joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466770
Capabilities:
Create cabinet on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x33c]
push ebx
mov eax, esi
sub esp, 0x37c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
call fcn.00465d30
lea eax, [ebp - 0x348]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 0x464d60
mov dword [esp + 0x24], 0x464e60
mov dword [esp + 0x20], 0x464ec0
mov dword [esp + 0x1c], 0x464c30
mov dword [esp + 0x18], 0x464f30
mov dword [esp + 0x14], 0x464fa0
mov dword [esp + 0x10], 0x465010
mov dword [esp + 0xc], 0x464d20
mov dword [esp + 8], 0x464ce0
mov dword [esp + 4], 0x464c20
mov dword [esp], eax
call sub.cabinet.dll_FCICreate
mov dword [esp + 4], 0x954
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov esi, eax
call fcn.0052ae70
xor eax, eax
test esi, esi
mov dword [esp + 4], str.Failed_to_create_an_FCI_context_n
setne al
mov dword [esp], eax
call fcn.0052b0e0
cmp byte [ebx], 0
je 0x46687a
nop
mov edx, ebx
mov ecx, 1
mov eax, esi
call fcn.00465dc0
mov dword [esp + 4], 0x95a
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov edi, eax
call fcn.0052ae70
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Failed_to_add_file:__s_n
mov dword [esp], edi
call fcn.0052b0e0
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x466830
mov dword [esp], esi
mov dword [esp + 0xc], 0x464c10
mov dword [esp + 8], 0x464cb0
mov dword [esp + 4], 0
call sub.cabinet.dll_FCIFlushCabinet
mov dword [esp + 4], 0x95f
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov ebx, eax
call fcn.0052ae70
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_flush_the_cabinet_n
call fcn.0052b0e0
mov dword [esp], esi
call sub.cabinet.dll_FCIDestroy
mov dword [esp + 4], 0x962
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov ebx, eax
call fcn.0052ae70
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_destroy_the_cabinet_n
call fcn.0052b0e0
add esp, 0x37c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x466900
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
sub esp, 0x34
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
test eax, eax
je 0x466932
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0x59c340
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], 0
mov dword [esp + 4], str.AppData
mov dword [esp], eax
mov dword [ebp - 0xc], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
jne 0x466990
call sub.advapi32.dll_RegCloseKey
mov ebx, 1
mov eax, ebx
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
Function at 0x4669a0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x24]
push ebx
xor ebx, ebx
sub esp, 0x3c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x101
mov dword [esp + 8], 0
mov dword [esp + 4], 0x550370
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4669f0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp - 0x24]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x20]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x59c220
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x55039a
mov dword [esp], eax
mov dword [ebp - 0x1c], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x466a67
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x59c220
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5503b0
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x466b42
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x59bfe0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5503c0
mov dword [esp], eax
mov dword [ebp - 0x1c], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x466ad2
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x59bfe0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5503d5
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x466b42
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x59bec0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5503b0
mov dword [esp], eax
mov dword [ebp - 0x1c], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
jne 0x466b55
call sub.advapi32.dll_RegCloseKey
xor ebx, ebx
sub esp, 4
mov dword [esp + 4], 0x104
mov dword [esp], 0x59c460
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
sub esp, 8
test eax, eax
setne bl
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x4669dd
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x466b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x466c00
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [ebp + 0x10]
sub esp, 0x14
test eax, eax
jne 0x466c10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetEndOfFile]
sub esp, 4
jmp 0x466bf4
Function at 0x466d80
Capabilities:
Create cabinet on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea ebx, [ebp - 0x32c]
sub esp, 0x370
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 0x550409
mov dword [esp], 0x550409
call fcn.00466b70
mov dword [esp + 8], 0xc350
mov dword [esp + 4], 0x550411
mov dword [esp], 0x550411
call fcn.00466b70
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 0x55041a
mov dword [esp], 0x55041a
call fcn.00466b70
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 0x550423
mov dword [esp], 0x550423
call fcn.00466b70
mov ecx, 0x9c40
mov edx, 0x55042a
mov eax, ebx
call fcn.00465d30
lea eax, [ebp - 0x338]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], str.test_d.cab
mov dword [esp + 0x28], 0x464d60
mov dword [esp + 0x24], 0x464e60
mov dword [esp + 0x20], 0x464ec0
mov dword [esp + 0x1c], 0x464c30
mov dword [esp + 0x18], 0x464f30
mov dword [esp + 0x14], 0x464fa0
mov dword [esp + 0x10], 0x465010
mov dword [esp + 0xc], 0x464d20
mov dword [esp + 8], 0x464ce0
mov dword [esp + 4], 0x464c20
mov dword [esp], eax
call sub.cabinet.dll_FCICreate
mov dword [esp + 4], 0xc02
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov ebx, eax
call fcn.0052ae70
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.Failed_to_create_an_FCI_context_n
setne al
mov dword [esp], eax
call fcn.0052b0e0
xor ecx, ecx
mov edx, 0x550409
mov eax, ebx
call fcn.00465dc0
mov dword [esp + 4], 0xc05
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov esi, eax
call fcn.0052ae70
mov dword [esp], esi
mov dword [esp + 4], str.Failed_to_add_file_maximus_n
call fcn.0052b0e0
xor ecx, ecx
mov edx, 0x550411
mov eax, ebx
call fcn.00465dc0
mov dword [esp + 4], 0xc08
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov esi, eax
call fcn.0052ae70
mov dword [esp], esi
mov dword [esp + 4], str.Failed_to_add_file_augustus_n
call fcn.0052b0e0
xor ecx, ecx
mov edx, 0x55041a
mov eax, ebx
call fcn.00465dc0
mov dword [esp + 4], 0xc0b
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov esi, eax
call fcn.0052ae70
mov dword [esp], esi
mov dword [esp + 4], str.Failed_to_add_file_tiberius_n
call fcn.0052b0e0
mov dword [esp], ebx
mov dword [esp + 0xc], 0x464c10
mov dword [esp + 8], 0x464cb0
mov dword [esp + 4], 0
call sub.cabinet.dll_FCIFlushCabinet
mov dword [esp + 4], 0xc0e
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov esi, eax
call fcn.0052ae70
mov dword [esp], esi
mov dword [esp + 4], str.Failed_to_flush_the_cabinet_n
call fcn.0052b0e0
mov dword [esp], ebx
call sub.cabinet.dll_FCIDestroy
mov dword [esp + 4], 0xc11
mov dword [esp], str..._wine_dlls_msi_tests_install.c
mov ebx, eax
call fcn.0052ae70
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_destroy_the_cabinet_n
call fcn.0052b0e0
mov dword [esp + 8], str.caesar
mov dword [esp + 4], 0x7fffffff
mov dword [esp], str.test3.cab
call fcn.00466770
mov ebx, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [esp], 0x550409
call ebx
sub esp, 4
mov dword [esp], 0x550411
call ebx
sub esp, 4
mov dword [esp], 0x55041a
call ebx
sub esp, 4
mov dword [esp], 0x550423
call ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x467020
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x10c]
sub esp, 0x124
mov dword [esp + 4], 0x59c220
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strcpy]
mov eax, ebx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x467043
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
mov ecx, edx
add cl, dl
mov edx, dword [ebp + 8]
sbb eax, 3
sub eax, ebx
mov byte [ebx + eax], 0x5c
lea eax, [ebx + eax + 1]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
test eax, eax
je 0x4670b0
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret

Function at 0x467330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x116]
sub esp, 0x144
mov dword [esp], ebx
mov dword [esp + 4], 0x59c100
call dword [sym.imp.msvcrt.dll_strcpy]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, 0x6261
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x134], 0
lea edx, [ebx + eax]
mov ebx, 0x1094
mov dword [edx], 0x632e2a5c
mov word [edx + 4], cx
mov byte [edx + 6], 0
mov byte [ebp + eax - 0x10f], 0
lea eax, [ebp - 0x134]
mov dword [esp], eax
mov word [ebp - 0x124], bx
mov dword [ebp - 0x130], 3
mov dword [ebp - 0x128], 0
call sub.shell32.dll_SHFileOperationA
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret

Function at 0x4673e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x10c]
sub esp, 0x124
mov dword [esp + 4], 0x59c220
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strcpy]
mov eax, ebx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x467403
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
mov ecx, edx
add cl, dl
mov edx, dword [ebp + 8]
sbb eax, 3
sub eax, ebx
mov byte [ebx + eax], 0x5c
lea eax, [ebx + eax + 1]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, dword [ebp - 4]
sub esp, 4
cmp eax, 0xffffffff
leave
setne al
movzx eax, al
ret
Function at 0x471f20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x10c]
sub esp, 0x124
mov dword [esp + 4], 0x59c220
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strcpy]
mov eax, ebx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x471f43
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
mov ecx, edx
add cl, dl
mov edx, dword [ebp + 8]
sbb eax, 3
sub eax, ebx
mov byte [ebx + eax], 0x5c
lea eax, [ebx + eax + 1]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x471fb1
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], eax
call fcn.00466b70
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
Function at 0x476540
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x58b780]
test ebx, ebx
je 0x476570
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
Function at 0x477380
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x24]
lea edi, [ebp - 0x20]
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x3c
mov dword [ebp - 0x20], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0xffffffff
mov dword [ebp - 0x1c], 0
call sub.advapi32.dll_OpenProcessToken
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.advapi32.dll_GetTokenInformation
lea eax, [ebp - 0x1c]
sub esp, 0x14
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.advapi32.dll_ConvertSidToStringSidA
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x24]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d3ce0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x567cce
push ebx
mov ebx, edx
sub esp, 0xac
mov dword [ebp - 0x8c], eax
mov eax, dword [str.INSERT_INTO__RegLocator____Signature_____Root____Key____Name____Type___VALUES___s___u___s___s___u__]
mov dword [ebp - 0x94], ecx
mov ecx, 0x1a
mov dword [ebp - 0x82], eax
mov eax, dword [0x567d32]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp], ebx
call edi
mov edx, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov dword [esp], edx
call edi
mov edx, dword [ebp + 0xc]
mov esi, eax
mov dword [esp], edx
call edi
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
lea ecx, [ecx + esi + 0x7e]
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x94]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x82]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004d3c10
mov eax, dword [ebp - 0x8c]
mov edx, esi
call fcn.004d35b0
mov dword [esp + 8], esi
mov ebx, eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp + 4], 0x36a
mov dword [esp], str..._wine_dlls_msi_tests_package.c
call fcn.0052ae70
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.failed_to_insert_into_reglocator_table:__u_n
mov dword [esp], eax
call fcn.0052b0e0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d3e10
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov edx, dword [0x58b7a8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [0x58b7a8], 0
mov dword [0x58b7a0], 0
sub esp, 0xc
mov dword [0x58b7a4], 0
leave
ret

Function at 0x4d3f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov ecx, dword [edx + 4]
mov ebx, dword [edx + 8]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], ecx
mov ecx, 0x74
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0x7469736d
mov dword [ebp - 0x44], 0x20747365
mov dword [ebp - 0x40], 0x74736572
mov dword [ebp - 0x3c], 0x2065726f
mov dword [ebp - 0x38], 0x6e696f70
mov word [ebp - 0x34], cx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x58b7b4]
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
Function at 0x4d9c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
mov dword [esp + 4], 0x3d8
mov dword [esp], str..._wine_dlls_msi_tests_package.c
call fcn.0052ae70
xor eax, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], esi
setne al
mov dword [esp + 4], str.Failure_to_open_file__s_n
mov dword [esp], eax
call fcn.0052b0e0
cmp ebx, 0xffffffff
je 0x4d9d41
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_strlen]
lea edx, [ebp - 0x1c]
mov esi, dword [sym.imp.kernel32.dll_WriteFile]
mov dword [esp + 4], edi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
lea edx, [ebp - 0x1c]
sub esp, 0x14
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x568c9e
mov dword [esp], ebx
call esi
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d9d50
Capabilities:
Get token membership

Disassembly:
push ebp
mov edx, 0x500
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x34]
push ebx
lea ebx, [ebp - 0x1e]
sub esp, 0x6c
mov dword [ebp - 0x1e], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], ebx
mov word [ebp - 0x1a], dx
mov dword [ebp - 0x34], 0
call sub.advapi32.dll_AllocateAndInitializeSid
sub esp, 0x2c
test eax, eax
je 0x4d9df2
mov eax, dword [ebp - 0x34]
lea edi, [ebp - 0x30]
mov dword [esp], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sub.advapi32.dll_CheckTokenMembership
sub esp, 0xc
test eax, eax
jne 0x4d9e30
mov dword [esp + 4], 0x52
mov dword [esp], str..._wine_dlls_msi_tests_package.c
call fcn.0052ae70
mov dword [esp], str.Could_not_check_if_the_current_user_is_an_administrator_n
call fcn.0052b110
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.advapi32.dll_FreeSid
xor edx, edx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.advapi32.dll_FreeSid
mov edx, dword [ebp - 0x30]
sub esp, 4
test edx, edx
jne 0x4d9ee6
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x223
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], ebx
mov dword [ebp - 0x3c], edx
call sub.advapi32.dll_AllocateAndInitializeSid
mov edx, dword [ebp - 0x3c]
sub esp, 0x2c
test eax, eax
je 0x4d9f70
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], edi
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [ebp - 0x3c], edx
call sub.advapi32.dll_CheckTokenMembership
mov edx, dword [ebp - 0x3c]
sub esp, 0xc
test eax, eax
je 0x4d9f70
mov eax, dword [ebp - 0x30]
mov edx, 1
test eax, eax
je 0x4d9e22
lea eax, [ebp - 0x2c]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call sub.advapi32.dll_OpenProcessToken
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x4d9e22
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0x12
mov dword [esp], eax
mov dword [ebp - 0x28], 1
call sub.advapi32.dll_GetTokenInformation
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [ebp - 0x3c]
sub esp, 4
test edx, edx
je 0x4d9e22
xor edx, edx
cmp dword [ebp - 0x28], 3
sete dl
jmp 0x4d9e22
mov dword [esp + 4], 0x60
mov dword [esp], str..._wine_dlls_msi_tests_package.c
mov dword [ebp - 0x3c], edx
call fcn.0052ae70
mov dword [esp], str.Could_not_check_if_the_current_user_is_a_power_user_n
call fcn.0052b110
mov edx, dword [ebp - 0x3c]
jmp 0x4d9e22
Function at 0x4da3e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x58b7c4]
test ebx, ebx
je 0x4da410
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret