joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d2cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
movzx eax, word [esp + 8]
push ebp
push esi
push edi
push 0x44042c
push eax
push dword [0x449ca8]
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x42d39b
push esi
push dword [0x449ca4]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
cmp edi, 0x32
jbe 0x42d39b
push esi
push dword [0x449ca4]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x42d39b
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x42d39b
push ebx
push 0x449d68
mov eax, edi
shr eax, 1
mov dword [esp + 0x1c], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004100a8
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42d35c
xor bl, bl
jmp 0x42d38f
lea eax, [edi - 2]
push eax
lea eax, [ebp + 2]
push eax
push ebx
call fcn.004132e0
mov eax, dword [esp + 0x24]
add esp, 0xc
xor ecx, ecx
mov word [ebx + eax*2 - 4], cx
mov eax, dword [esp + 0x10]
push ebx
push dword [eax + 0x60]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.004100a3
pop ecx
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, bl
pop ebx
jmp 0x42d39d
xor al, al
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x42d763
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8fc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x2c]
call fcn.0040ac2d
lea ecx, [esp + 0x10]
call fcn.0040ac2d
lea ecx, [esp + 0x48]
call fcn.00405a51
lea ecx, [esp + 0x260]
call fcn.00405a51
push str.metatester.exe
push dword [ebp + 8]
mov esi, 0x43e864
lea eax, [esp + 0x50]
push esi
push eax
mov bl, 1
call fcn.0040940c
add esp, 0x10
lea ecx, [esp + 0x10]
push dword [esp + 0x4c]
call fcn.0040ac6e
push str.metatester64.exe
push dword [ebp + 8]
lea eax, [esp + 0x50]
push esi
push eax
call fcn.0040940c
add esp, 0x10
lea ecx, [esp + 0x10]
push dword [esp + 0x4c]
call fcn.0040ac6e
push dword [ebp + 8]
lea eax, [esp + 0x264]
push str._s.exe
push eax
call fcn.0040940c
add esp, 0xc
lea eax, [esp + 0x478]
push eax
push dword [esp + 0x268]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d8a0
mov edx, 0x43e860
lea ecx, [esp + 0x4a4]
call fcn.00401178
test eax, eax
je 0x42d882
mov edx, 0x43e858
lea ecx, [esp + 0x4a4]
call fcn.00401178
test eax, eax
je 0x42d882
test byte [esp + 0x478], 0x10
jne 0x42d882
lea eax, [esp + 0x4a4]
push eax
push dword [ebp + 8]
lea eax, [esp + 0x50]
push 0x43e864
push eax
call fcn.0040940c
add esp, 0x10
lea ecx, [esp + 0x2c]
push dword [esp + 0x4c]
call fcn.0040ac6e
test al, al
je 0x42d897
lea eax, [esp + 0x478]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x42d820
jmp 0x42d899
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [esp + 0x34], 0
je 0x42d941
lea eax, [esp + 0x2c]
push eax
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x6d4]
call fcn.004332e0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x6cc]
call fcn.0043333f
cmp eax, 1
je 0x42d935
push dword [esp + 0x26c]
push dword [esp + 0x268]
push 0x4b
call fcn.00422830
lea ecx, [esp + 0x260]
call fcn.004059e7
lea ecx, [esp + 0x6c8]
call fcn.00433387
push eax
push dword [esp + 0x268]
lea eax, [esp + 0x50]
push eax
call fcn.0040940c
mov eax, dword [edi + 0x54]
add esp, 0xc
add eax, 0xe
push 0x40
push eax
push dword [esp + 0x54]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor bl, bl
lea ecx, [esp + 0x6c8]
call fcn.0043331e
xor ecx, ecx
mov eax, 0x4405f0
mov dword [esp + 0x264], ecx
mov dword [esp + 0x268], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov esi, 0x43e50c
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], esi
call fcn.004096ff
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], esi
call fcn.004096ff
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d993
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.004127c0
xor eax, eax
push edi
mov word [ebp - 0x42c], ax
lea eax, [ebp - 0x42a]
push ebx
push eax
call fcn.004127c0
xor eax, eax
push 0x81e
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0xc4a]
push ebx
push eax
call fcn.004127c0
add esp, 0x24
cmp dword [ebp + 8], ebx
je 0x42da24
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push 0x103
push eax
call fcn.0040fb9c
add esp, 0x10
mov edx, 0x440444
lea ecx, [ebp - 0x224]
call fcn.0040114f
cmp eax, 1
jne 0x42daf6
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
jne 0x42daa9
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0x23
call fcn.00422830
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0xc4c]
push 0x40f
push eax
call fcn.0040abf2
add esp, 0x10
mov eax, dword [esi + 0x54]
add eax, 0xe
push 0x30
push eax
lea eax, [ebp - 0xc4c]
jmp 0x42db18
cmp dword [ebp - 8], ebx
ja 0x42daf2
jb 0x42dab9
cmp dword [ebp - 0xc], 0x3200000
jae 0x42daf2
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0xe
call fcn.00422830
push 0x32
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0xc4c]
push 0x40f
push eax
call fcn.0040abf2
add esp, 0x14
jmp 0x42da98
mov al, 1
jmp 0x42db24
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0x1e
call fcn.00422830
mov eax, dword [esi + 0x54]
add eax, 0xe
push 0x30
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42dc5f
Capabilities:
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x230], ax
xor esi, esi
lea eax, [ebp - 0x22e]
push esi
push eax
mov ebx, ecx
call fcn.004127c0
xor eax, eax
push edi
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x436]
push esi
push eax
call fcn.004127c0
add esp, 0x18
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jns 0x42dcbd
xor eax, eax
jmp 0x42dd84
lea eax, [ebp - 8]
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x42dd79
push 0x103
lea eax, [ebp - 0x438]
push eax
push 0x39
call fcn.00422830
push 0x104
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
push 8
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x14], 0x42d6f4
mov dword [ebp - 0x18], 0x8047
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x42dd6a
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x42e075
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x218]
call fcn.00405a51
lea ecx, [ebp - 0x430]
call fcn.00405a51
push ecx
push ecx
mov ecx, edi
call fcn.0040b2a4
push 7
push dword [edi + 4]
call fcn.004224ac
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push dword [edi + 0x55c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
call fcn.004059e7
mov eax, dword [edi + 0x54]
add eax, 0xe
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push eax
call fcn.0040940c
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
add esp, 0xc
push dword [ebp - 0x42c]
push dword [edi + 0x55c]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x216
push eax
push dword [edi + 0x60]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x626
push eax
push dword [edi + 0x2a8]
call esi
mov eax, dword [edi + 0x54]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [eax]
push 0
and eax, 1
push eax
mov ebx, 0xf1
push ebx
push dword [edi + 0x538]
call esi
mov eax, dword [edi + 0x54]
push 0
mov eax, dword [eax]
shr eax, 1
and eax, 1
push eax
push ebx
push dword [edi + 0x4f0]
call esi
mov ecx, dword [edi + 0x54]
push 0
mov ecx, dword [ecx]
shr ecx, 2
and ecx, 1
push ecx
push ebx
push dword [edi + 0x514]
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10
Function at 0x42e38e
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
sub esp, 0x624
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x418]
call fcn.00405a51
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x638]
or eax, 0x20019
push eax
xor ebp, ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
mov edi, ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e4c5
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
push eax
push ebp
jmp 0x42e481
cmp dword [esp + 0x10], ebp
jbe 0x42e4bb
xor eax, eax
push 0x1fe
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push ebp
push eax
call fcn.004127c0
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x428]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040940c
push dword [esp + 0x64c]
mov edx, dword [esp + 0x438]
push 0x1fe
lea eax, [esp + 0x38]
push eax
push str.InstallLocation
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409e31
add esp, 0x28
test al, al
je 0x42e46e
push dword [0x44922c]
lea eax, [esp + 0x1c]
push eax
call fcn.00411014
pop ecx
pop ecx
test eax, eax
je 0x42e49d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
inc edi
push eax
push edi
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42e3ef
jmp 0x42e4bb
lea eax, [esp + 0x218]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x414
push 0x104
push eax
call fcn.0041060d
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x54]
xor eax, eax
cmp word [ecx + 0x414], bp
pop edi
pop esi
setne al
pop ebp
add esp, 0x624
ret 4
Function at 0x42e395
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
sub esp, 0x624
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x418]
call fcn.00405a51
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x638]
or eax, 0x20019
push eax
xor ebp, ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
mov edi, ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e4c5
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
push eax
push ebp
jmp 0x42e481
cmp dword [esp + 0x10], ebp
jbe 0x42e4bb
xor eax, eax
push 0x1fe
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push ebp
push eax
call fcn.004127c0
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x428]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040940c
push dword [esp + 0x64c]
mov edx, dword [esp + 0x438]
push 0x1fe
lea eax, [esp + 0x38]
push eax
push str.InstallLocation
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409e31
add esp, 0x28
test al, al
je 0x42e46e
push dword [0x44922c]
lea eax, [esp + 0x1c]
push eax
call fcn.00411014
pop ecx
pop ecx
test eax, eax
je 0x42e49d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
inc edi
push eax
push edi
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42e3ef
jmp 0x42e4bb
lea eax, [esp + 0x218]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x414
push 0x104
push eax
call fcn.0041060d
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x54]
xor eax, eax
cmp word [ecx + 0x414], bp
pop edi
pop esi
setne al
pop ebp
add esp, 0x624
ret 4
Function at 0x42e4e0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0xc58
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x38
lea eax, [esp + 0x24]
push ebx
or ebp, 0xffffffff
push eax
mov esi, ecx
mov dword [esp + 0x20], 0x43e504
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
call fcn.004127c0
xor eax, eax
mov edi, 0x206
push edi
mov word [esp + 0x270], ax
lea eax, [esp + 0x272]
push ebx
push eax
call fcn.004127c0
xor eax, eax
push edi
mov word [esp + 0x74], ax
lea eax, [esp + 0x76]
push ebx
push eax
call fcn.004127c0
push 0x7ff
lea eax, [esp + 0x491]
push ebx
push eax
mov byte [esp + 0x498], bl
call fcn.004127c0
add esp, 0x30
mov edi, 0x104
push edi
lea eax, [esp + 0x264]
push eax
push ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
dec edi
test eax, eax
jne 0x42e5c8
push ebp
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x60]
push edi
push eax
call fcn.0040fb9c
lea eax, [esp + 0x68]
push 0x5c
push eax
call fcn.004100d0
add esp, 0x18
test eax, eax
je 0x42e5b7
lea ecx, [esp + 0x58]
sub eax, ecx
sar eax, 1
jmp 0x42e5b9
mov eax, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x42e5c8
xor ecx, ecx
mov word [esp + eax*2 + 0x58], cx
push str.mtuninstall.bat
lea eax, [esp + 0x5c]
push edi
push eax
call fcn.004119f2
mov eax, dword [esi + 0x54]
add esp, 0xc
test byte [eax + 0x840], 1
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x264]
je 0x42e62d
push dword [0x44922c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
lea eax, [esp + 0x270]
push eax
push str.cd_r_n__S___processwait:_d_r_ndel__Q___S__r_nrd___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x480]
push 0x7ff
push eax
call fcn.0040a8a5
add esp, 0x20
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x42e65f
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
lea eax, [esp + 0x26c]
push eax
push str.cd_r_n__S___processwait:_d_r_ndel__Q___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x47c]
push 0x7ff
push eax
call fcn.0040a8a5
add esp, 0x1c
neg eax
sbb al, al
inc al
mov bl, al
test bl, bl
je 0x42e719
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x46c]
call fcn.0042e2e8
mov esi, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete bl
cmovs esi, ecx
test bl, bl
je 0x42e719
push ecx
push 2
push ecx
push 0x40000000
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x28]
call fcn.00409509
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
je 0x42e70e
push esi
lea eax, [esp + 0x46c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004093d4
cmp eax, esi
jne 0x42e70e
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x42e6d2
push esi
call edi
mov esi, ebp
and dword [esp + 0x30], 0
and dword [esp + 0x38], 0
lea eax, [esp + 0x58]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x2c], str.Open
mov dword [esp + 0x24], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
jmp 0x42e712
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x42e719
push esi
call edi
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc58
ret
Function at 0x42e726
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov eax, dword [esi + 0x54]
push edi
cmp word [eax + 0x414], bp
je 0x42e7c6
lea ecx, [esp + 0x10]
call fcn.00405a51
mov eax, dword [esi + 0x54]
add eax, 0x414
push eax
lea eax, [esp + 0x14]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040940c
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42e7ac
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42e7ac
push ebp
push 0x20206
push dword [esp + 0x1c]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
push ebp
push 0x20106
push dword [esp + 0x1c]
push ebx
call edi
jmp 0x42e7bb
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test esi, esi
je 0x42e7c6
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret

Function at 0x42e72e
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov eax, dword [esi + 0x54]
push edi
cmp word [eax + 0x414], bp
je 0x42e7c6
lea ecx, [esp + 0x10]
call fcn.00405a51
mov eax, dword [esi + 0x54]
add eax, 0x414
push eax
lea eax, [esp + 0x14]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040940c
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42e7ac
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42e7ac
push ebp
push 0x20206
push dword [esp + 0x1c]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
push ebp
push 0x20106
push dword [esp + 0x1c]
push ebx
call edi
jmp 0x42e7bb
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test esi, esi
je 0x42e7c6
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x42ea20
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
push esi
mov esi, ecx
lea ecx, [ebp - 0x4a0]
call fcn.00405a51
lea ecx, [ebp - 0x288]
call fcn.00405a51
lea ecx, [ebp - 0x70]
call fcn.00424b0a
push dword [ebp - 0x49c]
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x4a0]
call fcn.004059e7
push 0x449228
lea ecx, [ebp - 0x288]
call fcn.00409c80
mov edx, dword [ebp - 0x284]
test edx, edx
je 0x42ea96
push dword [ebp - 0x27c]
push edx
call fcn.004119ab
mov edx, dword [ebp - 0x284]
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
call fcn.00424abf
mov eax, dword [ebp - 0x280]
add eax, eax
push eax
push edx
call fcn.00424a07
lea ecx, [ebp - 0x70]
call fcn.00424907
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x70]
push dword [ebp - 0x284]
call fcn.0042483f
push 0x440470
lea ecx, [ebp - 0x4a0]
call fcn.0040aa12
mov eax, dword [esi + 0x54]
add eax, 0xa50
push eax
lea ecx, [ebp - 0x4a0]
call fcn.0040aa12
push 0x43e878
lea ecx, [ebp - 0x4a0]
call fcn.0040aa12
push dword [ebp - 0x284]
lea ecx, [ebp - 0x4a0]
call fcn.0040aa12
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42eb2a
lea ecx, [ebp - 0x4a0]
call fcn.0040b8b0
lea ecx, [ebp - 0x70]
call fcn.00424ae6
pop esi
leave
ret

Function at 0x42eb35
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
jne 0x42eb63
push 0xc8
push 7
push 0
mov ecx, esi
call fcn.004207aa
mov ecx, esi
call fcn.0042072c
cmp dword [esp + 0xc], 1
jne 0x42eb7e
mov ecx, esi
call fcn.00420711
push 0
push 8
push 8
mov ecx, esi
call fcn.004207aa
pop esi
ret 8
Function at 0x42efea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0040ac2d
lea ecx, [esp + 0x28]
call fcn.00405a51
lea ecx, [esp + 0x240]
call fcn.00405a51
push str.metatester.exe
push dword [0x44922c]
mov ebx, 0x43e864
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.0040940c
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 0x10
push dword [esp + 0x2c]
call edi
cmp eax, 0xffffffff
je 0x42f055
push dword [esp + 0x2c]
lea ecx, [esp + 0x10]
call fcn.0040ac6e
push str.metatester64.exe
push dword [0x44922c]
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.0040940c
add esp, 0x10
push dword [esp + 0x2c]
call edi
cmp eax, 0xffffffff
je 0x42f086
push dword [esp + 0x2c]
lea ecx, [esp + 0x10]
call fcn.0040ac6e
xor edi, edi
cmp dword [esp + 0x14], edi
jbe 0x42f139
mov eax, dword [esi + 0x54]
add eax, 0x824
push eax
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x464]
call fcn.004332e0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x45c]
call fcn.0043333f
cmp eax, 1
je 0x42f12d
push dword [esp + 0x24c]
push dword [esp + 0x248]
push 0x25
call fcn.00422830
lea ecx, [esp + 0x240]
call fcn.004059e7
mov eax, dword [esi + 0x54]
add eax, 0x848
push eax
push eax
push dword [esp + 0x24c]
lea eax, [esp + 0x34]
push eax
call fcn.0040940c
mov eax, dword [esi + 0x54]
add esp, 0x10
add eax, 0x848
push 0x40
push eax
push dword [esp + 0x34]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x458]
call fcn.0043331e
push 5
jmp 0x42f165
lea ecx, [esp + 0x458]
call fcn.0043331e
push edi
push edi
push 0xf0
push dword [esi + 0xc8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42f15c
or dword [eax + 0x840], 1
jmp 0x42f163
and dword [eax + 0x840], 0xfffffffe
push 6
mov eax, 0x4405f0
pop esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], edi
mov dword [esp + 0x248], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0xc], 0x43e50c
call fcn.004096ff
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret