joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x588c1e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00404960
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00404960
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00404960
mov byte [esp + 0x18], 2
movzx eax, byte [esi + 0x48]
mov byte [edi + 0x48], al
movzx eax, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x415570
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x588e08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jne 0x4155b8
xor al, al
jmp 0x41563e
lea esi, [edi + 4]
mov dword [esp + 0x18], esi
test esi, esi
je 0x4155d0
mov eax, dword [esi]
test eax, eax
je 0x4155d0
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x28], 0
push ebp
push dword [edi]
call fcn.00415660
mov edi, eax
test edi, edi
jne 0x4155ea
xor bl, bl
jmp 0x41561b
push edi
call fcn.004523b0
add esp, 4
push edi
sub eax, 0x64
je 0x415612
dec eax
je 0x415608
call fcn.004518a0
add esp, 4
xor bl, bl
jmp 0x41561b
call fcn.004518a0
add esp, 4
jmp 0x415619
mov ecx, ebx
call fcn.00415890
mov bl, 1
mov dword [esp + 0x28], 0xffffffff
test esi, esi
je 0x41563c
mov eax, dword [esi]
test eax, eax
je 0x415634
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00564de8
add esp, 0x18
ret 8
Function at 0x415a30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0
push dword [0x7e16be]
push dword [0x7e16c4]
call fcn.0056754b
movzx eax, word [0x7e16d6]
imul eax, dword [0x7e16d0]
imul eax, dword [0x7e16cc]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
call fcn.00560e4f
movzx ecx, word [0x7e16d6]
imul ecx, dword [0x7e16d0]
push dword [0x7e16c4]
mov dword [0x7e16f4], eax
push 1
imul ecx, dword [0x7e16cc]
shr ecx, 3
push ecx
push eax
call fcn.00567410
mov ax, word [0x7e16d6]
mov esi, dword [0x7e16d0]
mov ecx, dword [0x7e16cc]
shr ax, 3
movzx ebp, ax
mov ebx, ebp
mov dword [esp + 0x34], ecx
mov eax, ebx
mov dword [esp + 0x38], esi
imul eax, esi
imul eax, ecx
push eax
call fcn.00560e4f
lea edi, [esi - 1]
mov edx, eax
mov eax, dword [esp + 0x38]
add esp, 0x24
imul edi, ebx
mov dword [0x7e16f0], edx
imul edi, eax
add edi, edx
test esi, esi
je 0x415b70
mov esi, ebx
lea ebx, [edi + 2]
imul esi, eax
mov eax, dword [0x7e16f4]
sub eax, edx
add ebx, eax
sub edx, dword [0x7e16f4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
lea esp, [esp]
xor eax, eax
test esi, esi
je 0x415b66
mov ecx, ebx
mov edx, ebp
sub ecx, edi
add ecx, 0xfffffffe
mov dword [esp + 0x14], ecx
cmp ebp, 1
jne 0x415b32
lea edx, [eax + edi]
mov cl, byte [ecx + edx]
mov byte [edx], cl
jmp 0x415b5a
cmp ebp, 3
jne 0x415b60
mov edx, dword [esp + 0x1c]
lea esi, [eax + edi]
movzx ecx, byte [ecx + esi]
add edx, ebx
mov byte [edx + eax], cl
movzx ecx, byte [ebx + eax - 1]
mov byte [eax + edi + 1], cl
movzx ecx, byte [ebx + eax]
mov byte [esi], cl
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, ebp
add eax, edx
cmp eax, esi
jb 0x415b23
sub edi, esi
sub ebx, esi
dec dword [esp + 0x18]
jne 0x415b10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4160f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
push 0x5a9274
push dword [esp + 0x14]
call fcn.00567236
push 0x5a9278
push dword [esp + 0x20]
mov dword [0x7e16c4], eax
call fcn.00567236
push dword [0x7e16c4]
mov dword [0x7e16b0], eax
push 1
push 0xe
push 0x7e16b4
call fcn.00567410
push dword [0x7e16c4]
push 1
push 0x28
push 0x7e16c8
call fcn.00567410
add esp, 0x30
call fcn.00415a30
call fcn.00415b80
push dword [0x7e16c4]
call fcn.0056676d
add esp, 4
push dword [0x7e16b0]
call fcn.0056676d
mov esi, dword [0x7e16f4]
add esp, 4
mov edi, 0x8123
test esi, esi
je 0x416191
push esi
call fcn.0056503c
mov eax, dword [0x7e16f4]
add esp, 4
test esi, esi
cmovne eax, edi
mov dword [0x7e16f4], eax
mov esi, dword [0x7e16f0]
test esi, esi
je 0x4161b3
push esi
call fcn.0056503c
mov eax, dword [0x7e16f0]
add esp, 4
test esi, esi
cmovne eax, edi
mov dword [0x7e16f0], eax
pop edi
pop esi
pop ecx
ret 8
Function at 0x416b70
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x586b00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x34]
cmp dword [esp + 0x48], 8
lea edx, [esp + 0x14]
cmovae ecx, dword [esp + 0x34]
call fcn.00405b10
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ebp, eax
jne 0x416bff
xor bl, bl
jmp 0x416c3b
mov ebx, eax
xor ecx, ecx
sub ebx, ebp
xor edi, edi
add ebx, 3
mov esi, ebp
shr ebx, 2
cmp ebp, eax
cmova ebx, ecx
test ebx, ebx
je 0x416c39
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x416c31
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
add esi, 4
cmp edi, ebx
jne 0x416c18
mov bl, 1
mov byte [esp + 0x2c], 0
test ebp, ebp
je 0x416c65
push ebp
call fcn.00564de3
add esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x416c80
push dword [esp + 0x34]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov word [esp + 0x34], ax
mov al, bl
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00564de8
add esp, 0x1c
ret
Function at 0x416cc0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x589010
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x40], 0
xor esi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416d10
push 9
xor eax, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
push str.Software_
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
call fcn.00404a80
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x1c]
push 0x24
push str.MicrosoftWindowsCurrentVersionRun
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x20]
mov edi, esi
cmovae eax, dword [esp + 0x20]
neg edi
push 0x20006
push 0
sbb edi, edi
push eax
add edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call ebp
test eax, eax
je 0x416dd4
push 0x15
push str.SoftwareWow6432Node_
lea ecx, [esp + 0x24]
call fcn.00404a80
push 0x24
push str.MicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push edi
call ebp
test eax, eax
jne 0x416df2
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x416dfd
cmp dword [esp + 0x5c], 8
lea eax, [esp + 0x48]
cmovae eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x416dfd
push eax
call ebx
mov byte [esp + 0x40], 0
cmp dword [esp + 0x30], 8
jb 0x416e15
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jl 0x416d10
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x5c], 8
jb 0x416e51
push dword [esp + 0x48]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x4170a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5890e1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x28], 0
xorps xmm0, xmm0
mov esi, dword [esp + 0x30]
mov dword [esp + 8], 0
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0
call fcn.00417300
mov dword [esp + 0x28], 2
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
call fcn.00416f00
test eax, eax
je 0x417173
mov ecx, dword [esi + 0x14]
add eax, 0x2f
movzx edx, ax
cmp ecx, 8
jb 0x417145
mov eax, dword [esi]
jmp 0x417147
mov eax, esi
cmp ecx, 8
jb 0x417150
mov ecx, dword [esi]
jmp 0x417152
mov ecx, esi
test eax, eax
je 0x41715a
sub eax, ecx
sar eax, 1
push edx
push 1
push eax
mov ecx, esi
call fcn.00415710
push ecx
lea ecx, [esp + 0x14]
call fcn.00416f00
test eax, eax
jne 0x417133
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4171a4
push eax
call fcn.00564de3
add esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564de8
add esp, 0x24
ret 4
Function at 0x41b0f0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x58995b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x258]
mov ebx, dword [esp + 0x254]
mov eax, dword [esp + 0x25c]
push ebp
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b28a
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41b28a
mov esi, dword [0x7e18a0]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0042a640
cmp dword [eax], esi
jne 0x41b28a
xor eax, eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov dword [esp + 0x24c], eax
push 0x1fe
push eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x3c]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x28]
call fcn.0040bc40
push 0
push dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
call fcn.0042a580
cmp eax, 0xffffffff
jne 0x41b226
push str.RC::RCPackagesInstall::AutoClickBtn
push str._s_error:_GetWindowText__s_Failed.
push 1
push 3
call fcn.004c3cc0
push eax
call fcn.004c4520
add esp, 0x14
xor bl, bl
jmp 0x41b251
movzx eax, byte [0x7e1a4d]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x28]
push eax
call fcn.0042af50
push 0
push 0
push 0xf5
push ebp
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov bl, 1
mov dword [esp + 0x24c], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x41b26f
push dword [esp + 0x24]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov word [esp + 0x24], ax
mov al, bl
mov dword [esp + 0x34], 0
jmp 0x41b28c
xor al, al
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00564de8
add esp, 0x23c
ret 0xc
Function at 0x422230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5871cb
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xd0]
mov esi, dword [esp + 0xd4]
push str.PACKAGE
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42229e
push str.RC::RCPackagesInstall::ExtractBinResource
push str._s_error:_FindResource_Failed.
jmp 0x422362
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4222c3
push str.RC::RCPackagesInstall::ExtractBinResource
push str._s_error:_LockResource_Failed.
jmp 0x422362
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x422334
push 0xa8
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4222f0
mov eax, dword [esi]
jmp 0x4222f2
mov eax, esi
sub esp, 0xc
lea ecx, [esp + 0x20]
push eax
call fcn.00407e90
mov dword [esp + 0xc8], 0
lea ecx, [esp + 0x14]
push 0
push edi
push ebx
call fcn.00407d50
lea ecx, [esp + 0x14]
call fcn.00408030
mov dword [esp + 0xc8], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004072b0
cmp edi, 4
ja 0x422345
push str.RC::RCPackagesInstall::ExtractBinResource
push str._s_error:_FileSize___4.
jmp 0x422362
mov ecx, esi
call fcn.004b3170
cmp eax, edi
jne 0x422358
test edx, edx
jne 0x422358
mov al, 1
jmp 0x422376
push str.RC::RCPackagesInstall::ExtractBinResource
push str._s_error:_FileSize_Failed.
push 1
push 3
call fcn.004c3cc0
push eax
call fcn.004c4520
add esp, 0x14
xor al, al
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00564de8
add esp, 0xbc
ret 8
Function at 0x422cf0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a540
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x422f56
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x422d87
push 9
push str.Software_
jmp 0x422d8e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xc
push 0x5a9d24
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x422dfb
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x422e16
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x422d43
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0x70], 1
lea edx, [esp + 0x34]
lea ecx, [eax + 0x1c]
call fcn.00411f00
test al, al
je 0x422f24
push 0x2c
xor eax, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
push str.2345ExplorerUser_DataDefaultpage_file.dat
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
call fcn.00404a80
mov byte [esp + 0x70], 2
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x50]
call fcn.004b2290
add esp, 4
mov byte [esp + 0x70], 4
cmp dword [esp + 0x30], 8
jb 0x422ed5
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
lea ecx, [esp + 0x4c]
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.004bbf20
mov byte [esp + 0x70], 1
cmp dword [esp + 0x60], 8
jb 0x422f0d
push dword [esp + 0x4c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x422f3f
push dword [esp + 0x34]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00564de8
add esp, 0x60
ret
Function at 0x422f80
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x4230c7
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x423017
push 9
push str.Software_
jmp 0x42301e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 7
push 0x5aa044
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x42308b
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4230a6
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x422fd3
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x4230f0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423237
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x423187
push 9
push str.Software_
jmp 0x42318e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push 0x5aa11c
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x4231fb
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423216
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423143
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x423260
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x4232ea
push 9
push str.Software_
jmp 0x4232f1
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push 0x5aa224
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x42335e
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423379
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x4232a6
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret