joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4762d0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], ecx
push eax
push 0x476300
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x4775f0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x5150df
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x580558]
test eax, eax
jne 0x47772e
push 0x10
call fcn.004da6a7
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x2b4
push 0
push eax
call fcn.004de4e0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp]
add esp, 0x10
push 0x4011
push 0x2b4
push eax
push 0x10
push 0x540384
call edi
push 0x4011
push 0x2b4
mov dword [esi], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
push 0x4013
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4776fd
push 0x4009
push 0x2b4
lea eax, [ebp]
push eax
push 0
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x477704
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x477704
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x580558]
mov dword [0x580558], esi
test eax, eax
je 0x47772c
push 0x10
push eax
call fcn.004dadb5
mov eax, dword [0x580558]
add esp, 8
jmp 0x47772e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0x2b8]
pop ebp
ret
Function at 0x477750
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515120
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x4777ac
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d637
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004e345c
mov edx, eax
add esp, 8
test edx, edx
js 0x477875
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x477875
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004de4e0
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x477852
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x477871
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da696
mov esp, ebp
pop ebp
ret 4
call esi
jmp 0x477852
push 0x80070057
call fcn.0040d795
int3
Function at 0x479d00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515638
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57d074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040d266
mov ecx, eax
test ecx, ecx
je 0x479e4c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x534850
jne 0x479e56
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00479e70
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x479d77
xor bl, bl
jmp 0x479df3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x479dee
cmp dword [edi + 0xc], 0
jl 0x479de3
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x479de3
call fcn.00406f9b
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x479dd9
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x534850
jne 0x479e5d
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479dee
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479dee
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d7d9
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x479e38
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x534850
jne 0x479e66
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040d795
call edx
jmp 0x479d52
mov ecx, edx
call eax
jmp 0x479dd9
call edx
jmp 0x479e38
Function at 0x479e70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x57d074]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
lea eax, [esp + 0x214]
mov ebx, edx
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x479eba
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004da696
add esp, 0x418
ret
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x479ea1
push ebp
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004e07a4
mov esi, dword [ebx]
mov edi, eax
add esp, 4
test edi, edi
jne 0x479f73
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], eax
je 0x47a01d
cmp dword [ecx + 0xc], eax
lea edx, [ecx + 0xc]
jge 0x479f1e
cmp dword [esi - 8], eax
jl 0x47a038
mov dword [esi - 0xc], eax
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x47a01d
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x479f4b
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x47a042
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x534850
jne 0x47a04b
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [ebx], eax
jmp 0x47a01d
add eax, 0x10
mov dword [ebx], eax
jmp 0x47a01d
mov eax, dword [esi - 0xc]
lea ebp, [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], eax
sar ebp, 1
test edi, edi
js 0x47a055
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x479fa5
push edi
mov ecx, ebx
call fcn.0040d637
mov esi, dword [ebx]
lea ecx, [edi + edi]
cmp ebp, dword [esp + 0x10]
ja 0x479ff3
mov eax, dword [esi - 8]
lea edx, [esi + ebp*2]
test ecx, ecx
je 0x47a00b
test edx, edx
jne 0x479fce
call fcn.004e08d4
mov dword [eax], 0x16
call fcn.004e0744
jmp 0x47a008
add eax, eax
cmp eax, ecx
jae 0x479fe6
call fcn.004e08d4
mov dword [eax], 0x22
call fcn.004e0744
jmp 0x47a008
push ecx
push edx
push esi
call fcn.004dc330
add esp, 0xc
jmp 0x47a008
mov edx, dword [esi - 8]
lea eax, [esp + 0x14]
push ecx
push eax
add edx, edx
mov ecx, esi
call fcn.0040d710
add esp, 8
lea ecx, [edi + edi]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x47a038
mov dword [eax - 0xc], edi
xor edx, edx
mov eax, dword [ebx]
mov word [ecx + eax], dx
mov ecx, dword [esp + 0x424]
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.004da696
add esp, 0x418
ret
push 0x80070057
call fcn.0040d795
mov ecx, edx
call esi
jmp 0x479f4b
mov ecx, edi
call dword [eax + 0xc]
jmp 0x479f69
push 0x80070057
call fcn.0040d795
int3
Function at 0x47b1b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5158c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57d074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], 0x533e78
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x47b212
or esi, eax
xor bl, bl
jmp 0x47b228
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x47b224
xor bl, bl
jmp 0x47b228
mov dword [edi], eax
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x533e78
test esi, esi
je 0x47b248
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47b260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515780
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x57d074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.0047b310
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47b2ef
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x534850
jne 0x47b302
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call eax
jmp 0x47b2ef
Function at 0x47bc20
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x47bccf
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x47bc6c
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x47bc74
cmp dword [eax - 8], 0
jl 0x47bd2e
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x47bca1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x534850
jne 0x47bd38
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x534850
jne 0x47bd41
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
js 0x47bd4b
mov edx, dword [esi]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x47bcee
push edi
mov ecx, esi
call fcn.0040d637
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x47bd01
xor ecx, ecx
jmp 0x47bd13
push dword [eax - 8]
push eax
call fcn.004e345c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x47bd2e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x47bd2e
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
lea eax, [edx + 1]
ret 4
push 0x80070057
call fcn.0040d795
mov ecx, edx
call ebx
jmp 0x47bca1
mov ecx, edi
call dword [eax + 0xc]
jmp 0x47bcc2
push 0x80070057
call fcn.0040d795
int3
Function at 0x486f30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508218
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x487030
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x5361b8
jne 0x48704c
jmp 0x487030
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.00452686
cmp dword [ebp - 0x14], 8
lea eax, [esi + 1]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
cmp eax, 0x5361b8
jne 0x4870c3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x48701c
mov ecx, dword [ebp - 0x28]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x7fffffff
ja 0x4870d2
add edx, edx
cmp edx, 0x1000
jb 0x487012
lea esi, [edx + 0x23]
cmp esi, edx
jbe 0x4870d2
mov edx, esi
test al, 0x1f
jne 0x4870d2
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x4870d2
sub eax, ecx
cmp eax, 4
jb 0x4870d2
cmp eax, 0x23
ja 0x4870d2
push edx
push ecx
call fcn.004dadb5
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da696
mov esp, ebp
pop ebp
ret
call edx
test al, al
je 0x487030
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
push 0x1f6
push dword [edi + 0x24]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x486fa1
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
ja 0x486f7d
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmovae ecx, dword [ebp - 0x28]
xor eax, eax
mov word [ecx + esi*2], ax
jmp 0x486f8a
push dword [edi + 0x24]
lea edx, [ebp - 0x28]
push edx
call dword [eax + 8]
jmp 0x486fb1
call fcn.004e0754
int3
Function at 0x4899c2
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x516bd4
call fcn.004db273
mov bl, dl
mov edi, ecx
cmp byte [0x5805ec], 0
je 0x489a1f
lea ecx, [ebp - 0x10]
call fcn.0040cd94
and dword [ebp - 4], 0
mov esi, dword [edi]
test esi, esi
je 0x4899fe
push esi
call fcn.004e07a4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00410e44
lea eax, [ebp - 0x10]
mov ecx, 0x5805b8
push eax
call fcn.004a24eb
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
cmp byte [0x57db1c], 0
push dword [edi]
je 0x489a7c
lea ecx, [ebp - 0x10]
call fcn.0040d859
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.0040cd94
movzx ecx, bl
shl ecx, 0x12
add ecx, 0x10
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00476280
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d05a
jmp 0x489a82
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004db23c
ret
Function at 0x48bafc
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x517127
call fcn.004db273
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], ebx
je 0x48bb20
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x18], ebx
push dword [eax]
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48bc90
lea ecx, [ebp - 0x1c]
call fcn.0040cd94
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x1c]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.00411637
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0
je 0x48bb70
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.msi.dll_MsiEnumClientsA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48bc75
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48bc75
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], eax
je 0x48bbb0
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne bl
cmp dword [ebp - 0x10], 0
mov byte [ebp + 0xb], bl
je 0x48bbd6
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
test bl, bl
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48bc64
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov edi, eax
je 0x48bc0c
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
test edi, edi
je 0x48bc64
mov eax, dword [ebp + 0xc]
test bl, bl
mov ebx, dword [ebp + 0x10]
cmovne eax, ebx
push dword [eax]
push 1
push edi
mov edi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call edi
test eax, eax
jne 0x48bc64
cmp byte [ebp + 0xb], al
cmovne ebx, dword [ebp + 0xc]
push dword [ebx]
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x48bc64
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48bc64
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48bc64
mov bl, 1
jmp 0x48bc66
xor bl, bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x48bc75
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48bc84
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x48bc9f
push dword [ebp - 0x18]
call esi
mov al, bl
call fcn.004db23c
ret 0xc
Function at 0x48c48c
Capabilities:
Reference sql statements

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x10
mov eax, 0x517303
call fcn.004db273
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x20c]
push dword [ebx + 4]
call fcn.004dadb0
and dword [ebx + 4], 0
lea eax, [ebp]
and dword [ebx], 0
push esi
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x14], 0
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
je 0x48c4f6
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x1c]
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp]
call fcn.0048c6ea
pop ecx
test eax, eax
jns 0x48c514
xor bl, bl
jmp 0x48c5bf
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48c527
push dword [ebp - 0x10]
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
je 0x48c562
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x48c55d
cmp esi, 0x80070103
je 0x48c55d
call fcn.0048c7c5
mov eax, dword [ebp - 0x10]
jmp 0x48c567
mov esi, 0x80070057
test esi, esi
jns 0x48c56f
xor bl, bl
jmp 0x48c5b0
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
push ecx
push 0x534080
push 1
push eax
call esi
cmp eax, 0xea
jne 0x48c5ab
mov eax, dword [ebp - 0x18]
mov ecx, ebx
inc eax
push eax
mov dword [ebp - 0x18], eax
call fcn.004847e0
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x48c5bf
push dword [ebp - 0x10]
call edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x48c5ce
push dword [ebp - 0x14]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0x204]
pop ebp
ret
Function at 0x48caae
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x517381
call fcn.004db273
lea eax, [ebp - 0x1c]
push eax
movzx eax, byte [ebp + 0xc]
shl eax, 8
inc eax
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x14
pop edi
push edi
mov esi, eax
mov dword [ebp - 0x18], 1
call fcn.004dadc3
or dword [ebp - 0x34], 0xffffffff
mov ebx, eax
mov dword [ebp - 0x30], ebx
and dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], edi
call fcn.004dadc3
or dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
push eax
mov dword [ebp + 0xc], edi
call fcn.004dadb0
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
push edi
call fcn.004dadc3
or dword [ebp - 0x2c], 0xffffffff
mov edi, eax
xor eax, eax
mov dword [ebp - 0x28], edi
add esp, 0x10
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x48cbf2
mov esi, str.AI_InstallLanguage
lea ecx, [ebp + 0xc]
push ecx
push edi
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x24], eax
cmp eax, 0xea
jne 0x48cbba
push ebx
call fcn.004dadb0
push dword [ebp - 0x10]
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
call fcn.004dadc3
or dword [ebp - 0x34], 0xffffffff
mov ebx, eax
push edi
mov dword [ebp - 0x30], ebx
call fcn.004dadb0
push dword [ebp + 0xc]
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
call fcn.004dadc3
or dword [ebp - 0x2c], 0xffffffff
add esp, 0x10
mov edi, eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], edi
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
lea eax, [esi - 1]
sub ecx, str.AI_InstallLanguage
mov dword [ebp - 0x20], ecx
inc eax
mov cl, byte [ecx + eax]
mov dl, byte [eax]
cmp cl, dl
jl 0x48cbe1
jg 0x48cbe1
test cl, cl
je 0x48cc27
test dl, dl
je 0x48cc27
mov ecx, dword [ebp - 0x20]
jmp 0x48cbc8
mov eax, dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x14], eax
je 0x48cb39
xor esi, esi
push edi
mov byte [ebp - 4], 4
call fcn.004dadb0
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
push ebx
mov dword [ebp - 4], 5
call fcn.004dadb0
or dword [ebp - 4], 0xffffffff
mov eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
call fcn.004db23c
ret
or dword [ebp - 0x24], 0xffffffff
lea edx, [ebp - 0x24]
push ecx
mov ecx, edi
call fcn.004849d0
pop ecx
mov esi, eax
jmp 0x48cbf4