joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d6ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53d70d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0053bbba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x53d730
test byte [esp + 8], 2
je 0x53d730
call fcn.0053bc2d
mov dword [eax], 0xd
call fcn.0053bc36
mov dword [eax], 5
jmp 0x53d709
xor eax, eax
ret

Function at 0x54e509
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x54e541
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0054c593
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0054c56b
jmp 0x54e54d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x54fbf7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x54fc39
call fcn.00555ee5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x54fc39
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x54fc30
xor eax, eax
jmp 0x54fc41
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0054fc47
pop edi
pop esi
pop ebx
ret 4

Function at 0x556415
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x556443
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x556461
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0055637b
jmp 0x556461
mov eax, dword [esi + 0x14]
test eax, eax
je 0x556461
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0055637b
test edi, edi
mov eax, edi
jne 0x55644b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x1e4dc
mov dword [ebp - 0xc], 0x3000
mov dword [ebp - 4], 0x40
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esp, ebp
pop ebp
ret

Function at 0x401160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0x11cb
mov dword [ebp - 0x10], 0
jmp 0x40117f
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jae 0x401246
mov dword [ebp - 8], 0x4189
cmp dword [ebp - 0x10], 0
jne 0x4011e8
push 0x104
push 0x4021a4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system32cabinet.dll
push 0x4021a4
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 1
push 0x4021a4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4011e1
cmp dword [ebp - 4], 0
jne 0x4011e8
mov eax, 0x42
jmp 0x401246
mov edx, dword [ebp - 0x10]
add edx, 0x563
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x401176
mov esp, ebp
pop ebp
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10001193
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push esi
push edi
push 0xa
push 0x66
push dword [0x10003290]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x100012b6
push edi
push dword [0x10003290]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push dword [0x10003290]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x100012b6
cmp dword [ebp - 8], esi
je 0x100012b6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100012b6
push ebx
lea eax, [ebp - 0x26c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x26c]
push eax
push esi
push 0x100021c4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
push esi
push 2
push esi
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100012b5
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], esi
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], ebx
jne 0x100012b5
push 0x44
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x26c]
push eax
push esi
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x100012b5
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x20]
call edi
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x100012bd
Capabilities:
Check mutex on windows

Disassembly:
push edi
push 0x10003220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x100012d6
inc eax
pop edi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0xb7
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
Function at 0x10001398
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x58], esi
push eax
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100013e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10001428
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001401
push 0x5b4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], 0x2c9
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x1000142b
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0
push 0x10002310
push 0x80000000
mov dword [ebp - 4], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x100015fa
cmp word [ebp - 0x20c], 0x22
setne al
test eax, eax
jne 0x100015fc
lea eax, [ebp - 0x20a]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 0x1000230c
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100015fa
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x100022fc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100015fa
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_PathGetShortPath]
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x100022f0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x10002298
push eax
call esi
mov edi, 0xea60
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.10001398
add esp, 0x1c
test eax, eax
je 0x100015f8
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x10002264
push eax
call esi
lea eax, [ebp - 0x824]
push 0x1d4c0
push eax
call fcn.10001398
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call fcn.10001677
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x10002218
push eax
call esi
lea eax, [ebp - 0x824]
push 0x3a980
push eax
call fcn.10001398
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push 0x100021ec
push eax
call esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.10001398
add esp, 0x34
pop edi
pop esi
leave
ret
mov eax, 0x100021e8
jmp 0x10001490
Function at 0x10001606
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, 0x1388
push ebp
push dword [0x1000329c]
mov dword [esp + 0x18], eax
call edi
mov ebx, 0x102
jmp 0x10001665
call esi
cmp eax, dword [esp + 0x10]
jb 0x10001672
sub eax, dword [esp + 0x10]
cmp eax, 0x6ddd00
ja 0x10001672
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp eax, dword [esp + 0x14]
jne 0x10001672
push ebp
push dword [0x1000329c]
call edi
cmp eax, ebx
je 0x1000163d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
xor eax, eax
inc eax
jmp 0x1000166b
Function at 0x100019e6
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push esi
xor esi, esi
push esi
push 4
push esi
push 0x100018d3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffff1
push eax
mov dword [0x10003298], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x10001a1d
push dword [0x10003298]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10001a30
push esi
push dword [0x10003298]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x10003298], esi
pop esi
ret
Function at 0x302be0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0xc], ecx
push edi
lea ecx, [ebp - 4]
call fcn.00302750
push 0x302330
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
lea ebx, [eax + esi + 0x78]
lea ecx, [ebp - 0x2c]
push ecx
add edi, esi
push edi
push ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x416c6175
mov dword [ebp - 0x24], 0x636f6c6c
mov byte [ebp - 0x20], 0
call fcn.00302920
lea edx, [ebp - 0x2c]
push edx
push edi
push ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x466c6175
mov dword [ebp - 0x24], 0x656572
call fcn.00302920
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x1200
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 0xc]
mov ecx, edi
sub eax, edi
mov esi, 0x1200
mov dl, byte [eax + ecx]
mov byte [ecx], dl
inc ecx
dec esi
jne 0x302c82
mov edx, 0x1200
mov ecx, edi
call fcn.00302ba0
mov ebx, dword [edi + 0x3c]
add ebx, edi
lea eax, [ebx + 0x18]
push 0x40
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x38]
push 0x3000
push eax
push esi
call dword [ebp - 0x10]
mov esi, eax
test esi, esi
je 0x302d88
push 0x40
mov edx, edi
mov ecx, esi
call fcn.003025a0
movzx eax, word [ebx + 0x14]
mov ecx, dword [esi + 0x3c]
add ecx, esi
push eax
mov edx, ebx
mov dword [ebp - 0x10], ecx
call fcn.003025a0
movzx eax, word [ebx + 0x14]
movzx ecx, word [ebx + 6]
mov edx, dword [ebp - 0x10]
add eax, dword [ebp - 8]
movzx ebx, word [edx + 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
lea ebx, [ebx + edx + 0x18]
test ecx, ecx
je 0x302d4a
sub eax, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x302d07
mov eax, dword [ebp - 0x10]
push 0x28
lea edx, [eax + ebx]
mov ecx, ebx
call fcn.003025a0
add ebx, 0x28
dec dword [ebp - 0xc]
jne 0x302d04
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test ecx, ecx
je 0x302d4a
lea ebx, [eax + 0x14]
mov dword [ebp - 0xc], ecx
jmp 0x302d30
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx - 8]
add edx, edi
add ecx, esi
call fcn.003025a0
add ebx, 0x28
dec dword [ebp - 0xc]
jne 0x302d30
mov edx, dword [ebp - 8]
push edx
push esi
lea ecx, [ebp - 4]
call fcn.003027d0
mov edi, dword [ebp - 8]
push edi
push esi
lea ecx, [ebp - 4]
call fcn.00302880
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x10]
mov dword [eax + 8], esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add ecx, esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], ecx
call ecx
push 0x8000
push 0
push esi
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x302d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
lea eax, [ebp - 0x84]
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_BeginPaint]
lea ecx, [ebp - 0x44]
push ecx
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 6
lea edx, [ebp - 0x44]
push edx
push edi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [0x303630]
push 0x30235c
push 0x6a
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x303630]
mov esi, eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x303630]
push esi
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00302550
xor edx, edx
lea ecx, [ebp - 0x34]
call fcn.00303390
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.003032b0
mov edi, eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.003032e0
mov ebx, eax
imul ebx, edi
add ebx, ebx
add ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.003031c0
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 0x10], esi
jbe 0x302ec8
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
jbe 0x302eb9
mov edi, edi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.003033c0
lea ecx, [ebp - 4]
call fcn.003031e0
lea ecx, [ebp - 4]
mov byte [esi + edi], al
call fcn.00303200
lea ecx, [ebp - 4]
mov byte [esi + edi + 1], al
call fcn.00303220
lea ecx, [ebp - 4]
mov byte [esi + edi + 2], al
call fcn.00303240
mov byte [esi + edi + 3], al
inc ebx
add esi, 4
cmp ebx, dword [ebp - 0xc]
jb 0x302e70
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
jb 0x302e67
mov ebx, dword [ebp - 0x14]
mov edx, ebx
mov ecx, edi
call fcn.00302be0
mov edx, dword [ebp - 0x20]
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x34]
call fcn.00302390
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x84]
push eax
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402910
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x45c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 0
push eax
mov dword [ebp - 0x45c], 0
call sub.msi.dll_MsiOpenProductW
test eax, eax
je 0x40294f
xor bl, bl
jmp 0x402ab1
lea eax, [ebp - 0x458]
mov dword [ebp - 0x458], 0
push eax
push str.SELECT__Value__FROM__Property__WHERE__Property_ProductVersion
push dword [ebp - 0x45c]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
jne 0x402a9f
push eax
push dword [ebp - 0x458]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x402a9f
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x458]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x402a8b
lea eax, [ebp - 0x464]
mov dword [ebp - 0x464], 0x100
push eax
lea eax, [ebp - 0x454]
push eax
push 1
push dword [ebp - 0x460]
call sub.msi.dll_MsiRecordSetStreamA
test eax, eax
jne 0x402a8b
push 0x4c
push eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push esi
call sub.msi.dll_MsiSourceListClearAllW
test eax, eax
jne 0x402a8b
push 0x1fe
push eax
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x252]
push eax
mov dword [ebp - 0x468], 0x100
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x254]
push eax
push str.VersionString
lea eax, [ebp - 0x54]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x402a8b
lea ecx, [ebp - 0x454]
lea eax, [ebp - 0x254]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402a7f
test dx, dx
je 0x402a76
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402a7f
add eax, 4
add ecx, 4
test dx, dx
jne 0x402a54
xor eax, eax
test eax, eax
sete bl
jmp 0x402a8d
sbb eax, eax
or eax, 1
test eax, eax
sete bl
jmp 0x402a8d
xor bl, bl
mov eax, dword [ebp - 0x460]
test eax, eax
je 0x402aa1
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
jmp 0x402aa1
xor bl, bl
mov eax, dword [ebp - 0x458]
test eax, eax
je 0x402ab1
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x45c]
test ecx, ecx
je 0x402ac1
push ecx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret