joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
sub esp, 0x5c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 0x20]
lea ebx, [edx + esi]
mov eax, dword [eax + 0x18]
cmp ebx, ecx
jbe 0x4121d6
lea edx, [esi + ecx*2]
mov dword [esp], eax
lea edx, [edx + edx*4]
shl edx, 2
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x412333
mov edx, dword [edi + 0x20]
mov dword [edi + 0x18], eax
lea edx, [esi + edx*2]
mov dword [edi + 0x20], edx
mov edx, dword [edi + 0x1c]
lea edx, [edx + edx*4]
mov edi, dword [ebp - 0x34]
lea edx, [eax + edx*4]
lea eax, [esi + esi*4]
shl eax, 2
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], edx
call sym._memcpy
mov eax, dword [ebp - 0x2c]
test byte [eax + 4], 1
je 0x412221
test esi, esi
je 0x412221
xor ebx, ebx
mov edx, edi
lea esi, [esi]
lea esi, [esi]
lea eax, [ebx + ebx*4]
lea edi, [edx + eax*4]
cmp word [edi], 1
je 0x412240
inc ebx
cmp esi, ebx
ja 0x412210
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
add dword [eax + 0x1c], esi
test edx, edx
jne 0x412268
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [edi + 0xe], 3
jne 0x41221c
test byte [edi + 0x11], 1
jne 0x41221c
lea eax, [esi - 1]
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x412278
mov eax, dword [edi + 4]
test eax, eax
jne 0x4122c0
mov esi, ebx
jmp 0x412221
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._process_console_input
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
sub esi, ebx
lea esi, [esi + esi*4]
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 0x18]
lea esi, [esi*4 - 0x14]
mov dword [esp + 8], esi
add eax, ebx
lea eax, [eax + eax*4 + 5]
shl eax, 2
lea ecx, [edx + eax - 0x14]
add eax, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
test ecx, ecx
je 0x41221d
lea eax, [ebp - 0x28]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 8
mov dword [esp + 0x14], 0x50004c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
sub esp, 0x28
jmp 0x41221d
mov dword [ebp - 0x30], 0xc0000017
jmp 0x41222e
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
push edi
xor edi, edi
cmp dword [0x2afa6d4], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push edi
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x421c68]
mov dword [ebp - 0x20], eax
mov eax, dword [0x421c6c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.00401000
mov eax, dword [0x421c70]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x421c74]
add esi, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2afa6d4], 0xc
mov dword [ebp - 4], eax
jne 0x4010b6
push edi
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2afa6d4]
cmp eax, 0xfa9
jne 0x4010d2
mov dword [0x2afa6d0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ed
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2afa084], edi
mov ecx, dword [ebp - 0xc]
mov edx, ebx
lea eax, [esi + ebx]
shr edx, cl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x2afa6cc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
shr eax, cl
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub ebx, dword [ebp - 4]
add esi, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x401076
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4039e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42129c]
jne 0x4039f2
repz ret
jmp fcn.00406407

Function at 0x405fa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401c1f
and dword [ebp - 4], 0
cmp dword [0x425f84], 0
mov ebx, eax
jne 0x406055
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406106
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406106
push eax
call fcn.00401bad
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425f84], eax
call esi
push eax
call fcn.00401bad
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f88], eax
call esi
push eax
call fcn.00401bad
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425f8c], eax
call esi
push eax
call fcn.00401bad
pop ecx
mov dword [0x425f94], eax
test eax, eax
je 0x406055
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401bad
pop ecx
mov dword [0x425f90], eax
mov eax, dword [0x425f90]
cmp eax, ebx
je 0x4060ad
cmp dword [0x425f94], ebx
je 0x4060ad
push eax
call fcn.00401c28
push dword [0x425f94]
mov esi, eax
call fcn.00401c28
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4060ad
test edi, edi
je 0x4060ad
call esi
test eax, eax
je 0x4060a4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4060a4
test byte [ebp - 0xc], 1
jne 0x4060ad
or dword [ebp + 0x10], 0x200000
jmp 0x4060e6
mov eax, dword [0x425f88]
cmp eax, ebx
je 0x4060e6
push eax
call fcn.00401c28
pop ecx
test eax, eax
je 0x4060e6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4060e6
mov eax, dword [0x425f8c]
cmp eax, ebx
je 0x4060e6
push eax
call fcn.00401c28
pop ecx
test eax, eax
je 0x4060e6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425f84]
call fcn.00401c28
pop ecx
test eax, eax
je 0x406106
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406108
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov esi, dword [ecx - 0x75]
inc ebp
or byte [ebx - 0x3f7aebc0], cl
xor ecx, dword ss:[ebx + 0x50510c4d]
adc al, 0x85
sal byte [esi], 0x33
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a3d8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
scasd eax, dword es:[edi]
push ds
test eax, eax
popfd
add eax, 0xf5c29811
add bh, bh
or byte [0xa0780], al
mov eax, 0x8075d
inc eax
pop ebp
ret 8
Function at 0x10001b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x14c
push edi
mov edx, dword [ebx + 0x3c]
lea eax, [ebx + 0x88]
add eax, edx
lea ecx, [ebx + 0x78]
add ecx, edx
cmp word [edx + ebx + 4], si
cmovne ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x10001c34
cmp dword [ebp + 0x10], 0
lea ecx, [eax + ebx]
mov dword [ebp - 8], ecx
ja 0x10001b7c
mov eax, dword [ebp + 0xc]
jb 0x10001b4b
cmp eax, 0xffff
ja 0x10001b7c
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x10001c34
jb 0x10001b68
cmp edx, dword [ecx + 0x14]
jae 0x10001c34
mov eax, dword [ecx + 0x1c]
pop edi
pop esi
lea eax, [eax + edx*4]
mov eax, dword [eax + ebx]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, ebx
mov dword [ebp - 0x14], eax
add edx, ebx
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001c34
nop word [eax + eax]
mov ecx, dword [edx + eax*4]
add ecx, ebx
mov esi, ecx
mov dword [ebp - 0xc], ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001bb0
mov edi, dword [0x10004048]
sub esi, edx
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 1
push esi
push ecx
call fcn.10002320
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.10002320
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x10001bf9
cmp dword [ebp + 0x10], ecx
je 0x10001c10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x10001c34
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001ba0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1000237a
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002340
pop esi
pop ebx
pop edi
pop ebp
ret 0x18

Function at 0x414dd9
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edi
mov esi, 0xce84b88
add esi, 0x66efb89f
sub ecx, 0xf0a62f06
add ebx, 4
cmp ebx, eax
jne fcn.00414dd9
or edx, edx
sub edx, 1
dec esi
ret
Function at 0x40437a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x419404]
call fcn.00401379
mov eax, dword [0x419596]
add esp, 0xc
test eax, eax
jg 0x4043a5
and dword [0x41a964], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x4043ab
mov esi, eax
push esi
push dword [0x419404]
push dword [0x418004]
call fcn.004090f2
add esp, 0xc
cmp dword [0x41a990], 0
mov dword [0x41a964], eax
je 0x404417
cmp eax, 0xffffffff
je 0x404417
cmp eax, esi
je 0x404423
test eax, eax
jl 0x404417
mov ecx, dword [0x41800c]
mov edx, dword [0x41a994]
inc ecx
call fcn.00402b84
mov eax, dword [0x41a964]
test eax, eax
jne 0x404410
push esi
push dword [0x419404]
push dword [0x418004]
call fcn.004090f2
add esp, 0xc
mov dword [0x41a964], eax
cmp eax, 0xffffffff
je 0x404417
mov esi, eax
cmp eax, esi
je 0x404423
push 2
pop ecx
jmp fcn.00403b75
mov esi, dword [0x419404]
mov ecx, dword [0x418044]
mov dword [0x41a960], esi
test byte [ecx + 0x28], 1
je 0x404475
mov byte [0x41a95f], 1
test word [ecx + 0x28], 0x1300
jne 0x404481
push edi
mov edi, eax
test edi, edi
je 0x40446d
dec edi
call fcn.00408d3e
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00408d58
inc esi
test edi, edi
pop ecx
jne 0x404451
mov eax, dword [0x41a964]
mov byte [0x41a95f], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x41a964], eax
mov eax, ecx
pop esi
ret
push 0xf72
push dword [0x41801c]
call fcn.0040256a
int3
Function at 0x408d58
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x424a98]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x4195a8]
mov ecx, dword [0x424aa0]
mov dword [0x424a98], eax
movzx eax, al
add eax, dword [0x424a9c]
imul eax, eax, 0x8088405
inc eax
mov dword [0x424a9c], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x4195a8]
mov eax, dword [esp + 4]
mov dword [0x424aa0], ecx
ret

Function at 0x408de8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x418420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41a98c]
mov esi, ecx
call fcn.00408db0
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00401329
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.00408d3e
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.00408d58
inc esi
cmp esi, 0xc
pop ecx
jl 0x408e17
cmp dword [0x41a988], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x408e56
movzx cx, byte [0x41958f]
cmp ax, cx
je 0x408e60
or eax, 0xffffffff
jmp 0x408e62
movzx cx, byte [0x419595]
jmp 0x408e4c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409326
leave
ret
Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x438c99
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
add ecx, 0x83fc4272
sub ebx, ecx
call fcn.00438cdc
sub ebx, 0xe1b7b999
or ecx, ebx
add ebx, 0x6af140c4
xor dword [eax], edi
inc ebx
inc eax
add ecx, 0xccc08135
sub ecx, ebx
cmp eax, edx
jne fcn.00438c99
inc ebx
push 0x1f324098
pop ebx
mov ebx, 0xab3e1e1b
ret
Function at 0x402e97
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x42c13c
call fcn.0041678c
xor edi, edi
push str.SELECT_Value_FROM_Property_WHERE_Property.Property
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], edi
call fcn.00401a26
mov esi, 0x42f230
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00402bc8
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
call fcn.00402c68
push esi
lea ecx, [ebp - 0x18]
call fcn.00402bc8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040238e
push eax
push esi
push dword [ebp + 0xc]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
je 0x402f0a
mov ecx, dword [ebp + 8]
call fcn.00401301
jmp 0x402f9c
push edi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x402efd
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0040238e
push eax
push esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
cmp eax, edi
jne 0x402efd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call sub.msi.dll_MsiRecordSetStreamA
cmp dword [ebp - 0x1c], edi
je 0x402efd
call fcn.004062c1
push eax
lea ecx, [ebp + 0x10]
call fcn.004011df
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call fcn.00401315
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call sub.msi.dll_MsiRecordSetStreamA
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.004011ba
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.00401780
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
cmp dword [ebp - 0x10], edi
je 0x402fa9
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], edi
je 0x402fb6
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040103d
mov eax, dword [ebp + 8]
call fcn.0041682b
ret 0xc
Function at 0x4036dc
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x42c294
call fcn.0041678c
lea eax, [ebp - 0x10]
push eax
call fcn.00402fcc
xor esi, esi
push 0x44
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00416950
push 0x10
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0x68], 0x44
call fcn.00416950
mov eax, dword [ebp - 0x10]
add esp, 0x18
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00401315
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403770
cmp dword [0x43c368], esi
je 0x403764
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
push str.InstallProduct:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x43c35c
call fcn.00401448
add esp, 0x10
mov ecx, 0x43c2b8
call fcn.00404a50
jmp 0x4037c1
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4037b1
cmp dword [ebp - 0x14], 0xbc2
jne 0x4037b1
cmp dword [0x43c36c], esi
jne 0x4037b1
mov ecx, 0x43c2b8
mov dword [0x43c36c], 1
call fcn.0040efdb
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040103d
call fcn.0041682b
ret
Function at 0x4039d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
mov edi, ecx
call fcn.00416950
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 0x58], 0x44
call fcn.00416950
add edi, 8
mov eax, dword [edi]
add esp, 0x18
push dword [eax - 0xc]
mov ecx, edi
call fcn.00401315
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403a61
cmp dword [0x43c368], esi
je 0x403a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [edi]
push str.InstallUpdate:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x43c35c
call fcn.00401448
add esp, 0x10
mov ecx, 0x43c2b8
call fcn.00404a50
xor eax, eax
jmp 0x403ae5
xor edi, edi
cmp dword [0x43c370], esi
jne 0x403a7b
push esi
push esi
push esi
push esi
push 0x42eae0
call fcn.0040d489
mov edi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp edi, esi
je 0x403aa6
mov eax, dword [edi + 0x20]
cmp eax, esi
jne 0x403a95
xor eax, eax
jmp 0x403a98
mov eax, dword [eax + 0x20]
push esi
push esi
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edi, edi
inc edi
test eax, eax
je 0x403ad3
cmp dword [ebp - 4], 0xbc2
jne 0x403ad3
mov ecx, 0x43c2b8
mov dword [0x43c36c], edi
call fcn.0040efdb
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x403ba8
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x42be86
call fcn.0041678c
mov esi, ecx
push 0
lea ebx, [esi + 8]
push str.http:__
mov ecx, ebx
call fcn.00402480
test eax, eax
je 0x403bdd
push 0
push str.ftp:__
mov ecx, ebx
call fcn.00402480
test eax, eax
jne 0x403c5c
push 0x2f
mov ecx, ebx
call fcn.004023a4
mov ecx, dword [ebx]
inc eax
cmp eax, dword [ecx - 0xc]
mov dword [ebp - 0x10], eax
jne 0x403bfa
mov ecx, ebx
call fcn.0040120e
jmp 0x403c5c
lea ecx, [esi + 0x10]
push ebx
mov dword [esi + 0xc], 1
call fcn.004013fb
lea edi, [esi + 0x14]
mov esi, 0x104
push esi
mov ecx, edi
call fcn.00401315
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004011ba
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.00403ae9
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00402c68
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040103d
push edi
mov ecx, ebx
call fcn.004013fb
call fcn.0041682b
ret