joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]

Function at 0x446097
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558920
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x446118
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558920
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5525fb
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4461be
cmp edi, dword [esi + 0x7c]
jge 0x4461be
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0045aa62
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0045aa62
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558920
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558920
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446110
jmp 0x4460e0
call fcn.0045ec89
int3

Function at 0x45ccb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38
Function at 0x4682ea
Capabilities:
Encode data using xor

Disassembly:
das
and eax, 0x49563301
sbb byte [ebp + 0x25], dh
add dword fs:[ebp - 0x46223e46], esp
sbb ecx, eax
and al, 0xd0
dec eax
sbb dword [ecx], edx
xchg edi, eax
mov eax, dword [esi - 0x3d31abba]
sub dh, byte [ebx + eax*2 - 0x5b]
push eax
lodsd eax, dword [esi]
mov ah, 0x24
mov dh, 0xe8
fdivr qword ss:[0xe9b7ddf8]
outsb dx, byte [esi]
test ecx, 0x557de974
das
mov ch, 0x13
sbb al, ah
mov cl, 0x5d
inc ecx
bound esp, qword [edx]
sbb edi, eax
fst qword [ebp - 0x519456ae]
pop ss
adc al, 0x3f
push edx
pop dword [ecx]
xor eax, 0x97013cdd
adc dword [edi + 0x5446868b], edx
into
ret 0x742a
imul ebp, dword [esi + 0x523f1417], 0xffffff8f
add dword [0x97013cdd], esi
inc ecx
adc al, byte [ebx - 0x64450143]
lds edi, [ebx + 0x5df2fa73]
mov dh, 0x36
jae 0x468288
cmp esi, dword [edx + ecx*2]
inc byte [edx]
jo 0x4681f6
mov dword [0x9f7bf9d5], eax
sar byte [edi + 0x36], 1
jbe 0x468292
scasd eax, dword es:[edi]
in al, dx
int1
lodsd eax, dword [esi]
ja 0x46820c
sbb dword [ecx - 0x6c], ebp
mov bh, 0xd6
jp 0x4682b4
clc
jge 0x468280
daa
xchg edx, eax
wait
dec esp
xchg esp, eax
inc ebx
fdivr qword [ebx + 0x35]
dec edx
jbe 0x46823c
mov bl, 0x30
rcr dword [edx], 2
xor cl, al
sbb al, byte [edx]
add dl, byte [ebp - 0x7d]
loopne 0x46827f
push ebp
and eax, 0xffffffee
jns 0x4682f5
bound edx, qword [esi - 0xec9930]
xchg esi, eax
shl byte [esi + 0x13], 1
call [ebx - 0x1e]
cli
adc di, di
pop ebx
loop 0x468295
mov ebx, 0x13d6522a
rcr byte [ebx + 0x1a], cl
mov dl, 0x4a
add edi, ebx
sbb byte [eax + 0xd], 0x2f
ja 0x4682c0
dec esi
wait
inc edx
cwde
adc cl, bl
xlatb
movsd dword es:[edi], dword [esi]
fdiv qword [esi]
int1
mov al, byte [0x7043a3c7]
mov al, 0xc
dec edx
scasb al, byte es:[edi]
push esi
sub dword [edx - 0x309c8418], ebx
dec ebp
mov esp, 0xf97f1cd3
iretd
mov esi, 0x57767bb2
adc esp, edi
mov edx, 0x25ca771a
mov dl, 0x7a
in al, dx
adc ecx, dword [0x27cffd8c]
and eax, 0x13ec7ab2
or eax, 0x27cffd8c
jo 0x46831a
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
jbe 0x46828c
dec esi
out dx, al
xor byte [esi], 0xe0
xchg edx, eax
jp 0x468307
push ebx
bound edx, qword [edi]
inc ebp
into
into
mov byte [0x843212b3], al
retf 0x9f93
lahf
cmp al, byte [ebx - 0x893a9e4]
xchg ebx, eax
pop ds
xchg esi, eax
cmp bl, byte [edx + 0x29932603]
into
mov esp, 0x752e748d
sbb byte [edx + 0x46], cl
cmp dword [eax + edi], eax
insd dword es:[edi], dx
pop edi
push ss
lcall 0xd0f4, 0xfa9fd3d3
dec esi
shr dword [edi], 0xa2
add bh, byte [edx + eax*4 - 0x50]
sbb eax, 0xefeddf9
imul eax, edx, 0x70
xchg ebx, eax
lcall 0x56b2, 0x1982cb9e
mov cl, 0xa3
inc edi
and dl, byte [ebx - 0x778db981]
xor al, 0x87
mov ecx, 0xc35460fd
fisttp dword [ebx]
sub al, ch
test al, bh
std
cdq
add bl, byte [edi + ebp*4 + 0x1784a4bc]
imul edx, dword [eax + 0xf9a7c5e], 0xfffffff8
dec ebx
jl 0x46838a
int1
lea esp, [eax - 0x2db755b8]
add al, 0xfe
add al, 0xb8
inc byte [eax + edi*4]
mov byte [eax + 0x78087844], bh
test byte [edx + 0x44], dh
mov eax, 0x39043244
inc esp
pop ds
test al, 0x90
xor byte [ecx + ecx*2 - 0x48], 0x84
mov eax, 0xf408ed68
int3
Function at 0x4842b8
Capabilities:
Encode data using xor

Disassembly:
mov ebp, fs
push es
cwde
mov dword [ebx + 0x73fd9c80], edi
invalid

Function at 0x4ba08d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1418
cmp edx, dword [eax]
je 0x4ba0af
add eax, 8
inc ecx
cmp eax, 0x4c14a8
jl 0x4ba0a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1418]
jne 0x4ba1dd
mov eax, dword [0x4c5db0]
cmp eax, 1
je 0x4ba1b7
test eax, eax
jne 0x4ba0e0
cmp dword [0x4c1340], 1
je 0x4ba1b7
cmp edx, 0xfc
je 0x4ba1dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba117
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baa70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baf00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba15a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baf00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf734
push edi
call fcn.004bcdd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baa70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baa80
lea eax, [ebp - 0xa0]
push 0x4bf714
push eax
call fcn.004baa80
push dword [esi + 0x4c141c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baa80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd44
add esp, 0x2c
pop edi
jmp 0x4ba1dd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c141c]
push 0
push eax
push dword [esi]
call fcn.004baf00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6fac681b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x701f0008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x701f0008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6fac68c7
jmp 0x6fac6953
jmp 0x6fac69df
jmp 0x6fac6a6b
jmp 0x6fac6af7
jmp 0x6fac6b83
jmp 0x6fac6c0f
jmp 0x6fac6c9b
jmp 0x6fac6d27
jmp 0x6fac6db3
mov dword [ebp - 0x14], 0
jmp 0x6fac6e46
jmp 0x6fac6ed2
jmp 0x6fac6f5e
jmp 0x6fac6fea
jmp 0x6fac7076
jmp 0x6fac7102
jmp 0x6fac718e
jmp 0x6fac721a
jmp 0x6fac72a6
jmp 0x6fac7332
mov dword [ebp - 0x18], 0
jmp 0x6fac73c5
jmp 0x6fac7451
jmp 0x6fac74dd
jmp 0x6fac7569
jmp 0x6fac75f5
jmp 0x6fac7681
jmp 0x6fac770d
jmp 0x6fac7799
jmp 0x6fac7825
jmp 0x6fac78b1
mov dword [ebp - 0x10], 0
jmp 0x6fac7944
jmp 0x6fac79d0
jmp 0x6fac7a5c
jmp 0x6fac7ae8
jmp 0x6fac7b74
jmp 0x6fac7c00
jmp 0x6fac7c8c
jmp 0x6fac7d18
jmp 0x6fac7da4
jmp 0x6fac7e30
mov dword [ebp - 0x10], 0
jmp 0x6fac99da
jmp 0x6fac7ec8
jmp 0x6fac7f54
jmp 0x6fac7fe0
jmp 0x6fac806c
jmp 0x6fac80f8
jmp 0x6fac8184
jmp 0x6fac8210
jmp 0x6fac829c
jmp 0x6fac8328
jmp 0x6fac83b4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x701f0004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6fac8451
jmp 0x6fac84dd
jmp 0x6fac8569
jmp 0x6fac85f5
jmp 0x6fac8681
jmp 0x6fac870d
jmp 0x6fac8799
jmp 0x6fac8825
jmp 0x6fac88b1
jmp 0x6fac893d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x701f000c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6fac89da
jmp 0x6fac8a66
jmp 0x6fac8af2
jmp 0x6fac8b7e
jmp 0x6fac8c0a
jmp 0x6fac8c96
jmp 0x6fac8d22
jmp 0x6fac8dae
jmp 0x6fac8e3a
jmp 0x6fac8ec6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x6fac8f6e
jmp 0x6fac8ffa
jmp 0x6fac9086
jmp 0x6fac9112
jmp 0x6fac919e
jmp 0x6fac922a
jmp 0x6fac92b6
jmp 0x6fac9342
jmp 0x6fac93ce
jmp 0x6fac945a
add dword [ebp - 0xc], 0x28
jmp 0x6fac94ea
jmp 0x6fac9576
jmp 0x6fac9602
jmp 0x6fac968e
jmp 0x6fac971a
jmp 0x6fac97a6
jmp 0x6fac9832
jmp 0x6fac98be
jmp 0x6fac994a
jmp 0x6fac99d6
add dword [ebp - 0x10], 1
mov eax, dword [0x701f0008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6fac7e3c
nop
leave
ret

Function at 0x6fad9700
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x701ef040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6fad9760
Function at 0x6fad9760
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x701f0378]
test esi, esi
jle 0x6fad984d
mov edi, dword [0x701f037c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6fad9794
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6fad9846
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6fad9780
mov dword [esp], eax
mov esi, eax
call fcn.6fad9f00
test eax, eax
mov edi, eax
je 0x6fad988a
mov esi, dword [0x701f037c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6fada010
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x701f037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6fad986a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6fad983f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6fad983f
mov eax, dword [esp + 0x20]
add ebx, dword [0x701f037c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6fad9854
add dword [0x701f0378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6fad979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6fad9700
mov eax, dword [0x701f037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6fad9700
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6fad9700
lea esi, [esi]

Function at 0x6fad9b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x701f0388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x701f0380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6fad9bc5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6fad9bbe
test esi, esi
je 0x6fad9bbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6fad9ba0
mov dword [esp], 0x701f0388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40270a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402749
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402749
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402749
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402749
cmp dword [ecx + 0x74], 0xe
jbe 0x402749
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001110
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x100265de
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1003b014]
xor eax, ebp
mov dword [ebp + 0x238], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1003c1d0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1003c9b8]
cmp eax, dword [ecx + 4]
jle 0x100011de
push 0x1003c9b8
call fcn.1001000b
add esp, 4
cmp dword [0x1003c9b8], 0xffffffff
jne 0x100011de
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x1003c9cc], 0
mov dword [0x1003c9d0], 0
mov dword [0x1003c9cc], 0
mov dword [0x1003c9d0], 7
mov word [0x1003c9bc], ax
mov byte [ebp - 4], 1
push 0x100291d0
call fcn.100103e6
mov byte [ebp - 4], 0
push 0x1003c9b8
call fcn.1000ffc1
add esp, 8
cmp dword [0x1003c9cc], 0
jne 0x10001296
lea eax, [ebp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10001296
add eax, eax
cmp eax, 0x208
jae 0x100012d3
xor ecx, ecx
mov dword [ebp + 0x28], ecx
mov word [ebp + eax + 0x30], cx
xor eax, eax
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x28], ecx
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x2c], 7
lea edx, [ecx + 2]
mov word [ebp + 0x18], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001232
sub ecx, edx
lea eax, [ebp + 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x18]
call fcn.10001a00
mov dword [ebp - 4], 4
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.10002b60
mov byte [ebp - 4], 5
lea eax, [ebp]
cmp dword [ebp + 0x14], 8
mov ecx, 0x1003c9bc
push dword [ebp + 0x10]
cmovae eax, dword [ebp]
push eax
call fcn.10001a00
mov byte [ebp - 4], 4
lea ecx, [ebp]
call fcn.10001b50
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.10001b50
push 0x1003c9bc
mov ecx, esi
call fcn.100014e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.1000feb6
lea esp, [ebp + 0x23c]
pop ebp
ret
call fcn.1001051c
int3
Function at 0x100013a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026738
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1003b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x100013ec
mov edx, dword [edx]
lea eax, [ebp - 0x218]
push eax
push 0
push 0x10033dc0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1000142f
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x100014c1
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001440
sub ecx, edx
mov dword [ebp - 0x220], 0
xor eax, eax
sar ecx, 1
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push ecx
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
push eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
call fcn.10001a00
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x230]
push eax
mov ecx, esi
call fcn.10002b60
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10001b50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000feb6
mov esp, ebp
pop ebp
ret
Function at 0x10002100
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x100269bd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1003b014]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x20c]
mov dword [ebp - 0x20], ebx
push dword [ebx + 4]
call fcn.10010652
push esi
lea eax, [ebp]
mov dword [ebx + 4], 0
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
mov dword [ebx], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x1000218d
push eax
call edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
cmp word [ebp], 0
je 0x100021d1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jle 0x100021ca
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10002214
call fcn.100023d0
mov byte [ebp - 4], 0
test esi, esi
je 0x100021dc
push esi
call edi
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100021ef
push ecx
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.1000feb6
lea esp, [ebp + 0x204]
pop ebp
ret
push 0
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiViewModify]
mov ebx, eax
test ebx, ebx
jle 0x10002230
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x10002237
call fcn.100023d0
mov byte [ebp - 4], 0
test esi, esi
je 0x10002242
push esi
call edi
test ebx, ebx
js 0x100021dc
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1000225b
push eax
call edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x10002290
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jle 0x10002282
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x100022a9
cmp eax, 0x80070103
je 0x10002290
call fcn.100023d0
xor bl, bl
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100021de
push eax
call edi
jmp 0x100021de
mov ebx, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
lea eax, [ebp - 0x18]
push eax
push 0x10033dcc
push 1
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 0
call ebx
cmp eax, 0xea
jne 0x10002303
mov esi, dword [ebp - 0x18]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x18], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10010649
mov ecx, dword [ebp - 0x20]
add esp, 4
mov dword [ecx + 4], eax
mov dword [ecx], esi
lea ecx, [ebp - 0x18]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call ebx
test eax, eax
sete bl
jmp 0x10002292
Function at 0x10003a5c
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push dword [0x1003b420]

Function at 0x10004b70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ecx], 3
push esi
push edi
mov edi, edx
jae 0x10004b9d
push dword [ebp + 0x10]
mov edx, 5
push dword [ebp + 0xc]
push ecx
mov ecx, edi
call fcn.100049f0
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x10004bab
xor ecx, ecx
jmp 0x10004bbf
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004bb0
sub ecx, esi
sar ecx, 1
mov esi, dword [ebp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.10007bb0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x10004bf1
push dword [ebp + 0x10]
mov edx, 6
push dword [ebp + 0xc]
push ecx
mov ecx, edi
call fcn.100049f0
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004c16
push esi
push dword [ebp + 0xc]
lea edx, [eax + 7]
push ecx
mov ecx, edi
call fcn.100049f0
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.1000d750
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret