joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407fb3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41001c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040542a
and dword [ebp - 0x14], 0
cmp dword [0x411d34], 0
mov dword [ebp - 0x18], eax
jne 0x408066
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40810e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40810e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411d34], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411d38], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411d3c], eax
call edi
push eax
call esi
mov dword [0x411d44], eax
test eax, eax
je 0x408066
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411d40], eax
mov eax, dword [0x411d40]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4080bf
cmp dword [0x411d44], ecx
je 0x4080bf
push eax
call esi
push dword [0x411d44]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4080bf
test ebx, ebx
je 0x4080bf
call edi
test eax, eax
je 0x4080b6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4080b6
test byte [ebp - 8], 1
jne 0x4080bf
or dword [ebp + 0x10], 0x200000
jmp 0x4080f2
mov eax, dword [0x411d38]
cmp eax, dword [ebp - 0x18]
je 0x4080f2
push eax
call esi
test eax, eax
je 0x4080f2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4080f2
mov eax, dword [0x411d3c]
cmp eax, dword [ebp - 0x18]
je 0x4080f2
push eax
call esi
test eax, eax
je 0x4080f2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411d34]
call esi
test eax, eax
je 0x40810e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408110
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401efc
leave
ret
Function at 0x401da0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x401dcd
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401dc1
pop esi
ret

Function at 0x401dd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0x19600
push 0x407030
call fcn.00401da0
push 0x407030
call fcn.004012f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x401e15
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.00401af0
add esp, 8
test eax, eax
jne 0x401e19
push ebx
call fcn.00401b80
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x2a8
mov ecx, 0xaa
mov esi, str._.________.
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.00401b80
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1001884
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1001897
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1001893
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10018b8
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x10018f7
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10018ed
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10018f9
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10018dd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401ca5
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x401ca7
ret

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x445e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x40000]
push edi
jmp 0x445e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x445e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x445e70
mov eax, 1
add ebx, ebx
jne 0x445e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x445e88
jne 0x445ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445e88
xor ecx, ecx
sub eax, 3
jb 0x445eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x445f2a
mov ebp, eax
add ebx, ebx
jne 0x445ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x445ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x445ef4
inc ecx
add ebx, ebx
jne 0x445ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x445ed5
jne 0x445ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x445f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x445f05
jmp 0x445e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x445f14
add edi, ecx
jmp 0x445e76
pop esi
mov edi, esi
mov ecx, 0x6800
jmp 0x445f66
mov al, byte [edi]
add edi, 1
cmp al, 0x80
jb 0x445f47
cmp al, 0x8f
ja 0x445f47
cmp byte [edi - 2], 0xf
je 0x445f4d
sub al, 0xe8
cmp al, 1
ja 0x445f70
cmp byte [edi], 1
jne 0x445f70
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
mov dword [edi], eax
add edi, 4
sub ecx, 4
mov al, byte [edi]
add edi, 1
loop 0x445f47
sub ecx, 1
jg 0x445f34
lea edi, [esi + 0x43000]
mov eax, dword [edi]
or eax, eax
je 0x445fc6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4a300]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4a3a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x445f7b
mov ecx, edi
jns 0x445faa
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4a3a4]
or eax, eax
je 0x445fc0
mov dword [ebx], eax
add ebx, 4
jmp 0x445f98
call dword [esi + 0x4a3b4]
mov ebp, dword [esi + 0x4a3a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x445ffa
sub esp, 0xffffff80
jmp 0x403640
Function at 0x43c290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42f015
lea edi, [esi - 0x2e015]
push edi
jmp 0x43c2aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43c2b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43c2a0
mov eax, 1
add ebx, ebx
jne 0x43c2c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43c2b8
jne 0x43c2d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43c2b8
xor ecx, ecx
sub eax, 3
jb 0x43c2e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43c35a
mov ebp, eax
add ebx, ebx
jne 0x43c2f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43c300
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43c324
inc ecx
add ebx, ebx
jne 0x43c310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43c305
jne 0x43c321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43c305
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43c344
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43c335
jmp 0x43c2a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43c344
add edi, ecx
jmp 0x43c2a6
pop esi
mov edi, esi
mov ecx, 0x1b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43c362
cmp byte [edi], 6
jne 0x43c362
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43c367
lea edi, [esi + 0x3a000]
mov eax, dword [edi]
or eax, eax
je 0x43c3df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3c5e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3c624]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43c394
mov ecx, edi
jns 0x43c3c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3c62c]
or eax, eax
je 0x43c3d9
mov dword [ebx], eax
add ebx, 4
jmp 0x43c3b1
call dword [esi + 0x3c628]
mov ebp, dword [esi + 0x3c630]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43c413
sub esp, 0xffffff80
jmp 0x40232c
Function at 0x4010d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x40111d
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + edx*4]
movzx eax, word [edx + ecx]
cmp eax, 0x2d
je 0x401124
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + eax*4]
movzx ecx, word [eax + edx]
cmp ecx, 0x2f
je 0x401124
xor eax, eax
jmp 0x40127c
mov edx, 2
shl edx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + eax*4]
movzx ecx, word [eax + edx]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x3f
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x39
ja case.0x401159.1
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x4012b0]
jmp dword [ecx*4 + 0x401284]
call fcn.00401000
push 0
call fcn.00403bbb
mov edx, dword [ebp + 0xc]
add edx, 1
cmp edx, dword [ebp + 0x10]
jl 0x40117e
xor eax, eax
jmp 0x40127c
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 1
mov eax, 2
jmp 0x40127c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 1
mov eax, 1
jmp 0x40127c
mov edx, dword [ebp + 0xc]
add edx, 1
cmp edx, dword [ebp + 0x10]
jl 0x4011b8
xor eax, eax
jmp 0x40127c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx + ecx*4 + 4]
mov dword [eax], ecx
mov eax, 2
jmp 0x40127c
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 1
mov eax, 1
jmp 0x40127c
mov eax, dword [ebp + 0xc]
add eax, 1
cmp eax, dword [ebp + 0x10]
jl 0x4011f7
xor eax, eax
jmp 0x40127c
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + edx*4 + 4]
mov dword [ecx + 4], edx
mov eax, 2
jmp 0x40127c
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 1
mov eax, 1
jmp 0x40127c
mov ecx, dword [ebp + 0xc]
add ecx, 1
cmp ecx, dword [ebp + 0x10]
jl 0x40122e
xor eax, eax
jmp 0x40127c
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 1
mov eax, 2
jmp 0x40127c
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 1
mov eax, 1
jmp 0x40127c
mov ecx, dword [ebp + 0xc]
add ecx, 1
cmp ecx, dword [ebp + 0x10]
jl 0x40125f
xor eax, eax
jmp 0x40127c
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 1
mov eax, 2
jmp 0x40127c
call fcn.00401000
push 1
call fcn.00403bbb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4015f0
Capabilities:
Reference sql statements
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401644
mov dword [ebp - 4], 2
jmp 0x401760
lea ecx, [ebp - 0xc]
push ecx
push str.SELECT_Data_FROM__Streams_WHERE_Name___
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call sub.msi.dll_MsiEnumClientsA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40166c
jmp 0x401760
push 1
call sub.msi.dll_MsiDatabaseExportA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40168d
mov dword [ebp - 4], 0xe
jmp 0x401760
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call sub.msi.dll_MsiReinstallFeatureW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4016af
jmp 0x401760
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.msi.dll_MsiViewModify
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4016cf
jmp 0x401760
mov edx, dword [ebp - 8]
push edx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.msi.dll_MsiDatabaseIsTablePersistentA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4016f9
jmp 0x401760
mov dword [ebp - 0x14], 0x400
cmp dword [ebp - 0x14], 0x400
jne 0x401760
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x41c]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call sub.msi.dll_MsiRecordSetStringA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40172c
jmp 0x401760
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x41c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401753
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
je 0x40175e
mov dword [ebp - 4], 0x1d
jmp 0x401760
jmp 0x401700
cmp dword [ebp - 8], 0
je 0x40176f
mov ecx, dword [ebp - 8]
push ecx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0xc], 0
je 0x40177e
mov edx, dword [ebp - 0xc]
push edx
call sub.msi.dll_MsiViewGetErrorW
cmp dword [ebp - 0x10], 0xffffffff
je 0x40178e
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x40179d
mov dword [ebp - 0x18], 1
jmp 0x4017a4
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x401c60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], str.bqrdeosjhrmyb
mov dword [ebp - 8], 0
jmp 0x401c8d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x167b
jae 0x401cdf
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + section..data]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 1]
sar edx, 3
movzx eax, byte [ebp - 1]
shl eax, 5
or edx, eax
movzx ecx, byte [ebp - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + section..data], dl
mov eax, dword [ebp - 0xc]
add eax, 1
cdq
mov ecx, 0xd
idiv ecx
mov dword [ebp - 0xc], edx
jmp 0x401c84
lea edx, [ebp - 0x20]
push edx
push 0x40
push 0x167b
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, section..data
call eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 1
jmp 0x401d3d
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x10], 0
je 0x401d65
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
jge 0x401d65
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.004010d0
mov dword [ebp - 0x10], eax
jmp 0x401d34
lea ecx, [ebp - 0x48]
push ecx
call fcn.00401020
test eax, eax
jne 0x401d7c
jmp 0x401e07
lea edx, [ebp - 0x48]
push edx
call fcn.004012f0
test eax, eax
jne 0x401d8d
jmp 0x401e07
cmp dword [ebp - 0x3c], 0
je 0x401da4
lea eax, [ebp - 0x48]
push eax
call fcn.004014d0
test eax, eax
jne 0x401da4
jmp 0x401e07
cmp dword [ebp - 0x28], 0
je 0x401dbb
lea ecx, [ebp - 0x48]
push ecx
call fcn.00401c10
test eax, eax
jne 0x401dbb
jmp 0x401e07
cmp dword [ebp - 0x38], 0
je 0x401dd2
lea edx, [ebp - 0x48]
push edx
call fcn.004017b0
test eax, eax
jne 0x401dd2
jmp 0x401e07
cmp dword [ebp - 0x2c], 0
je 0x401de9
lea eax, [ebp - 0x48]
push eax
call fcn.00401820
test eax, eax
jne 0x401de9
jmp 0x401e07
cmp dword [ebp - 0x34], 0
je 0x401e00
lea ecx, [ebp - 0x48]
push ecx
call fcn.004015c0
test eax, eax
jne 0x401e00
jmp 0x401e07
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x401e16
mov dword [ebp - 0x18], 1
jmp 0x401e1d
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00401350
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x40b270
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040aeed
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul edi
sub ebx, 0xff
dec esi
imul eax
sub ebx, 0x2b
or edx, 0xcd
mov eax, 0xa9
neg eax
imul eax
bswap edx
rcl ebx, 0x35
dec eax
rcr ebx, 0x9b
neg edx
dec edi
and esi, 0xf0
mov edi, 0xdf
ror ebx, 5
rcl esi, 2
bswap esi
bswap edx
rcr eax, 0xb5
bswap ebx
neg ebx
imul edx
inc esi
inc eax
dec esi
dec eax
not edi
rol ebx, 0x8a
inc eax
add esi, 0x33
and edx, 0xd6
mov eax, 0x27
bswap esi
imul edx
dec edi
add esi, 0x27
rcl eax, 0x53
dec edx
dec eax
bswap edx
imul edi
not eax
sbb edx, 0x7e
sub edx, 0x9f
bswap edi
neg eax
bswap ebx
xor ecx, ecx
xor edi, edi
neg edi
rcr edx, 0x47
dec esi
inc edi
sbb eax, 0xaa
bswap ebx
inc eax
rol edi, 0xbf
not edx
bswap esi
not ebx
rcl edx, 0xe7
inc edx
mov esi, 0x4f
sbb edx, 0x2f
rcr edi, 0xbd
dec edi
mov edi, 0xd6
or eax, 0x3e
imul edx
bswap edi
rol edi, 0x6d
bswap esi
imul esi
or edx, 0xbf
bswap eax
add ebx, 0x6a
add esi, 0xf8
neg edi
ror edx, 0x64
bswap ebx
rol edx, 0xd0
imul ebx
not eax
rol edi, 0xa7
mov ebx, 0xe8
add esi, 0xae
rcr esi, 0x29
neg eax
dec edi
rol ebx, 0xf8
imul edx
ror ebx, 2
dec edx
dec edi
rcl ebx, 0x3b
sbb eax, 7
or edi, 0x4c
dec ebx
ror edi, 0x3f
mov ecx, dword [ebp + 0xc]
imul ebx
ror edi, 0xbf
dec edi
dec eax
ror edx, 0xd4
mov edx, 0xbc
neg ebx
sbb esi, 0xc1
rcl esi, 0xa3
neg ebx
inc esi
rcr edx, 0xac
imul edi
rcr eax, 0x23
neg esi
sbb edi, 0x21
imul eax
inc eax
not ebx
add eax, 0xa8
not esi
not edi
rcr eax, 0xd9
or eax, 0xd1
not edx
and eax, 0x60
not edi
imul ebx
rcl eax, 0x68
inc esi
rcl eax, 0x63
bswap esi
rcl eax, 0x2f
not edx
mov esi, 0x5a
inc edx
sbb edi, 0xf7
and esi, 0xf5
dec edx
imul edx
not esi
neg edi
rcl ebx, 2
rcl edx, 0x79
bswap eax
sub esi, 0x2d
rcl edi, 0x7c
ror edi, 0x30
bswap ebx
and esi, 0x6e
mov edi, dword [ebp + 8]
xor ebx, eax
mov eax, ebx
xor esi, esi
xor eax, esi
mov ebx, esi
xor ebx, esi
xor eax, ebx
xor eax, eax
xor esi, ebx
mov esi, esi
xor eax, ebx
xor esi, ebx
not byte [edi]
xor eax, eax
mov eax, esi
xor ebx, esi
mov ebx, ebx
mov ebx, ebx
mov ebx, eax
xor esi, esi
mov eax, esi
xor esi, esi
add byte [edi], 0x97
mov ebx, ebx
xor ebx, esi
mov esi, ebx
xor esi, esi
mov eax, esi
mov ebx, ebx
mov eax, eax
xor ebx, eax
xor esi, ebx
sub byte [edi], 0x56
mov eax, ebx
mov esi, ebx
xor esi, eax
xor ebx, ebx
mov ebx, eax
xor esi, eax
mov esi, ebx
xor ebx, ebx
mov eax, esi
imul byte [edi]
inc edi
loop 0x4011a2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403857
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461484]
jne 0x403861
repz ret
jmp fcn.0040696c