joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100074d4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push str.CustomActionData
push dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.10003a20
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
cmp eax, esi
jne 0x1000750a
push dword [ebp - 0x14]
call fcn.10002adf
pop ecx
jmp 0x100075ab
push edi
mov edi, dword [ebp - 0x14]
cmp eax, 2
jne 0x1000751d
push 0x3a
pop eax
push 3
mov word [edi + 2], ax
pop eax
cmp eax, 3
jne 0x10007529
push 0x5c
pop eax
mov word [edi + 4], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x10007559
push edi
call fcn.10002adf
pop ecx
jmp 0x100075aa
push ebx
mov ebx, dword [ebp - 4]
imul ebx, dword [ebp - 8]
shr ebx, 0xa
imul ebx, dword [ebp - 0xc]
push 0xb
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
pop edi
lea esi, [ebp - 0x20]
shr ebx, 0xa
call fcn.100021c4
push dword [ebp - 0x1c]
mov edi, ebx
call fcn.10002481
pop ecx
push dword [ebp - 0x1c]
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push dword [ebp - 0x1c]
call fcn.10002adf
push dword [ebp - 0x14]
call fcn.10002adf
pop ecx
pop ecx
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret 4
Function at 0x10007be2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xa30]
push eax
push str.AI_OFFICE_REG
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x208
call sub.msi.dll_MsiGetSummaryInformationW
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x20019
push esi
lea eax, [ebp - 0xa30]
push eax
push 0x80000001
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007cca
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
jmp 0x10007c8e
push str.OPEN
lea eax, [ebp - 0x230]
call fcn.10002b85
pop ecx
test al, al
je 0x10007c72
inc dword [ebp - 8]
inc dword [ebp - 0xc]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 4]
call edi
test eax, eax
je 0x10007c5a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
cmp edi, esi
jne 0x10007cae
push 0x1000e704
jmp 0x10007cbc
lea eax, [ebp - 0x28]
push eax
call fcn.10002481
pop ecx
lea eax, [ebp - 0x28]
push eax
push str.AI_ADDIN
push dword [ebp + 8]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
pop edi
xor eax, eax
pop esi
leave
ret 4
Function at 0x10007cd1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareCaphyonAdvanced_InstallerInstallation_Path
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007e87
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0xc], edi
je 0x10007e87
push ebx
push esi
push edi
lea eax, [ebp - 0x4c]
push 0x32
push eax
call fcn.10002af1
push edi
mov ebx, 0x208
lea eax, [ebp - 0x288]
push ebx
push eax
call fcn.10002af1
push str.0.0.0.0
lea eax, [ebp - 0x4c]
call fcn.10002c93
add esp, 0x1c
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
jbe 0x10007e1f
push edi
lea eax, [ebp - 0x80]
push 0x32
push eax
call fcn.10002af1
push edi
xor esi, esi
lea eax, [ebp - 0x490]
push ebx
inc esi
push eax
mov dword [ebp - 0x18], 0x19
mov dword [ebp - 0x10], esi
call fcn.10002af1
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10007e10
cmp dword [ebp - 0x10], esi
jne 0x10007e10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jle 0x10007e10
lea ecx, [ebp - 0x4c]
call fcn.100013d5
lea esi, [ebp - 0x4c]
call fcn.10002ce7
lea eax, [ebp - 0x80]
push eax
mov eax, esi
call fcn.10002c93
lea ecx, [ebp - 0x288]
call fcn.100013d5
lea esi, [ebp - 0x288]
call fcn.10002ce7
lea eax, [ebp - 0x490]
push eax
mov eax, esi
call fcn.10002c93
pop ecx
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x10007d5f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], edi
je 0x10007e2f
push dword [ebp - 4]
call esi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareCaphyonAdvanced_Installer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10007e85
lea ecx, [ebp - 0x288]
call fcn.100013d5
cmp eax, edi
jbe 0x10007e7b
add eax, eax
push eax
lea eax, [ebp - 0x288]
push eax
push 1
push edi
push str.Advanced_Installer_Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], edi
je 0x10007e85
push dword [ebp - 4]
call esi
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 4
Function at 0x10008250
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0x20019
cmp byte [ebp + 0x10], bl
je 0x1000826e
mov eax, 0x20119
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000828d
xor eax, eax
jmp 0x1000833a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp + 0x10], 0x104
mov dword [ebp - 0xc], ebx
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20]
call fcn.10003257
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
call fcn.1000322c
test eax, eax
jl 0x10008324
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x10008339
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x10], 0x104
push dword [ebp - 4]
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20]
call fcn.10003257
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
call fcn.1000322c
test eax, eax
jge 0x1000832b
cmp dword [ebp - 8], ebx
je 0x100082e2
jmp 0x1000832e
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x10009497
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
and dword [esp + 8], 0
push ebx
push dword [ebp + 8]
lea ebx, [esp + 0x10]
mov eax, str.SELECT__Argument____Condition__FROM__ControlEvent__WHERE__Dialog____ExitDialog_AND__Control____Finish_AND__Event___DoAction_ORDER_BY__Ordering_
call fcn.10003d2e
pop ecx
test eax, eax
jge 0x100094c6
cmp dword [esp + 0xc], 0
jmp 0x100095ab
xor ebx, ebx
mov dword [esp + 8], ebx
cmp dword [esp + 8], ebx
je 0x100094db
push dword [esp + 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [esp + 8]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x10], ebx
call fcn.10003e6d
pop ecx
pop ecx
test eax, eax
jl 0x10009598
push 2
push dword [esp + 0xc]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.1000418f
pop ecx
pop ecx
push dword [esp + 0x1c]
push dword [ebp + 8]
call sub.msi.dll_MsiGetComponentStateW
cmp eax, 1
je 0x1000952a
mov byte [esp + 7], bl
cmp eax, 2
jne 0x1000952f
mov byte [esp + 7], 1
push 1
push dword [esp + 0xc]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1000418f
pop ecx
pop ecx
cmp byte [esp + 7], bl
je 0x1000956f
mov edx, dword [esp + 0x14]
push ebx
push 0x100115dc
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x1000956f
push dword [esp + 0x14]
push dword [ebp + 8]
call sub.msi.dll_MsiEnumComponentQualifiersA
push dword [esp + 0x14]
call fcn.10002adf
push dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.10002adf
pop ecx
pop ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
jmp 0x100094cc
cmp dword [esp + 8], ebx
je 0x100095a7
push dword [esp + 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [esp + 0xc], ebx
je 0x100095b6
push dword [esp + 0xc]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100095bf
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
and dword [esp + 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
lea ebx, [esp + 0x18]
mov eax, str.SELECT__Argument____Condition__FROM__ControlEvent__WHERE__Dialog____ExitDialog_AND__Control____Finish_AND__Event___DoAction_ORDER_BY__Ordering_
call fcn.10003d2e
pop ecx
test eax, eax
jge 0x100095f1
cmp dword [esp + 0x14], 0
jmp 0x1000979b
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0xf], bl
mov byte [esp + 0xe], bl
cmp dword [esp + 0x10], ebx
je 0x1000960e
push dword [esp + 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.10003e6d
pop ecx
pop ecx
test eax, eax
jl 0x100096f5
push 2
push dword [esp + 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.1000418f
pop ecx
pop ecx
push dword [esp + 0x1c]
push edi
call sub.msi.dll_MsiGetComponentStateW
cmp eax, 1
je 0x1000965b
mov byte [esp + 0xd], bl
cmp eax, 2
jne 0x10009660
mov byte [esp + 0xd], 1
push 1
push dword [esp + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.1000418f
mov esi, dword [esp + 0x2c]
pop ecx
pop ecx
cmp byte [esp + 0xd], bl
je 0x100096cf
push ebx
push 0x100115dc
mov edx, esi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x100096cf
push ebx
push str.AI_ViewReadme
mov edx, esi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x100096b0
mov byte [esp + 0xf], 1
jmp 0x100096c8
push ebx
push str.AI_LaunchApp
mov edx, esi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x100096c8
mov byte [esp + 0xe], 1
push esi
push edi
call sub.msi.dll_MsiEnumComponentQualifiersA
push esi
call fcn.10002adf
push dword [esp + 0x20]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call fcn.10002adf
pop ecx
pop ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
jmp 0x100095ff
push str.CTRLS
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.10003a20
mov edi, dword [esp + 0x2c]
pop ecx
pop ecx
mov esi, 0x10011628
cmp byte [esp + 0xe], bl
jne 0x1000974c
push ebx
push esi
mov edx, edi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
jne 0x1000973f
push ebx
push 0x1000fafc
mov edx, edi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x1000974c
push str.AI_LaunchApp
push dword [ebp + 8]
call sub.msi.dll_MsiEnumComponentQualifiersA
cmp byte [esp + 0xf], bl
jne 0x10009781
push ebx
push esi
mov edx, edi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
jne 0x10009774
push ebx
push 0x1000fabc
mov edx, edi
call fcn.10002bfa
pop ecx
pop ecx
test al, al
je 0x10009781
push str.AI_ViewReadme
push dword [ebp + 8]
call sub.msi.dll_MsiEnumComponentQualifiersA
push edi
call fcn.10002adf
pop ecx
cmp dword [esp + 0x10], ebx
je 0x10009797
push dword [esp + 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [esp + 0x14], ebx
je 0x100097a6
push dword [esp + 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10009cd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftInetStp
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009dc5
push esi
push ebx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.10002af1
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.PathWWWRoot
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x10009dc4
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10002af1
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x218]
call fcn.10002c82
cmp eax, ebx
je 0x10009db0
add eax, eax
cmp word [ebp + eax - 0x21a], 0x5c
je 0x10009db0
push 0x5c
pop ecx
mov word [ebp + eax - 0x218], cx
xor ecx, ecx
mov word [ebp + eax - 0x216], cx
lea eax, [ebp - 0x218]
push eax
push str.IIsWWWRootFolder
push dword [ebp + 8]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
pop esi
pop ebx
leave
ret
Function at 0x10009ebe
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, str.AI_PATH_VALIDATION_FAILED
push edi
push dword [ebp + 8]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push str.AI_PATH_VALIDATION_OPT
push dword [ebp + 8]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.10003a20
pop ecx
pop ecx
cmp dword [esp + 0x28], ebx
je 0x1000a0ba
mov esi, dword [esp + 0x2c]
or dword [esp + 0x10], 0xffffffff
push 0xa
lea eax, [esp + 0x14]
call fcn.10003186
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x1000a0ba
mov esi, dword [ebp + 8]
push str.APPDIR
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.10003a20
pop ecx
pop ecx
cmp dword [esp + 0x20], ebx
je 0x1000a0b0
test byte [esp + 0x10], 1
je 0x10009f70
push dword [esp + 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10009f70
push ebx
push str.4160
push esi
call fcn.10009e4f
add esp, 0xc
jmp 0x1000a0b0
test byte [esp + 0x10], 2
je 0x10009ffd
push dword [esp + 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10009ffd
push 1
push str.4161
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.10003c35
add esp, 0xc
push ebx
push 0x100105e8
push esi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.10003c35
add esp, 0xc
push 0x34
push dword [esp + 0x20]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x10009fef
push dword [esp + 0x1c]
call fcn.10002adf
pop ecx
push dword [esp + 0x14]
jmp 0x1000a0aa
push 0x1000fabc
push edi
push esi
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
jmp 0x10009fdc
mov eax, dword [esp + 0x10]
and eax, 4
mov dword [esp + 0x18], eax
jne 0x1000a015
test byte [esp + 0x10], 8
je 0x1000a0b0
push str.AI_PATH_VALIDATION_FILENAME
push esi
lea eax, [esp + 0x38]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.10003a20
mov eax, dword [esp + 0x38]
pop ecx
pop ecx
cmp eax, ebx
jne 0x1000a03c
push dword [esp + 0x34]
jmp 0x1000a0aa
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx]
lea esi, [esp + 0x38]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.100021c4
mov esi, dword [esp + 0x3c]
push dword [esp + 0x24]
mov eax, esi
call fcn.10002c93
mov edi, dword [esp + 0x38]
pop ecx
push edi
mov eax, esi
call fcn.10002c93
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x1000a08a
cmp dword [esp + 0x18], ebx
je 0x1000a0a2
push edi
push str.4162
jmp 0x1000a097
test byte [esp + 0x10], 8
je 0x1000a0a2
push edi
push str.4163
push dword [ebp + 8]
call fcn.10009e4f
add esp, 0xc
push esi
call fcn.10002adf
pop ecx
push edi
call fcn.10002adf
pop ecx
push dword [esp + 0x24]
call fcn.10002adf
pop ecx
push dword [esp + 0x2c]
call fcn.10002adf
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a51c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 1
xor esi, esi
push esi
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1000a55d
push ebx
push str.ERROR___Registry_value_not_found:
call fcn.10003dca
push ebx
push dword [ebp + 8]
call fcn.10003dca
add esp, 0x10
xor eax, eax
jmp 0x1000a5c1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
mov esi, str.HardwareInformation.MemorySize
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 4
call edi
cmp eax, 2
jne 0x1000a590
push ebx
push str.ERROR___Registry_value_not_found:
call fcn.10003dca
push ebx
push esi
jmp 0x1000a551
push dword [ebp - 4]
call fcn.10002ad2
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0
push esi
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebx]
push ebx
shr esi, 0x14
call fcn.10002adf
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a5c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], 4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x1000a60a
push dword [ebp + 8]
push str.ERROR___Registry_value_not_found:
call fcn.10003dca
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.10003dca
add esp, 0x10
xor eax, eax
leave
ret
mov eax, dword [ebp - 4]
leave
ret

Function at 0x1000a60f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 2
xor esi, esi
push 0x40
mov dword [ebp - 8], esi
call edi
cmp eax, esi
je 0x1000a636
xor ecx, ecx
mov word [eax], cx
mov ebx, eax
jmp 0x1000a638
xor ebx, ebx
push 0xffffffffffffffff
mov ecx, str.DeviceVideo
mov eax, ebx
call fcn.10002caa
pop ecx
push 2
push 0x40
call edi
cmp eax, esi
je 0x1000a65b
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], eax
jmp 0x1000a65e
mov dword [ebp - 4], esi
push dword [ebp - 4]
xor edi, edi
call fcn.10002481
push dword [ebp - 4]
mov eax, ebx
call fcn.10002c93
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call esi
cmp eax, 2
jne 0x1000a697
xor eax, eax
jmp 0x1000a6d6
inc dword [ebp - 8]
push dword [ebp - 4]
mov edi, dword [ebp - 8]
call fcn.10002481
pop ecx
mov ecx, ebx
call fcn.10002c82
mov ecx, dword [ebp - 4]
mov cx, word [ecx]
mov word [ebx + eax*2 - 2], cx
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call esi
cmp eax, 2
jne 0x1000a697
mov eax, edi
dec eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000abdf
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push str.AI_USER_CHECK_PASSWORD
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10003a20
cmp dword [ebp - 0x18], 1
pop ecx
pop ecx
ja 0x1000ac22
push 0x1000e704
push str.AI_USER_VALID_PASSWORD
push edi
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push dword [ebp - 0x14]
call fcn.10002adf
jmp 0x1000acb5
push str.USER_PASSWORD
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.10003a20
cmp dword [ebp - 0x10], 1
pop ecx
pop ecx
jb 0x1000ac94
lea eax, [ebp - 8]
push eax
push ebx
push 3
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
cmp eax, 0x52f
setne byte [ebp - 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, ebx
je 0x1000ac7e
mov byte [eax], bl
inc eax
dec ecx
jne 0x1000ac78
cmp byte [ebp - 1], bl
je 0x1000ac94
mov eax, 0x1000fdfc
cmp esi, ebx
jne 0x1000ac91
mov eax, 0x1000fbd4
push eax
jmp 0x1000ac99
push 0x1000e704
push str.AI_USER_VALID_PASSWORD
push edi
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push dword [ebp - 0xc]
call fcn.10002adf
push dword [ebp - 0x14]
call fcn.10002adf
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x1000bacf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 0x444]
push 0x208
push eax
call fcn.10002af1
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x444]
push eax
push str.CustomActionData
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x104
call sub.msi.dll_MsiGetSummaryInformationW
cmp dword [ebp + 8], 1
jne 0x1000bb29
push str.Stopped
push str.AI_PROCESS_STATE
push dword [ebp + 0xc]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call esi
push edi
push 2
call eax
push edi
mov dword [ebp - 0x10], eax
mov edi, 0x22c
lea eax, [ebp - 0x23c]
push edi
push eax
call fcn.10002af1
add esp, 0xc
push str.Process32FirstW
push ebx
mov dword [ebp - 0x23c], edi
call esi
push str.Process32NextW
push ebx
mov edi, eax
call esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x23c]
push eax
push esi
call edi
jmp 0x1000bbe4
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000bbd9
mov eax, dword [ebp + 8]
dec eax
je 0x1000bbc7
dec eax
jne 0x1000bbd9
push dword [ebp - 0x234]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000bbd9
push str.Running
push str.AI_PROCESS_STATE
push dword [ebp + 0xc]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [ebp - 8]
test eax, eax
jne 0x1000bb8c
test esi, esi
je 0x1000bbf3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1000bbfe
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret