joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48609f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x50b5cd
call fcn.004d0cf3
mov dword [ebp - 0x10], edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
push 0x38
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x50]
push eax
call fcn.004d1f70
mov edi, dword [ebp + 0xc]
mov eax, 0x400
mov esi, dword [ebx]
add esp, 0xc
test edi, edi
mov dword [ebp - 0x54], 0x3c
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov ecx, ebx
mov dword [ebp - 0x50], eax
call fcn.00471570
test al, al
je 0x4860f1
add esi, 8
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp byte [ebp + 0x10], al
mov dword [ebp - 0x44], esi
sete al
mov dword [ebp - 0x48], str.open
mov ecx, dword [ecx]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
cmp dword [ecx - 0xc], 0
cmovne eax, ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x486133
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x18]
xor ebx, ebx
inc ebx
call fcn.004700e0
jmp 0x48613f
push 2
pop ebx
push ecx
lea ecx, [ebp + 0x10]
call fcn.004073ac
push eax
lea ecx, [ebp + 0xc]
call fcn.004073ac
test bl, 2
je 0x48615f
and ebx, 0xfffffffd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
test bl, 1
je 0x486173
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov esi, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00471570
test al, al
je 0x486185
add esi, 8
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x48619a
xor ebx, ebx
jmp 0x4861ca
test edi, edi
je 0x4861b9
cmp dword [ebp - 0x1c], 0
je 0x4861c8
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1c], 0
je 0x4861c8
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00406dd3
mov al, bl
call fcn.004d0cbc
ret
Function at 0x48642e
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x56a078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
push 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x48646a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48650e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x18]
mov esi, ebx
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4864b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x486501
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.0044ec3e
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push esi
push 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x486501
cmp dword [ebp - 0x10], ebx
je 0x486501
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x486507
push dword [ebp - 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x20]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x486507
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.004d0771
pop ecx
cmp dword [ebp - 0x18], 0
je 0x48651d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004d014c
mov esp, ebp
pop ebp
ret

Function at 0x48652f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x56a078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x486595
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x486589
cmp dword [ebp - 0x218], ebx
je 0x48658f
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x486573
jmp 0x486595
mov esi, dword [ebp - 0x228]
test edi, edi
je 0x4865a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d014c
mov esp, ebp
pop ebp
ret
Function at 0x48687b
Capabilities:
Read file on windows

Disassembly:
push 0x40c
mov eax, 0x50b6a9
call fcn.004d0d27
mov edi, edx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], ebx
mov esi, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4868d6
cmp eax, 0x400
jae 0x48693d
mov byte [ebp + eax - 0x410], 0
mov ecx, edi
lea eax, [ebp - 0x410]
push eax
call fcn.004729f0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x3ff
lea eax, [ebp - 0x410]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x4868b7
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x48692c
add eax, 0xfffffffe
mov ecx, edi
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.004450c5
push eax
mov ecx, edi
call fcn.0044369a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
test esi, esi
je 0x486937
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004d0cd1
ret
call fcn.004d096b
int3

Function at 0x487588
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, edx
push eax
lea eax, [ebp - 8]
mov ebx, ecx
push eax
push 0
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x4875ee
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.00406a2a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
mov esi, dword [edi]
push eax
call fcn.0041e88d
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xffffffffffffffff
call fcn.00406a87
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4875fc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x28c
mov eax, 0x50b8f8
call fcn.004d0d27
mov ebx, ecx
mov dword [ebp - 0x298], ebx
mov edi, dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x290], esi
call fcn.0046fb70
call fcn.00406cde
push eax
lea ecx, [ebp - 0x28c]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28c]
push eax
push edi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004073ac
call fcn.0048782c
test al, al
je 0x4876af
push ecx
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f781
push ecx
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f8f1
push eax
mov ecx, esi
call fcn.0046e350
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0048797c
test al, al
je 0x4876af
xor edi, edi
jmp 0x4877d8
xor edi, edi
inc edi
cmp dword [ebp + 0xc], edi
jl 0x4877d8
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407359
add eax, 0x10
mov dword [ebp - 0x284], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
push 0x52ec08
call fcn.004072a1
mov esi, dword [ebp - 0x284]
cmp dword [esi - 4], edi
jle 0x487702
push dword [esi - 0xc]
lea ecx, [ebp - 0x284]
call fcn.00406931
mov esi, dword [ebp - 0x284]
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp ebx, 0xffffffff
setne cl
test cl, cl
je 0x4877c1
lea ecx, [ebp - 0x27c]
call fcn.00487803
test al, al
je 0x487794
lea eax, [ebp - 0x250]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x280]
call fcn.0044fed8
mov eax, dword [ebp + 0xc]
pop ecx
push dword [ebp - 0x290]
dec eax
push dword [ebp - 0x294]
push eax
push ecx
lea eax, [ebp - 0x280]
mov ecx, esp
push eax
call fcn.004073ac
mov ecx, dword [ebp - 0x298]
call fcn.004875fc
test eax, eax
je 0x4877ad
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec eax
neg eax
sbb al, al
add al, 1
jne 0x48772e
jmp 0x4877c1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
xor edi, edi
test ebx, ebx
je 0x4877cc
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28c]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406dd3
mov eax, edi
call fcn.004d0cd1
ret 0x10
Function at 0x487af4
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x50b9a3
call fcn.004d0cf3
cmp byte [ebp + 0x10], 0
jne 0x487b35
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00487a75
cmp byte [ebp + 0x14], 0
je 0x487b1e
test eax, eax
setne bl
jmp 0x487b23
test eax, eax
sete bl
test eax, eax
je 0x487b2e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x487bce
mov ebx, dword [ebp + 8]
push 0x5c
push dword [ebx]
call fcn.004d3931
pop ecx
pop ecx
mov esi, eax
push 3
pop edi
test esi, esi
je 0x487bbb
sub esi, dword [ebx]
sar esi, 1
js 0x487bbb
push esi
push 0
lea eax, [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00445339
mov dl, byte [ebp + 0xc]
lea ecx, [ebp + 0x10]
call fcn.00487a75
mov dword [ebp + 8], eax
test eax, eax
je 0x487bac
lea edx, [esi + 1]
mov ecx, ebx
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00445170
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00406dd3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
xor eax, eax
cmp byte [ebp + 0x14], al
je 0x487bc9
test edi, edi
sete al
jmp 0x487bce
test edi, edi
setne al
call fcn.004d0cbc
ret 0x10

Function at 0x487f8a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
mov ecx, 0x570678
call fcn.0044af0d
cmp byte [0x570680], 0
je 0x487fb1
push dword [0x570678]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x487fe1
cmp dword [0x570678], 0
je 0x487fe1
xor ecx, ecx
lea eax, [ebp + 8]
push eax
push ecx
push 0x570674
push 0x488003
push ecx
push ecx
mov dword [ebp + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov ecx, 0x570684
call fcn.00422d68
pop ebp
ret 4
Function at 0x489670
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x50bd72
call fcn.004d0cf3
mov ebx, ecx
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x14]
add eax, 0x60
push eax
call fcn.004073ac
lea ecx, [ebp - 0x14]
call fcn.004857bb
call fcn.00406cde
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.00409267
call fcn.00406cde
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push edi
push eax
call fcn.004575ca
mov esi, dword [ebp - 0x10]
add esp, 0x14
cmp byte [0x5706cc], 0
je 0x48972a
call fcn.00406cde
push eax
lea ecx, [ebp + 8]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x48970d
push esi
lea ecx, [ebp + 8]
call fcn.004072a1
lea eax, [ebp + 8]
mov ecx, 0x57069c
push eax
call fcn.0048a377
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
cmp byte [ebx + 0x10], 0
je 0x489739
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x489763
mov ecx, dword [ebx]
lea ecx, [ecx + 0xc]
call fcn.00484ff8
mov ecx, dword [ebx]
push 0
call fcn.0048516f
mov ebx, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x10
push ebx
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.0046c3a0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
call fcn.004d0cbc
ret 0xc
Function at 0x48a488
Capabilities:
Write file on windows

Disassembly:
push 0x214
mov eax, 0x50bf72
call fcn.004d0d27
mov ebx, ecx
lea esi, [ebx + 0x28]
cmp dword [esi], 0
jne 0x48a5f0
lea edi, [ebx + 0x20]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x48a51f
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add eax, eax
cmp eax, 0x208
jae 0x48a570
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004093ce
push 0x2e
push dword [edi]
call fcn.004d3931
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x48a4ff
or ecx, 0xffffffff
jmp 0x48a503
sub ecx, dword [edi]
sar ecx, 1
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.00472880
push str..log
mov ecx, edi
call fcn.004072a1
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.00422d68
cmp dword [esi], 0xffffffff
je 0x48a5e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48a575
cmp dword [esi], 0
je 0x48a5f0
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x48a5b0
call fcn.004d096b
test eax, eax
jne 0x48a5e7
cmp dword [esi], eax
je 0x48a5e7
push 2
pop ecx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0xfeff
push eax
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [esi], 0
je 0x48a5f0
lea eax, [ebx + 0x24]
mov ecx, ebx
push eax
call fcn.0048a5f6
lea ecx, [ebp - 0x21c]
call fcn.0048a625
push eax
mov ecx, ebx
call fcn.0048a5f6
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
jmp 0x48a5f0
push 0
mov ecx, esi
call fcn.00422d68
call fcn.004d0cd1
ret

Function at 0x48a5f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x48ad8e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x56a078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.004855cb
test al, al
jne 0x48ae61
push str.ProgramFilesFolder
mov ecx, edi
call fcn.004453c8
mov esi, str.AppDataFolder
test eax, eax
je 0x48ade3
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.00487ee6
test al, al
jne 0x48ade3
push esi
mov ecx, edi
call fcn.004453c8
test eax, eax
jne 0x48ae61
push esi
mov ecx, edi
call fcn.004453c8
neg eax
mov ecx, str.PROGRAMFILES
push 0
sbb al, al
add al, 1
pop eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov eax, str.APPDATA
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x48ae2d
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x210], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x48ae73
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x48ae58
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.004093ce
xor eax, eax
test esi, esi
setne al
jmp 0x48ae63
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d014c
mov esp, ebp
pop ebp
ret
call fcn.004d096b
int3

Function at 0x48bdff
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
add ecx, 0x20
push esi
xor esi, esi
push edi
mov eax, dword [ecx]
mov edi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
cmp dword [eax - 0xc], esi
je 0x48be2a
push ecx
lea ecx, [ebp - 0xc]
call fcn.0046e350
mov edi, dword [ebp - 8]
test edi, edi
jle 0x48be4a
push esi
lea ecx, [ebp - 0xc]
call fcn.00406740
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
cmp esi, edi
jl 0x48be2e
lea ecx, [ebp - 0xc]
call fcn.00452170
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48c4e7
Capabilities:
Copy file

Disassembly:
push 0x1c
mov eax, 0x50c47e
call fcn.004d0cf3
mov ebx, ecx
call fcn.00406cde
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b09
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.00406cde
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b09
mov dword [ebp - 4], edi
call fcn.00406cde
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b09
mov dword [ebp - 4], edi
lea eax, [ebp - 0x18]
mov ecx, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004821d6
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0044369a
push 0
push 0x52fbf8
lea ecx, [ebp - 0x18]
call fcn.0046e420
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x48c569
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004093ce
push 0x52940c
push dword [ebp + 0xc]
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.0047fc19
pop ecx
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.0044fed8
pop ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push 0
mov dl, 1
lea ecx, [ebp - 0x10]
call fcn.00471b90
lea edi, [ebx + 0x20]
mov dword [esp], str.instname_target.msi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x24], edi
lea ecx, [ebp + 0xc]
call fcn.0044fed8
pop ecx
push eax
mov ecx, edi
call fcn.0044369a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
lea eax, [ebx + 0x24]
push str.instname_custom.mst
lea edx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea ecx, [ebp + 0xc]
call fcn.0044fed8
pop ecx
push eax
lea ecx, [ebx + 0x24]
call fcn.0044369a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push 0
push dword [edi]
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x48c64a
mov ecx, dword [ebp + 8]
call fcn.00406df5
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov dword [ebp - 4], ebx
lea ecx, [esi - 0x10]
call fcn.00406dd3
mov dword [ebp - 4], ebx
lea ecx, [edi - 0x10]
call fcn.00406dd3
mov dword [ebp - 4], ebx
jmp 0x48c6d5
push 0x527bb0
lea ecx, [ebp + 0xc]
call fcn.004093f6
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.0048cb39
mov bl, al
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00406dd3
test bl, bl
je 0x48c69f
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x24]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0048c9d3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
call fcn.004073ac
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406dd3
mov eax, dword [ebp + 8]
call fcn.004d0cbc
ret 8
Function at 0x48cb39
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x50c5a1
call fcn.004d0cf3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
xor ebx, ebx
push dword [eax]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48cc9f
call fcn.00406cde
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push dword [ecx]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.004575ca
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.msi.dll_MsiEnumClientsA]
add esp, 0xc
mov dword [ebp - 0x10], ebx
push eax
push edi
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x48cc84
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48cc84
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne byte [ebp + 0xb]
cmp dword [ebp - 0x10], ebx
je 0x48cbe2
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp byte [ebp + 0xb], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
mov dword [ebp - 0x10], ebx
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x48cc76
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov esi, eax
je 0x48cc1d
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x48cc84
cmp byte [ebp + 0xb], 0
mov eax, dword [ebp + 0xc]
cmovne eax, dword [ebp + 0x10]
push dword [eax]
push 1
push esi
mov esi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call esi
test eax, eax
jne 0x48cc76
cmp byte [ebp + 0xb], al
mov eax, dword [ebp + 0x10]
cmovne eax, dword [ebp + 0xc]
push dword [eax]
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x48cc76
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48cc76
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48cc76
mov bl, 1
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x48cc84
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x10], 0
je 0x48cc93
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00406dd3
cmp dword [ebp - 0x18], 0
je 0x48ccae
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov al, bl
call fcn.004d0cbc
ret 0xc