joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d16d
Capabilities:
Delete directory

Disassembly:
mov eax, 0x464ea4
call fcn.004571ec
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x34]
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.0042d088
lea ecx, [ebp + 8]
call fcn.00405599
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call edi
test eax, eax
jne 0x42d296
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
je 0x42d296
cmp ebx, 2
je 0x42d296
cmp ebx, 5
jne 0x42d1da
lea eax, [ebp + 8]
push eax
call fcn.0042c6b5
test al, al
pop ecx
jne 0x42d1e2
mov ebx, 0x91
cmp ebx, 0x91
je 0x42d1ff
push dword [ebp + 0x34]
lea eax, [ebp + 8]
mov ecx, esi
push ebx
push dword [ebp + 0x30]
push eax
call fcn.0042cfb1
lea ecx, [ebp + 8]
call fcn.00405599
push eax
jmp 0x42d19e
xor edi, edi
mov dword [ebp + 0x30], edi
mov eax, dword [esi]
mov dword [ebp - 0x10], edi
lea edx, [ebp + 0x30]
mov byte [ebp - 4], 1
mov eax, dword [eax + 4]
push edx
push 0x47df78
push 0x46b938
mov eax, dword [eax + esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, edi
jl 0x42d238
mov eax, dword [ebp + 0x30]
lea edx, [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp word [ebp - 0x10], di
je 0x42d285
sub esp, 0x28
lea eax, [ebp + 0x37]
mov dword [ebp - 0x14], esp
mov ecx, esp
push edi
push eax
push 0x485ac4
mov dword [ecx], 0x469494
mov dword [ecx + 0x20], 0x46948c
call fcn.00410de9
sub esp, 0x28
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push 1
push eax
mov byte [ebp - 4], 2
call fcn.00405b24
mov byte [ebp - 4], 1
call fcn.00452131
add esp, 0x50
mov eax, dword [ebp + 0x30]
and byte [ebp - 4], 0
cmp eax, edi
je 0x42d296
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x30

Function at 0x43022b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4652f8
call fcn.004571ec
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x46a918
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00430367
lea eax, [ebp - 0xd]
push 1
push eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.0040487b
lea eax, [ebp - 0xe]
push 1
push eax
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 3
call fcn.0040487b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x84], bl
mov dword [esi], 0x46a780
mov dword [esi + 4], 0x46a770
mov dword [esi + 8], 0x46a758
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43dfeb
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4668af
call fcn.004571ec
sub esp, 0x408
and dword [ebp - 0x414], 0
push ebx
lea eax, [ebp - 0x410]
push 0x485ac0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.004054cd
push eax
lea eax, [ebp - 0x10]
push str.SELECT__FROM_Directory_WHERE_Directory___s
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.0043e07d
mov ebx, eax
add esp, 0x14
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0x10], 0
je 0x43e05a
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x414], 0
je 0x43e06e
push dword [ebp - 0x414]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43e1b6
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4668e0
call fcn.004571ec
sub esp, 0x130
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], edi
mov ebx, 0x80070000
jne 0x43e22a
call esi
test eax, eax
je 0x43e20d
call esi
and eax, 0xffff
or eax, ebx
jmp 0x43e20f
xor eax, eax
cmp eax, edi
jge 0x43e22a
push eax
lea ecx, [ebp - 0x38]
call fcn.00411aa6
lea eax, [ebp - 0x38]
push 0x46f9c0
push eax
call fcn.00457c2c
mov dword [ebp - 0x14], edi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msi.dll_MsiRecordSetStringA
mov edi, eax
test edi, edi
jne 0x43e2b6
cmp dword [ebp + 0x10], eax
je 0x43e2a7
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x13c]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43e288
call esi
test eax, eax
je 0x43e282
call esi
and eax, 0xffff
or eax, ebx
jmp 0x43e284
xor eax, eax
test eax, eax
jl 0x43e2dd
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x10]
je 0x43e2a7
call esi
test eax, eax
je 0x43e2a1
call esi
and eax, 0xffff
or eax, ebx
jmp 0x43e2a3
xor eax, eax
test eax, eax
jl 0x43e2f4
mov eax, dword [ebp + 0x10]
add dword [ebp - 0x14], eax
test eax, eax
jbe 0x43e30b
jmp 0x43e22d
mov esi, edi
and edi, 0xf7ff
or edi, 0x80040800
neg esi
sbb esi, esi
and esi, edi
cmp dword [ebp - 0x10], 0xffffffff
je 0x43e2d9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x43e31c
push eax
lea ecx, [ebp - 0x38]
call fcn.00411aa6
lea eax, [ebp - 0x38]
push 0x46f9c0
push eax
call fcn.00457c2c
push eax
lea ecx, [ebp - 0x38]
call fcn.00411aa6
lea eax, [ebp - 0x38]
push 0x46f9c0
push eax
call fcn.00457c2c
cmp dword [ebp - 0x10], 0xffffffff
je 0x43e31a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43e32b
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4668ff
call fcn.004571ec
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 0x410]
xor edi, edi
push 0x485ac0
push eax
mov dword [ebp - 0x414], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
push str.SELECT__FROM__Binary__WHERE__Name___s
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.0043e07d
add esp, 0x14
cmp eax, edi
je 0x43e38f
and eax, 0xf7ff
or eax, 0x80040800
jmp 0x43e39f
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x10]
call fcn.0043e1b6
add esp, 0xc
cmp dword [ebp - 0x10], edi
mov esi, eax
je 0x43e3ae
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x414], edi
je 0x43e3c1
push dword [ebp - 0x414]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x43e3d1
Capabilities:
Copy file

Disassembly:
mov eax, 0x46691c
call fcn.004571ec
sub esp, 0x854
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043e32b
add esp, 0xc
test eax, eax
je 0x43e4b5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x800
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.0043e4c3
pop ecx
test eax, eax
pop ecx
jne 0x43e4b7
push eax
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x469494
mov dword [ebp - 0x18], 0x46948c
call fcn.00404c93
and dword [ebp - 4], 0
lea eax, [ebp + 0x13]
push 1
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x60]
call fcn.00404c93
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.00411942
and byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.004060f2
push 0
lea ecx, [ebp - 0x38]
push dword [ebp + 0xc]
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x43e4a9
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov esi, 0x80004005
je 0x43e498
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004060f2
mov eax, esi
pop esi
jmp 0x43e4b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004060f2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x43ea20
Capabilities:
Reference sql statements

Disassembly:
mov eax, 0x4669e7
call fcn.004571ec
sub esp, 0x43c
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.msi.dll_MsiPreviewBillboardA
xor ebx, ebx
mov esi, eax
cmp byte [ebp + 0xc], bl
je 0x43eb9d
cmp esi, 0x666
jne 0x43eb9d
push str.msi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x43ea89
push str.MsiOpenPackageExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x47f084], eax
je 0x43ea89
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call eax
jmp 0x43eb9f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call sub.msi.dll_MsiOpenProductA
mov esi, eax
cmp esi, ebx
jne 0x43eb90
lea eax, [ebp + 0xf]
push 1
push eax
lea ecx, [ebp - 0x44]
call fcn.0040487b
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x444]
push 0x485ac0
push eax
mov dword [ebp - 0x448], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 3
je 0x43eae0
push dword [ebp + 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp + 8]
push str.SELECT__Value__FROM__Property__WHERE__Property___ProductCode
push eax
lea eax, [ebp - 0x448]
push dword [ebp - 0x10]
mov dword [ebp + 8], ebx
push eax
call fcn.0043e07d
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x43eb65
mov eax, 0x800
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], eax
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004049f7
mov esi, eax
mov ecx, dword [esi]
mov byte [ebp - 4], 4
call fcn.004054cd
lea ecx, [ebp + 0xc]
mov dword [esi + 8], eax
push ecx
push eax
push 1
push dword [ebp + 8]
call sub.msi.dll_MsiRecordSetInteger
lea ecx, [ebp - 0x1c]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.00404a35
cmp esi, ebx
jne 0x43eb65
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
push dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
call fcn.004054cd
push eax
call sub.msi.dll_MsiPreviewDialogA
mov esi, eax
cmp dword [ebp - 0x448], ebx
je 0x43eb78
push dword [ebp - 0x448]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp + 8], ebx
je 0x43eb85
push dword [ebp + 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.004060f2
cmp dword [ebp - 0x10], ebx
je 0x43eb9d
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43edce
