joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c4c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov eax, dword [0x0045f9bc]
and eax, 1
test eax, eax
jne 0x40c500
mov eax, dword [0x0045f9bc]
or eax, 1
mov dword [0x0045f9bc], eax
call fcn.0040c710
mov dword [0x0045f9b8], eax
mov eax, dword [rsp]
mov eax, 0x10
sub rsp, rax
lea rax, [rsp + 0x20]
mov ecx, dword [rax]
mov qword [rbp + 0x18], rax
mov r8d, 0x30
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x40c536
xor eax, eax
jmp 0x40c6db
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
dec eax
mov eax, eax
not rax
mov rcx, qword [rbp + 0x18]
and rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x28]
sub rax, rcx
mov qword [rbp + 0x20], rax
cmp dword [0x00445b00], 1
jne 0x40c584
mov dword [rbp + 0x148], 0x11000
jmp 0x40c58e
mov dword [rbp + 0x148], 0x2000
movsxd rax, dword [rbp + 0x148]
mov rcx, qword [rbp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x20], rax
jae 0x40c5b7
xor eax, eax
jmp 0x40c6db
cmp dword [0x00445b00], 1
je 0x40c68d
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x90], rax
mov r8d, 0x30
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x40c5f5
xor eax, eax
jmp 0x40c6db
mov rax, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x90]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x90], rax
mov eax, dword [rbp + 0x80]
and eax, 0x1000
test eax, eax
je 0x40c5d2
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x90], rax
mov eax, dword [rbp + 0x84]
and eax, 0x100
test eax, eax
je 0x40c640
mov eax, 1
jmp 0x40c6db
mov rax, qword [rbp + 0x90]
cmp qword [rbp + 0x20], rax
jae 0x40c654
xor eax, eax
jmp 0x40c6db
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x90], rax
jae 0x40c66c
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov eax, dword [rbp + 0x28]
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x40c698
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x90], rax
cmp dword [0x00445b00], 1
jne 0x40c6ad
mov dword [rbp + 0x14c], 1
jmp 0x40c6b7
mov dword [rbp + 0x14c], 0x104
mov eax, dword [rbp + 0x14c]
mov dword [rbp], eax
mov eax, dword [rbp + 0x28]
lea r9, [rbp + 0x10]
mov r8d, dword [rbp]
mov rdx, rax
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rsp, [rbp + 0x150]
pop rbp
ret
Function at 0x40f9d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1a8
mov qword [rsp + 0x198], 0xfffffffffffffffe
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x178], eax
cmp dword [rsp + 0x178], 0
jne 0x40fa9b
mov dword [rsp + 0x17c], 0
cmp qword [rsp + 0x50], 0
je 0x40fa80
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x17c], eax
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x17c]
mov dword [rsp + 0x178], eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x40faf2
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x160], eax
mov dword [rsp + 0x188], 0
cmp qword [rsp + 0x50], 0
je 0x40fae6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x188], eax
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x160]
jmp 0x40fc29
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40fba6
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.0040f9d0
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x40fb99
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x18c], 0
cmp qword [rsp + 0x50], 0
je 0x40fb8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x18c], eax
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x164]
jmp 0x40fc29
mov dword [rsp + 0x40], 0x100
jmp 0x40fafa
mov dword [rsp + 0x190], 0
cmp qword [rsp + 0x50], 0
je 0x40fbd4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x190], eax
mov qword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x168], eax
mov dword [rsp + 0x194], 0
cmp qword [rsp + 0x50], 0
je 0x40fc22
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x194], eax
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x168]
add rsp, 0x1a8
ret
Function at 0x410e00
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jge 0x410e99
xor eax, eax
cmp eax, 1
je 0x410e82
jmp 0x410e95
lea r8, str.Should_not_be_here___n
xor edx, edx
mov ecx, 0x100
call fcn.0040d330
xor eax, eax
jmp 0x410eb6
cmp dword [rsp + 0x60], 0
jbe 0x410eaa
mov dword [rsp + 0x64], 1
jmp 0x410eb2
mov dword [rsp + 0x64], 0
mov eax, dword [rsp + 0x64]
add rsp, 0x78
ret

Function at 0x410ec0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x410f66
xor eax, eax
cmp eax, 1
je 0x410f4c
jmp 0x410f5f
lea r8, str.RegQueryInfoKey_Failed
xor edx, edx
mov ecx, 0x100
call fcn.0040d330
xor eax, eax
jmp 0x41102b
cmp dword [rsp + 0x60], 1
jne 0x41100e
mov dword [rsp + 0x70], 0x1000
mov ecx, 0x1000
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x410f98
xor eax, eax
jmp 0x41102b
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
jne 0x410fff
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
test eax, eax
je 0x410fff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_free]
mov eax, 1
jmp 0x41102b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x41102b
cmp dword [rsp + 0x60], 0
jbe 0x41101f
mov dword [rsp + 0x74], 1
jmp 0x411027
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x74]
add rsp, 0x88
ret
Function at 0x411240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x100], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x100], 0
jne 0x411278
xor al, al
jmp 0x4112c3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x004112d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x4112b7
mov dword [rsp + 0x3c], 1
jmp 0x4112bf
mov dword [rsp + 0x3c], 0
mov al, byte [rsp + 0x3c]
add rsp, 0x48
ret

Function at 0x41cb40
Capabilities:
Reference sql statements

Disassembly:
mov word [rsp + 8], cx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
movzx eax, byte [0x00438f7d]
mov byte [rsp + 0x28], al
lea rax, [rsp + 0x29]
mov rdi, rax
xor eax, eax
mov ecx, 9
rep stosb byte [rdi], al
mov dword [0x004601b0], 0
movzx eax, word [rsp + 0x50]
test eax, eax
jne 0x41cbbd
lea rdx, str.Error_in_opening_MSI_DB
lea rcx, [0x0045ff90]
call qword [sym.imp.msvcrt.dll_sprintf]
mov dword [0x0045fd6c], 1
lea rcx, [0x0045fd70]
call fcn.0041d420
mov dword [0x004601b0], 0
mov eax, dword [0x004601b0]
jmp 0x41cc26
mov r8d, 0x100
lea rdx, str.SELECT__FROM_ASIC_IDs_WHERE__Items_
lea rcx, [0x0045fd70]
call qword [sym.imp.msvcrt.dll_strncpy]
movzx eax, word [rsp + 0x50]
mov r8d, eax
lea rdx, [0x00438fc0]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x28]
lea rcx, [0x0045fd70]
call sub.msvcrt.dll_strcat
mov r8d, dword [0x004601a4]
mov edx, dword [0x004601a8]
mov ecx, dword [0x004601a0]
call fcn.0041cc40
mov dword [0x004601b0], eax
mov eax, dword [0x004601b0]
add rsp, 0x40
pop rdi
ret
Function at 0x41d420
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [0x004601c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x0045fe80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov r9d, dword [0x004601c8]
lea r8, str.Error_CMD_
lea rdx, [0x0043937c]
lea rcx, [rsp + 0x170]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8, qword [rsp + 0x290]
lea rdx, [0x00439384]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, qword [0x004601c0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r9d, dword [0x004601c8]
lea r8, str.Error_MSG_
lea rdx, [0x00439394]
lea rcx, [rsp + 0x170]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [0x0045ff90]
lea rdx, [0x0043939c]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, qword [0x004601c0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r9d, dword [0x004601c8]
lea r8, str.Error_CODE_
lea rdx, [0x004393ac]
lea rcx, [rsp + 0x170]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, dword [0x0045fd6c]
lea rdx, [0x004393b4]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, qword [0x004601c0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x004601c8]
inc eax
mov dword [0x004601c8], eax
mov rcx, qword [0x004601c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x288
ret
Function at 0x41d600
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x178]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x41d77e
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41d77e
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41d77e
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov edx, 0x6801
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x41d77e
mov dword [rsp + 0x54], 0x100
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x170]
call fcn.0041d790
cmp eax, 1
jne 0x41d757
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x41d757
mov eax, dword [rsp + 0x54]
mov byte [rsp + rax + 0x60], 0
mov r8d, dword [rsp + 0x188]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x41d780
xor al, al
add rsp, 0x168
ret
Function at 0x421100
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x170]
call fcn.004201b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x42113e
mov eax, 8
jmp 0x421225
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x170]
call fcn.00420330
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
je 0x421182
mov eax, dword [rsp + 0x150]
jmp 0x421225
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x154], eax
cmp dword [rsp + 0x154], 0
je 0x4211bd
mov eax, 8
jmp 0x421225
cmp qword [rsp + 0x178], 0
jne 0x4211d7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x421225
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x421218
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 9
jmp 0x421225
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x168
ret
Function at 0x4226b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x42272a
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret

Function at 0x4227e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x558
mov dword [rsp + 0x184], 0
mov dword [rsp + 0x40], 0x64
mov r9d, 6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rsp + 0x188], rax
cmp qword [rsp + 0x188], 0xffffffffffffffff
jne 0x42282b
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
mov dword [rsp + 0x48], 0x20
mov dword [rsp + 0x180], 0
jmp 0x422850
mov eax, dword [rsp + 0x180]
inc eax
mov dword [rsp + 0x180], eax
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x180]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x4229a8
mov dword [rsp + 0x434], 0x104
mov dword [rsp + 0x430], 0x104
mov dword [rsp + 0x430], 0x104
mov byte [rsp + 0x320], 0
lea r9, [rsp + 0x430]
mov r8d, dword [rsp + 0x430]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDescriptionA]
mov dword [rsp + 0x434], 0x104
mov byte [rsp + 0x440], 0
lea rax, [rsp + 0x434]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x434]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x310]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
lea rcx, [rsp + 0x320]
call sub.msvcrt.dll_strlen
test rax, rax
jbe 0x4229a3
lea rcx, [rsp + 0x440]
call sub.msvcrt.dll_strlen
test rax, rax
jbe 0x4229a3
lea r9, [rsp + 0x440]
lea r8, [rsp + 0x320]
lea rdx, str.__s_______s_
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r9d, dword [rsp + 0x184]
lea r8, [0x00439af0]
lea rdx, [0x00439b04]
lea rcx, [rsp + 0x190]
call qword [sym.imp.msvcrt.dll_sprintf]
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x190]
call fcn.00414f50
mov eax, dword [rsp + 0x184]
inc eax
mov dword [rsp + 0x184], eax
jmp 0x422840
mov r8d, dword [rsp + 0x184]
lea rdx, [0x00439b0c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, dword [rsp + 0x184]
lea rdx, [rsp + 0x2a0]
lea rcx, [0x00439b10]
call fcn.00414f50
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
add rsp, 0x558
ret
Function at 0x422a40
Capabilities:
Get installed programs
Query or enumerate registry key
Terminate process

Disassembly:
sub rsp, 0x658
mov qword [rsp + 0x280], 0xffffffff80000002
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov qword [rsp + 0x288], rax
mov dword [rsp + 0x160], 0
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x298], 1
mov dword [rsp + 0x640], 0
mov dword [rsp + 0x40], 0x64
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x422adb
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [rsp + 0x298], 1
jne 0x422cf9
mov dword [rsp + 0x44], 0x104
mov eax, dword [0x0046050c]
mov dword [rsp + 0x644], eax
mov eax, dword [0x0046050c]
inc eax
mov dword [0x0046050c], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x170]
mov edx, dword [rsp + 0x644]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x422b9e
cmp dword [rsp + 0x160], 0xea
je 0x422b9e
cmp dword [rsp + 0x160], 0x103
jne 0x422b93
mov dword [rsp + 0x298], 0
jmp 0x422adb
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x3c0]
call sub.msvcrt.dll_strcpy
lea rdx, [0x00439b5c]
lea rcx, [rsp + 0x3c0]
call sub.msvcrt.dll_strcat
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x3c0]
call sub.msvcrt.dll_strcat
mov ecx, 0x105
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x290], rax
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x290]
call sub.msvcrt.dll_memset
mov r9, qword [rsp + 0x280]
lea r8, str.UninstallString
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x3c0]
call fcn.004226b0
mov rax, qword [rsp + 0x290]
movsx eax, byte [rax]
test eax, eax
je 0x422ce6
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x290]
call sub.msvcrt.dll_memset
mov r9, qword [rsp + 0x280]
lea r8, str.DisplayName
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x3c0]
call fcn.004226b0
mov rax, qword [rsp + 0x290]
movsx eax, byte [rax]
test eax, eax
je 0x422ce6
mov r8, qword [rsp + 0x290]
lea rdx, str.__s_
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r9d, dword [rsp + 0x640]
lea r8, [0x00439b88]
lea rdx, str._s_04d
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.msvcrt.dll_sprintf]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2b0]
call fcn.00414f50
mov eax, dword [rsp + 0x640]
inc eax
mov dword [rsp + 0x640], eax
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x422adb
mov r8d, dword [rsp + 0x640]
lea rdx, [0x00439ba8]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, dword [rsp + 0x640]
lea rdx, [rsp + 0x5d0]
lea rcx, [0x00439bb0]
call fcn.00414f50
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x658
ret
Function at 0x4245d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x100]
call fcn.00422f50
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x0043fca8]
mov r8d, 0x15
xor edx, edx
lea rcx, [0x0043fd78]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x42463f
xor eax, eax
jmp 0x424735
mov edx, 0xffffffff
lea rcx, str.ROOTCIMV2
call fcn.004036c0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x18]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x10]
cmp dword [rsp + 0x60], 0
jge 0x4246ea
xor eax, eax
jmp 0x424735
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x424733
mov rax, qword [rsp + 0x58]
jmp 0x424735
xor eax, eax
add rsp, 0xf8
ret