joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50be61
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x573080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x14]
mov edx, esi
cmp edi, 8
jb 0x469c8c
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x469ca3
mov eax, edx
cmp word [eax], 0x2a
je 0x469ccd
add eax, 2
sub ecx, 1
jne 0x469c95
cmp edi, 8
jb 0x469caa
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5b75
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x469ca3
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x469ca3
lea ecx, [ebp - 0x478]
call fcn.00469df0
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x469cf4
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x478]
call fcn.0047e530
test eax, eax
je 0x469dc9
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x18], 0
je 0x469d52
mov eax, dword [ebp - 0x478]
shr eax, 4
and eax, 1
je 0x469d4e
cmp word [ebp - 0x44c], 0x2e
jne 0x469d4e
mov cx, word [ebp - 0x44a]
test cx, cx
je 0x469da7
cmp cx, 0x2e
jne 0x469d4e
cmp word [ebp - 0x448], 0
je 0x469da7
test eax, eax
jne 0x469da7
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x478]
call fcn.0047e970
mov byte [ebp - 4], 1
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x469da7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x52b690
jne 0x469de0
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x469dc9
cmp dword [ebp - 0x18], 0
je 0x469dc9
lea ecx, [ebp - 0x478]
push ecx
push eax
call ebx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x469d14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.00469ea0
jmp 0x469cb1
mov ecx, edx
call esi
jmp 0x469da7

Function at 0x46ade0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x46ae0f
cmp dword [edi + 0x20], 8
lea ecx, [edi + 0xc]
jb 0x46adf5
mov ecx, dword [ecx]
mov eax, dword [edi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [edi + 0x3c]
mov ecx, edi
call fcn.004580cd
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x46ae1b
mov esi, dword [esi]
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
jb 0x46ae27
mov ebx, dword [ebx]
test esi, esi
jne 0x46ae3b
mov eax, 0xd
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
push esi
call fcn.004dbc76
add esp, 4
lea eax, [eax*2 + 2]
push eax
push esi
push 2
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
Function at 0x46b170
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x46b1a0
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x46b184
mov ecx, dword [ecx]
mov eax, dword [esi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [esi + 0x3c]
mov ecx, esi
call fcn.004580cd
mov edx, dword [esi]
mov ecx, dword [esp + 8]
pop esi
cmp dword [ecx + 0x14], 8
jb 0x46b1ad
mov ecx, dword [ecx]
mov eax, dword [esp + 8]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 8
Function at 0x470c00
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], ecx
push eax
push 0x470c30
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x471f20
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x50cc5f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x573080]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57640c]
test eax, eax
jne 0x47205e
push 0x10
call fcn.004d5b94
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x2b4
push 0
push eax
call fcn.004d99d0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp]
add esp, 0x10
push 0x4011
push 0x2b4
push eax
push 0x10
push 0x5375d4
call edi
push 0x4011
push 0x2b4
mov dword [esi], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
push 0x4013
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x47202d
push 0x4009
push 0x2b4
lea eax, [ebp]
push eax
push 0
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x472034
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x472034
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x57640c]
mov dword [0x57640c], esi
test eax, eax
je 0x47205c
push 0x10
push eax
call fcn.004d5b86
mov eax, dword [0x57640c]
add esp, 8
jmp 0x47205e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004d5b75
lea esp, [ebp + 0x2b8]
pop ebp
ret
Function at 0x472080
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50cca0
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x573080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x4720dc
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d6fc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004de957
mov edx, eax
add esp, 8
test edx, edx
js 0x4721a1
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x4721a1
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004d99d0
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x472182
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x52b690
jne 0x4721ab
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5b75
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040d85a
call esi
jmp 0x472182
Function at 0x4748f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d1b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x573080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040d32d
mov ecx, eax
test ecx, ecx
je 0x474a3c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x52b690
jne 0x474a46
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00474a60
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x474967
xor bl, bl
jmp 0x4749e3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x4749de
cmp dword [edi + 0xc], 0
jl 0x4749d3
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4749d3
call fcn.004070e8
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4749c9
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x52b690
jne 0x474a4d
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4749de
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4749de
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d89e
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x474a28
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x52b690
jne 0x474a56
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040d85a
call edx
jmp 0x474942
mov ecx, edx
call eax
jmp 0x4749c9
call edx
jmp 0x474a28
Function at 0x474a60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x573080]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
lea eax, [esp + 0x214]
mov ebx, edx
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x474c17
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x474c17
push ebp
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004dbc76
mov esi, dword [ebx]
mov edi, eax
add esp, 4
test edi, edi
jne 0x474b52
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], eax
je 0x474bfc
cmp dword [ecx + 0xc], eax
lea edx, [ecx + 0xc]
jge 0x474afd
cmp dword [esi - 8], eax
jl 0x474c43
mov dword [esi - 0xc], eax
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x474bfc
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x474b2a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x52b690
jne 0x474c30
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x52b690
jne 0x474c39
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [ebx], eax
jmp 0x474bfc
add eax, 0x10
mov dword [ebx], eax
jmp 0x474bfc
mov eax, dword [esi - 0xc]
lea ebp, [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], eax
sar ebp, 1
test edi, edi
js 0x474c43
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x474b84
push edi
mov ecx, ebx
call fcn.0040d6fc
mov esi, dword [ebx]
lea ecx, [edi + edi]
cmp ebp, dword [esp + 0x10]
ja 0x474bd2
mov eax, dword [esi - 8]
lea edx, [esi + ebp*2]
test ecx, ecx
je 0x474bea
test edx, edx
jne 0x474bad
call fcn.004dbdb4
mov dword [eax], 0x16
call fcn.004dbc16
jmp 0x474be7
add eax, eax
cmp eax, ecx
jae 0x474bc5
call fcn.004dbdb4
mov dword [eax], 0x22
call fcn.004dbc16
jmp 0x474be7
push ecx
push edx
push esi
call fcn.004d7810
add esp, 0xc
jmp 0x474be7
mov edx, dword [esi - 8]
lea eax, [esp + 0x14]
push ecx
push eax
add edx, edx
mov ecx, esi
call fcn.0040d7d5
add esp, 8
lea ecx, [edi + edi]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x474c43
mov dword [eax - 0xc], edi
xor edx, edx
mov eax, dword [ebx]
mov word [ecx + eax], dx
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004d5b75
add esp, 0x418
ret
mov ecx, dword [esp + 0x41c]
xor al, al
pop esi
pop ebx
xor ecx, esp
call fcn.004d5b75
add esp, 0x418
ret
mov ecx, edx
call esi
jmp 0x474b2a
mov ecx, edi
call dword [eax + 0xc]
jmp 0x474b48
push 0x80070057
call fcn.0040d85a
int3
Function at 0x475f80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d418
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x573080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], 0x52aca8
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x475fe2
or esi, eax
xor bl, bl
jmp 0x475ff8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x475ff4
xor bl, bl
jmp 0x475ff8
mov dword [edi], eax
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x52aca8
test esi, esi
je 0x476018
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476030
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d450
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x573080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.004760e0
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4760bf
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x52b690
jne 0x4760d2
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call eax
jmp 0x4760bf
Function at 0x4769b0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x476a5f
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x4769fc
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x476a04
cmp dword [eax - 8], 0
jl 0x476abe
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x476a31
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x52b690
jne 0x476ac8
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x52b690
jne 0x476ad1
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
js 0x476abe
mov edx, dword [esi]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x476a7e
push edi
mov ecx, esi
call fcn.0040d6fc
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x476a91
xor ecx, ecx
jmp 0x476aa3
push dword [eax - 8]
push eax
call fcn.004de957
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x476abe
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x476abe
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
lea eax, [edx + 1]
ret 4
push 0x80070057
call fcn.0040d85a
mov ecx, edx
call ebx
jmp 0x476a31
mov ecx, edi
call dword [eax + 0xc]
jmp 0x476a52
Function at 0x4841fd
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x50e787
call fcn.004d6783
mov bl, dl
mov edi, ecx
cmp byte [0x576534], 0
je 0x48425a
lea ecx, [ebp - 0x10]
call fcn.0040ce6d
and dword [ebp - 4], 0
mov esi, dword [edi]
test esi, esi
je 0x484239
push esi
call fcn.004dbc76
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00410f2f
lea eax, [ebp - 0x10]
mov ecx, 0x576500
push eax
call fcn.0049d180
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
cmp byte [0x573b1c], 0
push dword [edi]
je 0x4842b7
lea ecx, [ebp - 0x10]
call fcn.0040d91c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.0040ce6d
movzx ecx, bl
shl ecx, 0x12
add ecx, 0x10
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00470bb0
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d133
jmp 0x4842bd
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004d674c
ret
Function at 0x48636e
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x50ecda
call fcn.004d6783
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], ebx
je 0x486392
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x18], ebx
push dword [eax]
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x486502
lea ecx, [ebp - 0x1c]
call fcn.0040ce6d
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x1c]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.00411714
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0
je 0x4863e2
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.msi.dll_MsiEnumClientsA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x4864e7
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x4864e7
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], eax
je 0x486422
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne bl
cmp dword [ebp - 0x10], 0
mov byte [ebp + 0xb], bl
je 0x486448
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
test bl, bl
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x4864d6
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov edi, eax
je 0x48647e
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4864d6
mov eax, dword [ebp + 0xc]
test bl, bl
mov ebx, dword [ebp + 0x10]
cmovne eax, ebx
push dword [eax]
push 1
push edi
mov edi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call edi
test eax, eax
jne 0x4864d6
cmp byte [ebp + 0xb], al
cmovne ebx, dword [ebp + 0xc]
push dword [ebx]
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x4864d6
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x4864d6
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x4864d6
mov bl, 1
jmp 0x4864d8
xor bl, bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x4864e7
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x4864f6
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x486511
push dword [ebp - 0x18]
call esi
mov al, bl
call fcn.004d674c
ret 0xc
Function at 0x486cfe
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x50eeb6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x573080]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x20c]
push dword [ebx + 4]
call fcn.004d62d0
and dword [ebx + 4], 0
lea eax, [ebp]
and dword [ebx], 0
push esi
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x14], 0
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
je 0x486d7d
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x1c]
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp]
call fcn.00486f71
pop ecx
test eax, eax
jns 0x486d9b
xor bl, bl
jmp 0x486e46
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x486dae
push dword [ebp - 0x10]
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
je 0x486de9
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x486de4
cmp esi, 0x80070103
je 0x486de4
call fcn.0048704e
mov eax, dword [ebp - 0x10]
jmp 0x486dee
mov esi, 0x80070057
test esi, esi
jns 0x486df6
xor bl, bl
jmp 0x486e37
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
push ecx
push 0x52aec0
push 1
push eax
call esi
cmp eax, 0xea
jne 0x486e32
mov eax, dword [ebp - 0x18]
mov ecx, ebx
inc eax
push eax
mov dword [ebp - 0x18], eax
call fcn.0047f0f0
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x486e46
push dword [ebp - 0x10]
call edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x486e55
push dword [ebp - 0x14]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004d5b75
add ebp, 0x204
leave
ret