], 0x46
mov byte [edi + 0xd], 0xd3
xor eax, eax
cmp eax, 0xe
jae 0x42e6b1
movzx edx, byte [edi + eax]
mov ecx, eax
add ecx, 0x56
mov esi, 0x1bdf82a9
sub esi, eax
mov ebx, 0x1bdf82a9
sub ebx, eax
or esi, ebx
xor esi, 0xffffffff
mov ebx, edx
or ebx, esi
and ecx, edx
mov edx, ebx
xor edx, ecx
xor ecx, ebx
shl ecx, 1
sub ecx, edx
add cl, 0x50
mov byte [edi + eax], cl
add eax, 1
jmp 0x42e675
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.004091b0
mov bl, al
and bl, 1
jmp 0x42e6d4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004082d0
add esp, 4
jmp 0x42e6e7
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
xor esi, esi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
nop
nop
nop
cmp word [ecx + esi], 0
lea esi, [esi + 2]
jne 0x433130
cmp esi, 2
je 0x433154
lea eax, [esi - 2]
mov edx, eax
sar edx, 1
test al, 2
jne 0x43315b
cmp esi, 4
jne 0x43318e
jmp 0x4331fa
mov eax, edi
jmp 0x4331fa
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
mov edi, eax
cmp esi, 4
je 0x4331fa
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0xfefffe6c
mov ebx, edi
and ebx, 0x1000193
or edi, 0x1000193
imul edi, ebx
xor ebx, 0x1000193
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x4331a0
pop esi
pop edi
pop ebx
ret
Function at 0x4382d0
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
call fcn.004382c0
xor ecx, ecx
cmp dword [esp + 0x1c], 0
sete cl
jmp dword [ecx*4 + 0x4421a8]

Function at 0x4385c0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
movzx eax, word [ecx]
xor edx, edx
cmp eax, 0x5a4d
setne dl
xor eax, eax
jmp dword [edx*4 + 0x442298]
Function at 0x408199
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x46e8b6
call fcn.00434a16
mov esi, ecx
mov edx, dword [ebp + 0x18]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x48], edx
lea edx, [ebp - 0x40]
push edx
push 0x20019
push ebx
push eax
push ecx
mov dword [ebp - 0x44], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x4081ef
mov ecx, dword [esi + 0x18]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
push str.Failed_to_open_registry_key___._Error_code_.
push 3
call fcn.0040381c
xor al, al
jmp 0x408249
lea eax, [ebp - 0x40]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x3c]
push eax
call fcn.00402abe
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x48]
lea eax, [ebp + 0x14]
push eax
push ebx
push edi
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x40823d
mov ecx, dword [esi + 0x18]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
push str.Failed_to_query_registry_key___._Error_code_.
push 3
call fcn.0040381c
jmp 0x40823f
mov bl, 1
lea ecx, [ebp - 0x38]
call fcn.0040779e
mov al, bl
call fcn.004349c0
ret 0x18
Function at 0x4143ae
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x274
mov eax, 0x46fbb5
call fcn.00434a16
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4143ca
mov eax, dword [esi]
jmp 0x4143cc
mov eax, esi
push str.fileLogger
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x250], eax
call fcn.0040701e
lea eax, [ebp - 0x234]
xor edi, edi
push eax
lea eax, [ebp - 0x258]
mov dword [ebp - 4], edi
push eax
call fcn.0041b7f7
pop ecx
pop ecx
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 1
push ecx
mov ecx, dword [eax]
push str.Cleaning_temporary_folder_at___.
push 2
call fcn.0040378a
mov ecx, dword [ebp - 0x254]
test ecx, ecx
je 0x414424
call fcn.00408d35
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
push edi
push 1
call fcn.0040a6f3
cmp dword [esi + 0x14], 8
jb 0x414440
mov eax, dword [esi]
jmp 0x414442
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41455e
push 0x20c
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.0044e660
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x414470
mov eax, dword [esi]
jmp 0x414472
mov eax, esi
push eax
push 0x478fa0
lea eax, [ebp - 0x21c]
push 0x208
push eax
call fcn.0041697c
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x270], eax
add esp, 0x10
mov eax, 0x414
mov dword [ebp - 0x274], 3
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x278]
mov dword [ebp - 0x26c], edi
push eax
mov dword [ebp - 0x266], edi
mov dword [ebp - 0x262], edi
mov dword [ebp - 0x25e], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x41455e
cmp dword [esi + 0x14], 8
jb 0x4144eb
mov esi, dword [esi]
push str.fileLogger
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x254], esi
call fcn.0040701e
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0041b7f7
pop ecx
pop ecx
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x254]
push ecx
mov ecx, dword [eax]
push str.Failed_to_remove_temporary_folder___._Error_code:_
push 4
call fcn.0040381c
mov ecx, dword [ebp - 0x27c]
test ecx, ecx
je 0x41454c
call fcn.00408d35
push edi
push 1
lea ecx, [ebp - 0x24c]
call fcn.0040a6f3
mov al, 1
jmp 0x414560
xor al, al
call fcn.004349c0
ret

Function at 0x4147eb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x46fc69
call fcn.004349e2
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x414842
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x414846
cmp eax, 3
je 0x414846
sub esp, 0x18
mov ecx, esp
push 0x474228
call fcn.004070c0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00414d7f
add esp, 0x1c
jmp 0x414860
test al, 0x10
jne 0x414864
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00407098
call fcn.0041487a
add esp, 0x18
test al, al
je 0x414864
mov bl, 1
jmp 0x414866
xor bl, bl
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040a748
mov al, bl
call fcn.004349ab
ret
Function at 0x41487a
Capabilities:
Create directory

Disassembly:
push 0x20
mov eax, 0x46fc94
call fcn.00434a16
and dword [ebp - 4], 0
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
xor edi, edi
inc esi
push 0x478e2c
call fcn.004501bb
pop ecx
push eax
lea eax, [edi + 1]
push eax
push 0x478e2c
lea ecx, [ebp + 8]
call fcn.0041a7a1
mov edi, eax
lea ecx, [ebp + 8]
push edi
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0041e96a
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x4148ef
call ebx
cmp eax, 0xb7
je 0x4148ef
test esi, esi
je 0x41491a
dec esi
jmp 0x4148c7
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040a748
cmp edi, 0xffffffff
jne 0x414895
xor bl, bl
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040a748
mov al, bl
call fcn.004349c0
ret
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00407098
call ebx
push eax
call fcn.00414d7f
add esp, 0x1c
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040a748
mov bl, 1
jmp 0x414906

Function at 0x414943
Capabilities:
Check if file exists
Check mutex on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, str.GOG_WEBINSTALLERMUTEX
push ebx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x4149a0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x414999
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
test eax, eax
jne 0x4149a7
sub esp, 0x18
mov ecx, esp
push 0x474228
call fcn.004070c0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00414d7f
add esp, 0x1c
jmp 0x4149a5
call fcn.00414f62
jmp 0x4149a5
call fcn.00415160
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d7f
Capabilities:
Identify system language via api

Disassembly:
push 0x38
mov eax, 0x46fd2f
call fcn.00434a16
xor edi, edi
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call fcn.00415ef3
cmp eax, 0x12
jg 0x414e80
je 0x414e69
sub eax, 4
je 0x414e52
sub eax, 3
je 0x414e3b
sub eax, 3
je 0x414e24
dec eax
sub eax, ebx
je 0x414e0d
sub eax, 4
je 0x414df6
sub eax, ebx
jne 0x414e9f
lea eax, [ebp + 8]
mov esi, 0x476c64
push eax
push ecx
mov eax, esp
mov dword [eax], 0x476c78
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.Installazione_fallita
push eax
push ecx
mov eax, esp
mov dword [eax], str.Impossibile_inizializzare_GOG_Galaxy_Web_Installer._Contatta_support.gog.com_per_ricevere_assistenza._Codice_errore:_.
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, 0x477424
push eax
push ecx
mov eax, esp
mov dword [eax], 0x477458
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.Instalaci
push eax
push ecx
mov eax, esp
mov dword [eax], str.El_instalador_web_de_GOG_Galaxy_no_ha_podido_iniciarse._Visita_support.gog.com_para_recibir_ayuda._C
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.Installation_fehlgeschlagen
push eax
push ecx
mov eax, esp
mov dword [eax], str.GOG_Galaxy_Installationsprogramm_fehlgeschlagen._Hilfe_erh
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, 0x476b74
push eax
push ecx
mov eax, esp
mov dword [eax], 0x476b80
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, 0x476cf4
push eax
push ecx
mov eax, esp
mov dword [eax], str.GOG_____.___support.gog.com___.__:_.
jmp 0x414f15
cmp eax, 0x15
je 0x414f03
cmp eax, 0x19
je 0x414eef
cmp eax, 0x416
je 0x414edb
cmp eax, 0x80a
je 0x414ec7
cmp eax, 0x7c04
je 0x414eb3
lea eax, [ebp + 8]
mov esi, str.Installation_Failed
push eax
push ecx
mov eax, esp
mov dword [eax], str.GOG_Galaxy_Web_Installer_failed_to_initialize._Contact_support.gog.com_for_assistance._Error_code:_.
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, 0x476be8
push eax
push ecx
mov eax, esp
mov dword [eax], 0x476bf8
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.Instalaci
push eax
push ecx
mov eax, esp
mov dword [eax], str.El_instalador_web_de_GOG_Galaxy_no_pudo_iniciarse._Visita_support.gog.com_para_recibir_ayuda._C
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.A_Instala
push eax
push ecx
mov eax, esp
mov dword [eax], str.O_instalador_do_GOG_Galaxy_falhou_ao_iniciar._Entre_em_contato_com_support.gog.com_para_obter_aux
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, 0x4771f0
push eax
push ecx
mov eax, esp
mov dword [eax], 0x477218
jmp 0x414f15
lea eax, [ebp + 8]
mov esi, str.Nieudana_instalacja
push eax
push ecx
mov eax, esp
mov dword [eax], str.Instalator_sieciowy_GOG_Galaxy_nie_uruchomi
lea eax, [ebp - 0x28]
push eax
call fcn.00410bec
add esp, 0xc
lea ecx, [ebp - 0x40]
push eax
call fcn.0042b985
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040a748
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push esi
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00415060
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040a748
push edi
push ebx
lea ecx, [ebp + 0xc]
call fcn.0040a748
call fcn.004349c0
ret
Function at 0x415349
Capabilities:
Write file on windows

Disassembly:
push 0x58
mov eax, 0x46fd6c
call fcn.00434a16
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 0xc]
push str.fileLogger
call fcn.0040701e
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0041b7f7
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 2
push 0
inc ebx
lea ecx, [ebp - 0x28]
push ebx
call fcn.0040a6f3
mov ecx, dword [ebp - 0x64]
push esi
push str.Trying_to_dump_personalized_token_to___
push 2
call fcn.00411741
cmp dword [esi + 0x14], 8
jb 0x4153a7
mov eax, dword [esi]
jmp 0x4153a9
mov eax, esi
xor ecx, ecx
push ecx
push ecx
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x5c], eax
cmp eax, 0xffffffff
jne 0x4153e6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
push str.CreateFile_failed_with_error_
push 4
call fcn.004113c1
jmp 0x415478
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x54]
push eax
call fcn.00410186
and dword [ebp - 0x58], 0
lea eax, [edi + 0x10]
cmp dword [edi + 0x14], 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x54], eax
jb 0x415412
mov edi, dword [edi]
push 0
lea ecx, [ebp - 0x58]
push ecx
push dword [eax]
push edi
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x415447
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
push esi
push str.Couldnt_write_to_file___._Error_code_.
push 4
call fcn.004117d2
jmp 0x415470
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp dword [ebp - 0x58], eax
je 0x41546e
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push str.Bytes_written_to_file____does_not_match_expected_size._Written_____expected___
push 4
call fcn.00411866
jmp 0x415470
xor bl, bl
lea ecx, [ebp - 0x50]
call fcn.0040779e
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x415484
call fcn.00408d35
mov al, bl
call fcn.004349c0
ret
Function at 0x41571a
Capabilities:
Get common file path

Disassembly:
push 0x2c8
mov eax, 0x46fe59
call fcn.00434a16
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x4157b6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push str.fileLogger
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x2cc], eax
call fcn.0040701e
lea eax, [ebp - 0x268]
xor esi, esi
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], esi
push eax
call fcn.0041b7f7
pop ecx
pop ecx
lea ecx, [ebp - 0x2cc]
xor ebx, ebx
push ecx
mov ecx, dword [eax]
inc ebx
push str.Getting_temporary_path_failed._Error_code_.
push 4
mov byte [ebp - 4], bl
call fcn.004112ac
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x4157a2
call fcn.00408d35
push esi
push ebx
lea ecx, [ebp - 0x268]
call fcn.0040a6f3
mov al, bl
jmp 0x415903
lea eax, [ebp - 0x18]
push 5
push eax
call fcn.0041b6dc
pop ecx
pop ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x280]
call fcn.0040701e
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.0041de69
mov ebx, eax
xor eax, eax
mov byte [ebp - 4], 3
xor esi, esi
mov dword [ebp - 0x23c], 7
push str.GalaxyInstaller_
mov dword [ebp - 0x240], esi
mov word [ebp - 0x250], ax
call fcn.004501bb
add esp, 0xc
lea ecx, [ebp - 0x250]
push eax
push str.GalaxyInstaller_
call fcn.0040acd8
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], esi
mov word [ebp - 0x238], ax
cmp word [ebp - 0x220], ax
jne 0x415855
mov eax, esi
jmp 0x415862
lea eax, [ebp - 0x220]
push eax
call fcn.004501bb
pop ecx
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040acd8
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.004026c6
push ebx
push eax
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 6
push eax
call fcn.004026c6
add esp, 0x18
mov ecx, edi
push eax
call fcn.0042b985
xor ebx, ebx
lea ecx, [ebp - 0x298]
push esi
inc ebx
push ebx
call fcn.0040a748
push esi
push ebx
lea ecx, [ebp - 0x2b0]
call fcn.0040a748
push esi
push ebx
lea ecx, [ebp - 0x238]
call fcn.0040a748
push esi
push ebx
lea ecx, [ebp - 0x250]
call fcn.0040a748
push esi
push ebx
lea ecx, [ebp - 0x2c8]
call fcn.0040a748
push esi
push ebx
lea ecx, [ebp - 0x280]
call fcn.0040a6f3
xor al, al
call fcn.004349c0
ret
Function at 0x415ef3
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
movzx edx, al
cmp edx, 0x16
je 0x415f2d
push 4
pop ecx
cmp edx, ecx
jne 0x415f18
mov edx, 0x7c04
cmp eax, edx
cmove ecx, edx
mov eax, ecx
ret
push esi
push 0xa
pop esi
cmp edx, esi
jne 0x415f2e
mov ecx, 0x80a
cmp eax, ecx
cmove esi, ecx
mov eax, esi
pop esi
ret
mov eax, 0x474590
mov esi, dword [eax]
cmp edx, esi
je 0x415f2a
add eax, ecx
cmp eax, 0x4745c8
jne 0x415f33
push 9
pop eax
pop esi
ret
Function at 0x4169cc
Capabilities:
Identify system language via api

