joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f9edc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword gs:[0x58]
xor ebx, ebx
mov dword [rbp + 0x90], ebx
mov rdi, rcx
mov qword [rcx + 8], rdx
mov rsi, rdx
mov ecx, 0x18
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x14017c638], eax
jg 0x1400fa121
mov rax, qword [0x14017c620]
mov r12d, 2
test rax, rax
jne 0x1400f9f45
xor al, al
jmp 0x1400f9fb4
lea rdx, [rbp + 0x90]
mov rcx, rsi
call rax
test eax, eax
jne 0x1400f9fab
cmp dword [0x14017c080], r12d
jg 0x1400f9f97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r8d, 0x4b
call fcn.140068d00
lea rdx, [0x140150ed0]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 8
test bl, 8
je 0x1400f9f41
and ebx, 0xfffffff7
lea rcx, [rsp + 0x60]
call fcn.140068d80
jmp 0x1400f9f41
cmp dword [rbp + 0x90], ebx
setne al
mov byte [rdi + 0x89], al
test al, al
je 0x1400f9fc7
mov byte [rdi + 0x88], 0
jmp 0x1400f9fe1
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x30], 9
sete al
mov byte [rdi + 0x88], al
mov dl, byte [rdi + 0x89]
lea rax, [rdi + 0x38]
lea r14, [rdi + 0x30]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rdi
mov rcx, rsi
call fcn.1400faf6c
test al, al
jne 0x1400fa052
cmp dword [0x14017c080], r12d
jg 0x1400fa03c
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x22d
lea rcx, [rsp + 0x60]
or ebx, 1
call fcn.1400681c0
lea rdx, str.GetProcessBasicInformation_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test bl, 1
je 0x1400fa04b
lea rcx, [rsp + 0x60]
call fcn.140068220
xor al, al
jmp 0x1400fa104
cmp byte [rdi + 0x88], 0
mov r8, rdi
mov rdx, qword [r14]
mov rcx, rsi
je 0x1400fa06b
call fcn.1400fb184
jmp 0x1400fa070
call fcn.1400fb32c
test al, al
jne 0x1400fa0af
cmp dword [0x14017c080], r12d
jg 0x1400fa0aa
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x236
lea rcx, [rsp + 0x60]
or ebx, r12d
call fcn.1400681c0
lea rdx, str.ReadProcessData_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test r12b, bl
jmp 0x1400fa03f
mov dl, byte [rdi + 0x88]
mov r8, rdi
mov rcx, rsi
call fcn.1400f9698
test al, al
jne 0x1400fa102
cmp dword [0x14017c080], r12d
jg 0x1400fa0fa
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x23b
lea rcx, [rsp + 0x60]
or ebx, 4
call fcn.1400681c0
lea rdx, str.ReadMemoryInfo_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test bl, 4
jmp 0x1400fa03f
mov al, 1
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
lea rcx, [0x14017c638]
call fcn.140111a38
cmp dword [0x14017c638], 0xffffffff
jne 0x1400f9f2f
lea rdx, str.::IsWow64Process
lea rcx, str.kernel32.dll
call fcn.1400b64b4
lea rcx, [0x14017c638]
mov qword [0x14017c620], rax
call fcn.1401119d8
jmp 0x1400f9f2f
Function at 0x1400fc850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140175e00]
mov rdi, r8
cmp rax, r8
mov rsi, rdx
mov rbx, rcx
cmovb edi, eax
jmp 0x1400fc899
mov eax, dword [rsp + 0x50]
cmp eax, 0xffffffff
jne 0x1400fc881
int3
test eax, eax
jne 0x1400fc8bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x1400fc8cf
mov rdx, rsi
mov rcx, rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400fc877
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
jmp 0x1400fc8bf

Function at 0x1400fd28c
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x140
xor ebx, ebx
lea rdx, [rax + 0x10]
mov dword [rsp + 0x158], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400fd306
cmp dword [0x14017c080], 2
jg 0x1400fd2f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9d, [rbx + 2]
mov r8d, 0x102
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.140068d00
lea rdx, [0x14015f1f0]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 1
test bl, 1
je 0x1400fd300
lea rcx, [rsp + 0x30]
call fcn.140068d80
or rbx, 0xffffffffffffffff
jmp 0x1400fd30e
mov rbx, qword [rsp + 0x158]
mov rax, qword [0x14017c420]
test rax, rax
jne 0x1400fd339
xor edx, edx
lea r9d, [rax + 0x32]
mov r8d, 0x1400000
lea rcx, str.Crashpad.CrashReportSize
call fcn.140051900
mov qword [0x14017c420], rax
mov r8, qword [rax]
mov edx, ebx
mov rcx, rax
add rsp, 0x140
pop rbx
jmp qword [r8 + 0x20]
Function at 0x14010f2e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateKey
mov rcx, rdi
mov qword [0x140176400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeleteKey
mov rcx, rdi
mov qword [0x140176408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenKeyEx
mov rcx, rdi
mov qword [0x140176410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rdi
mov qword [0x140176418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryValueKey
mov rcx, rdi
mov qword [0x140176420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetValueKey
mov rcx, rdi
mov qword [0x140176428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [0x140176430], rax
cmp qword [0x140176400], rbx
je 0x14010f50c
cmp qword [0x140176408], rbx
je 0x14010f50c
cmp qword [0x140176418], rbx
je 0x14010f50c
cmp qword [0x140176410], rbx
je 0x14010f50c
cmp qword [0x140176420], rbx
je 0x14010f50c
cmp qword [0x140176428], rbx
je 0x14010f50c
test rax, rax
je 0x14010f50c
lea rdx, str.RtlFormatCurrentUserKeyPath
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x14010f50c
test rax, rax
je 0x14010f50c
lea rcx, [rsp + 0x20]
call rsi
test eax, eax
js 0x14010f50c
mov rdx, qword [rsp + 0x28]
lea rsi, [0x140176440]
mov ebp, 0xff
mov rcx, rsi
mov r8d, ebp
call fcn.140120600
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bx
jne 0x14010f465
mov r8, rbp
lea rdx, [0x14014ba54]
sub r8, rax
mov rcx, rsi
call fcn.140120600
mov rcx, qword [rsp + 0x28]
mov edx, 0x5c
call fcn.140113340
mov r8, rbp
lea rcx, [0x140176640]
lea rdx, [rax + 2]
call fcn.140120680
lea rcx, [rsp + 0x20]
call rdi
call fcn.14010f530
lea rcx, str.kernel32.dll
mov byte [0x140176439], al
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140150ed0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14010f4fb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call rdi
test eax, eax
je 0x14010f4fb
cmp dword [rsp + 0x40], ebx
setne bl
mov byte [0x14017643a], bl
mov al, 1
mov byte [0x140176438], 1
jmp 0x14010f50e
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140003cac
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x140015070]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebp, ebp
mov rbx, rcx
test rcx, rcx
je 0x140003e66
lea rax, [rsp + 0x30]
mov word [rcx], bp
test rax, rax
je 0x140003e58
lea rax, [rsp + 0x30]
lea edx, [rbp + 0x2c]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov word [rsp + 0x30], bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r11d, eax
cmp eax, 0x80004005
jne 0x140003d3a
lea rax, [rsp + 0x30]
lea edx, [rbp + 0x2b]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r11d, eax
mov r12d, 0x8000ffff
test r11d, r11d
js 0x140003d4e
cmovne r11d, r12d
test r11d, r11d
jns 0x140003d5c
mov word [rsp + 0x30], bp
test r11d, r11d
js 0x140003e5e
lea rdx, str.Microsoft_SharedVSTO
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x140003d7a
mov r11d, r12d
jmp 0x140003e5e
lea rsi, [rsp + 0x30]
mov edi, 0x104
mov rcx, rbx
sub rsi, rbx
mov edx, edi
mov r11d, ebp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140003db0
movzx eax, word [rsi + rcx]
test ax, ax
je 0x140003db0
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140003d8f
test rdx, rdx
jne 0x140003dbf
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], bp
test r11d, r11d
js 0x140003e5e
lea rdx, str.10.0VSTOInstaller.exe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140003d72
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov r11d, ebp
test eax, eax
jne 0x140003e61
mov rcx, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x140003e13
movzx eax, word [rsi + rcx]
test ax, ax
je 0x140003e13
mov word [rcx], ax
add rcx, 2
dec rdi
jne 0x140003df2
test rdi, rdi
jne 0x140003e22
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], bp
test r11d, r11d
js 0x140003e5e
lea rdx, str.9.0VSTOInstaller.exe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140003d72
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140003d72
mov r11d, ebp
jmp 0x140003e61
mov r11d, 0x80004003
mov word [rbx], bp
mov eax, r11d
jmp 0x140003e6b
mov eax, 0x80004003
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140004050
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x14000495c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400047c4
Function at 0x401008
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and qword [rax - 0x48], 0
and dword [rax + 0x10], 0
mov dword [rax - 0x50], 0x80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x58], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x40114a
mov rcx, rax
call fcn.00401b04
mov rbx, rax
test rax, rax
jne 0x40106b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40114a
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.00401288
lea rcx, [rsp + 0x40]
call fcn.004016f0
mov edx, dword [rsp + 0x40]
cmp edx, 0xc
jne 0x401096
movzx ecx, ax
add cx, cx
add ax, cx
jmp 0x40109a
shl ax, 2
movzx eax, ax
add eax, edx
cmp eax, edx
jb 0x401141
add eax, dword [rsp + 0x54]
cmp eax, dword [rsp + 0x54]
jb 0x401141
mov edx, eax
mov r8d, 0x42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov rsi, rax
test rax, rax
jne 0x4010d9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x401133
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov r11, rax
call fcn.004016f0
cmp dword [rcx], 0xc
jne 0x4010fd
movzx ecx, ax
add cx, cx
add ax, cx
jmp 0x401101
shl ax, 2
movzx ecx, word [r11]
mov r8d, dword [rsp + 0x54]
and qword [rsp + 0x20], 0
add rcx, r11
movzx edx, ax
lea r9, [rsp + 0x88]
add rdx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x40114c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x40272c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x40], di
call fcn.00449860
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4027f1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, str.InstallerLocation
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x104
lea rcx, [rsp + 0x40]
cmp ebx, edi
jne 0x4027fb
lea r8, [0x004990a8]
call fcn.00444f54
jmp 0x402807
mov edx, 0x104
lea rcx, [rsp + 0x40]
lea r8, str.msi.dll
call fcn.004444bc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x40283c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r15d, r8d
mov r12d, edx
mov r13d, ecx
lea rdx, str.Checking_Windows_Installer_version...
mov rcx, qword [0x004c5758]
call fcn.00429b54
xor ebx, ebx
mov r14b, bl
mov edi, VarUI4FromDisp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.00449860
mov dword [rsp + 0x60], edi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edi, [rbx + 1]
cmp eax, ebx
je 0x4028d9
cmp dword [rsp + 0x70], 2
jne 0x4028d9
cmp dword [rsp + 0x64], 5
jne 0x4028cf
cmp dword [rsp + 0x68], edi
jae 0x4028d6
cmp dword [rsp + 0x64], 5
jbe 0x4028d9
mov r14b, dil
call fcn.0040272c
mov rsi, rax
cmp rax, rbx
je 0x4029fd
lea rdx, str.msi.dll_loaded_ok
mov rcx, qword [0x004c5758]
call fcn.00429b54
lea rdx, str.DllGetVersion
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
cmp rax, rbx
je 0x4029ed
xor edx, edx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x30]
call fcn.00449860
mov dword [rsp + 0x30], 0x14
lea rcx, [rsp + 0x30]
call rbp
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, r13d
lea rdx, str.Looking_for:__d._d._d
mov rcx, qword [0x004c5758]
call fcn.0042a050
mov r11d, dword [rsp + 0x3c]
mov dword [rsp + 0x20], r11d
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
lea rdx, str.Found:__d._d._d
mov rcx, qword [0x004c5758]
call fcn.0042a050
mov r11d, dword [rsp + 0x34]
cmp r11d, r13d
setb dl
cmp r11d, r13d
jne 0x402999
cmp dword [rsp + 0x38], r12d
jae 0x402999
mov cl, dil
jmp 0x40299b
mov cl, bl
cmp r11d, r13d
jne 0x4029b3
cmp dword [rsp + 0x38], r12d
jne 0x4029b3
cmp dword [rsp + 0x3c], r15d
jae 0x4029b3
mov al, dil
jmp 0x4029b5
mov al, bl
cmp dl, bl
jne 0x4029d8
cmp cl, bl
jne 0x4029d8
cmp al, bl
jne 0x4029d8
lea rdx, str.Windows_Installer_version_ok
mov rcx, qword [0x004c5758]
call fcn.00429b54
mov edi, ebx
jmp 0x4029f2
lea rdx, str.Detected_old_Windows_Installer
mov rcx, qword [0x004c5758]
call fcn.00429b54
jmp 0x4029f2
mov edi, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402a15
lea rdx, str.Cannot_find_Windows_Installer.
mov rcx, qword [0x004c5758]
call fcn.00429b54
mov edi, 2
cmp r14b, bl
je 0x402a69
cmp edi, ebx
je 0x402a69
cmp r13d, 2
jne 0x402a69
mov ecx, 0x840
call fcn.004443a8
mov qword [rsp + 0x50], rax
cmp rax, rbx
je 0x402a52
lea r9, str.Cannot_detect_Windows_Installer_2.0_or_higher_on_Windows_XP_or_higher._You_need_to_repair_operating_system_to_reinstall_Windows_Installer.
mov edx, 0x1003
mov r8d, edx
mov rcx, rax
call fcn.00401de0
mov rbx, rax
mov qword [rsp + 0x48], rbx
lea rdx, [0x004bc148]
lea rcx, [rsp + 0x48]
call fcn.00449f60
int3
mov r8d, edi
lea rdx, str.Finished_Checking_Windows_Installer_version._Return_code__d
mov rcx, qword [0x004c5758]
call fcn.0042a050
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x406ac0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov rbx, r8
mov r14, rcx
lea r12d, [rbp + 1]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, rbx
mov rcx, r14
lea r13d, [rax + 0x3a98]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edi, eax
test eax, eax
je 0x406b88
mov r15d, 0x3e8
cmp dword [rbx + 4], 1
je 0x406b88
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp r13d, eax
jb 0x406b7b
test r12d, r12d
je 0x406b2d
mov ebp, dword [rbx + 4]
xor r12d, r12d
jmp 0x406b3c
cmp ebp, dword [rbx + 4]
je 0x406b37
mov ebp, dword [rbx + 4]
jmp 0x406b3c
cmp dword [rbx + 0x14], esi
jb 0x406b77
mov esi, dword [rbx + 0x14]
mov eax, 0xcccccccd
mul dword [rbx + 0x18]
mov eax, 0x2710
shr edx, 3
cmp edx, r15d
cmovb edx, r15d
cmp edx, eax
cmova edx, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edi, eax
test eax, eax
jne 0x406b0f
jmp 0x406b88
xor edi, edi
jmp 0x406b88
mov ecx, 0x5b4
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x409c28
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, rdx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov r13b, bl
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
lea rsi, [rcx + 0x158]
cmp dword [rsi], ebx
jne 0x409c86
mov r12d, ebx
mov dword [rsp + 0x48], ebx
jmp 0x409c99
mov ecx, dword [rcx + 0x138]
call qword [rsi + 0x88]
mov r12d, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], rbx
mov word [rsp + 0x90], bx
mov r8d, 0x8d
lea rdx, str.SELECT__FROM__Feature__WHERE__Feature_._Feature_Parent____AND___Feature_._Display__IS_NULL_OR__Feature_._Display___0___AND__Level_____0
lea rcx, [rsp + 0x88]
call fcn.00404e54
nop
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
lea r9, [rsp + 0x40]
mov edx, r12d
mov rcx, rsi
call fcn.0040391c
mov edi, eax
cmp eax, ebx
je 0x409d79
mov ecx, 0x840
call fcn.004443a8
mov rcx, rax
mov qword [rsp + 0x68], rax
cmp rax, rbx
je 0x409d63
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rax, qword [rsp + 0x90]
mov dword [rsp + 0x38], edi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, str.MsiDatabaseOpenView__d___s___d__returned__d
mov edx, 0x19dc
mov r8d, 0x654
call fcn.00401de0
mov rbx, rax
mov qword [rsp + 0x58], rbx
lea rdx, [0x004bc148]
lea rcx, [rsp + 0x58]
call fcn.00449f60
xor r8d, r8d
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call fcn.00403950
mov edi, eax
cmp eax, ebx
je 0x409de6
mov ecx, 0x840
call fcn.004443a8
mov rcx, rax
mov qword [rsp + 0x68], rax
cmp rax, rbx
je 0x409dd0
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, str.MsiViewExecute__d___d__returned__d
mov edx, 0x19dc
mov r8d, 0x654
call fcn.00401de0
mov rbx, rax
mov qword [rsp + 0x70], rbx
lea rdx, [0x004bc148]
lea rcx, [rsp + 0x70]
call fcn.00449f60
lea r8, [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call fcn.00403980
cmp eax, ebx
jne 0x409e5b
mov r8d, 1
mov edx, dword [rsp + 0x44]
mov rcx, rsi
call fcn.004039b0
mov rdx, rax
cmp rax, rbx
je 0x409e4d
mov r13b, 1
mov byte [rsp + 0x4c], r13b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r14
call fcn.00404a40
mov r8d, 1
lea rdx, [0x0049a2dc]
mov rcx, r14
call fcn.00404a40
mov edx, dword [rsp + 0x44]
mov rcx, rsi
call fcn.0040382c
jmp 0x409de6
mov edx, dword [rsp + 0x40]
cmp edx, ebx
je 0x409e6b
mov rcx, rsi
call fcn.0040382c
cmp r12d, ebx
je 0x409e7c
mov edx, r12d
mov rcx, rsi
call fcn.0040382c
nop
cmp qword [rsp + 0xa8], 8
jb 0x409e94
mov rcx, qword [rsp + 0x90]
call fcn.00443d3c
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], rbx
mov word [rsp + 0x90], bx
mov al, r13b
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x40bef0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x300
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rdx
lea rdx, str.Entering_CMsiInstaller::GetMscoreeVersionFromSystem
mov rcx, qword [0x004c5758]
call fcn.00429b54
xor esi, esi
mov word [rsp + 0x70], si
xor edx, edx
lea r8d, [rsi + 0x62]
lea rcx, [rsp + 0x72]
call fcn.00449860
mov word [rsp + 0xe0], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xe2]
call fcn.00449860
mov dword [rsp + 0x30], 0x32
mov edi, 0x105
mov edx, edi
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
je 0x40c0e8
cmp eax, edi
ja 0x40c0e8
lea ebp, [rsi + 7]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xe0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.00404e54
nop
lea r8d, [rsi + 0xc]
lea rdx, str.mscoree.dll
lea rcx, [rsp + 0x40]
call fcn.00404a40
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
call sub.msi.dll_MsiMessageBoxW
cmp eax, esi
je 0x40c064
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rdx, str.WARNING:_Cannot_obtain_MSCOREE.DLL_version_at__s
mov rcx, qword [0x004c5758]
call fcn.0042a050
nop
cmp qword [rsp + 0x60], 8
jb 0x40c04e
mov rcx, qword [rsp + 0x48]
call fcn.00443d3c
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
xor al, al
jmp 0x40c0ea
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea r9, [rsp + 0x70]
lea rdx, str.Version_of__s_is__s
mov rcx, qword [0x004c5758]
call fcn.0042a050
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.00404e54
lea rdx, str.Leaving_CMsiInstaller::GetMscoreeVersionFromSystem
mov rcx, qword [0x004c5758]
call fcn.00429b54
nop
cmp qword [rsp + 0x60], 8
jb 0x40c0d5
mov rcx, qword [rsp + 0x48]
call fcn.00443d3c
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov al, 1
jmp 0x40c0ea
xor al, al
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret