joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486bbe
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x28c
mov eax, 0x508ec1
call fcn.004d2c4d
mov ebx, ecx
mov dword [ebp - 0x298], ebx
mov edi, dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x290], esi
call fcn.0046f310
call fcn.00406d01
push eax
lea ecx, [ebp - 0x28c]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28c]
push eax
push edi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004073cf
call fcn.00486dee
test al, al
je 0x486c71
push ecx
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048ed16
push ecx
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048ee86
push eax
mov ecx, esi
call fcn.0046daf0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406df6
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00486f3e
test al, al
je 0x486c71
xor edi, edi
jmp 0x486d9a
xor edi, edi
inc edi
cmp dword [ebp + 0xc], edi
jl 0x486d9a
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040737c
add eax, 0x10
mov dword [ebp - 0x284], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
push 0x5292f8
call fcn.004072c4
mov esi, dword [ebp - 0x284]
cmp dword [esi - 4], edi
jle 0x486cc4
push dword [esi - 0xc]
lea ecx, [ebp - 0x284]
call fcn.00406951
mov esi, dword [ebp - 0x284]
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp ebx, 0xffffffff
setne cl
test cl, cl
je 0x486d83
lea ecx, [ebp - 0x27c]
call fcn.00486dc5
test al, al
je 0x486d56
lea eax, [ebp - 0x250]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x280]
call fcn.0044fcbf
mov eax, dword [ebp + 0xc]
pop ecx
push dword [ebp - 0x290]
dec eax
push dword [ebp - 0x294]
push eax
push ecx
lea eax, [ebp - 0x280]
mov ecx, esp
push eax
call fcn.004073cf
mov ecx, dword [ebp - 0x298]
call fcn.00486bbe
test eax, eax
je 0x486d6f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406df6
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec eax
neg eax
sbb al, al
add al, 1
jne 0x486cf0
jmp 0x486d83
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406df6
xor edi, edi
test ebx, ebx
je 0x486d8e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28c]
lea ecx, [ecx - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406df6
mov eax, edi
call fcn.004d2bf7
ret 0x10
Function at 0x4870b6
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x508f6c
call fcn.004d2c19
cmp byte [ebp + 0x10], 0
jne 0x4870f7
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00487037
cmp byte [ebp + 0x14], 0
je 0x4870e0
test eax, eax
setne bl
jmp 0x4870e5
test eax, eax
sete bl
test eax, eax
je 0x4870f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x487190
mov ebx, dword [ebp + 8]
push 0x5c
push dword [ebx]
call fcn.004d5852
pop ecx
pop ecx
mov esi, eax
push 3
pop edi
test esi, esi
je 0x48717d
sub esi, dword [ebx]
sar esi, 1
js 0x48717d
push esi
push 0
lea eax, [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.0044514d
mov dl, byte [ebp + 0xc]
lea ecx, [ebp + 0x10]
call fcn.00487037
mov dword [ebp + 8], eax
test eax, eax
je 0x48716e
lea edx, [esi + 1]
mov ecx, ebx
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00444f84
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00406df6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406df6
xor eax, eax
cmp byte [ebp + 0x14], al
je 0x48718b
test edi, edi
sete al
jmp 0x487190
test edi, edi
setne al
call fcn.004d2be2
ret 0x10

Function at 0x48754c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
mov ecx, 0x56b7e8
call fcn.0044ad2d
cmp byte [0x56b7f0], 0
je 0x487573
push dword [0x56b7e8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4875a3
cmp dword [0x56b7e8], 0
je 0x4875a3
xor ecx, ecx
lea eax, [ebp + 8]
push eax
push ecx
push 0x56b7e4
push 0x4875c5
push ecx
push ecx
mov dword [ebp + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov ecx, 0x56b7f4
call fcn.00422c5e
pop ebp
ret 4
Function at 0x488c3c
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x50933b
call fcn.004d2c19
mov ebx, ecx
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x14]
add eax, 0x60
push eax
call fcn.004073cf
lea ecx, [ebp - 0x14]
call fcn.00484d7d
call fcn.00406d01
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.0040928a
call fcn.00406d01
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push edi
push eax
call fcn.00457385
mov esi, dword [ebp - 0x10]
add esp, 0x14
cmp byte [0x56b83c], 0
je 0x488cf6
call fcn.00406d01
push eax
lea ecx, [ebp + 8]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x488cd9
push esi
lea ecx, [ebp + 8]
call fcn.004072c4
lea eax, [ebp + 8]
mov ecx, 0x56b80c
push eax
call fcn.00489943
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406df6
cmp byte [ebx + 0x10], 0
je 0x488d05
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x488d2f
mov ecx, dword [ebx]
lea ecx, [ecx + 0xc]
call fcn.004845ba
mov ecx, dword [ebx]
push 0
call fcn.00484731
mov ebx, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x10
push ebx
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.0046bb40
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406df6
call fcn.004d2be2
ret 0xc
Function at 0x489a54
Capabilities:
Write file on windows

Disassembly:
push 0x214
mov eax, 0x50953b
call fcn.004d2c4d
mov ebx, ecx
lea esi, [ebx + 0x28]
cmp dword [esi], 0
jne 0x489bbc
lea edi, [ebx + 0x20]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x489aeb
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add eax, eax
cmp eax, 0x208
jae 0x489b3c
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004093f1
push 0x2e
push dword [edi]
call fcn.004d5852
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x489acb
or ecx, 0xffffffff
jmp 0x489acf
sub ecx, dword [edi]
sar ecx, 1
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.00471e40
push str..log
mov ecx, edi
call fcn.004072c4
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.00422c5e
cmp dword [esi], 0xffffffff
je 0x489bb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x489b41
cmp dword [esi], 0
je 0x489bbc
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x489b7c
call fcn.004d289c
test eax, eax
jne 0x489bb3
cmp dword [esi], eax
je 0x489bb3
push 2
pop ecx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0xfeff
push eax
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [esi], 0
je 0x489bbc
lea eax, [ebx + 0x24]
mov ecx, ebx
push eax
call fcn.00489bc2
lea ecx, [ebp - 0x21c]
call fcn.00489bf1
push eax
mov ecx, ebx
call fcn.00489bc2
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00406df6
jmp 0x489bbc
push 0
mov ecx, esi
call fcn.00422c5e
call fcn.004d2bf7
ret

Function at 0x489bc2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x48a35f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5651c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.00484b8d
test al, al
jne 0x48a432
push str.ProgramFilesFolder
mov ecx, edi
call fcn.004451dc
mov esi, str.AppDataFolder
test eax, eax
je 0x48a3b4
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.004874a8
test al, al
jne 0x48a3b4
push esi
mov ecx, edi
call fcn.004451dc
test eax, eax
jne 0x48a432
push esi
mov ecx, edi
call fcn.004451dc
neg eax
mov ecx, str.PROGRAMFILES
push 0
sbb al, al
add al, 1
pop eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov eax, str.APPDATA
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x48a3fe
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x210], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x48a444
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x48a429
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.004093f1
xor eax, eax
test esi, esi
setne al
jmp 0x48a434
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d207d
mov esp, ebp
pop ebp
ret
call fcn.004d289c
int3

Function at 0x48b3d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
add ecx, 0x20
push esi
xor esi, esi
push edi
mov eax, dword [ecx]
mov edi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
cmp dword [eax - 0xc], esi
je 0x48b3fb
push ecx
lea ecx, [ebp - 0xc]
call fcn.0046daf0
mov edi, dword [ebp - 8]
test edi, edi
jle 0x48b41b
push esi
lea ecx, [ebp - 0xc]
call fcn.00406760
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
cmp esi, edi
jl 0x48b3ff
lea ecx, [ebp - 0xc]
call fcn.00451f33
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48bab8
Capabilities:
Copy file

Disassembly:
push 0x1c
mov eax, 0x509a47
call fcn.004d2c19
mov ebx, ecx
call fcn.00406d01
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b29
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.00406d01
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b29
mov dword [ebp - 4], edi
call fcn.00406d01
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b29
mov dword [ebp - 4], edi
lea eax, [ebp - 0x18]
mov ecx, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00481798
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004434b9
push 0
push str.__
lea ecx, [ebp - 0x18]
call fcn.0046dbc0
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x48bb3a
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004093f1
push 0x523a24
push dword [ebp + 0xc]
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.0047f1e3
pop ecx
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.0044fcbf
pop ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406df6
push 0
mov dl, 1
lea ecx, [ebp - 0x10]
call fcn.00471150
lea edi, [ebx + 0x20]
mov dword [esp], str.instname_target.msi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x24], edi
lea ecx, [ebp + 0xc]
call fcn.0044fcbf
pop ecx
push eax
mov ecx, edi
call fcn.004434b9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406df6
lea eax, [ebx + 0x24]
push str.instname_custom.mst
lea edx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea ecx, [ebp + 0xc]
call fcn.0044fcbf
pop ecx
push eax
lea ecx, [ebx + 0x24]
call fcn.004434b9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406df6
push 0
push dword [edi]
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x48bc1b
mov ecx, dword [ebp + 8]
call fcn.00406e18
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406df6
mov dword [ebp - 4], ebx
lea ecx, [esi - 0x10]
call fcn.00406df6
mov dword [ebp - 4], ebx
lea ecx, [edi - 0x10]
call fcn.00406df6
mov dword [ebp - 4], ebx
jmp 0x48bca6
push 0x5221e0
lea ecx, [ebp + 0xc]
call fcn.00409419
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.0048c10a
mov bl, al
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00406df6
test bl, bl
je 0x48bc70
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x24]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0048bfa4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406df6
push dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
call fcn.004073cf
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406df6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406df6
mov eax, dword [ebp + 8]
call fcn.004d2be2
ret 8
Function at 0x48c10a
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x509b6a
call fcn.004d2c19
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
xor ebx, ebx
push dword [eax]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48c270
call fcn.00406d01
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push dword [ecx]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.00457385
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.msi.dll_MsiEnumClientsA]
add esp, 0xc
mov dword [ebp - 0x10], ebx
push eax
push edi
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x48c255
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48c255
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne byte [ebp + 0xb]
cmp dword [ebp - 0x10], ebx
je 0x48c1b3
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp byte [ebp + 0xb], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
mov dword [ebp - 0x10], ebx
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x48c247
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov esi, eax
je 0x48c1ee
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x48c255
cmp byte [ebp + 0xb], 0
mov eax, dword [ebp + 0xc]
cmovne eax, dword [ebp + 0x10]
push dword [eax]
push 1
push esi
mov esi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call esi
test eax, eax
jne 0x48c247
cmp byte [ebp + 0xb], al
mov eax, dword [ebp + 0x10]
cmovne eax, dword [ebp + 0xc]
push dword [eax]
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x48c247
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48c247
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48c247
mov bl, 1
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x48c255
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x10], 0
je 0x48c264
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406df6
cmp dword [ebp - 0x18], 0
je 0x48c27f
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov al, bl
call fcn.004d2be2
ret 0xc
Function at 0x48cc18
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
sub esp, 0x190
lea ebp, [esp - 4]
mov eax, dword [0x5651c0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0x10
mov eax, 0x509d4e
call fcn.004d2c19
mov dword [ebp - 0x1c], edx
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x48cc6c
xor al, al
jmp 0x48cd7e
mov edi, dword [esi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x48cc7f
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xc8
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x48ccad
cmp dword [ebp - 0x18], 0xc8
jbe 0x48cd6e
call fcn.00406d01
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x48cd0f
push 0
mov ecx, esi
call fcn.0046ddb0
push 0x22
pop ecx
cmp ax, cx
je 0x48cd0f
push 0
push 0x20
mov ecx, esi
call fcn.004504a9
cmp eax, 0xffffffff
je 0x48cd0f
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0046dd50
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004072ec
push 0x22
lea ecx, [ebp - 0x10]
call fcn.0046dd50
jmp 0x48cd18
push esi
lea ecx, [ebp - 0x10]
call fcn.004434b9
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x48cd3a
push 0
mov ecx, ebx
call fcn.0046ddb0
push 0x20
pop ecx
cmp ax, cx
je 0x48cd3a
push ecx
lea ecx, [ebp - 0x10]
call fcn.0046dd50
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004072ec
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406df6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004d207d
lea esp, [ebp + 0x194]
pop ebp
ret
Function at 0x48ce5e
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0xf003f
xor edi, edi
mov esi, ecx
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48ce8c
xor al, al
jmp 0x48cee4
mov esi, dword [esi]
mov eax, dword [esi - 0xc]
cmp eax, 0x4f
jle 0x48ce9f
lea esi, [esi + eax*2]
add esi, 0xffffff62
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x48cec8
cmp edi, 0xea
jne 0x48ced4
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48d4ca
Capabilities:
Read file on windows

Disassembly:
push 0x18
mov eax, 0x509e04
call fcn.004d2c19
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x48d4eb
xor eax, eax
jmp 0x48d5a0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push 2
pop esi
cmp edi, 0xffffffff
je 0x48d593
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov ebx, dword [ebp + 0x10]
add ecx, esi
and dword [ebp - 0x20], 0
sub ebx, esi
push 0
push eax
push ecx
push edi
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48d593
mov eax, ebx
lea ecx, [ebp + 8]
shr eax, 1
push eax
push 0x78
call fcn.00443504
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x48d55c
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00406951
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48d584
cmp dword [ebp - 0x14], 0
je 0x48d584
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 8]
push eax
call fcn.0048d035
movzx esi, al
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406df6
test edi, edi
je 0x48d59e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.004d2be2
ret 0xc
Function at 0x48eb9c
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0xa8
lea ebp, [esp - 4]
mov eax, dword [0x5651c0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push 8
mov eax, 0x50a228
call fcn.004d2c19
mov esi, edx
mov edi, ecx
mov dword [ebp + 0x9c], 0x52eb68
mov dword [ebp + 0xa0], str.http:__www.yahoo.com
mov dword [ebp + 0xa4], str.http:__www.example.com
call fcn.00406d01
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
push str.tin9999.tmp
call fcn.00409419
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.00470120
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406df6
push esi
push edi
lea ecx, [ebp]
call fcn.00496c56
xor ebx, ebx
mov dword [ebp + 0x78], ebx
mov edi, ebx
push dword [ebp + edi*4 + 0x9c]
lea ecx, [ebp - 0x10]
call fcn.00409419
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp]
call fcn.004971c9
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406df6
test esi, esi
je 0x48ec68
inc edi
cmp edi, 3
jl 0x48ec2c
jmp 0x48ec6a
mov bl, 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp]
call fcn.0047c254
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406df6
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004d207d
lea esp, [ebp + 0xac]
pop ebp
ret

Function at 0x48efad
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x50a2d8
call fcn.004d2c19
mov esi, ecx
call fcn.00406d01
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b29
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, esi
push eax
push edi
call fcn.0048f14a
test eax, eax
jne 0x48efe5
push 3
pop esi
jmp 0x48f010
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
push 1
push esi
push dword [edi]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406df6
mov eax, esi
call fcn.004d2be2
ret 8