joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416120
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597090
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc8
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xac], ecx
mov esi, dword [ebx + 8]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x44
push eax
push 0
push 0
push 8
push 0
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x98], 0xc
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x98]
movlpd qword [ebp - 0x7c], xmm0
push eax
push esi
push 0
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x8c], 0xc
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x416296
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416273
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], eax
call fcn.0040a7e0
push esi
push 0x1fff
sub esp, 8
push 0x6d
call fcn.00402e10
movups xmm0, xmmword [ebp - 0x38]
push 0x608ce8
lea eax, [ebp - 0xc4]
movups xmmword [ebp - 0xc4], xmm0
push eax
movq xmm0, qword [ebp - 0x28]
movq qword [ebp - 0xb4], xmm0
call fcn.0056f00a
int3
Function at 0x416720
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
mov eax, esi
and eax, 0x3ff
cmp eax, 9
movzx eax, si
je 0x416753
mov eax, ecx
movzx esi, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push esi
push ecx
movzx eax, ax
push eax
push str.SetupInfo::GetOSLanguageIDProInst__:_langID_OS___04x__langID_Res___04x__langID___04x_n
call fcn.0041c4c0
mov eax, dword [ebp - 4]
add esp, 0x10
mov word [ebx], ax
mov eax, esi
and esi, 0x3ff
shr eax, 0xa
dec esi
cmp esi, 0x1e
ja case.0x41678a.2
jmp dword [esi*4 + 0x4169e4]
push 0x5eb188
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb824
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x40c
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb82c
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x407
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb834
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x410
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb83c
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0xc0a
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb844
jmp 0x416796
push 0x5eb84c
jmp 0x416796
dec eax
cmp eax, 3
ja case.default.0x416857
jmp dword [eax*4 + 0x416a60]
push 0x5eb854
jmp 0x416796
push 0x5eb85c
jmp 0x416796
push 0x5eb85c
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x804
mov word [ebx], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, 1
je 0x4168c2
push 0x5eb86c
push 4
push edi
sub eax, 1
je 0x416799
call fcn.0057580b
add esp, 0xc
mov eax, 0x816
mov word [ebx], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb864
jmp 0x416796
push 0x5eb874
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x413
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb87c
jmp 0x416796
push 0x5eb884
jmp 0x416796
push 0x5eb88c
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x414
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb894
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x41d
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb89c
jmp 0x416796
push 0x5eb8a4
jmp 0x416796
push 0x5eb8ac
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x401
mov word [ebx], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5eb8b4
jmp 0x416796
push 0x5eb8bc
jmp 0x416796
push 0x5eb8c4
jmp 0x416796
push 0x5eb8cc
jmp 0x416796
push 0x5eb8d4
jmp 0x416796
push 0x5eb8dc
jmp 0x416796
push 0x5eb188
push 4
push edi
call fcn.0057580b
add esp, 0xc
mov eax, 0x409
mov word [ebx], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4170d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41710b
push str.Setup___GetOsType_OSType_object_is_not_allocated_
call fcn.0041c4c0
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
push ecx
mov edx, 1
mov dword [esi], 0
call fcn.004121d0
test al, al
je 0x417139
or dword [esi], 0x14000
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
push ecx
xor edx, edx
call fcn.004121d0
test al, al
je 0x4170f8
push 0x204
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], 0x37
push 0
push eax
call fcn.0056eeb0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4171cf
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.BuildLab
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], 0x36
je 0x4171e6
mov ax, word [ebp - 0x208]
cmp ax, 0x31
jne 0x41720c
push str.The_OS_is_Windows_7
call fcn.0041c4c0
add esp, 4
mov al, 1
or dword [esi], 0x4000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
cmp ax, 0x32
jne 0x417225
push str.The_OS_is_Windows_8
call fcn.0041c4c0
add esp, 4
or dword [esi], 0x10000
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
Function at 0x4182e0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x824]
mov esi, ecx
push 0
push eax
call fcn.0056eeb0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056eeb0
push 0x208
lea eax, [ebp - 0xc34]
push 0
push eax
call fcn.0056eeb0
push 0x208
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], 0x104
push 0
push eax
call fcn.0056eeb0
add esp, 0x30
lea eax, [ebp - 0x824]
push eax
push 0
push 0
push str.EAB78CB1_2951_4462_83D4_5F72F56E7312
call dword [sym.imp.msi.dll_MsiSourceListClearAllW]
test eax, eax
jne 0x418526
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x414]
push eax
push str.VersionString
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msi.dll_MsiGetPropertyW]
test eax, eax
jne 0x418526
lea eax, [ebp - 0x414]
push str.1.0.0
push eax
call fcn.0056e4d9
add esp, 8
test eax, eax
jne 0x4183c9
lea eax, [ebp - 0x414]
push str.1.0.1
push eax
call fcn.0056e4d9
add esp, 8
test eax, eax
je 0x418526
push 5
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0057a249
add esp, 0x10
mov dword [ebp - 0xc38], 0x104
xor eax, eax
mov word [ebp - 0xa22], ax
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0xc34]
push eax
push str.InstallLocation
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msi.dll_MsiGetPropertyW]
test eax, eax
jne 0x418526
push 0x208
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0056eeb0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056eeb0
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0057580b
push 0x5ebf60
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00575aeb
add esp, 0x30
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x418526
lea eax, [esi + 0xcc8]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0057580b
push str.DLIH_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00575aeb
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00575aeb
push str.obexsrv.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00575aeb
add esp, 0x30
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418526
push 0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret
Function at 0x41a830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov word [ecx + 0x1b10], 7
mov byte [ecx + 0x1b12], 0
test esi, esi
je 0x41a87c
mov edx, dword [ebp + 8]
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
add byte [ecx + 0x1b11], al
movzx eax, byte [ecx + 0x1b10]
xor byte [edx - 1], al
movzx eax, byte [edx - 1]
add byte [ecx + 0x1b12], al
add byte [ecx + 0x1b10], 0x11
sub esi, 1
jne 0x41a850
pop esi
pop ebp
ret 8

Function at 0x41a890
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8008
call fcn.0056b050
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x5ec760
push eax
lea eax, [ebp - 0x8008]
mov dword [ebp - 0x8008], 0
push eax
mov edi, ecx
call fcn.0057a30a
add esp, 0xc
test eax, eax
jne 0x41aa6d
mov eax, dword [ebp - 0x8008]
test eax, eax
je 0x41aa6d
push eax
push 0x8000
lea eax, [ebp - 0x8004]
push 1
push eax
call fcn.0057a537
push dword [ebp - 0x8008]
mov esi, eax
call fcn.0057a668
add esp, 0x14
mov dword [ebp - 0x8008], 0
cmp esi, 4
jb 0x41a98c
lfence
movzx eax, byte [ebp + esi - 0x8005]
push eax
movzx eax, byte [ebp + esi - 0x8006]
push eax
movzx eax, byte [ebp + esi - 0x8007]
push eax
movzx eax, byte [ebp + esi - 0x8008]
push eax
push esi
push str.___________READ____d___02x__02x__02x__02x
call fcn.0041c4c0
add esp, 0x18
cmp byte [ebp + esi - 0x8007], 0xaa
lfence
jne 0x41a9ed
push str.___________ENCRYPTED
call fcn.0041c4c0
mov al, byte [ebp + esi - 0x8006]
add esp, 4
sub esi, 4
mov byte [edi + 0x1b13], al
lea eax, [ebp - 0x8004]
mov ecx, edi
push esi
push eax
call fcn.0041a830
push 0x5ec928
lea eax, [ebp - 0x8008]
push ebx
push eax
call fcn.0057a30a
add esp, 0xc
test eax, eax
jne 0x41aa6d
mov eax, dword [ebp - 0x8008]
test eax, eax
je 0x41aa6d
push eax
push esi
lea eax, [ebp - 0x8004]
push 1
push eax
call fcn.0057a90b
push dword [ebp - 0x8008]
call fcn.0057a668
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x7ffc
ja 0x41aa5a
push str.___________NOT_ENCRYPTED
call fcn.0041c4c0
add esp, 4
lea eax, [ebp - 0x8004]
mov ecx, edi
push esi
push eax
call fcn.0041a830
mov al, byte [edi + 0x1b12]
add esi, 4
mov cl, byte [edi + 0x1b11]
mov byte [ebp + esi - 0x8005], al
movzx eax, al
push eax
movzx eax, cl
push eax
push 0xaa
push 0x55
push esi
push str.___________WROTE___d___02x__02x__02x__02x
mov word [ebp + esi - 0x8008], 0xaa55
mov byte [ebp + esi - 0x8006], cl
call fcn.0041c4c0
add esp, 0x18
jmp 0x41a98c
push esi
push 0x7ffc
push str.File_size_exceeded_the_limit__limit:__d__size:__d_._Dont_have_space_to_store_postfix.
call fcn.0041c4c0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 8
Function at 0x41aa90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8008
call fcn.0056b050
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x5ec760
push eax
lea eax, [ebp - 0x8008]
mov dword [ebp - 0x8008], 0
push eax
call fcn.0057a30a
add esp, 0xc
test eax, eax
jne 0x41ab54
mov eax, dword [ebp - 0x8008]
test eax, eax
je 0x41ab54
push esi
push eax
push 0x8000
lea eax, [ebp - 0x8004]
push 1
push eax
call fcn.0057a537
push dword [ebp - 0x8008]
mov esi, eax
call fcn.0057a668
add esp, 0x14
mov dword [ebp - 0x8008], 0
cmp byte [ebp + esi - 0x8007], 0xaa
jne 0x41ab41
cmp byte [ebp + esi - 0x8008], 0x55
jne 0x41ab41
push str.ENCRYPTED
call fcn.0041c4c0
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
push str.Open_file_failed
call fcn.0041c4c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
Function at 0x41b520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59759b
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0056eeb0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0056eeb0
add esp, 0x18
mov dword [ebp - 0x630], 0x104
call fcn.00421571
mov edi, eax
test edi, edi
je 0x41b74e
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x62c], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x41b5da
push 0x104
lea ecx, [ebp - 0x62c]
call fcn.00403b40
mov esi, dword [ebp - 0x62c]
push esi
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esi - 8]
mov edi, eax
push esi
call fcn.005754d7
add esp, 8
test eax, eax
js 0x41b744
cmp eax, dword [esi - 8]
jg 0x41b744
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
js 0x41b6ac
push 0x208
push ecx
lea eax, [ebp - 0x218]
push eax
call fcn.0056eeb0
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0057580b
push str.InstalleriProData_v_mCore.msi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00575aeb
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
call fcn.0041b760
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056eeb0
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0057580b
push str.InstalleriProDatamCore.msi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00575aeb
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
call fcn.0041b760
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push str.B3E9B853_C790_4DC6_B432_5C7222C52483
call dword [sym.imp.msi.dll_MsiSourceListClearAllW]
test eax, eax
jne 0x41b6f6
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x628]
push eax
push str.LocalPackage
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.msi.dll_MsiGetPropertyW]
test eax, eax
jne 0x41b6f6
lea eax, [ebp - 0x628]
push eax
call fcn.0041b760
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41b724
lfence
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403ba0
push 0x80004005
call fcn.00403ba0
int3
Function at 0x41b760
Capabilities:
Check if file exists
Reference sql statements
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x8c], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b8af
push esi
push str.MSI_Package_exists:__s
call fcn.0041c4c0
add esp, 8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x41b7bb
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x8c]
push eax
push 1
push esi
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x41b8a8
push edi
mov ecx, 0x1f
mov dword [ebp - 0x90], eax
mov esi, str.SELECT__FROM_ISSelfReg_WHERE_ISSelfReg.FileKeyiWMSProv.dll
mov dword [ebp - 0x88], eax
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
movsw word es:[edi], word [esi]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov esi, eax
pop edi
test esi, esi
jne 0x41b882
push 0
push dword [ebp - 0x88]
call dword [sym.imp.msi.dll_MsiViewModify]
mov esi, eax
test esi, esi
jne 0x41b882
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x41b83a
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov esi, eax
test esi, esi
jne 0x41b882
push str.RemoveSelfRegEntry___MsiViewFetch_OK
call fcn.0041c4c0
add esp, 4
push dword [ebp - 0x90]
push 6
push dword [ebp - 0x88]
call dword [sym.imp.msi.dll_MsiRecordClearData]
push dword [ebp - 0x8c]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
mov esi, eax
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x41b893
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x41b8a4
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test esi, esi
jne 0x41b8af
mov esi, 1
jmp 0x41b8b1
xor esi, esi
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
je 0x41b8c2
push ecx
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 4
Function at 0x41b8e0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push ebx
mov dword [ebp - 0xc84], ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea eax, [ebp - 0xa30]
push 0x104
push eax
call fcn.0057580b
add esp, 0xc
lea eax, [ebp - 0xa30]
push str..
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41bb67
test esi, esi
je 0x41bb67
lea eax, [ebp - 0xc80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x41bb60
test byte [ebp - 0xc80], 0x10
je 0x41bab3
mov ecx, 0x5ea0e0
lea eax, [ebp - 0xc54]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41b9b6
test dx, dx
je 0x41b9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41b9b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41b990
xor eax, eax
jmp 0x41b9bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b960
mov eax, 0x5ea0e4
lea ecx, [ebp - 0xc54]
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41b9f6
test dx, dx
je 0x41b9f2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41b9f6
add ecx, 4
add eax, 4
test dx, dx
jne 0x41b9d0
xor eax, eax
jmp 0x41b9fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b960
push edi
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0057580b
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x5eaa84
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push 0x104
push eax
call fcn.0057580b
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x5eaa84
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00575aeb
mov ecx, dword [ebp - 0xc84]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0041b8e0
jmp 0x41b960
push edi
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.0057580b
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x5eaa84
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0x620]
push ebx
push 0x104
push eax
call fcn.0057580b
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x5eaa84
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.00575aeb
add esp, 0xc
lea eax, [ebp - 0x620]
push 0
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x41b960
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 8