joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416b12
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x4ad538
call fcn.0046ac08
mov ebx, ecx
push str.Notify...
lea ecx, [ebp - 0x10]
call fcn.00402829
xor edi, edi
lea edx, [ebp - 0x10]
push edi
push 2
pop ecx
mov dword [ebp - 4], edi
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push edi
call main
pop ecx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
test ecx, ecx
je 0x416b75
cmp eax, ecx
jbe 0x416b75
sub eax, ecx
cmp eax, 0x64
jae 0x416b75
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
push edi
push edi
push 3
pop esi
push esi
push edi
push edi
push 0x40000000
push dword [ebx + 0x14]
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x416c83
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe7
je 0x416bda
push str.Could_not_find_ARM_server_to_notify
lea ecx, [ebp - 0x10]
call fcn.00402829
push 0x186a0
push 2
lea edx, [ebp - 0x10]
mov dword [ebp - 4], 1
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor eax, eax
jmp 0x416cfd
push 0x7d0
push dword [ebx + 0x14]
call dword [sym.imp.kernel32.dll_WaitNamedPipeW]
test eax, eax
jne 0x416c08
push str.Wait_to_notify_ARM_Server_failed
lea ecx, [ebp - 0x10]
call fcn.00402829
push 2
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
push 0x186a0
jmp 0x416c3c
xor eax, eax
push eax
push eax
push esi
push eax
push eax
push 0x40000000
push dword [ebx + 0x14]
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x416c83
push str.Failed_to_contact_ARM_Server_to_notify
lea ecx, [ebp - 0x10]
call fcn.00402829
push 0x186a0
push 2
mov dword [ebp - 4], esi
pop ecx
lea edx, [ebp - 0x10]
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.Notify_ARM_Server_failed:_invalid_handle
lea ecx, [ebp - 0x14]
call fcn.00402829
push 0
push 2
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 6
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x416cf3
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0
push eax
push 4
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x416cb9
push str.Notify_ARM_Server:_failed_WriteFile
call fcn.00402829
mov dword [ebp - 4], 4
push 0x186a0
jmp 0x416ccf
push 2
pop esi
push str.WriteFile_succeeded_in_Notify
call fcn.00402829
mov dword [ebp - 4], 5
push 0
push 2
lea edx, [ebp - 0x10]
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x10], eax
push 0
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, esi
call fcn.0046abd1
ret 4
Function at 0x41815a
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0x828
mov eax, 0x4ad807
call fcn.0046ac3c
mov eax, dword [ebp + 0xc]
lea ebx, [ecx + 4]
mov edi, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x81c], ebx
call fcn.00456e5e
push ebx
call fcn.004183b2
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4183a7
call fcn.00450db1
push eax
lea ecx, [ebp - 0x818]
call main
and dword [ebp - 4], 0
mov esi, 0x104
imul esi, esi, 5
lea ecx, [ebp - 0x818]
push esi
call main
push dword [edi]
push esi
push eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileSectionNamesW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x818]
mov ebx, eax
call main
lea ecx, [esi - 2]
cmp ebx, ecx
je 0x4181bc
mov esi, dword [ebp - 0x818]
test ebx, ebx
je 0x41839f
cmp dword [esi - 4], 1
jle 0x418213
push dword [esi - 0xc]
lea ecx, [ebp - 0x818]
call main
mov esi, dword [ebp - 0x818]
mov edi, 0x4cead4
lea ecx, [ebp - 0x814]
push edi
call fcn.00402829
push edi
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 1
call fcn.00402829
lea eax, [ebx - 1]
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x81c]
xor edi, edi
mov dword [ebp - 0x834], eax
movzx eax, word [esi + edi*2]
test ax, ax
jne 0x418335
mov eax, dword [ebp - 0x814]
cmp dword [eax - 0xc], 0
je 0x418328
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004830a0
mov eax, dword [ebp - 0x824]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x810]
push 0x400
push eax
mov eax, dword [ebp - 0x828]
push 0x4cead4
push dword [eax]
push dword [ebp - 0x814]
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x820]
call main
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x82c], eax
cmp dword [eax - 0xc], 0
je 0x4182e9
push dword [ebp - 0x814]
mov ecx, ebx
call main
push dword [ebp - 0x82c]
mov ecx, eax
call main
jmp 0x418328
push str.Attention:_read_an_empty_string_from_resource_file__use_default_English_string_then:
lea ecx, [ebp - 0x81c]
call fcn.00402829
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 3
xor ecx, ecx
lea edx, [ebp - 0x81c]
push 0
push eax
inc ecx
call fcn.00416dc0
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x81c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x814]
call fcn.00402a6b
jmp 0x418369
push ecx
push eax
lea ecx, [ebp - 0x830]
call fcn.0041849c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x814]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call main
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x830]
add ecx, 0xfffffff0
call fcn.00402e64
inc edi
cmp edi, dword [ebp - 0x834]
jbe 0x418249
push 0xffffffffffffffff
lea ecx, [ebp - 0x818]
call main
mov ecx, dword [ebp - 0x820]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x814]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
xor eax, eax
inc eax
call fcn.0046abe6
ret 8
Function at 0x418788
Capabilities:
Create bits job

Disassembly:
push 8
mov eax, 0x4ad8fe
call fcn.0046ac08
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.00450db1
push eax
lea ecx, [edi + 8]
call main
xor ebx, ebx
lea ecx, [edi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.0043e399
push 0x10
mov byte [ebp - 4], 1
lea eax, [edi + 0x1c]
push ebx
push eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.004830a0
add esp, 0xc
mov dword [edi + 0xc], ebx
lea ecx, [edi + 8]
mov dword [edi + 0x3c], 4
mov dword [edi + 0x40], ebx
mov dword [edi + 0x18], 0x1b7740
push dword [ebp + 8]
call main
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, 0x272f4
mov dword [edi + 0xc], eax
cmp dword [0x5163b8], esi
je 0x4188d1
test eax, eax
js 0x4188d1
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [edi + 0xc], eax
test eax, eax
jns 0x418854
cmp eax, 0x80010119
je 0x418854
push str.Failed_to_connect_to_BITS__CoInitializeSecurity_
lea ecx, [ebp - 0x10]
call fcn.00402829
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
push dword [edi + 0xc]
push eax
push 0x27358
jmp 0x4188b4
push edi
push 0x4e96e4
push 4
push ebx
push 0x4e96d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [edi + 0xc], eax
cmp dword [0x5163b8], 0x222e0
je 0x41887f
test eax, eax
jns 0x4188ff
mov ecx, dword [edi]
test ecx, ecx
je 0x418897
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4b87e4]
call esi
mov dword [edi], ebx
push str.Failed_to_connect_to_BITS
lea ecx, [ebp - 0x10]
call fcn.00402829
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push dword [edi + 0xc]
push eax
push 0x222e0
mov ecx, 0x5163b0
call fcn.00415683
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4188ff
push str.Failed_to_connect_to_BITS___COM_threading_returned_an_error__CoInitializeEx_
lea ecx, [ebp - 0x10]
call fcn.00402829
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push dword [edi + 0xc]
mov ecx, 0x5163b0
push eax
push esi
call fcn.00415683
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, edi
call fcn.0046abd1
ret 4

Function at 0x41a1e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x41a1e8
mov dword [edx*4 + 0x5164e0], ecx
inc edx
cmp edx, 0x100
jb 0x41a1e3
mov esi, 0x800
jmp 0x41a230
mov ecx, dword [edx*4 + 0x5160e0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x5164e0]
mov dword [edx*4 + 0x5164e0], ecx
inc edx
cmp edx, esi
jb 0x41a214
mov dword [0x516440], 0x41a260
call main
mov ecx, dword [0x516440]
test eax, eax
mov edx, 0x41a300
cmove ecx, edx
mov dword [0x516440], ecx
pop esi
ret
Function at 0x4210bc
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0x28
mov eax, 0x4ae060
call fcn.0046ac08
mov esi, dword [ebp + 8]
xor edi, edi
push edi
mov ecx, esi
call main
push dword [esi]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4211cc
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x4211cc
push dword [esi]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
and ebx, 0xfffffffe
push ebx
push dword [esi]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push dword [esi]
test bl, 0x10
je 0x42118e
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4211cc
xorps xmm0, xmm0
mov dword [ebp - 0x28], edi
movlpd qword [ebp - 0x22], xmm0
mov dword [ebp - 0x1a], edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x34], eax
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov eax, 0x414
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x30], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, eax
test edi, edi
je 0x4211cc
push str.SHFileOperation_FO_DELETE__failed:
lea ecx, [ebp - 0x10]
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
push edi
push esi
inc ecx
call fcn.00416dc0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x421198
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x4211cc
push str.RemoveDirectory___DeleteFile___failed:
lea ecx, [ebp - 0x14]
call fcn.00402829
xor eax, eax
lea edx, [ebp - 0x14]
inc eax
push 0x186a0
push esi
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00416dc0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor eax, eax
jmp 0x4211cf
xor eax, eax
inc eax
call fcn.0046abd1
ret 4
Function at 0x429722
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x4af318
call fcn.0046ac08
mov edi, ecx
call fcn.00450db1
push eax
lea ecx, [ebp - 0x18]
call main
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x515f74], 2
mov esi, dword [0x515f58]
jne 0x429795
test esi, esi
jne 0x429762
cmp dword [0x5163b4], 0x249f0
jne 0x429795
push 0x51606c
lea ecx, [ebp - 0x18]
call main
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x429806
test esi, esi
mov ecx, str.http:__www.adobe.com_go_update_error_win
mov eax, str.http:__www.adobe.com_go_ARMUpgradeFailedHelp
cmove eax, ecx
lea ecx, [ebp - 0x18]
push eax
call main
jmp 0x429806
cmp dword [0x516010], ebx
jne 0x4297aa
mov eax, 0x516028
cmp dword [0x516060], ebx
je 0x4297af
mov eax, 0x516070
push eax
lea ecx, [ebp - 0x18]
call main
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x4297e2
mov ecx, 0x515f84
call fcn.004031f2
test eax, eax
mov edx, 0x515e24
mov ecx, 0x515e28
cmove ecx, edx
push ecx
lea ecx, [ebp - 0x18]
call main
cmp dword [0x516010], ebx
je 0x429806
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
push ebx
push 0x4cc754
push str.Upgrade_WhatsNew
mov ecx, 0x515e58
call main
mov ebx, dword [ebp - 0x18]
add ebx, 0xfffffff0
push ebx
call main
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
add edi, 0x84
push eax
mov ecx, edi
call main
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402e64
push 0x4cead4
lea ecx, [ebp - 0x14]
call fcn.00402829
push 1
xor eax, eax
mov byte [ebp - 4], 2
push eax
push eax
push dword [edi]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
cmp esi, 0x21
jge 0x42992b
mov ecx, esi
sub ecx, 0
je 0x4298c4
dec ecx
sub ecx, 1
je 0x4298b7
sub ecx, 1
je 0x4298b0
dec ecx
sub ecx, 1
je 0x4298c4
sub ecx, 3
je 0x4298a9
sub ecx, 0x12
je 0x4298a2
sub ecx, 6
lea ecx, [ebp - 0x14]
je 0x42989b
push str.All_other_non_caught_scenarios
jmp 0x4298bf
push str.The_specified_DLL_was_not_found.
jmp 0x4298bf
push str.A_sharing_violation_occurred.
jmp 0x4298bc
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x4298bc
push str.The_specified_path_was_not_found.
jmp 0x4298bc
push str.The_specified_file_was_not_found.
lea ecx, [ebp - 0x14]
call main
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x42992b
push str.Failed_to_navigate_to_URL:
lea ecx, [ebp - 0x1c]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 3
push esi
push edi
lea edx, [ebp - 0x1c]
inc ecx
call fcn.00416dc0
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.___Error_message:
lea ecx, [ebp - 0x1c]
call fcn.00402829
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
xor ecx, ecx
lea edx, [ebp - 0x1c]
push 0
push eax
inc ecx
call fcn.00416dc0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, ebx
call fcn.00402e64
xor eax, eax
inc eax
call fcn.0046abd1
ret
Function at 0x42a12f
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0x4aaf88
call fcn.0046ac08
mov esi, ecx
mov ebx, str.GlobalARM_Update_Mutex
xor edi, edi
push ebx
push 1
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x42a16d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
jne 0x42a16d
push ebx
push 1
push edi
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov dword [esi + 0x3c], eax
cmp dword [esi + 0x3c], edi
je 0x42a19a
push str.ARM_update_mutex_created
lea ecx, [ebp - 0x10]
call fcn.00402829
push edi
push 2
lea edx, [ebp - 0x10]
mov dword [ebp - 4], edi
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.0046abd1
ret
Function at 0x42cfb8
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x4afad0
call fcn.0046ac08
push str.ExecuteRetryInstall...
lea ecx, [ebp - 0x10]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x10]
push ebx
push 2
pop ecx
mov dword [ebp - 4], ebx
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.___file__
lea ecx, [ebp - 0x10]
call fcn.00402829
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x10]
push ebx
push 2
pop esi
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00416dc0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push 0xd
pop edi
call fcn.00450db1
push eax
lea ecx, [ebp - 0x10]
call main
mov dword [ebp - 4], esi
push 0x5c
push dword [ebx]
call main
pop ecx
pop ecx
test eax, eax
je 0x42d07d
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x42d07d
push eax
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call main
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call main
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov edx, str..exe
mov ecx, ebx
call fcn.004440ab
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x42d0ea
mov edi, 0x4cead4
test esi, esi
je 0x42d0b9
push 5
push 0
push edi
push esi
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push 5
push 0
push edi
push dword [ebx]
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x21
jae 0x42d12c
push str.ShellExecute_failed
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 4
push edi
jmp 0x42d143
mov edx, str..msi
mov ecx, ebx
call fcn.004440ab
test eax, eax
je 0x42d130
mov edi, 0x4cead4
test esi, esi
je 0x42d123
push 5
push 0
push edi
push esi
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push edi
push dword [ebx]
call dword [sym.imp.msi.dll_MsiOpenDatabaseW]
xor edi, edi
jmp 0x42d15a
push str.Not_supported_file_type
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 5
push 0
push 2
lea edx, [ebp - 0x14]
pop ecx
call fcn.004174f1
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
mov eax, edi
call fcn.0046abd1
ret 4
Function at 0x42f708
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x4afe98
call fcn.0046ac08
mov edi, ecx
push str.InitUpdateFromProductUpdatesTable...
lea ecx, [ebp - 0x1c]
call fcn.00402829
xor esi, esi
lea edx, [ebp - 0x1c]
push esi
push 2
pop ecx
mov dword [ebp - 4], esi
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.SELECT__FROM__ProductUpdates__WHERE__ProductCode_
lea ecx, [ebp - 0x14]
call fcn.00402829
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call main
push str._AND__ProductVersion_
lea ecx, [ebp - 0x14]
call fcn.0041035e
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call main
push 0x4ef018
lea ecx, [ebp - 0x14]
call fcn.0041035e
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [edi + 4]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov esi, eax
test esi, esi
je 0x42f7c6
push 0x4ef01c
lea ecx, [ebp - 0x1c]
call fcn.00402829
mov byte [ebp - 4], 4
jmp 0x42f7e8
push 0
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiViewModify]
mov esi, eax
test esi, esi
je 0x42f7f9
push 0x4ef028
lea ecx, [ebp - 0x1c]
call fcn.00402829
mov byte [ebp - 4], 5
push esi
lea edx, [ebp - 0x1c]
mov ecx, ebx
call fcn.004175da
pop ecx
mov ecx, dword [ebp - 0x1c]
jmp 0x42f85e
cmp dword [ebp - 0x10], 0
je 0x42f808
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x42f83d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 3
push eax
push dword [ebp - 0x10]
mov ecx, edi
call fcn.0042faa4
mov esi, eax
jmp 0x42f86b
push 0x4ef030
lea ecx, [ebp - 0x20]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 6
push ebx
lea edx, [ebp - 0x20]
inc ecx
call fcn.004175da
pop ecx
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov esi, 0x3d32
cmp dword [ebp - 0x10], 0
je 0x42f87a
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], 0
je 0x42f889
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, esi
call fcn.0046abd1
ret 8
Function at 0x42f89e
Capabilities:
Reference sql statements

Disassembly:
push 0x1c
mov eax, 0x4aff00
call fcn.0046ac08
mov esi, ecx
mov dword [ebp - 0x28], esi
push str.InitUpdateFromProductUpdatesExTable...
lea ecx, [ebp - 0x20]
call fcn.00402829
xor ebx, ebx
lea edx, [ebp - 0x20]
push ebx
push 2
pop ecx
mov dword [ebp - 4], ebx
call fcn.004174f1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.SELECT__FROM__ProductUpdatesEx__WHERE__ProductCode_
lea ecx, [ebp - 0x18]
call fcn.00402829
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call main
push 0x4ef018
lea ecx, [ebp - 0x18]
call fcn.0041035e
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push dword [esi + 4]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov esi, eax
test esi, esi
je 0x42f942
push 0x4ef01c
lea ecx, [ebp - 0x20]
call fcn.00402829
mov byte [ebp - 4], 4
jmp 0x42f963
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiViewModify]
mov esi, eax
test esi, esi
je 0x42f97b
push 0x4ef028
lea ecx, [ebp - 0x20]
call fcn.00402829
mov byte [ebp - 4], 5
push esi
push 2
lea edx, [ebp - 0x20]
pop ecx
call fcn.004175da
pop ecx
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
jmp 0x42fa6c
cmp dword [ebp - 0x10], 0
je 0x42f98a
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x42fa71
call fcn.00450db1
push eax
lea ecx, [ebp - 0x1c]
call main
mov byte [ebp - 4], 6
call fcn.00450db1
push eax
lea ecx, [ebp - 0x20]
call main
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
push eax
push 2
pop edx
call main
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push 3
pop edx
call main
mov edi, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
push edi
call main
mov esi, dword [ebp - 0x20]
test eax, eax
je 0x42fa49
mov ecx, dword [ebp + 0xc]
push esi
call main
test eax, eax
je 0x42fa49
cmp dword [edi - 0xc], 0
je 0x42fa1b
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
call main
test eax, eax
je 0x42fa30
cmp dword [esi - 0xc], 0
je 0x42fa49
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
call main
test eax, eax
jne 0x42fa49
lea ecx, [esi - 0x10]
call fcn.00402e64
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 3
call fcn.00402e64
jmp 0x42f97b
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 4
call fcn.0042faa4
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.00402e64
lea ecx, [edi - 0x10]
call fcn.00402e64
cmp dword [ebp - 0x10], 0
je 0x42fa80
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x14], 0
je 0x42fa8f
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.0046abd1
ret 8