joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41769c
Capabilities:
Hide graphical window

Disassembly:
push dword [0x496ca8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4176cc
push 0
push dword [0x496ca8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x496cb0]
push 0
mov ecx, dword [eax + 0x26c]
call fcn.004341ed
ret

Function at 0x4176cd
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x496ca8]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.0042af27
cmp dword [eax], 1
je 0x417737
cmp dword [eax + 4], ebx
je 0x41778c
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41778c
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x496ca8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41be56
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x470393
call fcn.004549fc
sub esp, 0xad4
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xade]
mov word [ebp - 0xae0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xae0]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0xae0]
mov edi, 0x4765e0
mov esi, 0x4765d8
mov dword [ebp - 0x68], edi
test eax, eax
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0xae0]
jne 0x41beba
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, str..mst
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [ebp - 0x3c], edi
test ecx, ecx
mov dword [ebp - 0x1c], esi
jne 0x41bee1
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.00424456
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00401093
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x41bf1a
mov eax, 0x4765fc
lea ecx, [ebp - 0x2e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x41c012
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x41bfec
lea eax, [ebp - 0xae0]
mov dword [ebp - 0x3c], edi
test eax, eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0xae0]
jne 0x41bf6a
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 3
test eax, eax
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x2b4]
jne 0x41bf9a
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x90]
call fcn.004011a9
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.00424456
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00401093
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x41bfd9
mov eax, 0x4765fc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00401093
lea eax, [ebp - 0x2e0]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41bf37
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, ebx
je 0x41c012
push dword [ebp - 0x14]
call eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42f0dc
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x472365
call fcn.004549fc
sub esp, 0x8d0
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x8da]
mov word [ebp - 0x8dc], bx
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x8dc]
lea ecx, [esi + 0x18]
push eax
push 0x494ad8
push str.ClickOncePackage
push str.Startup
call fcn.00402b35
cmp word [ebp - 0x8dc], bx
jne 0x42f13e
xor eax, eax
jmp 0x42f29a
lea eax, [ebp - 0xdc]
mov ecx, esi
push eax
call fcn.0042affa
mov eax, dword [eax + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x42f15b
mov eax, 0x476650
mov edi, 0x4765e0
mov esi, 0x4765d8
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x42f174
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 2
call fcn.00402424
lea eax, [ebp - 0x8dc]
mov dword [ebp - 0x64], edi
test eax, eax
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x8dc]
jne 0x42f1ac
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x64]
call fcn.004011a9
push ebx
lea eax, [ebp - 0xb4]
push ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00411c74
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x8c]
push ecx
mov ecx, eax
call fcn.0040aa61
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.00401d42
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 4
call fcn.00401093
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.00401093
push 4
lea eax, [ebp - 0xd]
sub esp, 0x28
lea ecx, [ebp - 0x38]
mov esi, esp
mov dword [ebp - 0x14], esp
push 1
push eax
call fcn.004303a2
push eax
mov ecx, esi
call fcn.00402d75
call fcn.0043a884
add esp, 0x2c
cmp al, bl
jne 0x42f266
lea eax, [ebp - 0x8dc]
test eax, eax
lea eax, [ebp - 0x8dc]
jne 0x42f25d
mov eax, 0x494ad8
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040b326
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x42f272
mov eax, 0x4765fc
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x3c]
sbb esi, esi
or dword [ebp - 4], 0xffffffff
neg esi
call fcn.00401093
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x434986
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x472e6c
call fcn.004549fc
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x434a91
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4349cf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push str..debug
call fcn.00434ae1
pop ecx
test eax, eax
pop ecx
je 0x4349fb
cmp dword [eax + 0xc], esi
jne 0x4349fb
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x434a4e
push edi
push str..rdata
call fcn.00434ae1
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x434a21
push edi
push str..text
call fcn.00434ae1
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x434a91
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x434a91
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x434a9c
cmp dword [ebp + 8], 0
je 0x434a9c
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x434a95
xor eax, eax
jmp 0x434ad2
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x434abb
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x434ab5
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x434aa6
cmp dword [ebp - 0x10], 0
je 0x434acf
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x434acf
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43623a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, 0x494ad8
push edi
push esi
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x10], edi
call ebx
push esi
push dword [ebp + 0x10]
call ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x4363c1
push esi
call fcn.00456983
push esi
push edi
push eax
mov dword [ebp - 8], eax
call fcn.004550b0
add esp, 0x10
push dword [ebp - 8]
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4363b8
lea eax, [ebp - 0x44]
push 0x34
mov dword [ebp + 8], eax
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004550b0
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp + 8]
push eax
push 0x48c2b8
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4362fc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
shr ecx, 0x10
push edx
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push str._u._u._u._u
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push 0x34
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.004550b0
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4363b8
push 0x7f
mov word [ebp - 0x244], di
mov esi, dword [ebp - 4]
pop ecx
xor eax, eax
lea edi, [ebp - 0x242]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
xor edi, edi
shr esi, 2
test esi, esi
mov dword [ebp + 0xc], eax
jle 0x4363b8
and dword [ebp - 0xc], 0
test edi, edi
jle 0x43635e
add dword [ebp + 0xc], 4
push 4
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push eax
call fcn.004553b0
movzx eax, word [ebp - 0xc]
add esp, 0xc
test edi, edi
push eax
jne 0x43638f
lea eax, [ebp - 0x244]
push 0x48df7c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4363a7
push dword [ebp + 0x10]
lea eax, [ebp - 0x244]
push str._s__u
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 0x10]
call ebx
inc edi
cmp edi, esi
jl 0x436352
push dword [ebp - 8]
call fcn.0045689a
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4365ef
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push dword [0x48ece0]
lea eax, [ebp - 0x800]
push dword [ebp + 8]
push eax
call fcn.0043691c
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
lea eax, [ebp - 0x800]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x436634
xor eax, eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
pop eax
leave
ret
Function at 0x436cfc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x473034
call fcn.004549fc
sub esp, 0xb4
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x7c], 0x4765e0
mov dword [ebp - 0x5c], 0x4765d8
jne 0x436d2e
mov eax, 0x494ad8
lea ecx, [ebp + 0xb]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.004011a9
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004550b0
push 0x44
lea eax, [ebp - 0xc0]
pop esi
push esi
push ebx
push eax
call fcn.004550b0
add esp, 0x18
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xc0], esi
mov word [ebp - 0x90], bx
push 1
pop eax
mov dword [ebp - 0x94], eax
je 0x436d81
mov word [ebp - 0x90], ax
mov edi, dword [ebp - 0x74]
cmp edi, ebx
jne 0x436d8d
mov edi, 0x4765fc
push eax
lea eax, [ebp + 0xf]
mov esi, str.C:Codebasesisdev_srcRuntimeMSISharedSetuputils.cpp
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x436db0
mov eax, 0x4765fc
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0x18]
push str.Attempting_to_launch:__s
push eax
mov dword [ebp - 0x14], 0x4a7
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00401093
push dword [ebp - 0x70]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x7c]
push eax
call fcn.0040b1a5
mov ecx, dword [eax]
mov byte [ebp - 4], 2
mov byte [eax + 4], 1
call fcn.0040afdf
lea ecx, [ebp - 0x2c]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0xc0]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x1c]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.0040b2ad
cmp edi, ebx
je 0x436ed1
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x2c]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
je 0x436e63
cmp eax, 1
jne 0x436e63
push ebx
push ebx
push ebx
lea eax, [ebp - 0x48]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp dword [ebp - 0x44], 0x11
je 0x436e63
cmp dword [ebp - 0x44], 0x10
je 0x436e63
cmp dword [ebp - 0x44], 0x12
jne 0x436e26
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x2c]
mov dword [0x498770], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
lea eax, [ebp + 0xf]
push 1
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 3
cmp eax, ebx
jne 0x436ea2
mov eax, 0x4765fc
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4c8
push edi
push str.Launch_result__d__exit_code__d
push eax
call fcn.0040a580
add esp, 0x10
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00401093
mov esi, dword [ebp - 0x10]
jmp 0x436ed6
mov esi, 0xcccccccc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401093
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x436ef5
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x47305e
call fcn.004549fc
sub esp, 0x8e0
push ebx
push esi
push edi
xor ebx, ebx
push 0x10
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.004550b0
push 0x44
lea eax, [ebp - 0x9c]
pop esi
push esi
push ebx
push eax
call fcn.004550b0
add esp, 0x18
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x9c], esi
mov word [ebp - 0x6c], bx
push 1
pop edi
mov dword [ebp - 0x70], edi
je 0x436f43
mov word [ebp - 0x6c], di
push dword [ebp + 8]
lea eax, [ebp - 0x8ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x58], 0x4765e0
test eax, eax
mov dword [ebp - 0x38], 0x4765d8
lea eax, [ebp - 0x8ec]
jne 0x436f76
mov eax, 0x494ad8
lea ecx, [ebp + 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.004011a9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], ebx
cmp eax, ebx
mov dword [ebp - 0x14], 0x4765fc
je 0x436f98
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xb]
push edi
mov esi, str.C:Codebasesisdev_srcRuntimeMSISharedSetuputils.cpp
push eax
push esi
lea ecx, [ebp - 0xec]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x436fbe
mov eax, 0x4765fc
push dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x4e9
push str.Attempting_to_launch__no_wait_:__s
push eax
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401093
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push ebx
push 0x20
push edi
push ebx
lea eax, [ebp - 0x8ec]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0xd]
push edi
push eax
push esi
lea ecx, [ebp - 0xc4]
call fcn.00401889
mov eax, dword [eax + 8]
mov dword [ebp - 4], 2
cmp eax, ebx
jne 0x43703d
mov eax, 0x4765fc
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4ee
push str.Launch_result__d
push eax
call fcn.0040a580
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0xc4]
call fcn.00401093
cmp dword [ebp + 0xc], ebx
pop edi
pop esi
pop ebx
je 0x437080
push 0x3e8
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x43a884
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x47327a
call fcn.004549fc
sub esp, 0xf4
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 0x30]
mov dword [ebp - 4], esi
test bl, 0x10
je 0x43a8d6
lea ecx, [ebp + 8]
call fcn.00433453
test al, al
je 0x43a8d6
push ebx
lea eax, [ebp + 8]
sub esp, 0x28
mov ecx, esp
mov dword [ebp + 0x30], esp
push 1
push eax
call fcn.0040798e
call fcn.0043ab39
add esp, 0x2c
mov bl, al
jmp 0x43aa53
sub esp, 0x28
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push esi
push eax
mov dword [ecx], 0x476628
mov dword [ecx + 0x20], 0x476620
call fcn.00403c6a
call fcn.004437a7
add esp, 0x28
cmp eax, 0xffffffff
je 0x43a923
test bl, 4
je 0x43a90b
test al, 0x10
je 0x43a91c
test bl, 8
je 0x43aa51
test al, 0x10
je 0x43aa51
mov bl, 1
jmp 0x43aa53
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
cmp esi, 2
je 0x43aa63
cmp esi, 3
je 0x43aa63
push 1
cmp esi, 5
pop ebx
jne 0x43a9d8
lea ecx, [ebp - 0x100]
call fcn.0043aaaa
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 8]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
push eax
call fcn.0040798e
call fcn.00443651
add esp, 0x2c
cmp eax, 0xffffffff
je 0x43a9c5
test byte [ebp + 0x30], 4
je 0x43a993
test byte [ebp - 0x100], 0x10
je 0x43a9a4
test byte [ebp + 0x30], 8
je 0x43a9a2
test byte [ebp - 0x100], 0x10
jne 0x43a9a4
xor bl, bl
mov ecx, dword [sym.imp.KERNEL32.dll_FindClose]
test ecx, ecx
je 0x43a9b1
push eax
call ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
call fcn.0043ab03
jmp 0x43aa53
call edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
mov esi, eax
call fcn.0043ab03
test byte [ebp + 0x30], 0x20
je 0x43aa51
lea eax, [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x4768a0
mov dword [ebp - 0x1c], 0x476898
call fcn.00403c6a
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], 0x4768a8
call fcn.0042ce9b
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0043aa80
mov eax, dword [ebp - 0x84]
push 0x4821d8
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x84], vtable.is::file_exception.0
lea eax, [ebp - 0x84]
push eax
call fcn.00455bf6
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402424
mov al, bl
jmp 0x43aa71
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402424
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x43cf11
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x114], 0x114
and dword [eax], 0
lea eax, [ebp - 0x114]
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 1
jne 0x43cf8c
cmp dword [ebp - 0x10c], 0
je 0x43cf84
cmp dword [ebp - 0x10c], 0xa
je 0x43cf6f
cmp dword [ebp - 0x10c], 0x5a
je 0x43cf78
xor al, al
mov dword [esi], 0x80
jmp 0x43cffd
call fcn.0043d2e5
test al, al
je 0x43cf7c
mov al, 1
jmp 0x43cf64
mov dword [esi], 0x40
jmp 0x43cfe6
mov dword [esi], 0x10
jmp 0x43cfe6
cmp dword [ebp - 0x104], 2
jne 0x43cffb
mov eax, dword [ebp - 0x110]
sub eax, 4
je 0x43cff3
mov ecx, dword [ebp - 0x10c]
dec eax
je 0x43cfb6
dec eax
je 0x43cfdc
xor al, al
mov dword [esi], 0x2000000
jmp 0x43cffd
test ecx, ecx
jne 0x43cfc2
mov dword [esi], 0x100000
jmp 0x43cfe6
cmp ecx, 1
jne 0x43cfcf
mov dword [esi], 0x400000
jmp 0x43cfe6
cmp ecx, 2
jne 0x43cfdc
mov dword [esi], 0x800000
jmp 0x43cfe6
test ecx, ecx
jne 0x43cfea
mov dword [esi], 0x1000000
mov al, 1
jmp 0x43cffd
cmp ecx, 1
jne 0x43cfac
mov al, cl
jmp 0x43cfae
mov dword [esi], 0x10000
jmp 0x43cfe6
xor al, al
pop esi
leave
ret

Function at 0x43d1da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x48f4c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43d209
push str.GetSystemDefaultUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d209
call eax
jmp 0x43d2e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, SysStringLen
push str..DefaultControl_PaneldesktopResourceLocale
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x43d255
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x494ad8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43d2b6
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str..DEFAULTControl_PanelInternational
push edi
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x43d28a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.Locale
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x43d29e
cmp esi, ebx
je 0x43d29e
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x43d2be
cmp dword [ebp - 4], ebx
je 0x43d2b0
cmp esi, ebx
je 0x43d2b0
push dword [ebp - 4]
call esi
mov ax, 0x409
jmp 0x43d2e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00454b5c
add esp, 0xc
cmp dword [ebp - 4], ebx
mov edi, eax
je 0x43d2dd
cmp esi, ebx
je 0x43d2dd
push dword [ebp - 4]
call esi
mov ax, di
pop edi
pop esi
pop ebx
leave
ret