joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045b1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0x431c40
push 0x431c4c
mov dword [ebp - 0x40c], edi
call fcn.0040b534
pop ecx
pop ecx
mov dword [edi + 0x34], eax
test eax, eax
jne 0x4045fd
push eax
push str.ERROR:_Could_not_create_temp_file_n
mov ecx, edi
call fcn.00404380
xor eax, eax
jmp 0x4046a8
push ebx
push 0x431cb8
push eax
call fcn.0040b46f
push 0x431cc0
push esi
mov dword [ebp - 0x408], eax
call fcn.0040b46f
add esp, 0x10
cmp dword [ebp - 0x408], 0
mov ebx, eax
je 0x404699
test ebx, ebx
je 0x404687
mov esi, 0x400
jmp 0x40465a
push ebx
call fcn.0040a293
pop ecx
test eax, eax
jne 0x404687
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push edi
push 1
push eax
call fcn.0040a1dd
add esp, 0x10
cmp eax, edi
jne 0x404675
push ebx
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0040a05e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x404633
jmp 0x404687
mov ecx, dword [ebp - 0x40c]
push 0
push str.ERROR:_Could_not_write_all_bytes_to_temp_file_n
call fcn.00404380
push dword [ebp - 0x408]
call fcn.00409d25
mov edi, dword [ebp - 0x40c]
pop ecx
test ebx, ebx
je 0x4046a4
push ebx
call fcn.00409d25
pop ecx
mov eax, dword [edi + 0x34]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004076ca
leave
ret 4
Function at 0x404856
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
cmp dword [esi], 0
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xac], eax
je 0x404894
cmp dword [edi], 0
jne 0x4048b2
xor ecx, ecx
push 2
mov eax, 0x200
pop edx
mov dword [esi], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
mov dword [edi], eax
push ebx
push dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push dword [edi]
push dword [ebp - 0xac]
call ebx
test eax, eax
je 0x404919
lea ecx, [eax + 2]
mov dword [ebp - 0xb0], ecx
cmp ecx, dword [esi]
jbe 0x404915
cmp eax, 0x7ffd
jae 0x404915
push dword [edi]
call fcn.00407eb5
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
push 2
pop edx
mov dword [esi], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
push dword [ebp - 0xb4]
mov dword [edi], eax
push dword [esi]
push eax
push dword [ebp - 0xac]
call ebx
test eax, eax
jne 0x40495a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0xa8]
mov dword [esi + 0x10], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
push eax
push str.ERROR:_GetPrivateProfileSection__:_GetLastError_returned__u_r_n
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.004047e0
add esp, 0x10
push 0
lea eax, [ebp - 0xa4]
push eax
mov ecx, esi
call fcn.00404380
xor al, al
jmp 0x404989
mov ecx, dword [ebp - 0xa8]
add eax, 2
cmp eax, dword [esi]
jbe 0x404977
push 0
mov dword [ecx + 0x10], 0xe
push str.ERROR:_GetPrivateProfileSection___out_of_memory_r_n
jmp 0x404951
push dword [ebp - 0xac]
push str._GetProfileSection_read__s_r_n
call fcn.00404380
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 0x10
Function at 0x4049f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push dword [ebp + 8]
mov edi, ecx
mov byte [ebp - 1], 1
call esi
push dword [edi + 0x3c]
mov ebx, eax
call esi
lea ebx, [ebx + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
and dword [ebp - 8], 0
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [edi + 0x3c]
mov dword [ebp - 0xc], eax
call esi
test eax, eax
jne 0x404a5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x10], eax
jmp 0x404b0a
mov eax, dword [ebp - 8]
test eax, eax
je 0x404a6b
xor ecx, ecx
mov word [eax], cx
push dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
call fcn.004047a6
xor ecx, ecx
push 2
lea eax, [ebx + ebx]
pop edx
mov dword [ebp - 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
mov ebx, dword [ebp + 0xc]
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebx], eax
push dword [ebp - 0xc]
call esi
cmp eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
jle 0x404ade
push dword [ebx]
call fcn.00407eb5
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebx], eax
push dword [ebp - 0xc]
call esi
mov dword [ebp + 0xc], eax
test eax, eax
je 0x404a51
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404b0e
push dword [ebp + 8]
push 0x400
push dword [edi + 0x38]
call fcn.0040472b
mov dword [edi + 0x10], 2
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.00407eb5
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404c0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d06
push 0x20a
call fcn.00407eaa
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
mov edi, str.InstallerLocation
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 0x105
call esi
cmp eax, 0xea
jne 0x404ca5
push ebx
call fcn.00407eb5
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x404d06
cmp dword [ebp - 0xc], 1
jne 0x404d06
cmp dword [ebp - 4], eax
jbe 0x404d06
push 0x430464
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
lea esi, [eax + ecx + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push ebx
mov edi, eax
push esi
push edi
call fcn.0040472b
test eax, eax
jl 0x404d06
push 0x430464
push esi
push edi
call fcn.004047a6
test eax, eax
jl 0x404d06
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x404d11
push 0x430464
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d16
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
push 0x20a
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call fcn.00407eaa
mov esi, eax
pop ecx
xor eax, eax
mov dword [ebp - 4], 0x105
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404dcc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push edi
mov ebx, str.InstallerLocation
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, 0xea
jne 0x404db8
push esi
call fcn.00407eb5
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x404dc7
cmp dword [ebp - 0x10], 1
jne 0x404dc7
cmp dword [ebp - 4], eax
jne 0x404dcc
xor eax, eax
mov word [esi], ax
cmp word [esi], 0
jne 0x404e3b
mov ecx, dword [ebp - 0x14]
push 0
push str.__Could_not_find_path_to_msiexec.exe_in_registry
call fcn.00404380
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
call ebx
mov edi, eax
cmp edi, dword [ebp - 4]
jbe 0x404e1d
push esi
call fcn.00407eb5
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
pop ecx
mov esi, eax
push edi
push esi
mov dword [ebp - 4], edi
call ebx
mov edi, eax
test edi, edi
jne 0x404e32
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], edi
cmp word [esi], 0
je 0x404e9d
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
mov ebx, str.msiexec.exe
push ebx
mov dword [ebp - 8], eax
call edi
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push esi
push edi
push eax
mov dword [ebp - 8], eax
call fcn.0040472b
test eax, eax
jl 0x404e8a
push ebx
push edi
push dword [ebp - 8]
call fcn.004047a6
test eax, eax
jge 0x404e97
push dword [ebp - 8]
call fcn.00407eb5
and dword [ebp - 8], 0
pop ecx
cmp dword [ebp - 8], 0
jne 0x404eac
mov ecx, dword [ebp - 0x14]
push 0
push str.ERROR:_Cant_build_path_to_msiexec.exe_
call fcn.00404380
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404eb5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xb4], edi
call fcn.00404d16
mov ebx, eax
mov ecx, esi
test ebx, ebx
jne 0x404efa
push eax
push str.ERROR:_msiexec_not_found_
call fcn.00404380
mov dword [esi + 0x10], 2
jmp 0x4050cf
push ebx
push 0x430ea4
call fcn.00404380
push edi
push 0x430edc
mov ecx, esi
call fcn.00404380
push ebx
call fcn.004040c4
push edi
call fcn.004040c4
xor eax, eax
lea edi, [ebp - 0xc4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00407920
add esp, 0x14
push 5
pop eax
push dword [ebp - 0xb4]
mov dword [ebp - 0x108], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], ax
call edi
push ebx
mov dword [ebp - 0xac], eax
call edi
mov ecx, dword [ebp - 0xac]
lea edi, [ecx + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push ebx
push edi
push eax
mov dword [ebp - 0xac], eax
call fcn.0040472b
mov ebx, dword [ebp - 0xac]
test eax, eax
jl 0x4050c1
push 0x430f74
push edi
push ebx
call fcn.004047a6
test eax, eax
jl 0x4050c1
push dword [ebp - 0xb4]
push edi
push ebx
call fcn.004047a6
test eax, eax
jl 0x4050c1
lea eax, [ebp - 0xc4]
push eax
xor edi, edi
lea eax, [ebp - 0x108]
push eax
push edi
push edi
push 0x4000000
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, esi
test eax, eax
jne 0x40501d
push ebx
push 0x430f78
call fcn.00404380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x10], eax
call fcn.00407eb5
jmp 0x4050ce
push dword [ebp - 0xc4]
call fcn.00404306
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xa5], 1
cmp eax, edi
je 0x405058
push ebx
push 0x430fc4
mov ecx, esi
call fcn.00404380
mov eax, dword [ebp - 0xb0]
mov dword [esi + 0x10], eax
mov byte [ebp - 0xa5], 0
jmp 0x4050a6
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0xb0]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x405099
push eax
push str.Warning:_msiexec_returned__u._r_n
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.004047e0
add esp, 0x10
push edi
lea eax, [ebp - 0xa4]
push eax
jmp 0x40509f
push edi
push str._Installation_completed_successfully._r_n
mov ecx, esi
call fcn.00404380
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00407eb5
mov al, byte [ebp - 0xa5]
pop ecx
jmp 0x4050d1
push ebx
call fcn.00407eb5
mov dword [esi + 0x10], 0x643
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 4
Function at 0x4058fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x40], edi
jne 0x405a16
mov edx, dword [esi + 0x44]
push ebx
cmp edx, edi
je 0x405a08
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x405920
sub eax, ebx
sar eax, 1
je 0x405a08
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push edi
push edx
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000002
call edi
test eax, eax
jne 0x40595c
push eax
push str._Found_Upgrade_Key_in_Registry__HKLM_____will_try_minor_upgrade__r_n
jmp 0x40597c
lea eax, [ebp - 4]
push eax
push ebx
xor ebx, ebx
push ebx
push dword [esi + 0x44]
push 0x80000001
call edi
push ebx
test eax, eax
jne 0x405a01
push str._Found_Upgrade_Key_in_Registry__HKCU_____will_try_minor_upgrade__r_n
mov ecx, esi
call fcn.00404380
mov eax, dword [esi + 0x48]
or byte [esi + 0x50], 0x10
xor ebx, ebx
cmp eax, ebx
je 0x405a15
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x405997
sub eax, edx
sar eax, 1
je 0x405a15
push 0x20a
call fcn.00407eaa
mov edi, eax
pop ecx
xor eax, eax
mov dword [ebp - 8], 0x105
mov word [edi], ax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push ebx
push str.ProductVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059f8
push dword [esi + 0x48]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4059f8
push ebx
push str._Same_Product_Version_already_installed__no_minor_upgrade__r_n
mov ecx, esi
call fcn.00404380
and byte [esi + 0x50], 0xef
push edi
call fcn.00407eb5
pop ecx
jmp 0x405a15
push str._Didnt_Find_Upgrade_Key_in_Registry____continue_with_standard_installation__r_n
jmp 0x405a0e
push edi
push str.____No_Upgrade_Key_Found____continue_with_standard_installation__r_n
mov ecx, esi
call fcn.00404380
pop ebx
pop edi
mov al, 1
pop esi
leave
ret
Function at 0x405a1c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test byte [ebx + 0x50], 2
je 0x405a4b
push 0
push str.Ignoring_already_running_MSI_instance__r_n
call fcn.00404380
xor al, al
jmp 0x405ad6
test byte [ebx + 0xc], 1
push esi
push edi
push 0x1c
pop ecx
mov esi, str.Global_MSISETUP_EA8130C1_8D3D_4338_9309_1A52D530D846
lea edi, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
push 0x18
pop ecx
mov esi, str._MSISETUP_EA8130C1_8D3D_4338_9309_1A52D530D846
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x405a77
lea eax, [ebp - 0x68]
jmp 0x405a91
cmp dword [ebx + 4], 5
jae 0x405a8b
mov ecx, ebx
call fcn.0040416f
test al, al
lea eax, [ebp - 0x68]
je 0x405a91
lea eax, [ebp - 0xd8]
push eax
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, esi
je 0x405abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ecx, ebx
cmp eax, 0xb7
je 0x405ac8
push str._No_running_Setup_found_r_n
call fcn.00404380
xor al, al
jmp 0x405ad4
push esi
push str.ERROR:_AlreadyRunning___could_not_create_mutex__r_n
mov ecx, ebx
jmp 0x405acd
push str.ERROR:_Theres_already_a_setup_running__r_n
call fcn.00404380
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret
Function at 0x4062b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x437118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push eax
mov ebx, ecx
mov dword [ebp - 0xb0], esi
call sub.msi.dll_MsiRecordGetStringA
push eax
call fcn.004040c4
add esp, 4
cmp eax, 5
jne 0x4062ee
mov al, 1
jmp 0x406490
push edi
push esi
push 0x431f0c
mov ecx, ebx
call fcn.00404380
push esi
call fcn.004040c4
xor eax, eax
lea edi, [ebp - 0xc0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00407920
add esp, 0x10
push 5
pop eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x104], edi
mov dword [ebp - 0xd8], 1
mov word [ebp - 0xd4], ax
call esi
push 0x431f84
mov edi, eax
call esi
lea esi, [edi + eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407eaa
pop ecx
push dword [ebp - 0xb0]
mov edi, eax
push esi
push edi
call fcn.0040472b
test eax, eax
jl 0x40647f
push 0x431f8c
push esi
push edi
call fcn.004047a6
test eax, eax
jl 0x40647f
lea eax, [ebp - 0xc0]
push eax
xor esi, esi
lea eax, [ebp - 0x104]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, ebx
test eax, eax
jne 0x4063dc
push edi
push str.ERROR:_Could_not_create_process__s._r_n
call fcn.00404380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebx + 0x10], eax
call fcn.00407eb5
jmp 0x40648c
push dword [ebp - 0xc0]
call fcn.00404306
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa5], 1
cmp eax, esi
je 0x406417
push edi
push str.ERROR:_While_waiting_for__s._r_n
mov ecx, ebx
call fcn.00404380
mov eax, dword [ebp - 0xac]
mov dword [ebx + 0x10], eax
mov byte [ebp - 0xa5], 0
jmp 0x406465
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0xac]
mov dword [ebx + 0x10], eax
cmp eax, esi
je 0x406458
push eax
push str.Warning:_install_runtime_returned__u._r_n
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.004047e0
add esp, 0x10
push esi
lea eax, [ebp - 0xa4]
push eax
jmp 0x40645e
push esi
push str._Installation_of_runtime_completed_successfully._r_n
mov ecx, ebx
call fcn.00404380
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00407eb5
mov al, byte [ebp - 0xa5]
jmp 0x40648e
push edi
call fcn.00407eb5
mov dword [ebx + 0x10], 0x643
xor al, al
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ca
leave
ret 8
Function at 0x4064a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
push str.Kernel32.dll
mov edi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x4064ec
push str.GetNativeSystemInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4064d9
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x4064e3
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4064f6
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x28]
push eax
call fcn.004040c4
add esp, 4
cmp word [ebp - 0x28], 9
jne 0x40654b
lea eax, [ebp - 4]
push eax
push str.redist_vcredist_x64.exe
mov ecx, edi
call fcn.004049f9
mov ecx, edi
test al, al
je 0x40652f
push dword [ebp - 4]
push str.5FCE6D76_F5DC_37AB_B2B8_22AB8CEDB1D4
call fcn.004062b0
jmp 0x40653a
push ebx
push str.ERROR:_no_installer_for_x64_runtime_libraries_found_
call fcn.00404380
cmp dword [ebp - 4], ebx
je 0x40654b
push dword [ebp - 4]
call fcn.00407eb5
pop ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push str.redist_vcredist_x86.exe
mov ecx, edi
call fcn.004049f9
mov ecx, edi
test al, al
je 0x406570
push dword [ebp - 4]
push str.9BE518E6_ECC6_35A9_88E4_87755C07200F
call fcn.004062b0
jmp 0x40657b
push ebx
push str.ERROR:_no_installer_for_x86_runtime_libraries_found_
call fcn.00404380
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x40658c
push dword [ebp - 4]
call fcn.00407eb5
pop ecx
mov al, 1
leave
ret
Function at 0x40675b
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [ebp + 8]
push 0x200
mov dword [edi], eax
mov dword [esi + 0x14], ebx
call fcn.00407eaa
mov dword [esi + 0x1c], eax
xor ecx, ecx
mov dword [esp], 0x100
mov word [eax], cx
push dword [esi + 0x1c]
push 0xa
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x208
call fcn.00407eaa
mov dword [esi + 0x3c], eax
xor ecx, ecx
mov dword [esp], 0x104
mov word [eax], cx
push dword [esi + 0x3c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4067d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
xor al, al
jmp 0x40687e
push edi
mov ecx, esi
call fcn.00405bc6
test al, al
je 0x4067cb
push str.GlobalMsiErrorObject
push 4
xor ebx, ebx
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x406815
push 4
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x4c], eax
cmp eax, ebx
je 0x406815
mov dword [eax], ebx
jmp 0x406824
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004040c4
add esp, 4
push dword [esi + 0x3c]
mov ecx, esi
push str.Starting:__s_r_n
call fcn.00404380
push dword [edi]
mov ecx, esi
push str._CommandLine__s__r_n
call fcn.00404380
test byte [esi + 0x50], 1
je 0x406854
push ebx
push str._Using_quiet_install_mode_r_n
mov ecx, esi
call fcn.00404380
lea eax, [ebp - 8]
push eax
call fcn.00407d89
lea eax, [ebp - 8]
push eax
call fcn.00407d62
push eax
call fcn.0040be06
add esp, 0xc
push eax
push str._Begin:__s_n
mov ecx, esi
call fcn.00404380
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4