joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c620
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
sub esp, 0x30
mov eax, dword [0x10067024]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
lea eax, [esp + 4]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
xorps xmm0, xmm0
push eax
push 0x24
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0
push eax
push 0
push ebx
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x34], xmm0
call ebp
test eax, eax
jne 0x1000c685
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1002c803
add esp, 0x30
ret 8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x1c], esi
je 0x1000c6d9
nop dword [eax]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push 0x24
lea eax, [esp + 0x20]
push eax
push 0
push ebx
call ebp
test eax, eax
je 0x1000c70a
cmp dword [esp + 0x1c], esi
je 0x1000c6d9
call edi
sub eax, dword [esp + 0x14]
cmp eax, 0x7530
ja 0x1000c6f0
cmp dword [esp + 0x1c], esi
jne 0x1000c6a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1002c803
add esp, 0x30
ret 8
pop edi
pop esi
pop ebp
mov eax, 0x102
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1002c803
add esp, 0x30
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002c803
add esp, 0x30
ret 8
Function at 0x10015d30
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x10015e5b
lea eax, [esp + 0x10]
push eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x10015dda
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10015e5b
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10015e5b
push 0x20a
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push edi
push eax
push 0
mov dword [esi + 4], eax
mov dword [esi], 0x105
call ebx
test eax, eax
je 0x10015dcd
mov esi, dword [esi + 4]
xor edx, edx
mov ecx, esi
cmp word [esi], dx
je 0x10015dcd
nop
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x10015db0
test edx, edx
je 0x10015dcd
cmp word [esi + edx*2 - 2], 0x5c
je 0x10015dcd
mov dword [esi + edx*2], 0x5c
pop edi
cmp eax, 1
pop esi
sete al
pop ebx
add esp, 8
ret
push 0x20a
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], 0x105
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edi, eax
test edi, edi
je 0x10015e2d
mov esi, dword [esi + 4]
xor edx, edx
mov ecx, esi
cmp word [esi], dx
je 0x10015e2d
nop dword [eax]
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x10015e10
test edx, edx
je 0x10015e2d
cmp word [esi + edx*2 - 2], 0x5c
je 0x10015e2d
mov dword [esi + edx*2], 0x5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 0xc]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
cmp edi, 1
pop edi
pop esi
sete al
pop ebx
add esp, 8
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret
Function at 0x100160c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100439a5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x14], esi
push ecx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x1001610b
xor esi, esi
jmp 0x10016205
mov eax, str.SELECT__FROM___s__WHERE__Property__s_AND__Value__s
xor ecx, ecx
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10016112
xor edx, edx
mov eax, esi
cmp word [esi], dx
je 0x1001612f
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x10016125
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, edi
cmp word [edi], si
je 0x1001614a
nop dword [eax + eax]
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x10016140
mov eax, dword [ebp + 0xc]
xor edi, edi
mov ebx, eax
cmp word [ebx], di
mov ebx, dword [ebp - 0x10]
je 0x1001616a
nop dword [eax]
lea eax, [eax + 2]
inc edi
cmp word [eax], 0
jne 0x10016160
add ecx, 0xfffffffb
lea eax, [edi + esi]
add eax, edx
mov edx, 2
add eax, ecx
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
push str.SELECT__FROM___s__WHERE__Property__s_AND__Value__s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp + 0x14]
add esp, 0x14
push esi
push edi
push ebx
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x100161e6
push eax
push dword [esi]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x100161e6
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x100161e6
lea esi, [eax + 1]
jmp 0x100161e8
xor esi, esi
mov byte [ebp - 4], 0
test edi, edi
je 0x100161f7
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x10016217
push ebx
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016230
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100439dd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov eax, str.SELECT__FROM___s__WHERE__Property__s
xor esi, esi
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x10016265
xor ecx, ecx
mov eax, edx
cmp word [edx], cx
je 0x10016282
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10016278
mov ebx, dword [ebp + 8]
xor edx, edx
mov eax, ebx
cmp word [ebx], dx
je 0x1001629a
nop
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x10016290
lea eax, [edx + ecx]
add esi, 0xfffffffd
xor ecx, ecx
add eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
push ebx
push dword [ebp - 0x10]
push str.SELECT__FROM___s__WHERE__Property__s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp + 0xc]
add esp, 0x10
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x10016305
push eax
push dword [esi]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x10016305
lea esi, [eax + 1]
jmp 0x10016307
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10016319
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017460
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043cfd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x100174aa
cmp dword [ebp + 8], edx
jne 0x100174aa
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test edi, edi
jne 0x100174ce
xor bl, bl
jmp 0x100175c6
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100174e3
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push str.SELECT__FROM__Control__WHERE__Dialog____VerifyReadyDlg_AND__Control___Install
push edi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x100175b6
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x100175b6
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov ebx, dword [sym.imp.msi.dll_MsiRecordClearData]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001752b
push eax
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x10017595
push 8
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
cmp eax, 0x80000000
je 0x100175a0
mov ecx, dword [ebp + 8]
mov edx, eax
or edx, dword [ebp - 0x18]
not ecx
and edx, ecx
cmp edx, eax
je 0x10017521
push edx
push 8
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiRecordSetStringW]
test eax, eax
jne 0x100175a0
push dword [ebp - 0x10]
push 6
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x100175a0
push dword [ebp - 0x10]
push 7
push dword [ebp - 0x14]
call ebx
test eax, eax
je 0x10017521
xor bl, bl
jmp 0x100175a6
push edi
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
je 0x100175a4
xor bl, bl
jmp 0x100175a6
mov bl, 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100175b8
push eax
call esi
jmp 0x100175b8
xor bl, bl
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100175c6
push eax
call esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x100175d4
push edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043dfd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov edx, str.MsiLogFileLocation
push eax
call fcn.10016940
mov esi, dword [ebp - 0x10]
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x10017ec9
push 5
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10017edb
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10018fc0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push str.AI_INSTALLPERUSER___0_
push edi
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
dec eax
mov dword [ebp - 0x24], 0
neg eax
mov dword [ebp - 0x20], 0
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.Install
push str.VerifyReadyDlg
push str.SELECT__Attributes__FROM__Control__WHERE__Dialog_____s_AND__Control____s
mov esi, eax
mov dword [ebp - 0x24], 0x104
push 0x104
push esi
mov dword [ebp - 0x20], esi
call fcn.10013b00
add esp, 0x14
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x10019068
push eax
call ebx
push edi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov ecx, esi
call fcn.10016e00
add esp, 4
test eax, eax
jne 0x1001911e
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10019096
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x10019110
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov edi, eax
test edi, edi
jle 0x100190c0
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100190cf
cmp edi, 0x80070103
je 0x10019110
call fcn.10016f50
test edi, edi
jne 0x10019110
push 1
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
mov edi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100190ee
push ecx
call ebx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100190fc
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10019143
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10019143
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001911e
push eax
call ebx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001912c
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1001913e
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, SysReAllocString
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
je 0x10019169
test edi, 0x800000
jne 0x10019171
push ecx
push 0
mov edx, 0x800000
jmp 0x10019190
test edi, 0x800000
jne 0x10019188
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push 0x800000
xor edx, edx
mov ecx, dword [ebp - 0x18]
call fcn.10017460
movzx eax, al
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b950
Capabilities:
Delete directory

Disassembly:
sub esp, 0xd0
mov eax, dword [0x10067024]
xor eax, esp
mov dword [esp + 0xcc], eax
lea eax, [esp]
mov dword [esp], 0x64
push eax
lea eax, [esp + 8]
push eax
push str.CustomActionData
push dword [esp + 0xe0]
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x1001b995
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0xcc]
xor eax, eax
xor ecx, esp
call fcn.1002c803
add esp, 0xd0
ret 4
Function at 0x1001b9b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e4]
sub esp, 0x6e4
push 0xffffffffffffffff
push 0x10044f8d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0x6e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x6ec]
push ebx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x1001ba0e
mov esi, 0x643
jmp 0x1001bbb0
push str.AI_SH_DIR
mov edx, str.ComboBox
mov ecx, ebx
call fcn.10016570
mov esi, dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp + 0x458]
push eax
push str.ProgramMenuFolder
push ebx
call esi
test eax, eax
jne 0x1001bbae
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x40
push eax
lea eax, [ebp + 0x660]
push eax
push 0x100586b4
push ebx
call esi
test eax, eax
jne 0x1001bbae
xor ecx, ecx
lea eax, [ebp + 0x458]
cmp word [ebp + 0x458], cx
je 0x1001ba8a
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1001ba80
lea eax, [ebp + 0x458]
mov edx, 0x100562f0
lea eax, [eax + ecx*2]
mov ecx, 0x2a
sub edx, eax
nop
mov word [eax], cx
lea eax, [eax + 2]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x1001baa0
xor ecx, ecx
push 0x250
mov word [eax], cx
lea eax, [ebp]
push ecx
push eax
call fcn.1002e160
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x1001bbae
lea eax, [ebp]
mov esi, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp], 0x10
mov cx, word [ebp + 0x2c]
jne 0x1001bb03
xor al, al
jmp 0x1001bb29
cmp cx, 0x2e
jne 0x1001bb27
mov ax, word [ebp + 0x2e]
test ax, ax
jne 0x1001bb16
xor al, al
jmp 0x1001bb29
cmp ax, 0x2e
jne 0x1001bb27
cmp word [ebp + 0x30], 0
jne 0x1001bb27
xor al, al
jmp 0x1001bb29
mov al, 1
test al, al
je 0x1001bb93
lea eax, [ebp + 0x250]
test cx, cx
je 0x1001bb54
mov edi, eax
movzx ecx, cx
lea edx, [ebp + 0x2c]
sub edx, edi
mov edi, dword [ebp - 0x14]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx + eax]
test cx, cx
jne 0x1001bb45
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x660]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001bb93
lea eax, [ebp + 0x250]
mov edx, ebx
push eax
push eax
push esi
push str.AI_SH_DIR
mov ecx, str.ComboBox
call fcn.10015e70
add esp, 0x10
test eax, eax
je 0x1001bb93
inc esi
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x1001baf5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001bbc5
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6e0]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0x6e4]
pop ebp
ret 4
Function at 0x1001dd30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100453e5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov edx, str.CustomActionData
push eax
call fcn.10016940
mov eax, dword [ebp - 0x24]
add esp, 4
mov edi, dword [ebp - 0x20]
test eax, eax
je 0x1001de52
cmp eax, 2
jne 0x1001dd9f
mov eax, 0x3a
mov word [edi + 2], ax
jmp 0x1001dda4
cmp eax, 3
jne 0x1001ddad
mov eax, 0x5c
mov word [edi + 4], ax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1001de52
mov esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
shr esi, 0xa
imul esi, dword [ebp - 0x18]
shr esi, 0xa
mov byte [ebp - 4], 1
push 0x16
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x2c], 0xb
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov ecx, esi
call fcn.10013d00
push ebx
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x1001de44
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1001de64
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa2c
mov eax, dword [0x10067024]
xor eax, esp
mov dword [esp + 0xa28], eax
push ebp
mov ebp, dword [esp + 0xa34]
lea eax, [esp + 0xc]
push esi
push edi
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], 0x208
push eax
push str.AI_OFFICE_REG
push ebp
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x104
push eax
push 0x20019
xor edi, edi
lea eax, [esp + 0x23c]
push edi
push eax
xor esi, esi
push SysReAllocString
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e98b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push eax
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x44]
push eax
push edi
push dword [esp + 0x2c]
call ebx
test eax, eax
jne 0x1001e959
nop word [eax + eax]
mov edx, str.OPEN
lea ecx, [esp + 0x30]
call fcn.10014f80
test al, al
je 0x1001e933
inc esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x104
push eax
lea eax, [esp + 0x44]
inc edi
push eax
push edi
push dword [esp + 0x2c]
call ebx
test eax, eax
je 0x1001e920
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test esi, esi
jne 0x1001e96f
push 0x10053794
jmp 0x1001e97f
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.10013d00
lea eax, [esp + 0x18]
push eax
push str.AI_ADDIN
push ebp
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov ecx, dword [esp + 0xa34]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1002c803
add esp, 0xa2c
ret 4
Function at 0x10021fa0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10045bd5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x10021fe6
push eax
call ebx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push esi
mov ecx, str.SELECT__Argument____Condition__FROM__ControlEvent__WHERE__Dialog____ExitDialog_AND__Control____Finish_AND__Event___DoAction_ORDER_BY__Ordering_
mov dword [ebp - 0x14], 0
call fcn.10016e00
add esp, 4
test eax, eax
js 0x10022144
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002201e
push eax
call ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x10022136
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jle 0x10022049
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1002212a
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, 2
push eax
call fcn.100173c0
mov edi, dword [ebp - 0x20]
add esp, 4
push edi
push esi
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1002208e
cmp eax, 2
je 0x1002208e
xor bl, bl
jmp 0x10022090
mov bl, 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov edx, 1
push eax
call fcn.100173c0
mov esi, dword [ebp - 0x18]
add esp, 4
test bl, bl
je 0x100220dc
push 0
mov edx, 0x10059974
mov ecx, esi
call fcn.10015020
add esp, 4
test al, al
je 0x100220dc
push esi
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiEnumComponentQualifiersA]
mov byte [ebp - 4], 2
test esi, esi
je 0x100220ef
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
jmp 0x100220f5
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
test edi, edi
je 0x1002210e
push edi
call esi
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
jmp 0x10022014
cmp eax, 0x80070103
je 0x10022136
call fcn.10016f50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10022144
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10022155
push eax
call ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4