joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102401a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1009394
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x1024053
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x10240cd
cmp dword [ebp - 4], edi
jne 0x1024065
mov esi, 0x80004005
jmp 0x10240dc
push ebx
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x1009370
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jle 0x102408c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x10240cc
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 8]
add eax, 2
push eax
call fcn.01023c1d
mov esi, eax
test esi, esi
jl 0x10240cc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0
push 0
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jle 0x10240ca
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop ebx
cmp dword [ebp - 4], 0
je 0x10240dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x10240e9
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x102410e
mov dword [ebp + 0xc], 0x80070057
jmp 0x102419d
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jne 0x102411f
mov dword [ebp + 0xc], 0x80070057
jmp 0x102419c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [esi], ebx
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.010277da
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x102419c
push 1
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.01023ce5
test eax, eax
jl 0x102419c
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.010277ce
test eax, eax
je 0x1024193
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1008cec
push dword [ebp - 4]
call fcn.010277c2
test eax, eax
je 0x1024193
cmp dword [ebp + 0x10], 0x34
jne 0x1024193
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp + 0xc], ebx
lea eax, [ebp - 4]
push eax
call fcn.01023d2d
pop esi
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
leave
ret 0xc
Function at 0x1024b22
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x1029343
call fcn.01022df8
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov edi, ecx
jne 0x1024b42
mov ebx, 0x80070057
jmp 0x1024c27
mov eax, dword [edi + 0x20]
xor ebx, ebx
test eax, eax
jne 0x1024c1f
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0xc]
push eax
push esi
mov ecx, edi
call fcn.0102449c
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x10]
push eax
mov ecx, edi
call fcn.01023ded
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x28]
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, edi
call fcn.010232ca
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x30]
push eax
mov ecx, edi
call fcn.01023399
mov ebx, eax
test ebx, ebx
jl 0x1024c27
call dword [0x10011ac]
mov dword [esi + 0x34], eax
call dword [0x10011a8]
movzx eax, ax
mov dword [esi + 0x38], eax
lea eax, [esi + 0x44]
push eax
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.01024adc
mov ebx, eax
test ebx, ebx
jl 0x1024c27
push 0x48
call sub.MFC42u.DLL_operatornew
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1024c07
push esi
mov ecx, eax
call fcn.010242e8
jmp 0x1024c09
xor eax, eax
test eax, eax
mov dword [edi + 0x20], eax
jne 0x1024c27
push 8
mov ebx, 0x8007000e
call dword [0x100112c]
jmp 0x1024c27
push eax
mov ecx, esi
call fcn.01024311
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1024ef4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1001808
push 0x80000001
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x1024fa7
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1024f48
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x1024fa7
cmp dword [ebp - 0xc], ebx
jne 0x1024f5d
mov dword [ebp - 8], 0x80004005
jmp 0x1024fb8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x10098a8
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x1024fa7
cmp eax, ebx
jle 0x1024f8c
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x1024fa7
mov eax, dword [ebp - 0x14]
sub eax, 4
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x1024fa7
mov byte [ebp - 1], bl
cmp dword [ebp - 0xc], ebx
je 0x1024fb8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0100d194
mov al, byte [ebp - 1]
cmp al, bl
mov byte [esi + 0x3a], al
jne 0x1024fd5
cmp dword [ebp - 0x18], ebx
setne al
mov byte [esi + 0x39], al
mov ecx, esi
call fcn.0100d1aa
xor eax, eax
cmp dword [ebp - 8], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x102526c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0100d194
mov al, byte [esi + 0x39]
mov ecx, esi
mov byte [ebp - 1], al
call fcn.0100d1aa
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x20006
push ebx
push 0x1009910
push ebx
push 0x1001808
push 0x80000001
call dword [entry0]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x10252ca
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x102530c
cmp dword [ebp - 0xc], ebx
jne 0x10252df
mov dword [ebp - 8], 0x80004005
jmp 0x1025336
xor eax, eax
cmp byte [ebp - 1], bl
push 4
setne al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push 0x10098a8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jle 0x1025309
and eax, edi
or eax, esi
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], ebx
je 0x102531d
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 8], ebx
jl 0x1025336
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.0100d194
mov ecx, esi
mov byte [esi + 0x3a], bl
call fcn.0100d1aa
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1025343
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x10293a9
call fcn.01022df8
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call sub.MFC42u.DLL_CString::CString_2
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0100d194
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x18], eax
mov al, byte [esi + 0x38]
mov byte [ebp - 0xd], al
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::operator
lea eax, [esi + 0x24]
push eax
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::operator
mov ecx, esi
call fcn.0100d1aa
cmp dword [ebp - 0x18], ebx
jne 0x10253f4
push ebx
lea eax, [ebp - 0x18]
push eax
push 1
push 0x1009930
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
cmp eax, ebx
jne 0x10253ea
mov esi, dword [fcn.010010e4]
call esi
test eax, eax
jg 0x10253d8
call esi
mov esi, eax
jmp 0x10253ec
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10253ec
xor esi, esi
cmp esi, ebx
jl 0x10254f0
mov eax, dword [ebp - 0x18]
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x20006
push ebx
push 0x1009910
push ebx
push 0x1001808
push 0x80000002
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0xc
call dword [entry0]
cmp eax, ebx
jle 0x1025437
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254f0
cmp dword [ebp - 0x14], ebx
jne 0x1025450
mov esi, 0x80004005
jmp 0x1025501
cmp byte [ebp - 0xd], bl
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x102548b
mov eax, dword [ebp - 0x28]
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
push 0x10098ec
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x1025483
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254ef
jmp 0x1025499
push 0x10098ec
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx - 8]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10098dc
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x10254c0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254ef
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 8]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10098c0
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x10254ed
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
cmp dword [ebp - 0x14], ebx
je 0x1025501
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10265bd
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
push 0x102f7f4
mov dword [ebx], 0x100a33c
call dword [0x10011b0]
call fcn.01010b3d
mov dword [ebx + 4], eax
xor esi, esi
mov dword [ebx + 8], esi
xor eax, eax
lea edi, [ebx + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [0x102f7e8], esi
mov dword [0x102f7f0], esi
jne 0x1026610
push esi
push 1
push 1
push esi
call dword [fcn.010010a0]
mov dword [0x102f7e8], eax
cmp dword [0x102f7ec], esi
jne 0x10266a1
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0x100a2d8
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
mov edi, 0x100a278
push edi
push esi
je 0x1026652
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0xc
push eax
jmp 0x1026653
push esi
call dword [0x10010c8]
cmp dword [ebp - 4], esi
mov dword [0x102f7ec], eax
je 0x102666c
push dword [ebp - 4]
call dword [fcn.010010ec]
cmp dword [0x102f7ec], esi
jne 0x10266a1
call dword [fcn.010010e4]
cmp eax, 5
jne 0x102668e
push edi
push esi
push 0x100000
call dword [0x1001118]
jmp 0x102669c
cmp eax, 6
jne 0x10266a1
push esi
push esi
push esi
call dword [0x10010c8]
mov dword [0x102f7ec], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1026c98
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 8
mov dword [ebp - 8], ebx
call sub.MFC42u.DLL_operatornew
cmp eax, ebx
pop ecx
je 0x1026cc3
mov cl, byte [ebp + 8]
mov byte [eax], cl
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov dword [ebp + 8], eax
jmp 0x1026cc6
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
je 0x1026d73
call fcn.01010b3d
mov esi, eax
call fcn.01010ac9
mov ecx, esi
mov edi, eax
call fcn.0102641e
test al, al
je 0x1026cff
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, esi
call fcn.010257ea
mov ecx, edi
call fcn.010235eb
jmp 0x1026d73
mov eax, dword [0x102f7e8]
cmp eax, ebx
je 0x1026d13
push eax
call dword [0x10010a8]
test eax, eax
je 0x1026d73
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x1026bb9
push ebx
push ebx
call dword [0x1001168]
cmp byte [ebp + 0x10], bl
mov edi, eax
jne 0x1026d73
push dword [ebp + 0x14]
mov esi, dword [fcn.010010c4]
push edi
call esi
test eax, eax
jne 0x1026d4f
lea eax, [ebp - 8]
push eax
push edi
call dword [0x1001164]
jmp 0x1026d73
push 0x7d0
call fcn.01026405
push ebx
push edi
call esi
test eax, eax
je 0x1026d73
cmp dword [ebp - 4], ebx
je 0x1026d73
push ebx
push ebx
push 0x12
push dword [ebp - 4]
call dword [0x1001524]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1026e76
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102e77c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x11c
push edi
xor esi, esi
lea eax, [ebp - 0x120]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], edi
mov edi, dword [0x10011bc]
push eax
call edi
test eax, eax
jne 0x1026ed1
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call edi
mov eax, dword [ebp - 0x110]
dec eax
je 0x1026f09
dec eax
jne 0x1026f2f
cmp dword [ebp - 0x11c], 5
jne 0x1026ef7
push 2
pop eax
cmp eax, dword [ebp - 0x118]
sbb esi, esi
and esi, 3
inc esi
jmp 0x1026f2f
push 4
pop eax
cmp eax, dword [ebp - 0x11c]
sbb esi, esi
neg esi
add esi, 3
jmp 0x1026f2f
cmp dword [ebp - 0x11c], 4
jne 0x1026f2f
cmp dword [ebp - 0x118], esi
je 0x1026f2c
cmp dword [ebp - 0x118], 0xa
je 0x1026f2c
cmp dword [ebp - 0x118], 0x5a
jne 0x1026f2f
push 2
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0102222e
leave
ret

Function at 0x1026f44
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102e77c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x102f800], si
jne 0x1026fdc
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x100af10
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1026fdc
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x100afc8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1026fdc
push 3
push dword [esi*8 + 0x100ae30]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x1026fce
inc esi
cmp esi, 0x1c
jl 0x1026fad
jmp 0x1026fdc
mov ax, word [esi*8 + 0x100ae34]
mov word [0x102f800], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x102f800]
xor ecx, ebp
pop esi
call fcn.0102222e
leave
ret
Function at 0x40b3d0
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x6fc03b3], cl
mov ecx, ebx
dec ecx
dec edi
mov esi, edi
dec edi
mov al, byte [esi]
dec esi
mov ah, byte [esi]
dec esi
xor al, ah
mov byte [edi], al
dec edi
loop 0x40b3e0
add ebx, dword [0x404168]
mov dword [0x40416c], ebx
mov ebx, dword [0x404168]
inc ebx
cmp byte [ebx], 0
jne 0x40b3fc
inc ebx
mov dword [0x404178], ebx
jmp 0x40b40c
inc ebx
cmp byte [ebx], 0
jne 0x40b40b
inc ebx
mov dword [0x404170], ebx
jmp 0x40b41b
inc ebx
cmp byte [ebx], 0
jne 0x40b41a
inc ebx
mov dword [0x404174], ebx
jmp 0x40b42a
inc ebx
cmp byte [ebx], 0
jne 0x40b429
inc ebx
mov dword [0x40417c], ebx
jmp 0x40b439
inc ebx
cmp byte [ebx], 0
jne 0x40b438
inc ebx
push dword [ebx]
pop dword [0x404180]
push dword [ebx + 4]
pop dword [0x404184]
push dword [ebx + 8]
pop dword [0x404188]
push dword [ebx + 0xc]
pop dword [0x40418c]
add ebx, 0x10
mov dword [0x404190], ebx
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a1b
Capabilities:
Copy file
Delete file
Move file
Query or enumerate registry value

Disassembly:
mov eax, 0x460cb6
call fcn.004571ec
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0xd]
mov ebx, 0x104
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x58], 0x469494
mov dword [ebp - 0x38], 0x46948c
call fcn.00404ab9
mov eax, dword [esi + 0x28]
mov byte [ebp - 4], 4
cmp eax, edi
je 0x403a73
push dword [esi + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 1
push edi
call fcn.004054cd
push eax
push dword [esi + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403b1d
lea eax, [ebp - 0x30]
push ebx
push eax
lea ecx, [ebp - 0x58]
call fcn.00405cca
mov ebx, eax
mov ecx, dword [ebx]
mov byte [ebp - 4], 5
call fcn.00405599
lea ecx, [ebp - 0x18]
mov dword [ebx + 8], eax
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push str.LogFile
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x30]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 4
inc bl
call fcn.00404c0f
test bl, bl
je 0x403b1d
lea ebx, [esi + 0x38]
mov ecx, ebx
call fcn.00405599
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
call fcn.00405599
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x403b1d
mov ecx, ebx
call fcn.00405599
push edi
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.00405599
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ebx, [esi + 0x38]
mov ecx, ebx
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004060f2
cmp dword [ebp - 0x14], edi
je 0x403b4b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004060f2
mov eax, dword [esi + 0x28]
and byte [ebp - 4], 0
cmp eax, edi
je 0x403b67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004060f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403a29
Capabilities:
Copy file
Delete file
Move file
Query or enumerate registry value

Disassembly:
mov eax, 0x460cb6
call fcn.004571ec
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0xd]
mov ebx, 0x104
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x58], 0x469494
mov dword [ebp - 0x38], 0x46948c
call fcn.00404ab9
mov eax, dword [esi + 0x28]
mov byte [ebp - 4], 4
cmp eax, edi
je 0x403a73
push dword [esi + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 1
push edi
call fcn.004054cd
push eax
push dword [esi + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403b1d
lea eax, [ebp - 0x30]
push ebx
push eax
lea ecx, [ebp - 0x58]
call fcn.00405cca
mov ebx, eax
mov ecx, dword [ebx]
mov byte [ebp - 4], 5
call fcn.00405599
lea ecx, [ebp - 0x18]
mov dword [ebx + 8], eax
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push str.LogFile
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x30]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 4
inc bl
call fcn.00404c0f
test bl, bl
je 0x403b1d
lea ebx, [esi + 0x38]
mov ecx, ebx
call fcn.00405599
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
call fcn.00405599
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x403b1d
mov ecx, ebx
call fcn.00405599
push edi
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.00405599
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ebx, [esi + 0x38]
mov ecx, ebx
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004060f2
cmp dword [ebp - 0x14], edi
je 0x403b4b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004060f2
mov eax, dword [esi + 0x28]
and byte [ebp - 4], 0
cmp eax, edi
je 0x403b67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004060f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404225
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push edi
lea eax, [ebp - 0x404]
xor edi, edi
push 0x485ac0
push eax
mov dword [ebp - 0x408], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x408]
mov dword [ebp - 4], edi
push str.SELECT_FileSize_FROM_File_WHERE_File___s
push dword [ebp + 8]
push eax
call fcn.0040157a
add esp, 0x10
test eax, eax
jne 0x4042cb
cmp dword [ebp - 4], edi
je 0x404277
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push dword [ebp - 0x408]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x4042cb
push esi
push 1
push dword [ebp - 4]
call sub.msi.dll_MsiRecordReadStream
mov esi, eax
sub esi, 0x80000000
neg esi
sbb esi, esi
and esi, eax
cmp dword [ebp - 4], edi
je 0x4042b3
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x408], edi
je 0x4042c6
push dword [ebp - 0x408]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, esi
pop esi
jmp 0x4042ed
cmp dword [ebp - 4], edi
je 0x4042d8
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x408], edi
je 0x4042eb
push dword [ebp - 0x408]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor eax, eax
pop edi
leave
ret 8

Function at 0x404f76
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x460f33
call fcn.004571ec
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov byte [esi + 0xc], al
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov al, byte [ebp - 0xd]
mov dword [ebp - 4], ebx
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov al, byte [ebp - 0xd]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x2c], al
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x3c]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call fcn.004053c0
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x4c]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call fcn.004053c0
lea ecx, [esi + 0x70]
lea eax, [ebp - 0xd]
push ebx
mov byte [esi + 0x5c], bl
mov byte [esi + 0x5d], 1
push eax
mov byte [ebp - 4], 4
mov dword [ecx], 0x469494
mov dword [ecx + 0x20], 0x46948c
call fcn.00404ab9
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x469514
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret