joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473010
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5097f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x570074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x47306c
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d01b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004d8907
mov edx, eax
add esp, 8
test edx, edx
js 0x473135
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x473135
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004d39c0
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x473116
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x528840
jne 0x473114
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x473116
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0217
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040d173
int3
Function at 0x475500
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509d08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x570074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040cc51
mov ecx, eax
test ecx, ecx
jne 0x475541
push 0x80004005
call fcn.0040d173
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x528840
jne 0x475556
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x475558
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00475660
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x47557d
xor bl, bl
jmp 0x4755f9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x4755f4
cmp dword [edi + 0xc], 0
jl 0x4755e9
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4755e9
call fcn.0040699a
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4755df
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x528840
jne 0x4755db
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4755f4
mov ecx, edx
call eax
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4755f4
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d1b7
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x475640
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x528840
jne 0x47563e
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x570074]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
lea eax, [esp + 0x210]
mov esi, edx
push eax
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4756aa
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004d0217
add esp, 0x414
ret
lea eax, [esp + 8]
push eax
push 0
push dword [edi]
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x475691
push ebx
lea eax, [esp + 0xc]
push ebp
push eax
call fcn.004d5c34
mov edi, eax
add esp, 4
mov eax, dword [esi]
test edi, edi
jne 0x47576a
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x475810
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x475715
cmp dword [eax - 8], 0
jl 0x47582b
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
jmp 0x475810
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x475742
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x528840
jne 0x475835
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x528840
jne 0x47583e
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [esi], eax
jmp 0x475810
add eax, 0x10
mov dword [esi], eax
jmp 0x475810
mov ebp, dword [eax - 0xc]
lea ebx, [esp + 0x10]
sub ebx, eax
sar ebx, 1
test edi, edi
js 0x475848
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x475796
push edi
mov ecx, esi
call fcn.0040d01b
mov ecx, dword [esi]
cmp ebx, ebp
ja 0x4757e8
mov eax, dword [ecx - 8]
lea edx, [ecx + ebx*2]
lea ebx, [edi + edi]
test ebx, ebx
je 0x4757fe
test ecx, ecx
jne 0x4757bf
call fcn.004d5d64
mov dword [eax], 0x16
call fcn.004d5bd4
jmp 0x4757fe
test edx, edx
je 0x4757ad
add eax, eax
cmp eax, ebx
jae 0x4757db
call fcn.004d5d64
mov dword [eax], 0x22
call fcn.004d5bd4
jmp 0x4757fe
push ebx
push edx
push ecx
call fcn.004d1e90
add esp, 0xc
jmp 0x4757fe
mov edx, dword [ecx - 8]
lea ebx, [edi + edi]
lea eax, [esp + 0x10]
add edx, edx
push ebx
push eax
call fcn.0040d0ee
add esp, 8
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x47582b
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [ebx + eax], cx
mov ecx, dword [esp + 0x420]
mov al, 1
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.004d0217
add esp, 0x414
ret
push 0x80070057
call fcn.0040d173
mov ecx, edx
call ebx
jmp 0x475742
mov ecx, edi
call dword [eax + 0xc]
jmp 0x475760
push 0x80070057
call fcn.0040d173
int3
Function at 0x476900
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509f68
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x570074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], 0x527e68
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x476970
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x476970
mov dword [edi], eax
mov bl, 1
jmp 0x476972
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x527e68
test esi, esi
je 0x476992
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4769b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509fa0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x570074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.00476a60
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x476a43
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x528840
jne 0x476a3f
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4772d0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x47737f
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x47731c
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x477324
cmp dword [eax - 8], 0
jl 0x4773dd
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x477351
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x528840
jne 0x4773e7
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x528840
jne 0x4773f0
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
js 0x4773fa
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x47739c
push edi
mov ecx, esi
call fcn.0040d01b
push edi
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x4773b0
xor ecx, ecx
jmp 0x4773c2
push dword [eax - 8]
push eax
call fcn.004d8907
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x4773dd
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4773dd
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
lea eax, [edx + 1]
ret 4
push 0x80070057
call fcn.0040d173
mov ecx, edx
call ebx
jmp 0x477351
mov ecx, edi
call dword [eax + 0xc]
jmp 0x477372
push 0x80070057
call fcn.0040d173
int3
Function at 0x482ed0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x570074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x483028
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x52a178
je 0x483028
call edx
test al, al
je 0x483028
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push 0x1f6
mov word [eax], cx
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x482fb8
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
ja 0x482f94
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmovae ecx, dword [ebp - 0x28]
xor eax, eax
mov word [ecx + esi*2], ax
jmp 0x482fa1
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.0044f09c
cmp dword [ebp - 0x14], 8
lea eax, [esi + 1]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
cmp eax, 0x52a178
je 0x482fce
push dword [edi + 0x24]
lea edx, [ebp - 0x28]
push edx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x483014
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
ja 0x483044
add eax, eax
cmp eax, 0x1000
jb 0x48300b
test cl, 0x1f
jne 0x483044
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x483044
sub ecx, eax
cmp ecx, 4
jb 0x483044
cmp ecx, 0x23
ja 0x483044
mov ecx, eax
push ecx
call fcn.004d0212
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0217
mov esp, ebp
pop ebp
ret
call fcn.004d5be4
int3
Function at 0x485504
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x50b247
call fcn.004d0de3
mov bl, dl
mov esi, ecx
cmp byte [0x5735e0], 0
je 0x485551
lea ecx, [ebp - 0x10]
call fcn.0040c77f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push dword [esi]
call fcn.00490d37
push eax
mov ecx, 0x5735ac
call fcn.0049abcf
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040ca45
or dword [ebp - 4], 0xffffffff
cmp byte [0x570b1c], 0
push dword [esi]
je 0x4855ae
lea ecx, [ebp - 0x10]
call fcn.0040d264
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.0040c77f
movzx ecx, bl
shl ecx, 0x12
add ecx, 0x10
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00471df0
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040ca45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040ca45
jmp 0x4855b4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004d0dac
ret
Function at 0x4869fe
Capabilities:
Copy file

Disassembly:
push 0x18
mov eax, 0x50b65d
call fcn.004d0de3
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
call fcn.0040c77f
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0040c77f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040c77f
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
mov ecx, dword [edi + 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0048daf8
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0044d0c3
push ebx
push str.__
lea ecx, [ebp - 0x10]
call fcn.00435a56
test eax, eax
jne 0x486a83
mov esi, dword [ebp - 0x10]
add esi, 8
jne 0x486a72
mov eax, ebx
jmp 0x486a79
push esi
call fcn.004d5c34
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040d1b7
push dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
lea ecx, [ebp + 0xc]
call fcn.0046f9e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
mov edx, eax
mov dword [esp], 0x52d76c
call fcn.0045015c
pop ecx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0040ca45
push ebx
mov dl, 1
lea ecx, [ebp - 0x14]
call fcn.00476640
lea edx, [ebp - 0x14]
mov dword [esp], str.instname_target.msi
lea ecx, [ebp + 0xc]
call fcn.0045015c
pop ecx
lea esi, [edi + 0x24]
mov byte [ebp - 4], 7
push eax
mov ecx, esi
call fcn.0044d0c3
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0040ca45
push str.instname_custom.mst
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.0045015c
pop ecx
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 8
push eax
mov dword [ebp - 0x20], ecx
call fcn.0044d0c3
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0040ca45
push ebx
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x486b64
mov ecx, dword [ebp + 8]
call fcn.0040c77f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 3
call fcn.0040ca45
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040ca45
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040ca45
mov byte [ebp - 4], bl
jmp 0x486c14
push 0x52bee4
lea ecx, [ebp + 0xc]
call fcn.0040d264
add edi, 0x1c
mov byte [ebp - 4], 9
push edi
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004870b7
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
mov bl, al
call fcn.0040ca45
test bl, bl
je 0x486bd9
push str.AI_PRODUCTNAME_ARP
lea ecx, [ebp + 0xc]
call fcn.0040d264
push edi
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 0xa
push eax
push esi
call fcn.004870b7
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0040ca45
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push edi
push esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00486f2c
lea ecx, [ebp + 0xc]
call fcn.0040ca45
jmp 0x486bdc
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
push edi
call fcn.004069f3
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 3
call fcn.0040ca45
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040ca45
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040ca45
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040ca45
mov eax, dword [ebp + 8]
call fcn.004d0dac
ret 8
Function at 0x4870b7
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x50b79a
call fcn.004d0de3
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], ebx
je 0x4870db
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x18], ebx
push dword [eax]
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48724b
lea ecx, [ebp - 0x1c]
call fcn.0040c77f
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x1c]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.00410eb2
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0
je 0x48712b
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.msi.dll_MsiEnumClientsA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x487230
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x487230
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], eax
je 0x48716b
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne bl
cmp dword [ebp - 0x10], 0
mov byte [ebp + 0xb], bl
je 0x487191
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
test bl, bl
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48721f
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov edi, eax
je 0x4871c7
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
test edi, edi
je 0x48721f
mov eax, dword [ebp + 0xc]
test bl, bl
mov ebx, dword [ebp + 0x10]
cmovne eax, ebx
push dword [eax]
push 1
push edi
mov edi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call edi
test eax, eax
jne 0x48721f
cmp byte [ebp + 0xb], al
cmovne ebx, dword [ebp + 0xc]
push dword [ebx]
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x48721f
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48721f
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48721f
mov bl, 1
jmp 0x487221
xor bl, bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x487230
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48723f
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0040ca45
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x48725a
push dword [ebp - 0x18]
call esi
mov al, bl
call fcn.004d0dac
ret 0xc
Function at 0x487aba
Capabilities:
Reference sql statements

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x570074]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x10
mov eax, 0x50b991
call fcn.004d0de3
mov esi, edx
mov ebx, ecx
mov eax, dword [ebp + 0x20c]
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.00480610
push esi
lea eax, [ebp]
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x14], 0
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
je 0x487b1e
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push ebx
lea ecx, [ebp]
call fcn.00487d00
pop ecx
test eax, eax
jns 0x487b3a
xor bl, bl
jmp 0x487be8
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x487b4d
push dword [ebp - 0x10]
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
je 0x487b88
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x487b83
cmp esi, 0x80070103
je 0x487b83
call fcn.00487ddb
mov eax, dword [ebp - 0x10]
jmp 0x487b8d
mov esi, 0x80070057
test esi, esi
jns 0x487b95
xor bl, bl
jmp 0x487bd9
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
push ecx
push 0x528070
push 1
push eax
call esi
cmp eax, 0xea
jne 0x487bd4
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
inc eax
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
call fcn.00480630
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x487be8
push dword [ebp - 0x10]
call edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x487bf7
push dword [ebp - 0x14]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004d0217
lea esp, [ebp + 0x204]
pop ebp
ret