joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012c60
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100398cd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10059024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push str.AI_INSTALLPERUSER___0_
push edi
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
dec eax
mov dword [ebp - 0x24], 0
neg eax
mov dword [ebp - 0x20], 0
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.Install
push str.VerifyReadyDlg
push str.SELECT__Attributes__FROM__Control__WHERE__Dialog_____s_AND__Control____s
mov esi, eax
mov dword [ebp - 0x24], 0x104
push 0x104
push esi
mov dword [ebp - 0x20], esi
call fcn.1000de80
add esp, 0x14
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x10012d08
push eax
call ebx
push edi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov ecx, esi
call fcn.10011080
add esp, 4
test eax, eax
jne 0x10012dbe
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10012d36
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x10012db0
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov edi, eax
test edi, edi
jle 0x10012d60
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x10012d6f
cmp edi, 0x80070103
je 0x10012db0
call fcn.100112b0
test edi, edi
jne 0x10012db0
push 1
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
mov edi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10012d8e
push ecx
call ebx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10012d9c
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10012de3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10012de3
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10012dbe
push eax
call ebx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10012dcc
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10012dde
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, SysReAllocString
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
je 0x10012e0d
test edi, 0x800000
jne 0x10012e15
push str.SELECT__FROM__Control__WHERE__Dialog____VerifyReadyDlg_AND__Control___Install
push 0
mov edx, 0x800000
jmp 0x10012e38
test edi, 0x800000
jne 0x10012e2c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.SELECT__FROM__Control__WHERE__Dialog____VerifyReadyDlg_AND__Control___Install
push 0x800000
xor edx, edx
mov ecx, dword [ebp - 0x18]
call fcn.10011720
movzx eax, al
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014bb0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xd0
mov eax, dword [0x10059024]
xor eax, esp
mov dword [esp + 0xcc], eax
lea eax, [esp]
mov dword [esp], 0x64
push eax
lea eax, [esp + 8]
push eax
push str.CustomActionData
push dword [esp + 0xe0]
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10014bf5
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0xcc]
xor eax, eax
xor ecx, esp
call fcn.10024a34
add esp, 0xd0
ret 4
Function at 0x10014c10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e4]
sub esp, 0x6e4
push 0xffffffffffffffff
push 0x10039b6d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10059024]
xor eax, ebp
mov dword [ebp + 0x6e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x6ec]
push ebx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x10014c6e
mov esi, 0x643
jmp 0x10014e10
push str.AI_SH_DIR
mov edx, str.ComboBox
mov ecx, ebx
call fcn.100108a0
mov esi, dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp + 0x458]
push eax
push str.ProgramMenuFolder
push ebx
call esi
test eax, eax
jne 0x10014e0e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x40
push eax
lea eax, [ebp + 0x660]
push eax
push 0x1004c89c
push ebx
call esi
test eax, eax
jne 0x10014e0e
xor ecx, ecx
lea eax, [ebp + 0x458]
cmp word [ebp + 0x458], cx
je 0x10014cea
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10014ce0
lea eax, [ebp + 0x458]
mov edx, 0x1004c8b4
lea eax, [eax + ecx*2]
mov ecx, 0x2a
sub edx, eax
nop
mov word [eax], cx
lea eax, [eax + 2]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x10014d00
xor ecx, ecx
push 0x250
mov word [eax], cx
lea eax, [ebp]
push ecx
push eax
call fcn.10026360
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x10014e0e
lea eax, [ebp]
mov esi, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp], 0x10
mov cx, word [ebp + 0x2c]
jne 0x10014d63
xor al, al
jmp 0x10014d89
cmp cx, 0x2e
jne 0x10014d87
mov ax, word [ebp + 0x2e]
test ax, ax
jne 0x10014d76
xor al, al
jmp 0x10014d89
cmp ax, 0x2e
jne 0x10014d87
cmp word [ebp + 0x30], 0
jne 0x10014d87
xor al, al
jmp 0x10014d89
mov al, 1
test al, al
je 0x10014df3
lea eax, [ebp + 0x250]
test cx, cx
je 0x10014db4
mov edi, eax
movzx ecx, cx
lea edx, [ebp + 0x2c]
sub edx, edi
mov edi, dword [ebp - 0x14]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx + eax]
test cx, cx
jne 0x10014da5
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x660]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10014df3
lea eax, [ebp + 0x250]
mov edx, ebx
push eax
push eax
push esi
push str.AI_SH_DIR
mov ecx, str.ComboBox
call fcn.100101a0
add esp, 0x10
test eax, eax
je 0x10014df3
inc esi
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x10014d55
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10014e25
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6e0]
xor ecx, ebp
call fcn.10024a34
lea esp, [ebp + 0x6e4]
pop ebp
ret 4
Function at 0x10016f90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10059024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov edx, str.CustomActionData
push eax
call fcn.10010bc0
mov eax, dword [ebp - 0x24]
add esp, 4
mov edi, dword [ebp - 0x20]
test eax, eax
je 0x100170b2
cmp eax, 2
jne 0x10016fff
mov eax, 0x3a
mov word [edi + 2], ax
jmp 0x10017004
cmp eax, 3
jne 0x1001700d
mov eax, 0x5c
mov word [edi + 4], ax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x100170b2
mov esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
shr esi, 0xa
imul esi, dword [ebp - 0x18]
shr esi, 0xa
mov byte [ebp - 4], 1
push 0x16
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x2c], 0xb
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov ecx, esi
call fcn.1000e080
push ebx
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x100170a4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x100170c4
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10017ae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa2c
mov eax, dword [0x10059024]
xor eax, esp
mov dword [esp + 0xa28], eax
push ebp
mov ebp, dword [esp + 0xa34]
lea eax, [esp + 0xc]
push esi
push edi
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], 0x208
push eax
push str.AI_OFFICE_REG
push ebp
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x104
push eax
push 0x20019
xor edi, edi
lea eax, [esp + 0x23c]
push edi
push eax
xor esi, esi
push SysReAllocString
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10017beb
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push eax
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x44]
push eax
push edi
push dword [esp + 0x2c]
call ebx
test eax, eax
jne 0x10017bb9
nop word [eax + eax]
mov edx, str.OPEN
lea ecx, [esp + 0x30]
call fcn.1000f2e0
test al, al
je 0x10017b93
inc esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x104
push eax
lea eax, [esp + 0x44]
inc edi
push eax
push edi
push dword [esp + 0x2c]
call ebx
test eax, eax
je 0x10017b80
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test esi, esi
jne 0x10017bcf
push 0x100469b0
jmp 0x10017bdf
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.1000e080
lea eax, [esp + 0x18]
push eax
push str.AI_ADDIN
push ebp
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov ecx, dword [esp + 0xa34]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10024a34
add esp, 0xa2c
ret 4
Function at 0x1001a770
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a59d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10059024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
mov eax, 0x2aaaaaab
imul ecx, esi, 0x64
imul ecx
mov ecx, esi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp esi, 0x60
lea edx, [ebp - 0x24]
sete byte [ebp - 0x25]
call fcn.1000e080
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov esi, dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push eax
push str.AI_SYSTEM_DPI
push ebx
call esi
lea edx, [ebp - 0x24]
mov ecx, edi
call fcn.1000e080
lea eax, [ebp - 0x24]
push eax
push str.AI_SYSTEM_DPI_SCALE
push ebx
call esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov edx, str.AI_BITMAP_DISPLAY_MODE
push eax
call fcn.10010bc0
add esp, 4
test al, al
je 0x1001a83f
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x34]
push 0xa
mov dword [ebp - 0x34], 0xffffffff
call fcn.1000fd60
add esp, 4
mov ebx, eax
xor edi, edi
xor esi, esi
cmp ebx, 3
ja case.default.0x1001a848
jmp dword [ebx*4 + 0x1001a8e8]
mov edi, 0x100000
jmp 0x1001a86f
xor edi, edi
mov esi, 0x100000
jmp case.default.0x1001a848
movzx esi, byte [ebp - 0x25]
xor edi, edi
xor esi, 1
shl esi, 0x14
jmp case.default.0x1001a848
xor edi, edi
xor esi, esi
mov ebx, dword [ebp + 8]
mov edx, edi
push str.SELECT__FROM__Control__WHERE__Type___Bitmap
push esi
mov ecx, ebx
call fcn.10011720
push str.SELECT__FROM__Control__WHERE__Type___Icon
push esi
mov edx, edi
mov ecx, ebx
call fcn.10011720
push str.SELECT__FROM__Control__WHERE__Type___PushButton
push esi
mov edx, edi
mov ecx, ebx
call fcn.10011720
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1001a8b9
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10024a34
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a900
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a5f5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10059024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x1001a946
push eax
call ebx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push esi
mov ecx, str.SELECT__Argument____Condition__FROM__ControlEvent__WHERE__Dialog____ExitDialog_AND__Control____Finish_AND__Event___DoAction_ORDER_BY__Ordering_
mov dword [ebp - 0x14], 0
call fcn.10011080
add esp, 4
test eax, eax
js 0x1001aaa4
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001a97e
push eax
call ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x1001aa96
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jle 0x1001a9a9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1001aa8a
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, 2
push eax
call fcn.10011680
mov edi, dword [ebp - 0x20]
add esp, 4
push edi
push esi
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1001a9ee
cmp eax, 2
je 0x1001a9ee
xor bl, bl
jmp 0x1001a9f0
mov bl, 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov edx, 1
push eax
call fcn.10011680
mov esi, dword [ebp - 0x18]
add esp, 4
test bl, bl
je 0x1001aa3c
push 0
mov edx, 0x1004dae4
mov ecx, esi
call fcn.1000f370
add esp, 4
test al, al
je 0x1001aa3c
push esi
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiEnumComponentQualifiersA]
mov byte [ebp - 4], 2
test esi, esi
je 0x1001aa4f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
jmp 0x1001aa55
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
test edi, edi
je 0x1001aa6e
push edi
call esi
mov ebx, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
jmp 0x1001a974
cmp eax, 0x80070103
je 0x1001aa96
call fcn.100112b0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001aaa4
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001aab5
push eax
call ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b650
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x1003a7cd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10059024]
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x624]
mov edi, 0x10059a20
mov eax, dword [edi]
mov esi, dword [edi + 4]
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push 0x410
push eax
call fcn.1000f2a0
add esp, 0xc
lea edx, [ebp]
mov ecx, esi
call fcn.1000fe10
test al, al
je 0x1001b6d4
cmp word [ebp], 0
je 0x1001b72b
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
jmp 0x1001b72b
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
call fcn.10010060
mov esi, dword [ebp - 0x14]
test al, al
je 0x1001b70b
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1001b71d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
add edi, 0xc
cmp edi, 0x10059a5c
jne 0x1001b694
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInetStp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b849
push eax
lea eax, [ebp + 0x208]
push 0x208
push eax
call fcn.1000f2a0
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 2
push eax
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.PathWWWRoot
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1001b849
push esi
lea eax, [ebp + 0x410]
push 0x208
push eax
call fcn.1000f2a0
add esp, 0xc
lea eax, [ebp + 0x410]
push 0x104
push eax
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [ebp + 0x410]
cmp word [ebp + 0x410], cx
je 0x1001b836
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1001b7f8
test ecx, ecx
je 0x1001b836
cmp word [ebp + ecx*2 + 0x40e], 0x5c
je 0x1001b836
mov eax, 0x5c
mov word [ebp + ecx*2 + 0x410], ax
lea eax, [ecx*2 + 2]
cmp eax, 0x208
jae 0x1001b870
xor ecx, ecx
mov word [ebp + eax + 0x410], cx
lea eax, [ebp + 0x410]
push eax
push str.IIsWWWRootFolder
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.10024a34
lea esp, [ebp + 0x61c]
pop ebp
ret 4
call fcn.100250b6
int3
Function at 0x1001d130
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ae0d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10059024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov edx, str.AI_USER_IGNORE_MSI
call fcn.10010bc0
mov edx, dword [ebp - 0x20]
xor ecx, ecx
add esp, 4
mov eax, edx
cmp word [edx], cx
je 0x1001d1a5
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1001d190
test ecx, ecx
je 0x1001d1a5
xor bl, bl
jmp 0x1001d2a8
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov edi, eax
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test edi, edi
jne 0x1001d1c6
xor bl, bl
jmp 0x1001d29d
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001d1db
push eax
call esi
cmp byte [ebp + 0xc], 0
mov ecx, str.SELECT__UserName__FROM__AI_UserAccounts__WHERE__UserName____
mov eax, str.SELECT__GroupName__FROM__AI_UserGroups__WHERE__GroupName____
mov dword [ebp - 0x10], 0
cmove eax, ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
je 0x1001d20a
xor bl, bl
jmp 0x1001d28f
push 1
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x1001d27f
push ebx
push 1
push edi
call dword [sym.imp.msi.dll_MsiReinstallFeatureW]
test eax, eax
jne 0x1001d27f
push edi
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x1001d27f
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001d24c
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x1001d26d
cmp dword [ebp - 0x14], eax
je 0x1001d26d
mov bl, 1
jmp 0x1001d26f
xor bl, bl
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001d281
push eax
call esi
jmp 0x1001d281
xor bl, bl
mov byte [ebp - 4], 2
test edi, edi
je 0x1001d28c
push edi
call esi
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001d29d
push eax
call esi
mov byte [ebp - 4], 0
test edi, edi
je 0x1001d2a8
push edi
call esi
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x20], 0
mov al, bl
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fc50
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x438]
sub esp, 0x438
push 0xffffffffffffffff
push 0x1003b875
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10059024]
xor eax, ebp
mov dword [ebp + 0x434], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
push 0
lea eax, [ebp + 0x22c]
push 0x208
push eax
call fcn.1000f2a0
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x22c]
push eax
push str.CustomActionData
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp esi, 1
jne 0x1001fcda
push str.Stopped
push str.AI_PROCESS_STATE
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x30], 0x10046a18
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004fd60
push esi
call edi
push 0
push 2
call eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x100469a8
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
lea eax, [ebp]
push 0x22c
push 0
push eax
call fcn.10026360
push 0
lea eax, [ebp]
push 0x22c
push eax
call fcn.1000f2a0
add esp, 0x18
mov dword [ebp], 0x22c
push 0x1004fd40
push esi
call edi
push 0x1004fd50
push dword [ebp - 0x10]
mov esi, eax
call edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp]
push eax
push edi
call esi
test eax, eax
je 0x1001fdc7
mov esi, dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001fdbb
mov eax, dword [ebp - 0x1c]
sub eax, 1
je 0x1001fdae
sub eax, 1
jne 0x1001fdbb
push dword [ebp + 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1001fdbb
push str.Running
push str.AI_PROCESS_STATE
push ebx
call esi
lea eax, [ebp]
push eax
push edi
call dword [ebp - 0x20]
test eax, eax
jne 0x1001fd75
mov byte [ebp - 4], 0
mov dword [ebp - 0x28], 0x100469a8
test edi, edi
je 0x1001fde4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0x10046a18
test eax, eax
je 0x1001fe07
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x2c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x434]
xor ecx, ebp
call fcn.10024a34
lea esp, [ebp + 0x438]
pop ebp
ret