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
and dword [ebp - 0x404], 0
lea eax, [ebp - 0x400]
push 0x485ac0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push str.SELECT__FROM__CustomAction__WHERE__Action____s
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call fcn.0043e07d
add esp, 0x14
test eax, eax
jne 0x43ee28
cmp dword [ebp - 0x404], eax
je 0x43ee24
push dword [ebp - 0x404]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov al, 1
leave
ret
cmp dword [ebp - 0x404], 0
je 0x43ee3c
push dword [ebp - 0x404]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor al, al
leave
ret
Function at 0x43ee40
Capabilities:
Delete file

Disassembly:
mov eax, 0x466a23
call fcn.004571ec
sub esp, 0x7c
push ebx
push esi
push edi
lea eax, [ebp - 0xd]
push 1
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x88]
call fcn.004048f0
lea eax, [ebp - 0xe]
push 1
xor edi, edi
push eax
push str..dll
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], edi
call fcn.004048f0
push dword [0x469488]
lea eax, [ebp - 0x60]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x5c]
and eax, ecx
push edi
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.00406edb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.004060f2
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x38]
push dword [ebp + 0x18]
push eax
call fcn.00415145
lea eax, [ebp - 0x38]
push 0xc
push eax
mov byte [ebp - 4], 2
call fcn.0041619c
mov ebx, dword [ebp + 8]
add esp, 0x14
test al, al
jne 0x43ef06
push dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
call fcn.00405599
push eax
push ebx
call fcn.0043e32b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x43ef06
push esi
push str.Failed_to_extract_Binary_for_DLL_CA__error_is__d
push ebx
call fcn.0043e163
add esp, 0xc
jmp 0x43efc7
push 8
push edi
lea ecx, [ebp - 0x38]
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x43ef45
call esi
test eax, eax
je 0x43ef45
call esi
push eax
push str.Could_find_function_in_DLL__error_is__d
push ebx
call fcn.0043e163
add esp, 0xc
call esi
mov esi, eax
jmp 0x43efc7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
mov dword [0x47f088], eax
jne 0x43ef60
call esi
test eax, eax
jne 0x43ef2b
push dword [ebp + 0xc]
call dword [0x47f088]
mov edi, eax
test edi, edi
je 0x43ef82
push edi
push str.Custom_Action_Call_failed__error_is__d
push ebx
call fcn.0043e163
add esp, 0xc
mov esi, edi
jmp 0x43efc7
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x43ef9f
call esi
test eax, eax
je 0x43ef9f
call esi
push eax
push str.Could_free_module_for_CA_DLL__error_is__d
jmp 0x43ef33
lea ecx, [ebp - 0x38]
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43efc5
call esi
test eax, eax
je 0x43efc5
call esi
push eax
push str.Could_delete_CA_DLL__error_is__d
jmp 0x43ef33
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004060f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.004060f2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43f528
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [esi + 0x88], eax
jne 0x43f547
xor al, al
jmp 0x43f561
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x43f565
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ecx
ret
Function at 0x43f7af
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareInstallShield
push 0x80000001
xor edi, edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x43f7e9
mov edi, dword [ebp - 4]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x808]
push dword [ebp + 8]
push eax
call fcn.00457250
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x808]
push eax
push 1
push esi
push str.IDriverInit
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp edi, esi
je 0x43f82f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x440084
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 4]
xor esi, esi
mov ecx, dword [ecx]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x4400b8
mov edi, dword [ebp - 4]
xor eax, eax
cmp eax, esi
mov ebx, eax
jne 0x4400db
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
cmp edi, esi
je 0x4400e6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x4400ef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
jne 0x440174
xor eax, eax
cmp dword [ebp - 4], esi
je 0x440130
push dword [ebp - 4]
call edi
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x440174
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
lea ecx, [ebp - 4]
push dword [ebp + 8]
push str.CLSID
call fcn.00440084
cmp dword [ebp - 4], esi
je 0x440170
push dword [ebp - 4]
call edi
xor eax, eax
jmp 0x44018e
and eax, 0xffff
push ebx
or eax, 0x80070000
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x44018b
push dword [ebp - 4]
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4475cf
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4678f3
call fcn.004571ec
sub esp, 0x78
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1c], ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x447679
lea eax, [ebp - 0x50]
mov ecx, esi
push eax
call fcn.00417e3f
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x50]
sete bl
or dword [ebp - 4], 0xffffffff
call fcn.004060f2
test bl, bl
je 0x447680
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.00417e3f
push 1
mov ecx, eax
pop edi
push 0
mov dword [ebp - 4], edi
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
lea ecx, [ebp - 0x84]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
inc bl
call fcn.004060f2
test bl, bl
je 0x447683
push 0
push str.Directory_does_not_exist_and_can_not_be_created_
mov ecx, esi
call fcn.00405599
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4477ec
push 1
pop edi
mov eax, dword [ebp + 0xc]
xor esi, esi
and dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov eax, dword [eax + 0xc]
cmp eax, edi
mov dword [ebp - 0x18], eax
jbe 0x4477ae
push 2
pop ebx
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.0043f3d8
movzx eax, word [eax]
cmp eax, 0x56
jg 0x447724
je 0x447789
cmp eax, 0x49
jg 0x447702
je 0x44774f
sub eax, 0x21
je 0x4476fa
sub eax, 9
je 0x4476f0
dec eax
je 0x4476e8
sub eax, 0x16
je 0x44775c
sub eax, ebx
je 0x447754
sub eax, ebx
jne 0x447679
or esi, ebx
jmp 0x44779f
mov dword [ebp - 0x14], edi
jmp 0x44779f
mov esi, 0xfdf
jmp 0x44779f
mov dword [ebp - 0x14], ebx
jmp 0x44779f
sub eax, 0x4d
je 0x44774b
sub eax, ebx
je 0x447764
dec eax
je 0x447799
sub eax, ebx
je 0x447791
sub eax, 3
jne 0x447679
or esi, 8
jmp 0x44779f
cmp eax, 0x6f
jg 0x44776c
je 0x447764
sub eax, 0x57
je 0x447784
sub eax, 0xa
je 0x44775c
sub eax, ebx
je 0x447754
sub eax, ebx
je 0x4476e1
sub eax, 4
je 0x44774f
sub eax, 4
jne 0x447679
or esi, edi
jmp 0x44779f
or esi, 0x10
jmp 0x44779f
or esi, 0x800
jmp 0x44779f
or esi, 0x100
jmp 0x44779f
or esi, 0x80
jmp 0x44779f
sub eax, 0x70
je 0x447799
sub eax, ebx
je 0x447791
sub eax, 3
je 0x44771f
dec eax
je 0x447789
dec eax
jne 0x447679
or esi, 4
jmp 0x44779f
or esi, 0x1000
jmp 0x44779f
or esi, 0x200
jmp 0x44779f
or esi, 0x400
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jb 0x44769f
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp + 8]
mov dword [edi + 0x2cc], esi
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4477c6
mov eax, 0x46949c
push eax
lea ecx, [edi + 0x2a4]
call fcn.00404bc1
mov eax, dword [ebp - 0x14]
mov ecx, ebx
push eax
mov dword [edi + 0x2d0], eax
call fcn.00405599
push eax
push esi
call sub.msi.dll_MsiGetComponentPathA
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x44a9df
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x467ff2
call fcn.004571ec
sub esp, 0x1e4
push esi
mov esi, ecx
push 0x499d68
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x44ab0d
add esi, 0x1c
push 0x47dd78
lea eax, [ebp - 0xb0]
push esi
push eax
call fcn.0040614f
add esp, 0xc
mov eax, dword [eax + 8]
and dword [ebp - 4], 0
test eax, eax
jne 0x44aa2d
mov eax, 0x46949c
push edi
lea ecx, [ebp - 0xe]
push 1
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00409419
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.004060f2
lea eax, [ebp - 0x1f0]
lea ecx, [ebp - 0x60]
push eax
call fcn.004054cd
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp byte [ebp - 0x1c4], 0x2e
je 0x44aad5
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x469494
mov dword [ebp - 0x18], 0x46948c
call fcn.00404c93
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.004118d8
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.004060f2
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.004060f2
lea eax, [ebp - 0x1f0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44aa64
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, esi
call fcn.00405599
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004060f2
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret