joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eca0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5144d1
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x14]
mov edx, esi
cmp edi, 8
jb 0x46ecdc
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46ecf3
mov eax, edx
cmp word [eax], 0x2a
je 0x46ed1d
add eax, 2
sub ecx, 1
jne 0x46ece5
cmp edi, 8
jb 0x46ecfa
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dab44
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x46ecf3
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x46ecf3
lea ecx, [ebp - 0x478]
call fcn.0046ee40
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x46ed44
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x478]
call fcn.00483590
test eax, eax
je 0x46ee19
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x18], 0
je 0x46eda2
mov eax, dword [ebp - 0x478]
shr eax, 4
and eax, 1
je 0x46ed9e
cmp word [ebp - 0x44c], 0x2e
jne 0x46ed9e
mov cx, word [ebp - 0x44a]
test cx, cx
je 0x46edf7
cmp cx, 0x2e
jne 0x46ed9e
cmp word [ebp - 0x448], 0
je 0x46edf7
test eax, eax
jne 0x46edf7
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x478]
call fcn.004839d0
mov byte [ebp - 4], 1
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x46edf7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x46ee30
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46ee19
cmp dword [ebp - 0x18], 0
je 0x46ee19
lea ecx, [ebp - 0x478]
push ecx
push eax
call ebx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x46ed64
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0046eef0
jmp 0x46ed01
mov ecx, edx
call esi
jmp 0x46edf7

Function at 0x46fe30
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x46fe5f
cmp dword [edi + 0x20], 8
lea ecx, [edi + 0xc]
jb 0x46fe45
mov ecx, dword [ecx]
mov eax, dword [edi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [edi + 0x3c]
mov ecx, edi
call fcn.004580a8
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x46fe6b
mov esi, dword [esi]
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
jb 0x46fe77
mov ebx, dword [ebx]
test esi, esi
jne 0x46fe8b
mov eax, 0xd
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
push esi
call fcn.004e0c46
add esp, 4
lea eax, [eax*2 + 2]
push eax
push esi
push 2
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
Function at 0x4701c0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x4701f0
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x4701d4
mov ecx, dword [ecx]
mov eax, dword [esi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [esi + 0x3c]
mov ecx, esi
call fcn.004580a8
mov edx, dword [esi]
mov ecx, dword [esp + 8]
pop esi
cmp dword [ecx + 0x14], 8
jb 0x4701fd
mov ecx, dword [ecx]
mov eax, dword [esp + 8]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 8
Function at 0x475c60
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], ecx
push eax
push 0x475c90
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x476f80
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x5152cf
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57f44c]
test eax, eax
jne 0x4770be
push 0x10
call fcn.004dab63
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x2b4
push 0
push eax
call fcn.004de9a0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp]
add esp, 0x10
push 0x4011
push 0x2b4
push eax
push 0x10
push 0x5407a8
call edi
push 0x4011
push 0x2b4
mov dword [esi], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
push 0x4013
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x47708d
push 0x4009
push 0x2b4
lea eax, [ebp]
push eax
push 0
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x477094
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x477094
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x57f44c]
mov dword [0x57f44c], esi
test eax, eax
je 0x4770bc
push 0x10
push eax
call fcn.004dab55
mov eax, dword [0x57f44c]
add esp, 8
jmp 0x4770be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004dab44
lea esp, [ebp + 0x2b8]
pop ebp
ret
Function at 0x4770e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515310
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x47713c
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d6fc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004e3927
mov edx, eax
add esp, 8
test edx, edx
js 0x477201
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x477201
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004de9a0
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4771e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x47720b
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dab44
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040d85a
call esi
jmp 0x4771e2
Function at 0x479950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515828
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57c080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040d32d
mov ecx, eax
test ecx, ecx
je 0x479a9c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x534850
jne 0x479aa6
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00479ac0
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x4799c7
xor bl, bl
jmp 0x479a43
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x479a3e
cmp dword [edi + 0xc], 0
jl 0x479a33
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x479a33
call fcn.004070e1
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x479a29
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x534850
jne 0x479aad
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479a3e
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479a3e
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d89e
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x479a88
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x534850
jne 0x479ab6
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040d85a
call edx
jmp 0x4799a2
mov ecx, edx
call eax
jmp 0x479a29
call edx
jmp 0x479a88
Function at 0x479ac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x57c080]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
lea eax, [esp + 0x214]
mov ebx, edx
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x479c77
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x479c77
push ebp
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004e0c46
mov esi, dword [ebx]
mov edi, eax
add esp, 4
test edi, edi
jne 0x479bb2
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], eax
je 0x479c5c
cmp dword [ecx + 0xc], eax
lea edx, [ecx + 0xc]
jge 0x479b5d
cmp dword [esi - 8], eax
jl 0x479ca3
mov dword [esi - 0xc], eax
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x479c5c
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x479b8a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x479c90
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x534850
jne 0x479c99
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479c5c
add eax, 0x10
mov dword [ebx], eax
jmp 0x479c5c
mov eax, dword [esi - 0xc]
lea ebp, [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], eax
sar ebp, 1
test edi, edi
js 0x479ca3
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x479be4
push edi
mov ecx, ebx
call fcn.0040d6fc
mov esi, dword [ebx]
lea ecx, [edi + edi]
cmp ebp, dword [esp + 0x10]
ja 0x479c32
mov eax, dword [esi - 8]
lea edx, [esi + ebp*2]
test ecx, ecx
je 0x479c4a
test edx, edx
jne 0x479c0d
call fcn.004e0d84
mov dword [eax], 0x16
call fcn.004e0be6
jmp 0x479c47
add eax, eax
cmp eax, ecx
jae 0x479c25
call fcn.004e0d84
mov dword [eax], 0x22
call fcn.004e0be6
jmp 0x479c47
push ecx
push edx
push esi
call fcn.004dc7e0
add esp, 0xc
jmp 0x479c47
mov edx, dword [esi - 8]
lea eax, [esp + 0x14]
push ecx
push eax
add edx, edx
mov ecx, esi
call fcn.0040d7d5
add esp, 8
lea ecx, [edi + edi]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x479ca3
mov dword [eax - 0xc], edi
xor edx, edx
mov eax, dword [ebx]
mov word [ecx + eax], dx
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004dab44
add esp, 0x418
ret
mov ecx, dword [esp + 0x41c]
xor al, al
pop esi
pop ebx
xor ecx, esp
call fcn.004dab44
add esp, 0x418
ret
mov ecx, edx
call esi
jmp 0x479b8a
mov ecx, edi
call dword [eax + 0xc]
jmp 0x479ba8
push 0x80070057
call fcn.0040d85a
int3
Function at 0x47afd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515a88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57c080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], 0x533e68
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x47b032
or esi, eax
xor bl, bl
jmp 0x47b048
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x47b044
xor bl, bl
jmp 0x47b048
mov dword [edi], eax
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x533e68
test esi, esi
je 0x47b068
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47b080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515ac0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x57c080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.0047b130
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47b10f
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x534850
jne 0x47b122
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call eax
jmp 0x47b10f
Function at 0x47ba00
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x47baaf
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x47ba4c
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x47ba54
cmp dword [eax - 8], 0
jl 0x47bb0e
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x47ba81
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x534850
jne 0x47bb18
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x534850
jne 0x47bb21
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
js 0x47bb0e
mov edx, dword [esi]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x47bace
push edi
mov ecx, esi
call fcn.0040d6fc
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x47bae1
xor ecx, ecx
jmp 0x47baf3
push dword [eax - 8]
push eax
call fcn.004e3927
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x47bb0e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x47bb0e
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
lea eax, [edx + 1]
ret 4
push 0x80070057
call fcn.0040d85a
mov ecx, edx
call ebx
jmp 0x47ba81
mov ecx, edi
call dword [eax + 0xc]
jmp 0x47baa2
Function at 0x48916a
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x516dd4
call fcn.004db753
mov bl, dl
mov edi, ecx
cmp byte [0x57f574], 0
je 0x4891c7
lea ecx, [ebp - 0x10]
call fcn.0040ce6d
and dword [ebp - 4], 0
mov esi, dword [edi]
test esi, esi
je 0x4891a6
push esi
call fcn.004e0c46
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00410f2f
lea eax, [ebp - 0x10]
mov ecx, 0x57f540
push eax
call fcn.004a1ee4
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
cmp byte [0x57cb1c], 0
push dword [edi]
je 0x489224
lea ecx, [ebp - 0x10]
call fcn.0040d91c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.0040ce6d
movzx ecx, bl
shl ecx, 0x12
add ecx, 0x10
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00475c10
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d133
jmp 0x48922a
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004db71c
ret
Function at 0x48b2db
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x517327
call fcn.004db753
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], ebx
je 0x48b2ff
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x18], ebx
push dword [eax]
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48b46f
lea ecx, [ebp - 0x1c]
call fcn.0040ce6d
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x1c]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.00411714
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0
je 0x48b34f
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.msi.dll_MsiEnumClientsA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48b454
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48b454
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], eax
je 0x48b38f
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne bl
cmp dword [ebp - 0x10], 0
mov byte [ebp + 0xb], bl
je 0x48b3b5
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
test bl, bl
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48b443
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov edi, eax
je 0x48b3eb
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
test edi, edi
je 0x48b443
mov eax, dword [ebp + 0xc]
test bl, bl
mov ebx, dword [ebp + 0x10]
cmovne eax, ebx
push dword [eax]
push 1
push edi
mov edi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call edi
test eax, eax
jne 0x48b443
cmp byte [ebp + 0xb], al
cmovne ebx, dword [ebp + 0xc]
push dword [ebx]
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x48b443
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48b443
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48b443
mov bl, 1
jmp 0x48b445
xor bl, bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x48b454
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48b463
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x48b47e
push dword [ebp - 0x18]
call esi
mov al, bl
call fcn.004db71c
ret 0xc
Function at 0x48bc6b
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x517503
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x20c]
push dword [ebx + 4]
call fcn.004db29c
and dword [ebx + 4], 0
lea eax, [ebp]
and dword [ebx], 0
push esi
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x14], 0
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
je 0x48bcea
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x1c]
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp]
call fcn.0048bede
pop ecx
test eax, eax
jns 0x48bd08
xor bl, bl
jmp 0x48bdb3
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48bd1b
push dword [ebp - 0x10]
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
je 0x48bd56
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x48bd51
cmp esi, 0x80070103
je 0x48bd51
call fcn.0048bfb9
mov eax, dword [ebp - 0x10]
jmp 0x48bd5b
mov esi, 0x80070057
test esi, esi
jns 0x48bd63
xor bl, bl
jmp 0x48bda4
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
push ecx
push 0x534080
push 1
push eax
call esi
cmp eax, 0xea
jne 0x48bd9f
mov eax, dword [ebp - 0x18]
mov ecx, ebx
inc eax
push eax
mov dword [ebp - 0x18], eax
call fcn.00484150
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x48bdb3
push dword [ebp - 0x10]
call edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x48bdc2
push dword [ebp - 0x14]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004dab44
add ebp, 0x204
leave
ret