joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40486d
Capabilities:
Delete registry key

Disassembly:
push 0x24
mov eax, 0x58ae87
call fcn.0055f097
push 0x58f9c4
lea ecx, [ebp - 0x28]
call fcn.00401302
mov esi, str.RunOne
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.00564b19
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040255e
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0xf003f
mov dword [ebp - 0x2c], edi
push ebx
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x40491d
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push 0x58fd94
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x4048f8
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x58fd9c
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40491d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x28]
call fcn.004014e8
call fcn.0055f052
ret

Function at 0x404adb
Capabilities:
Terminate process

Disassembly:
push 0x1c
mov eax, 0x58af84
call fcn.0055f097
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push esi
call fcn.00401302
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x404b20
push esi
call fcn.00411c20
pop ecx
test eax, eax
jle 0x404b20
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x404b20
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x28]
call fcn.004014e8
call fcn.0055f052
ret 4
Function at 0x404bf4
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a0
mov eax, 0x58abad
call fcn.0055f097
mov edi, ecx
xor ebx, ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.00401cdd
mov esi, 0x58f934
mov byte [ebp - 4], 1
push esi
call fcn.00564b19
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.0040255e
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404d6c
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x404d6c
push 0x2e
pop eax
cmp word [ebp - 0x27c], ax
je 0x404c5a
cmp word [ebp - 0x27a], 0
je 0x404c5a
cmp word [ebp - 0x27a], ax
jne 0x404c99
cmp word [ebp - 0x278], 0
je 0x404c5a
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401302
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push eax
je 0x404d18
call fcn.00401cdd
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.0040255e
push 0x58f93c
call fcn.00564b19
pop ecx
push eax
push 0x58f93c
lea ecx, [ebp - 0x28]
call fcn.0040255e
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00401cdd
mov ecx, edi
call fcn.00404bf4
jmp 0x404d53
call fcn.00401cdd
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 4
call fcn.0040255e
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00401cdd
mov ecx, edi
call fcn.00404db6
lea ecx, [ebp - 0x28]
call fcn.004014e8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004014e8
jmp 0x404c5a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404d9e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x58]
call fcn.004014e8
lea ecx, [ebp + 8]
call fcn.004014e8
call fcn.0055f052
ret 0x18

Function at 0x404e01
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0040486d
mov ecx, esi
call fcn.00404e2d
mov ecx, esi
call fcn.00404e48
mov ecx, esi
call fcn.004042bb
mov ecx, esi
call fcn.00404244
mov ecx, esi
pop esi
jmp fcn.00403ffe
Function at 0x4054d4
Capabilities:
Delete registry key

Disassembly:
push 0x1c
mov eax, 0x58af84
call fcn.0055f097
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x14], 8
jb 0x4054ed
mov ecx, dword [ecx]
push dword [esi + 8]
mov eax, dword [ebp + 8]
xor edi, edi
or eax, 0xf003f
push eax
push edi
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], edi
jne 0x405566
push 0x5902ec
lea ecx, [ebp - 0x28]
call fcn.00401302
mov dword [ebp - 4], edi
mov edi, str.BKStPDFCah
push edi
call fcn.00564b19
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040255e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
mov eax, dword [esi + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.004014e8
call fcn.0055f052
ret 4
Function at 0x40556e
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x405581
mov eax, dword [eax]
push dword [esi + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or edi, 0xf003f
push edi
push 0
push eax
mov eax, dword [esi + 4]
push dword [eax]
call ebx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x405693
push dword [esi + 0x10]
mov eax, dword [esi + 0xc]
push edi
push 0
push 0x590260
push dword [eax]
call ebx
mov ecx, dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x405658
push dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push edi
push 0
mov edi, 0x590268
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x405621
mov eax, dword [esi + 0x14]
push 0x59026c
push dword [eax]
call ebx
mov ecx, dword [esi]
push str.win64
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
push dword [eax]
call ebx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x10]
push edi
push dword [eax]
call ebx
mov ecx, dword [esi]
push str.FLAGS
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
push dword [eax]
call ebx
mov ecx, dword [esi]
push str.HELPDIR
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
push dword [eax]
call ebx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xc]
push 0x590260
push dword [eax]
call ebx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x40567e
mov eax, dword [eax]
push 0
push dword [ebp + 8]
push eax
mov eax, dword [esi + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [esi]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40569a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
cmp dword [ecx + 0x14], 8
jb 0x4056ab
mov ecx, dword [ecx]
push dword [edi + 0xc]
mov eax, dword [ebp + 8]
or eax, 0xf003f
push eax
mov eax, dword [edi + 4]
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi]
cmp dword [eax], 0
jne 0x405743
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.InprocServer32
push dword [eax]
call esi
mov ecx, dword [edi]
push str.Programmable
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push str.TypeLib
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push 0x590454
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 8]
pop esi
cmp dword [eax + 0x14], 8
jb 0x40572e
mov eax, dword [eax]
push 0
push dword [ebp + 8]
push eax
mov eax, dword [edi + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [edi]
mov dword [ecx], eax
pop edi
pop ebp
ret 4

Function at 0x405748
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x14], 8
jb 0x405759
mov ecx, dword [ecx]
push dword [esi + 8]
mov eax, dword [ebp + 8]
or eax, 0xf003f
push eax
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x405799
mov eax, dword [esi + 8]
push str.F7C71435_3F18_4903_B387_446346CA44B8
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 4
Function at 0x40579e
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x617a54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
cmp dword [ecx + 0x14], 8
jb 0x4057c0
mov ecx, dword [ecx]
push dword [edi + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
or eax, 0xf003f
push eax
mov eax, dword [edi + 4]
push ebx
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
cmp dword [eax], ebx
je 0x405896
push str.InprocServer32
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x405811
mov eax, dword [eax]
push ebx
push dword [ebp + 8]
push eax
mov eax, dword [edi + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi]
cmp dword [eax], ebx
je 0x405896
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov esi, eax
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x400
push dword [ecx]
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00561510
mov eax, dword [edi]
push esi
push dword [eax]
lea eax, [ebp - 0x20c]
push str.Error:__d_:__d
push eax
call fcn.0040543e
lea eax, [ebp - 0x20c]
push eax
call fcn.00408471
add esp, 0x20
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0055f02c
leave
ret 4
Function at 0x4058a6
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
cmp dword [ecx + 0x14], 8
jb 0x4058b7
mov ecx, dword [ecx]
push dword [edi + 0xc]
mov eax, dword [ebp + 8]
or eax, 0xf003f
push eax
mov eax, dword [edi + 4]
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
cmp dword [eax], 0
je 0x405967
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x58f4c4
push dword [eax]
call esi
mov ecx, dword [edi]
push str.AppID
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.InprocServer32
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push str.ProgID
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push str.Programmable
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push str.TypeLib
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
push str.VersionIndependentProgID
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call esi
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x405972
mov eax, dword [eax]
push 0
push dword [ebp + 8]
push eax
mov eax, dword [edi + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [edi]
pop edi
mov dword [ecx], eax
pop ebp
ret 4
Function at 0x406313
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x58b2c7
call fcn.0055f097
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x28]
push str.SOFTWAREClassesCLSID_
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
call fcn.00401302
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x406381
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00405f37
cmp dword [ebp - 0x2c], 0
je 0x406381
push dword [ebp - 0x2c]
call esi
push str.CLSID_
call fcn.00564b19
pop ecx
push eax
push str.CLSID_
lea ecx, [ebp - 0x28]
call fcn.00401589
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x4063d1
push dword [ebp - 0x30]
mov ecx, edi
call fcn.00405f37
cmp dword [ebp - 0x30], 0
je 0x4063d1
push dword [ebp - 0x30]
call esi
push str.TypeLib_
call fcn.00564b19
pop ecx
push eax
push str.TypeLib_
lea ecx, [ebp - 0x28]
call fcn.00401589
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x406421
push dword [ebp - 0x34]
mov ecx, edi
call fcn.00405fc9
cmp dword [ebp - 0x34], 0
je 0x406421
push dword [ebp - 0x34]
call esi
mov edi, str.SOFTWAREClassesDirectory_background_shellexContextMenuHandlers_
push edi
call fcn.00564b19
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401589
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x38]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x406489
mov edi, str.BKPDF_Extern
push edi
call fcn.00564b19
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401589
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x38]
call esi
lea ecx, [ebp - 0x28]
call fcn.004014e8
call fcn.0055f052
ret
Function at 0x40665f
Capabilities:
Delete registry key

Disassembly:
push 0x234
mov eax, 0x58b335
call fcn.0055f097
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00561510
push 0x58f9c4
lea eax, [ebp - 0x218]
push str._sService
push eax
call fcn.00402c17
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00407f60
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], esi
call fcn.00407f94
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x4066c6
push 0xf013f
jmp 0x4066cb
push 0xf003f
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4066ff
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x240]
call fcn.00407f73
call fcn.0055f052
ret
Function at 0x406710
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x65c
mov eax, 0x58b389
call fcn.0055f097
mov edi, ecx
mov ebx, 0x208
lea eax, [ebp - 0x628]
push ebx
xor esi, esi
push esi
push eax
call fcn.00561510
add esp, 0xc
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
push str.bd5ca
call fcn.0040697b
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
call fcn.00406aa9
mov ecx, edi
call fcn.0040665f
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x65c], esi
push eax
push 9
push esi
push str.SYSTEMCurrentControlSet_services_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40678c
xor eax, eax
jmp 0x406975
mov edi, esi
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x664], edi
mov dword [ebp - 0x660], esi
push 0x58f4c4
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], esi
call fcn.00401302
push ebx
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 1
push esi
push eax
call fcn.00561510
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00561510
lea eax, [ebp - 0x420]
push 0x58f9c4
push eax
call fcn.0056f7c8
lea eax, [ebp - 0x420]
push eax
call fcn.00570c11
add esp, 0x24
lea eax, [ebp - 0x218]
mov ebx, esi
push 0x104
push eax
push esi
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4068c2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00401302
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
call fcn.00570c11
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0056166a
add esp, 0xc
test eax, eax
je 0x40688b
lea eax, [ebp - 0x640]
push eax
cmp dword [ebp - 0x660], edi
je 0x406879
mov ecx, edi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
call fcn.00401cdd
add edi, 0x18
mov dword [ebp - 0x664], edi
jmp 0x40688b
push edi
lea ecx, [ebp - 0x668]
call fcn.00406576
mov edi, dword [ebp - 0x664]
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.004014e8
push 0x104
lea eax, [ebp - 0x218]
inc ebx
push eax
push ebx
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x406816
mov esi, dword [ebp - 0x668]
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406954
push str.SYSTEMCurrentControlSet_services_
lea ecx, [ebp - 0x640]
call fcn.00401302
cmp dword [esi + 0x14], 8
mov ebx, esi
mov byte [ebp - 4], 3
jb 0x4068f1
mov ebx, dword [esi]
push ebx
call fcn.00564b19
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x640]
call fcn.0040255e
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov ebx, reloc.WS2_32.dll_bind
cmovae eax, dword [ebp - 0x640]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.004014e8
add esi, 0x18
cmp esi, edi
jne 0x4068d3
lea ecx, [ebp - 0x658]
call fcn.004014e8
lea ecx, [ebp - 0x668]
call fcn.00404f3f
xor eax, eax
inc eax
call fcn.0055f052
ret
Function at 0x40697b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x58b3bc
call fcn.0055f097
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
push ebx
push eax
call fcn.00561510
push 0x58f9c4
lea eax, [ebp - 0x218]
push 0x58f94c
push eax
call fcn.00402c17
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.00407f60
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.00407f94
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x406a0f
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a96
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push 0xf013f
jmp 0x406a37
push 0xf003f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a96
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x406a5f
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406a96
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x248]
call fcn.00407f73
call fcn.0055f052
ret 8

Function at 0x406aa9
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x617a54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x406aed
push 0x10020
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x406aff
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0055f02c
leave
ret 4
push edi
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
test edi, edi
pop edi
je 0x406aed
xor eax, eax
inc eax
jmp 0x406aef