joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5402d4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
je 0x540335
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov esp, ebp
pop ebp
ret
Function at 0x54a658
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x554a3c], 0
je 0x54a69a
push pe_nt_image_headers32
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x308]
mov ecx, pe_nt_image_headers32
call fcn.00405630
jmp 0x54a6c2
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.00405618
mov esp, ebp
pop ebp
ret

Function at 0x54ab1c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3fc
mov dword [ebp - 4], eax
cmp byte [0x554a3c], 0
je 0x54ab57
lea eax, [ebp - 0xc04]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc04]
mov ecx, 0x400
call fcn.00405630
jmp 0x54ab7b
lea eax, [ebp - 0x404]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00405618
mov esp, ebp
pop ebp
ret

Function at 0x54ab80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3f8
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
cmp byte [0x554a3c], 0
je 0x54abbf
push 0
push 0x1a
lea eax, [ebp - 0xc08]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc08]
mov ecx, 0x400
call fcn.00405630
jmp 0x54abe4
push 0
push 0x1a
lea eax, [ebp - 0x408]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.00405618
cmp byte [ebp - 1], 0
je 0x54abfa
mov eax, dword [ebp - 8]
mov edx, 0x54ac04
call fcn.00405678
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10
Function at 0x401250
Capabilities:
Delete service

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4012a3
mov eax, dword [esp + 0xc]
push ebp
push edi
push 0x10000
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x401299
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x401296
mov ebx, 1
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
mov eax, ebx
pop esi
pop ebx
ret
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4012b0
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40131f
mov eax, dword [esp + 0x28]
push ebp
push esi
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x401312
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x40130a
cmp eax, 3
jne 0x40130f
push 0x78
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x401a00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push 0x41a7a0
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test al, al
je 0x401beb
push str.SogouExplorer.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x401beb
mov dword [0x41a798], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x84
push esi
call edi
push 0x8e
push esi
mov dword [0x41a79c], eax
call edi
push 0xaf
push esi
mov ebx, eax
call edi
push 0x13b
push esi
mov dword [ebp - 0x18], eax
call edi
push 0x4182b0
push esi
mov dword [ebp - 0xc], eax
call edi
mov edi, eax
test ebx, ebx
mov dword [ebp - 0x1c], edi
je 0x401beb
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x401beb
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x401beb
add ebx, 0xe
add eax, 0x6e
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
mov edx, dword [ebx - 7]
and edx, 0xffffff
cmp edx, 0xe80575
jne 0x401beb
cmp dword [eax], 0xf7fc858d
jne 0x401beb
cmp dword [ecx], 0x424548b
jne 0x401beb
push esi
call fcn.00401930
add esp, 4
mov dword [0x41a798], eax
test eax, eax
je 0x401beb
test edi, edi
je 0x401beb
mov ecx, dword [0x41a79c]
test ecx, ecx
je 0x401beb
cmp dword [eax + 1], 0xec8b55ff
jne 0x401beb
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test al, al
je 0x401beb
pushal
pushfd
lea eax, [0x41a798]
mov eax, dword [eax]
mov ecx, dword [eax]
cmp ecx, 0x8b55ff8b
jne 0x401b58
lea edx, [0x4019b0]
sub edx, eax
sub edx, 5
mov ecx, 0xe8
xchg dword [eax], ecx
inc eax
xchg dword [eax], edx
popfd
popal
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
push 0x40
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test al, al
je 0x401beb
pushal
pushfd
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov ecx, 0xc346f633
xchg dword [eax], ecx
popfd
popal
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x10
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test al, al
je 0x401beb
pushal
pushfd
lea eax, [ebp - 0x10]
mov eax, dword [eax]
lea edx, [0x41afa0]
mov ecx, 0xb890
xchg dword [eax], ecx
inc eax
inc eax
xchg dword [eax], edx
popfd
popal
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test al, al
je 0x401beb
pushal
pushfd
lea eax, [ebp - 8]
mov eax, dword [eax]
inc eax
lea edx, [0x41a7a0]
xchg dword [eax], edx
popfd
popal
lea esi, [ebp - 0x14]
push esi
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c00
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x160
mov al, 0xc8
mov cl, 0xf0
push esi
mov byte [esp + 0x13], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x3b], al
push edi
mov cl, 0xc2
lea eax, [esp + 8]
push 0x41
mov dl, 0xec
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x4b], cl
push eax
push 0x12
lea ecx, [esp + 0x5c]
mov byte [esp + 0x14], 0xe1
mov byte [esp + 0x15], 0xd7
mov byte [esp + 0x16], 0xd2
mov byte [esp + 0x17], 0xf3
mov byte [esp + 0x18], 0xe5
mov byte [esp + 0x19], 0xd9
mov byte [esp + 0x1a], 0xc6
mov byte [esp + 0x1b], 0xe2
mov byte [esp + 0x1c], 0xee
mov byte [esp + 0x1d], 0xd5
mov byte [esp + 0x1e], 0xfd
mov byte [esp + 0x1f], 0xc4
mov byte [esp + 0x20], 0xc0
mov byte [esp + 0x21], 0xf7
mov byte [esp + 0x22], 0xe7
mov byte [esp + 0x24], 0xd4
mov byte [esp + 0x25], dl
mov byte [esp + 0x28], 0xdb
mov byte [esp + 0x29], 0xf6
mov byte [esp + 0x2c], 0xc5
mov byte [esp + 0x2d], 0xeb
mov byte [esp + 0x2f], 0xe4
mov byte [esp + 0x30], 0xc7
mov byte [esp + 0x31], 0xea
mov byte [esp + 0x32], 0xe6
mov byte [esp + 0x34], 0xdc
mov byte [esp + 0x35], dl
mov byte [esp + 0x38], 0xc0
mov byte [esp + 0x39], 0xeb
mov byte [esp + 0x3a], 0xfd
mov byte [esp + 0x3c], 0xdc
mov byte [esp + 0x3d], 0xc4
mov byte [esp + 0x3e], 0xc1
mov byte [esp + 0x3f], 0xc9
mov byte [esp + 0x40], 0xdb
mov byte [esp + 0x41], 0xf6
mov byte [esp + 0x42], 0xe7
mov byte [esp + 0x43], 0xd3
mov byte [esp + 0x44], 0xd3
mov byte [esp + 0x45], 0xf4
mov byte [esp + 0x46], pe_nt_image_headers32
mov byte [esp + 0x47], 0xfb
mov byte [esp + 0x48], 0xe1
mov byte [esp + 0x49], 0xf7
mov byte [esp + 0x4a], 0xf3
mov byte [esp + 0x4c], 0xc7
mov byte [esp + 0x4d], 0xdd
mov byte [esp + 0x4e], dl
mov byte [esp + 0x4f], 0xd7
mov byte [esp + 0x50], 0xde
mov byte [esp + 0x51], 0xf7
mov byte [esp + 0x52], 0xe6
mov byte [esp + 0x54], 0xc0
call fcn.004021d0
mov esi, dword [esp + 0x16c]
mov dword [esp + 0x4c], 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401e02
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x64]
push ecx
lea eax, [esp + 0x64]
push edx
push eax
push str.UninstallString
lea ecx, [esp + 0x60]
call fcn.00402260
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x401e02
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
push 0x41a7a0
lea edx, [esp + 0x6c]
push 0xffffffffffffffff
push edx
push 0
push 0
call edi
test eax, eax
je 0x401e02
push 0x104
push 0x41afa0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
je 0x401e02
call fcn.00401a00
lea ecx, [esp + 0x50]
call fcn.00402220
pop edi
mov eax, 1
pop esi
add esp, 0x160
ret
lea ecx, [esp + 0x50]
call fcn.00402220
pop edi
xor eax, eax
pop esi
add esp, 0x160
ret
Function at 0x4023d0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x410
test eax, eax
push esi
mov esi, dword [esp + 0x418]
push edi
je 0x402400
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402400
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402419
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
call fcn.00403360
test eax, eax
je 0x402445
push esi
call fcn.00402600
add esp, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x410
ret
mov al, byte [0x41b7a4]
test al, al
jne 0x40246e
push 0x104
push 0x41b7a4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push 0x41b7a4
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4025f1
lea ecx, [esp + 0x10c]
push ecx
call fcn.00402600
lea edx, [esp + 0x110]
lea eax, [esp + 0xc]
push edx
push str.NUL_s_n
push 0x103
push eax
call sub.MSVCRT.dll__snprintf
push 0x418320
push 0x41b7a4
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x402517
push 0x41831c
push 0x41b7a4
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x4025f1
push esi
call sub.MSVCRT.dll_rewind
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea ecx, [esp + 0x218]
push 0x208
push ecx
stosb byte es:[edi], al
call sub.MSVCRT.dll_fgets
add esp, 0x10
test eax, eax
je 0x402592
lea edx, [esp + 0x210]
push edx
call sub.MSVCRT.dll__strlwr
lea eax, [esp + 0x214]
push str._rename_
push eax
call sub.MSVCRT.dll_strstr
add esp, 0xc
test eax, eax
jne 0x4025c2
push esi
lea ecx, [esp + 0x214]
push 0x208
push ecx
call sub.MSVCRT.dll_fgets
add esp, 0xc
test eax, eax
jne 0x402552
push esi
push str._rename__n
call sub.MSVCRT.dll_fputs
lea edx, [esp + 0x10]
push esi
push edx
call sub.MSVCRT.dll_fputs
add esp, 0x10
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
lea eax, [esp + 0x14]
push esi
push eax
call sub.MSVCRT.dll_fputs
add esp, 0x14
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
Function at 0x402db0
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
push edi
je 0x402e5a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402e5a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402df4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [esp + 0x114]
lea eax, [esp + 8]
push edi
push eax
call fcn.00402db0
add esp, 8
test eax, eax
je 0x402e5a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x402e70
Capabilities:
Move file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x402e83
push edi
call fcn.00402600
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x402e94
push esi
call fcn.00402600
add esp, 4
call fcn.00403360
test eax, eax
je 0x402eb3
xor eax, eax
test esi, esi
setne al
add eax, 4
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
pop esi
ret
push esi
push edi
call fcn.00402ec0
add esp, 8
pop edi
pop esi
ret
Function at 0x4033c0
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x403415
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403415
dec eax
push esi
mov ecx, 0x41bab0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
call fcn.00402260
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
mov ecx, 0x41baf0
call fcn.00402260
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
neg eax
sbb eax, eax
pop esi
inc eax
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x403c40
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x104
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
add edx, 4
push eax
push edx
call fcn.00404830
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403ca0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x403ca0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x404200
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x4042ba
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x40424c
cmp dword [esp + 4], 4
jne 0x4042ba
mov eax, 1
add esp, 0x94
ret
cmp eax, 2
jne 0x4042ba
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x404290
mov eax, dword [esp + 8]
test eax, eax
jne 0x40426e
mov eax, 2
add esp, 0x94
ret
cmp eax, 1
jne 0x40427f
mov eax, 3
add esp, 0x94
ret
cmp eax, 2
jne 0x4042ba
mov eax, 4
add esp, 0x94
ret
cmp eax, 6
jne 0x4042ba
mov eax, dword [esp + 8]
test eax, eax
jne 0x4042a9
mov eax, 5
add esp, 0x94
ret
cmp eax, 1
jne 0x4042ba
mov eax, 6
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x4043b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x413370]
mov edx, dword [0x413378]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [0x413374]
mov eax, dword [0x41337c]
mov dword [esp + 0x14], ecx
mov ecx, 0x41c870
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x10
call fcn.00402260
lea ecx, [esp + 8]
mov esi, eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, 0x41c860
call fcn.00402260
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40444b
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40443e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x404467
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
call fcn.00404480
pop edi
pop esi
add esp, 0x18
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 8

Function at 0x404480
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x40449a
xor eax, eax
add esp, 0x10
ret 4
push esi
mov ecx, 0x41c870
call fcn.00402260
lea ecx, [esp + 4]
push 0x10
push ecx
push 3
mov ecx, 0x41c860
mov esi, eax
call fcn.00402260
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, dword [esp + 0x18]
pop esi
test eax, eax
je 0x4044eb
mov edx, dword [esp]
mov ecx, dword [esp + 4]
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, 1
add esp, 0x10
ret 4

Function at 0x404500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov ecx, 0x41c870
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call fcn.00402260
mov esi, eax
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, 0x41c850
call fcn.00402260
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ax, word [esp + 4]
pop esi
add esp, 0xc
ret
Function at 0x405260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov dword [esp + 8], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
push 0x103
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4052e1
xor al, al
pop edi
add esp, 0x214
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x114]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40531b
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
add esp, 0x214
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 4
setae al
add esp, 0x214
ret

Function at 0x4053f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x41c970
push ebx
push eax
xor ebx, ebx
call fcn.00402260
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x405468
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x40545d
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret

Function at 0x405480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x41c960
push ebx
push eax
xor ebx, ebx
call fcn.00402260
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4054f8
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x4054ed
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret