joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401797
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00401046
mov esi, eax
mov ecx, esi
call fcn.00409e5d
push 1
mov ecx, esi
mov ebx, eax
call fcn.00409e42
mov ecx, esi
call fcn.00409e3b
push eax
mov ecx, esi
call fcn.00409dc2
mov ecx, ebx
call fcn.0040b4cc
push eax
mov ecx, esi
call fcn.00409dfd
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0040190b
test eax, eax
jne 0x401818
mov edi, 0x47f
mov ecx, esi
mov dword [0x424d80], edi
call fcn.00409e0a
shr eax, 0xa
push eax
push edi
call fcn.0040bc9d
pop ecx
pop ecx
jmp 0x4018ff
lea eax, [ebp - 0x404]
push eax
push 0
lea eax, [ebp - 0x804]
push 0x41f140
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x404]
push eax
call fcn.0040c621
lea eax, [ebp - 0x404]
push 0x2e
push eax
call fcn.004110a0
and byte [eax], 0
pop ecx
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0040c5ca
test eax, eax
jne 0x40186e
lea eax, [ebp - 0x404]
push eax
call fcn.0040c520
lea eax, [ebp - 0x404]
mov edi, 0x4230e4
push eax
push edi
call fcn.00410fb0
pop ecx
pop ecx
mov ecx, ebx
call fcn.0040b498
test ax, ax
jne 0x4018b1
push 2
mov ecx, esi
call fcn.00409e42
push dword [0x41f970]
mov ecx, esi
call fcn.00409df6
push eax
push 0x423eb8
call fcn.0040c475
jmp 0x4018cd
push dword [0x41f970]
push edi
push 0x423eb8
call fcn.0040c475
mov ecx, esi
call fcn.0040a426
test eax, eax
je 0x4018ff
mov ecx, dword [ebp - 4]
call fcn.004019cc
test eax, eax
jne 0x4018eb
mov eax, 0x481
push 0
mov dword [0x424d80], eax
push eax
jmp 0x40180c
cmp dword [esi + 0x1420], 5
jne 0x401903
mov ecx, esi
call fcn.0040a562
test eax, eax
jne 0x401903
xor eax, eax
jmp 0x401906
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40190b
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov ecx, eax
call fcn.00409e0a
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40194c
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.004019a1
test eax, eax
jne 0x401998
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x401968
push esi
push edi
mov ecx, ebx
call fcn.004019a1
test eax, eax
jne 0x401998
push 0x4230e0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.0040c25c
add esp, 0xc
test eax, eax
jge 0x401998
push edi
push esi
push 4
call fcn.0040c25c
add esp, 0xc
test eax, eax
jge 0x401998
xor eax, eax
jmp 0x40199b
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x4019cc
Capabilities:
Query environment variable
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
call fcn.00401046
mov ebp, eax
mov esi, 0x400
push esi
push 0
lea edi, [ebp + 0x410]
push edi
call fcn.00410ec0
add esp, 0xc
mov ebx, 0x4230e0
push 0x423eb8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [0x41b448]
push dword [0x41b444]
call edi
lea eax, [ebp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ada
lea eax, [ebp + 0x810]
push esi
push 0
push eax
call fcn.00410ec0
add esp, 0xc
lea eax, [ebp + 0x810]
push 0x423eb8
push esi
push eax
push ebx
push dword [0x41b450]
push dword [0x41b444]
call edi
lea eax, [ebp + 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ada
lea eax, [ebp + 0x10]
push esi
push 0
push eax
call fcn.00410ec0
add esp, 0xc
lea eax, [ebp + 0x10]
push 0x423eb8
push esi
push eax
push ebx
push dword [0x41b44c]
push dword [0x41b444]
call edi
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ada
push 2
lea eax, [esp + 0x16]
push 0
push eax
call fcn.00410ec0
add esp, 0xc
lea eax, [esp + 0x12]
push 0x423eb8
push 2
push eax
push ebx
push dword [0x41b454]
push dword [0x41b444]
call edi
lea eax, [esp + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x401ae1
xor eax, eax
jmp 0x401bda
and dword [ebp + 0xc], 0
cmp dword [0x424d84], 0
jne 0x401b09
lea eax, [esp + 0x12]
push 0x41f144
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401b09
mov dword [ebp + 0xc], 1
and byte [esp + 0x14], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [esp + 0x15]
push 0x423eb8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
push ebx
push dword [0x41b458]
push dword [0x41b45c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
mov dword [ebp + 0x1014], 0x1f40
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401b68
lea eax, [esp + 0x14]
push eax
call fcn.004110d5
pop ecx
mov dword [ebp + 0x1014], eax
lea edi, [ebp + 0x1018]
push ebx
push edi
call fcn.00410f20
pop ecx
test eax, eax
pop ecx
jne 0x401baf
push 0x423eb8
push esi
push edi
push ebx
push dword [0x41b460]
push dword [0x41b444]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call fcn.004110c7
pop ecx
mov ebx, eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0x1420
cmp dword [ebp], 0
jne 0x401bd7
push 0x423eb8
push 0
push dword [0x41b464]
push dword [0x41b444]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp], eax
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x4021b7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x4021d0
xor esi, esi
jmp 0x4021fd
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00411720
xor eax, eax
mov esi, esp
push eax
push eax
and byte [esi], 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40221f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x402216
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x64
jl 0x4021c2
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d6e
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x41abd0
call fcn.00411544
sub esp, 0x5a4
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
push edi
cmp byte [edi], 0x30
jne 0x404da6
mov esi, dword [sym.imp.USER32.dll_CharNextA]
call esi
mov cl, byte [eax]
cmp cl, 0x78
je 0x404de5
cmp cl, 0x58
je 0x404de5
push edi
call fcn.00411160
pop ecx
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
push 0x452
call fcn.00401754
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00401797
test eax, eax
je 0x404eae
mov ecx, dword [ebp + 0x10]
call fcn.0040a416
test eax, eax
je 0x404df0
push 0x4230e4
jmp 0x404df9
push eax
call esi
push eax
call fcn.00404d2b
jmp 0x404dab
mov ecx, dword [ebp + 0x10]
call fcn.00409df6
push eax
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
and byte [ebp - 0x5b0], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x5af]
rep stosd dword es:[edi], eax
push dword [0x41f970]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x5b0]
push eax
call fcn.0040c475
lea eax, [ebp - 0x5b0]
mov esi, str.Languages
push eax
push ebx
push str.Count
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
xor edi, edi
test ebx, ebx
jbe 0x404eae
push edi
push 0x41f36c
lea eax, [ebp - 0xac]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x2c]
push 0x13
push eax
lea eax, [ebp - 0xac]
push 0x4230e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x404eae
lea eax, [ebp - 0x2c]
push eax
call fcn.00404d2b
pop ecx
mov ecx, dword [ebp + 8]
cmp ecx, eax
je 0x404ecd
inc edi
cmp edi, ebx
jb 0x404e59
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040178c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp + 0xc]
push 1
pop esi
mov dword [eax], ecx
jmp 0x404eb0
Function at 0x40522e
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
mov eax, 0x41ac03
call fcn.00411544
sub esp, 0x730
push esi
lea eax, [ebp - 0x33c]
push edi
mov esi, 0x104
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x33c]
push 0x41f3b4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x73c]
push 0x400
push eax
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x73c]
lea ecx, [ebp - 0x238]
push eax
call fcn.0040b2ec
and dword [ebp - 4], 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x238]
push dword [0x41f970]
call fcn.0040b563
lea eax, [ebp - 0x110]
add edi, 4
push eax
push esi
push edi
push 0x4230e0
push str.PASSWORD
push 0x41f3a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.0040b42a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4052fe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405355
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x423d8c
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40534c
mov byte [0x423e90], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40543c
Capabilities:
Hide graphical window

Disassembly:
push dword [0x423eac]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405468
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x423eac]
call esi
push 0
push dword [0x423ea0]
call esi
pop esi
ret
Function at 0x405469
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x423eac]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.00409da5
cmp dword [eax], 1
je 0x4054d3
cmp dword [eax + 4], ebx
je 0x405528
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405528
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x423eac]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a9d
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004064e9
test eax, eax
pop ecx
jne 0x405bfa
mov esi, 0x4244e0
push esi
call fcn.00406580
test eax, eax
pop ecx
jne 0x405bfa
mov eax, dword [ebp + 0x20]
mov ecx, dword [0x4244e0]
push 0x4244d4
mov dword [eax], ecx
call fcn.00406539
test eax, eax
pop ecx
jne 0x405bfa
mov ebx, dword [ebp + 0x1c]
mov eax, dword [0x4244d4]
mov dword [ebx], eax
cmp dword [0x4244e0], 1
jne 0x405b00
xor eax, eax
jmp 0x405bfa
lea eax, [ebp + 8]
push eax
push 0x4244d8
call fcn.00405a89
test eax, eax
jne 0x405bfa
mov eax, dword [0x4244e0]
shl eax, 2
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [0x4244e4], eax
jne 0x405b3f
push 0xfffffffffffffffc
pop eax
jmp 0x405bfa
push esi
call fcn.004065a8
mov edi, eax
pop ecx
test edi, edi
je 0x405b75
push dword [0x4244e4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4244e4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x405bf8
movzx eax, word [ebp + 0x18]
push eax
mov dword [0x4244d0], ebx
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov dword [0x4242c4], eax
movzx eax, word [ebp + 0x14]
push 0x405d9a
push dword [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
mov eax, dword [0x4242c4]
test eax, eax
je 0x405bb8
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp edi, 1
jne 0x405bc1
xor edi, edi
jmp 0x405bc9
cmp edi, 2
jne 0x405bc9
or edi, 0xffffffff
mov eax, dword [0x4244e4]
test eax, eax
je 0x405bf1
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4244e4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx]
mov dword [0x4244d4], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40604f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ee
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x4061d6
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
call esi
push 0x3ef
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x4061d6
push edi
call ebx
cmp dword [ebp - 4], eax
jge 0x4060c1
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push edi
call esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4061d6
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.004066ec
push 1
push 0x41f428
push esi
mov edi, eax
call fcn.004066ec
push esi
push dword [ebp - 8]
movzx ebx, ax
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp + 8], 0
movzx esi, di
add esi, ebx
shr edi, 0x10
test esi, esi
mov dword [ebp - 0x14], edi
je 0x4061d6
test edi, edi
je 0x4061d6
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jge 0x406160
mov edi, esi
push 1
sub edi, eax
add edi, ebx
add esi, ebx
pop ebx
mov dword [ebp - 4], esi
mov dword [ebp + 8], ebx
jmp 0x406166
mov edi, dword [ebp + 8]
push 1
pop ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jge 0x406176
add eax, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x4061d6
mov esi, dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x2c
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
sub eax, edi
push dword [ebp - 4]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x2c
push eax
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 0x34]
push 1
push dword [ebp - 0xc]
lea eax, [edi + edi]
sub ecx, eax
push dword [ebp - 4]
push dword [ebp - 0x30]
push ecx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406539
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x4243cc
lea eax, [ebp - 0x14]
push 0x13
push eax
push 0x4230e0
push str.Default
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x406568
push 0xfffffffffffffffa
pop eax
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x41f440
push eax
call fcn.004120b0
add esp, 0xc
xor eax, eax
leave
ret
Function at 0x406580
Capabilities:
Read .ini file

Disassembly:
push 0x4243cc
push 0
push str.Count
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 6
add eax, 0xfffffffa
ret

Function at 0x4065a8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
cmp dword [edi], esi
jbe 0x406628
push esi
push 0x41f36c
lea eax, [ebp - 0x94]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x14]
push 0x4243cc
push 0x13
push eax
lea eax, [ebp - 0x94]
push 0x4230e0
push eax
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x406625
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push 0x41f440
push eax
call fcn.004120b0
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [eax + esi*4], ecx
inc esi
cmp esi, dword [edi]
jb 0x4065bf
jmp 0x406628
push 0xfffffffffffffffa
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4079ef
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe20
and byte [ebp - 0x20], 0
push ebx
push esi
push edi
mov ebx, ecx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f]
and byte [ebp - 0x620], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x61f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Msi.DLL
call fcn.0040bee0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.0040c6af
add esp, 0x14
test eax, eax
jge 0x407be7
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00409da5
mov ecx, ebx
mov esi, eax
call fcn.004077b7
test eax, eax
je 0x407b0c
cmp dword [esi], 2
jne 0x407b05
call fcn.0040c936
test eax, eax
jne 0x407a98
mov eax, 0x4b2
push eax
mov dword [0x424d80], eax
call fcn.0040bd91
pop ecx
push 1
jmp 0x407be9
and byte [ebp - 0x420], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
mov esi, 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x407ada
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.004074b2
test eax, eax
je 0x407afe
lea eax, [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x407b05
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.004074b2
test eax, eax
jne 0x407b05
push 2
jmp 0x407be9
xor eax, eax
jmp 0x407bea
cmp dword [esi + 0x14], 2
jne 0x407b33
cmp dword [esi + 8], 4
jne 0x407b33
mov eax, 0x47e
push 0
push eax
mov dword [0x424d80], eax
call fcn.0040bd91
pop ecx
pop ecx
push 3
jmp 0x407be9
mov esi, 0x400
push 0x423eb8
lea eax, [ebp - 0xe20]
push esi
push eax
push 0x4230e0
push dword [0x41b550]
push dword [0x41b548]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0xe20], 0x79
je 0x407be2
cmp byte [ebp - 0xe20], 0x59
je 0x407be2
and byte [ebp - 0x420], 0
mov ebx, 0xff
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x41f]
mov edx, 0x4b7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
push esi
push eax
push edx
mov dword [0x424d80], edx
call fcn.0040be05
and byte [ebp - 0xa20], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xa20]
push eax
call fcn.0040bc39
add esp, 0x10
or eax, 0xffffffff
jmp 0x407bea
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407bf1
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], bl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x42b]
mov byte [ebp - 0x42c], bl
mov esi, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x42c]
mov dword [esi], ebx
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp + 0xf], bl
push dword [ebp + 8]
call fcn.0040bee0
lea eax, [ebp - 0x24]
push eax
push str.11.50.0.0
call fcn.0040c6af
add esp, 0x14
test eax, eax
jge 0x407c73
push dword [ebp + 8]
push str.__s___q
jmp 0x407c7f
push dword [ebp + 8]
mov byte [ebp + 0xf], 1
push str.__s___c:_msiinst__delayrebootq_
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.0040c73f
mov edi, eax
cmp edi, ebx
je 0x407d51
cmp edi, 0xbc2
je 0x407cc9
push ebx
push edi
mov dword [0x424d80], 0x484
call fcn.0040bcab
pop ecx
mov eax, edi
pop ecx
jmp 0x407d53
cmp byte [ebp + 0xf], bl
je 0x407d4b
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 8]
mov dword [esi], 2
mov dword [ebp + 8], ebx
call fcn.00407474
test eax, eax
jne 0x407d3b
push 0x40
lea edi, [ebp - 0x22b]
pop ecx
mov byte [ebp - 0x22c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x104
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 8], ebx
je 0x407d51
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407d51
mov dword [esi], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8