Disassembly:
push 0x44
mov eax, 0x470117
call fcn.00434a16
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00408831
test al, al
jne 0x416a39
push str.fileLogger
lea ecx, [ebp - 0x28]
call fcn.0040701e
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041b7f7
pop ecx
pop ecx
mov ecx, dword [eax]
push str.Windows_7_or_later_not_found___system_not_suitable_for_Galaxy_install.
push 3
mov byte [ebp - 4], 1
call fcn.00403735
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x416a24
call fcn.00408d35
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040a6f3
call fcn.0041524b
mov al, 1
jmp 0x416aa5
mov ecx, esi
call fcn.004087be
test al, al
jne 0x416aa3
mov ecx, esi
call fcn.004087f7
test al, al
jne 0x416aa3
push str.fileLogger
lea ecx, [ebp - 0x40]
call fcn.0040701e
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0041b7f7
pop ecx
pop ecx
mov ecx, dword [eax]
push str..NET_framework_not_found___system_not_suitable_for_Galaxy_install.
push 3
mov byte [ebp - 4], 3
call fcn.00403735
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x416a90
call fcn.00408d35
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040a6f3
call fcn.00415075
jmp 0x416a35
xor al, al
call fcn.004349c0
ret

Function at 0x418716
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 2
mov eax, dword [eax + 0x224]
mov esi, dword [eax + 8]
mov edi, dword [eax + 4]
call fcn.00453f08
push eax
push esi
push 1
push edi
call fcn.004566c5
push 2
call fcn.00453f08
push eax
call fcn.00457849
add esp, 0x1c
pop edi
pop esi
pop ebp
ret 4

Function at 0x41a5ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41a5bb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a5d0
test al, 0x10
jne 0x41a5d0
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41ef4f
Capabilities:
Write file on windows

Disassembly:
push 0x58
mov eax, 0x470ade
call fcn.00434a16
mov edi, ecx
mov eax, dword [ebp + 8]
push dword [edi + 8]
mov eax, dword [eax + 0x224]
mov esi, dword [eax + 8]
push esi
push 1
push dword [eax + 4]
call fcn.004566c5
add esp, 0x10
cmp eax, esi
je 0x41efc5
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0041a5d4
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x64]
push str.Failed_writing_to_file
push eax
call fcn.0040f673
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
call fcn.004501a8
lea ecx, [ebp - 0x34]
push dword [eax]
push esi
call fcn.004134cd
push 0x491da4
lea eax, [ebp - 0x34]
push eax
call fcn.0044e83c
call fcn.004349c0
ret 4
Function at 0x420064
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
test eax, eax
jne 0x42009b
lea eax, [ebp + 0xc]
push eax
push str.Failed_to_find_resource._Resource_id:_.
mov ecx, dword [edi]
push 4
call fcn.004113c1
mov al, 1
jmp 0x4200cf
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esi], eax
test eax, eax
jne 0x4200b5
lea eax, [ebp + 0xc]
push eax
push str.Failed_to_load_resource._Resource_id:_.
jmp 0x42008e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push dword [esi + 4]
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi + 0xc], eax
xor al, al
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4200d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push ebx
push eax
push 2
pop edi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x420105
mov al, 1
jmp 0x420149
cmp dword [ebp - 4], edi
jne 0x420101
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 1
push ecx
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call esi
test eax, eax
je 0x420101
cmp dword [ebp - 4], edi
jne 0x420101
movzx eax, word [ebp + 0xc]
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x420101
cmp dword [ebp - 4], edi
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43740c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x466160
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465e20