joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f46
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x45cb4e
call fcn.004480d4
lea eax, [ebp - 0x218]
push eax
xor esi, esi
push esi
push esi
push 0x8023
mov edi, ecx
push esi
mov dword [ebp - 0x228], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x415f7f
xor eax, eax
jmp 0x41605a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00402060
push str.AdobeARM
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], esi
call fcn.00408f8a
add esp, 0xc
push edi
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00416060
mov edi, eax
cmp edi, esi
jne 0x41603c
mov esi, 0x49d934
mov eax, esi
call fcn.0040517d
test eax, eax
je 0x41603c
mov eax, esi
call fcn.0040515f
test eax, eax
mov eax, str.AdobeReader
jne 0x415fed
mov eax, str.AdobeAcrobat
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00408f8a
add esp, 0xc
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.00409162
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040253e
push dword [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.00416060
mov edi, eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, edi
call fcn.00448157
ret
Function at 0x4182d8
Capabilities:
Download url
Receive data

Disassembly:
push 0x18
mov eax, 0x46053a
call fcn.0044806b
mov ebx, ecx
mov esi, edx
push str.DownloadFileDirectly...
lea ecx, [ebp - 0x10]
call fcn.00402060
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 4], edi
call fcn.00411fb7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
lea eax, [ebp - 0x14]
push eax
push str.iForbidURLDownloadToFile
push dword [0x49d460]
mov dword [ebp - 0x10], edi
push 0x80000002
mov dword [ebp - 0x14], edi
call fcn.0042e400
add esp, 0x10
cmp dword [ebp - 0x14], 1
jne 0x418375
push str.URLDownloadToFile_is_not_allowed
lea ecx, [ebp + 8]
call fcn.00402060
push edi
lea eax, [ebp + 8]
push eax
push 2
mov dword [ebp - 4], 1
call fcn.00411fb7
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
xor eax, eax
jmp 0x4184be
mov dword [ebp - 0x24], vtable.CCallback.0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 2
mov eax, dword [0x49dd00]
mov dword [ebp - 0x20], eax
lea eax, [esi + 4]
push eax
push ebx
call fcn.0040a5bb
pop ecx
pop ecx
test al, al
jne 0x4183be
lea eax, [esi + 0xc]
push eax
push ebx
call fcn.0040a5bb
pop ecx
pop ecx
test al, al
jne 0x4183be
add esi, 0x18
push esi
push ebx
call fcn.0040a5bb
pop ecx
pop ecx
test al, al
je 0x4183c5
mov dword [ebp - 0x1c], 0x3c
mov eax, dword [ebx]
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
lea edx, [ebp - 0x24]
push edx
push edi
push eax
push ecx
push edi
call sub.urlmon.dll_URLDownloadToFileW
cmp eax, edi
jl 0x41840a
push str.Download_success:
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 1
call fcn.00402060
push edi
push esi
lea eax, [ebp + 8]
push eax
push 2
mov byte [ebp - 4], 3
call fcn.00411b31
add esp, 0x10
jmp 0x4184b0
cmp dword [0x49d548], edi
jne 0x4184bb
mov esi, eax
call fcn.00417e00
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.004020a4
push str.http:__
push str.https:__
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 4
call fcn.00408ddf
test eax, eax
je 0x4184b0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebx]
push edi
push edi
push ebx
push dword [ebp + 8]
push edi
call sub.urlmon.dll_URLDownloadToFileW
cmp eax, edi
jl 0x41847a
push str.Download_success:
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 1
call fcn.00402060
mov byte [ebp - 4], 5
jmp 0x418492
mov esi, eax
call fcn.00417e00
push str.Download_failed:
lea ecx, [ebp - 0x18]
call fcn.00402060
mov byte [ebp - 4], 6
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
call fcn.00411b31
mov ecx, dword [ebp - 0x18]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, dword [ebp - 0x10]
call fcn.00448143
ret 4
Function at 0x4184c6
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x460cd4
call fcn.0044806b
push str.DownloadFilesDirectly...
lea ecx, [ebp - 0x14]
call fcn.00402060
xor esi, esi
push esi
lea eax, [ebp - 0x14]
push eax
push 2
mov dword [ebp - 4], esi
call fcn.00411fb7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [0x49d944]
cmp eax, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
jle 0x41861b
push dword [ebp - 0x14]
mov ecx, 0x49d93c
call fcn.00409086
mov edi, eax
mov eax, dword [edi]
cmp eax, esi
je 0x41860c
cmp dword [eax + 0x18], esi
jne 0x41860c
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.004020a4
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
add eax, 4
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.00401eca
mov eax, dword [edi]
lea ecx, [eax + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00409162
mov ecx, edi
call fcn.00415f46
test eax, eax
je 0x4185bd
push str.File_already_exist_and_valid:
lea ecx, [ebp - 0x18]
call fcn.00402060
mov byte [ebp - 4], 2
mov eax, dword [edi]
push 0
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
push 2
call fcn.00411b31
mov ecx, dword [ebp - 0x18]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040253e
mov edi, dword [edi]
mov dword [edi + 0x18], esi
jmp 0x4185fb
mov eax, dword [edi]
add eax, 0xc
push eax
lea ecx, [ebp - 0x10]
mov edx, ebx
call fcn.004182d8
cmp dword [0x49d548], 0
jne 0x418626
test eax, eax
mov eax, dword [edi]
je 0x41866b
mov ebx, dword [eax + 0x14]
mov esi, dword [ebp - 0x10]
call fcn.0041e29e
mov edi, dword [edi]
test eax, eax
je 0x418635
mov ebx, dword [ebp + 8]
mov dword [edi + 0x18], 1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040253e
xor esi, esi
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jl 0x418524
xor eax, eax
inc eax
call fcn.00448143
ret 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040253e
xor eax, eax
jmp 0x41861e
and dword [edi + 0x18], 0
push str.Downloaded_file_is_not_valid:
lea ecx, [ebp + 8]
call fcn.00402060
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 2
mov byte [ebp - 4], 3
call fcn.00411b31
mov ecx, dword [ebp + 8]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040253e
jmp 0x418626
and dword [eax + 0x18], 0
jmp 0x418626
Function at 0x41b107
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45cfd1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x498d50]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.00434892
push eax
lea ecx, [esp + 0x18]
call fcn.0040210b
xor ebx, ebx
mov dword [esp + 0x28], ebx
cmp dword [0x49d568], 2
jne 0x41b184
cmp dword [0x49dcc4], 0x249f0
jne 0x41b184
push 0x49d9c4
lea ecx, [esp + 0x18]
call fcn.00409162
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x41b1cb
push 0x481418
lea ecx, [esp + 0x18]
call fcn.004020d4
jmp 0x41b1cb
mov eax, 0x49d9f8
cmp dword [0x49d9ec], ebx
jne 0x41b196
mov eax, 0x49d9c0
push eax
lea ecx, [esp + 0x18]
call fcn.00409162
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x41b1cb
mov eax, 0x49d934
call fcn.0040515f
test eax, eax
mov eax, 0x49d45c
jne 0x41b1c1
mov eax, 0x49d458
push eax
lea ecx, [esp + 0x18]
call fcn.00409162
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.004020a4
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
add esi, 0x58
push eax
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.00409162
mov byte [esp + 0x28], bl
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040253e
push 0x46a238
lea ecx, [esp + 0x14]
call fcn.00402060
push 1
push ebx
push ebx
mov byte [esp + 0x34], 2
mov eax, dword [esi]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x21
jge 0x41b2f6
sub eax, ebx
je 0x41b284
dec eax
dec eax
je 0x41b276
dec eax
je 0x41b26f
dec eax
dec eax
je 0x41b284
sub eax, 3
je 0x41b268
sub eax, 0x12
je 0x41b261
sub eax, 6
lea ecx, [esp + 0x10]
je 0x41b25a
push str.All_other_non_caught_scenarios
jmp 0x41b27f
push str.The_specified_DLL_was_not_found.
jmp 0x41b27f
push str.A_sharing_violation_occurred.
jmp 0x41b27b
push str.There_was_not_enough_memory_to_complete_the_operation.
jmp 0x41b27b
push str.The_specified_path_was_not_found.
jmp 0x41b27b
push str.The_specified_file_was_not_found.
lea ecx, [esp + 0x14]
call fcn.004020d4
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], ebx
je 0x41b2f6
push str.Failed_to_navigate_to_URL:
lea ecx, [esp + 0x1c]
call fcn.00402060
push edi
push esi
lea eax, [esp + 0x20]
push eax
push 1
mov byte [esp + 0x38], 3
call fcn.00411b31
mov byte [esp + 0x38], 2
mov ecx, dword [esp + 0x28]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040253e
push str.___Error_message:
lea ecx, [esp + 0x1c]
call fcn.00402060
push ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 1
mov byte [esp + 0x38], 4
call fcn.00411b31
mov ecx, dword [esp + 0x28]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0040253e
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41b9eb
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0x45d414
call fcn.0044806b
mov esi, str.GlobalARM_Update_Mutex
push esi
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x1c], eax
cmp eax, ebx
jne 0x41ba27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41ba27
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi + 0x1c], eax
cmp dword [edi + 0x1c], ebx
je 0x41ba56
push str.ARM_update_mutex_created
lea ecx, [ebp - 0x10]
call fcn.00402060
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 4], ebx
call fcn.00411fb7
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
call fcn.00448143
ret
Function at 0x41e29e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0x498d50]
xor eax, esp
mov dword [esp + 0x254], eax
test esi, esi
je 0x41e31d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e31d
and dword [esp], 0
push 0x24c
lea eax, [esp + 8]
push 0
push eax
call fcn.004462a0
add esp, 0xc
lea eax, [esp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41e31d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xffffffff
je 0x41e302
cmp dword [esp + 0x20], ebx
jne 0x41e31d
push esi
call fcn.0041dde3
pop ecx
test eax, eax
je 0x41e31d
cmp ebx, 0xffffffff
jne 0x41e318
mov eax, dword [esp + 0x20]
jmp 0x41e31f
xor eax, eax
inc eax
jmp 0x41e31f
xor eax, eax
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.0044546a
mov esp, ebp
pop ebp
ret
Function at 0x420014
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x461841
call fcn.0044806b
push str.InitUpdateFromProductUpdatesTable...
lea ecx, [ebp - 0x1c]
call fcn.00402060
xor esi, esi
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
mov dword [ebp - 4], esi
call fcn.00411fb7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push str.SELECT__FROM__ProductUpdates__WHERE__ProductCode_
lea ecx, [ebp - 0x18]
call fcn.00402060
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401e6a
push str._AND__ProductVersion_
lea eax, [ebp - 0x18]
push eax
call fcn.00408cf5
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.00401e6a
push 0x482710
lea eax, [ebp - 0x18]
push eax
call fcn.00408cf5
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
mov eax, dword [ebx + 4]
push ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
push eax
call sub.msi.dll_MsiEnumClientsA
mov dword [ebp + 8], eax
cmp eax, esi
je 0x420114
push 0x482714
lea ecx, [ebp + 0xc]
call fcn.00402060
mov byte [ebp - 4], 4
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00411fb7
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
cmp dword [ebp - 0x10], esi
je 0x4200ef
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x4200fc
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, 0x3d32
call fcn.00448143
ret 8
push esi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
mov dword [ebp + 8], eax
cmp eax, esi
je 0x42017e
push 0x482720
lea ecx, [ebp + 0xc]
call fcn.00402060
mov byte [ebp - 4], 5
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00411fb7
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
cmp dword [ebp - 0x10], esi
je 0x42015d
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x42016a
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov esi, 0x3d32
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, esi
jmp 0x42010c
cmp dword [ebp - 0x10], esi
je 0x42018b
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
neg eax
sbb eax, eax
inc eax
je 0x4201d5
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
mov dword [ebp + 8], 3
push ebx
call fcn.0042045a
mov edi, eax
cmp dword [ebp - 0x10], esi
je 0x4201c4
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x4201d1
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov esi, edi
jmp 0x42016f
push 0x482728
lea ecx, [ebp + 8]
call fcn.00402060
push esi
lea eax, [ebp + 8]
push eax
push edi
mov byte [ebp - 4], 6
call fcn.00411fb7
mov ecx, dword [ebp + 8]
jmp 0x420145
Function at 0x42346e
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x45fca0
call fcn.0044806b
push 0x49da00
lea ecx, [ebp - 0x1c]
call fcn.004020a4
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push str.SELECT__FileSequences__FROM__ProductUpgrades__WHERE__UpgradeMatch_
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00402060
mov byte [ebp - 4], 3
mov ebx, dword [ebp - 0x1c]
push dword [ebx - 0xc]
lea ecx, [ebp - 0x18]
push ebx
call fcn.00401eca
push 0x482710
lea eax, [ebp - 0x18]
push eax
call fcn.00408cf5
cmp dword [ebp - 0x10], edi
je 0x4234d1
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
push eax
call sub.msi.dll_MsiEnumClientsA
cmp eax, edi
je 0x423552
push 0x482714
lea ecx, [ebp + 8]
call fcn.00402060
mov byte [ebp - 4], 4
mov esi, 0x3d32
push esi
lea eax, [ebp + 8]
push eax
push 1
call fcn.00411fb7
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040253e
cmp dword [ebp - 0x14], edi
je 0x423533
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], edi
je 0x423540
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebx - 0x10]
call fcn.0040253e
mov eax, esi
call fcn.00448143
ret 8
push edi
push dword [ebp - 0x10]
call sub.msi.dll_MsiViewModify
cmp eax, edi
je 0x423572
push 0x482720
lea ecx, [ebp + 8]
call fcn.00402060
mov byte [ebp - 4], 5
jmp 0x4234fc
cmp dword [ebp - 0x14], edi
je 0x42357f
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x4235a2
push dword [ebp + 0xc]
push 1
push dword [ebp - 0x14]
call fcn.00432e90
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040253e
cmp dword [ebp - 0x14], edi
je 0x4235ba
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], edi
je 0x4235c7
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor esi, esi
jmp 0x423540
Function at 0x42563a
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x498d50]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x45c603
call fcn.0044806b
mov eax, dword [ebp + 0x214]
push dword [eax]
mov esi, ecx
push str._INSTALLDIR_
push esi
call fcn.00408ddf
test eax, eax
jne 0x42573e
call fcn.00434892
push eax
lea ecx, [ebp - 0x10]
call fcn.0040210b
and dword [ebp - 4], 0
mov edi, str._WindowsFolder_
push edi
xor ecx, ecx
call fcn.00408f59
or ebx, 0xffffffff
cmp eax, ebx
je 0x4256a5
push 0x24
jmp 0x4256e2
mov edi, str._SystemFolder_
push edi
xor ecx, ecx
call fcn.00408f59
cmp eax, ebx
je 0x4256ba
push 0x25
jmp 0x4256e2
mov edi, str._ProgramFilesFolder_
push edi
xor ecx, ecx
call fcn.00408f59
cmp eax, ebx
je 0x4256cf
push 0x26
jmp 0x4256e2
mov edi, str._CommonFilesFolder_
push edi
xor ecx, ecx
call fcn.00408f59
cmp eax, ebx
je 0x425733
push 0x2b
pop ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.004020d4
xor eax, eax
push 0x206
mov word [ebp], ax
xor edi, edi
lea eax, [ebp + 2]
push edi
push eax
call fcn.004462a0
add esp, 0xc
lea eax, [ebp]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x425733
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x425733
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push esi
call fcn.00408ddf
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044546a
add ebp, 0x20c
leave
ret
Function at 0x425a6e
Capabilities:
Enumerate gui resources

Disassembly:
push 0x29c
mov eax, 0x45e871
call fcn.0044806b
push 0x49d9a4
lea ecx, [ebp - 0x20]
call fcn.004020a4
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push ebx
mov ecx, 0x49dcac
mov dword [ebp - 0x1c], ebx
call fcn.004367dd
cmp dword [0x49d958], ebx
mov dword [ebp - 0x14], ebx
jle 0x425bf0
push dword [ebp - 0x14]
mov ecx, 0x49d950
call fcn.00409086
mov esi, eax
mov eax, dword [esi]
cmp eax, ebx
je 0x425ba6
cmp dword [eax + 0x20], ebx
jne 0x425ba6
add eax, 8
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
call fcn.004020a4
push 0x484890
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00409001
lea ecx, [ebp - 0x10]
test eax, eax
je 0x425b33
lea eax, [ebp - 0x20]
push eax
call fcn.0042563a
pop ecx
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0040a4ee
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
je 0x425b23
push 0x46aefc
lea ecx, [ebp - 0x10]
call fcn.00409023
mov eax, dword [esi]
add eax, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.00401e6a
jmp 0x425b3e
mov eax, dword [esi]
add eax, 4
push eax
call fcn.00409162
mov esi, dword [esi]
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp - 0x10]
cmp eax, 6
jne 0x425b67
xor esi, esi
push ebx
inc esi
lea eax, [ebp - 0x18]
push esi
push eax
mov ecx, edi
call fcn.004260b9
add esp, 0xc
test eax, eax
je 0x425b88
mov dword [ebp - 0x1c], esi
jmp 0x425b88
cmp eax, ebx
jne 0x425b9b
push dword [esi + 4]
lea eax, [ebp - 0x18]
push ebx
push eax
mov ecx, edi
call fcn.004260b9
add esp, 0xc
test eax, eax
je 0x425b88
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x18], ebx
je 0x425b9b
push dword [ebp - 0x18]
push 0x425598
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.0040253e
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x49d958]
jl 0x425aae
cmp dword [ebp - 0x1c], ebx
je 0x425bf0
push dword [0x49dd00]
lea eax, [ebp - 0x2a8]
push eax
call fcn.0041a5ee
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 2
call fcn.00440138
lea ecx, [ebp - 0x2a8]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.0041a713
jmp 0x425bf3
xor esi, esi
inc esi
cmp esi, 4
je 0x425a8f
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, esi
call fcn.00448143
ret
Function at 0x426335
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x498d50]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x640], eax
cmp eax, 0xffffffff
jne 0x426371
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0044546a
leave
ret
lea ecx, [ebp - 0x63c]
push ecx
push eax
mov dword [ebp - 0x63c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x42639e
xor edi, edi
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x426363
push 0x46aefc
push ebx
call fcn.0044631a
pop ecx
pop ecx
push dword [ebp + 8]
mov esi, eax
neg esi
push 0
sbb esi, esi
push 0x2000000
neg esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x644], eax
test esi, esi
jne 0x4263d7
push ebx
lea eax, [ebp - 0x61c]
push eax
jmp 0x426427
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.004462a0
add esp, 0xc
cmp dword [ebp - 0x644], 0
je 0x426435
push 0x104
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x620]
push dword [ebp - 0x644]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x426435
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.004474d0
mov edi, eax
neg edi
sbb edi, edi
pop ecx
inc edi
pop ecx
lea eax, [ebp - 0x63c]
push eax
push dword [ebp - 0x640]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x42638e
test edi, edi
je 0x4263c9
jmp 0x42638e