joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
je 0x401089
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp byte [esi], 0
je 0x401089
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x401089
and byte [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401062
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105b
test ebp, ebp
je 0x40105b
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401062
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401083
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x401083
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401014
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402191
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0xc]
push ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwarePythonPythonCore
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021c3
xor eax, eax
jmp 0x4022f0
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 8], 0x50
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4022e4
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
cmp eax, ebx
mov dword [ebp - 8], 0x50
je 0x402219
cmp byte [eax], bl
je 0x402219
lea ecx, [ebp - 0x64]
push ecx
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4022c2
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x104]
push str.Python_Version__s__found_in_registry_
push eax
call esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xb4]
push str.SoftwarePythonPythonCore_sInstallPath
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0xb4]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022c2
push 0x10c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x14], 0x105
je 0x4022b9
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4022b9
lea eax, [ebp - 0x104]
push eax
push ebx
push 0x180
push dword [ebp + 8]
call edi
mov ecx, dword [ebp + 0xc]
push esi
push eax
push 0x19a
push dword [ebp + 8]
mov dword [esi + 0x108], ecx
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4021f0
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop ebx
leave
ret
Function at 0x402618
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PySys_GetObject
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_OptimizeFlag
push edi
mov dword [ebp - 0xc], eax
call esi
xor esi, esi
cmp dword [0x40c41c], esi
jne 0x402676
xor eax, eax
jmp 0x4026c0
cmp ebx, esi
je 0x4026bd
cmp dword [ebp + 8], esi
je 0x4026bd
cmp dword [ebp - 8], esi
je 0x4026bd
cmp dword [ebp - 4], esi
je 0x4026bd
cmp dword [ebp - 0xc], esi
je 0x4026bd
cmp eax, esi
je 0x4026bd
xor ecx, ecx
cmp dword [ebp + 0xc], esi
push 0x40c440
setne cl
mov dword [eax], ecx
call dword [ebp + 8]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004026c5
add esp, 0xc
mov esi, eax
call dword [ebp - 8]
mov eax, esi
jmp 0x4026c0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x40d900
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call edi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll__putenv]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40287c
push dword [0x40d870]
lea eax, [ebp - 0x54]
push dword [0x40da04]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call edi
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x402850
xor eax, eax
jmp 0x40287c
lea eax, [ebp - 0x158]
push 0x40b0b0
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call esi
pop edi
pop esi
leave
ret
Function at 0x402880
Capabilities:
Delete file
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push esi
call dword [sym.imp.MSVCRT.dll__tempnam]
mov edi, dword [sym.imp.MSVCRT.dll_freopen]
mov ebp, eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov ebx, 0x40ba78
add eax, 0x40
mov dword [esp + 0x1c], ebp
push eax
push ebx
push ebp
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
push ebx
push ebp
call edi
push 0x40d700
call fcn.004027ca
mov edi, eax
add esp, 0x24
cmp edi, esi
jne 0x4028e1
push str.Cant_load_Python_for_pre_install_script
call fcn.004025ef
pop ecx
or eax, 0xffffffff
jmp 0x4029e0
push dword [esp + 0x1c]
push edi
call fcn.004029e7
pop ecx
mov dword [esp + 0x14], eax
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, dword [sym.imp.MSVCRT.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov ebx, dword [sym.imp.MSVCRT.dll_fclose]
add eax, 0x40
push eax
call ebx
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call ebx
add esp, 0x10
cmp dword [esp + 0x10], esi
je 0x4029d1
push str.Running_the_pre_installation_script_failed_r_n
call sub.MSVCRT.dll_strlen
mov dword [esp], 0x40ba18
push ebp
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
push 2
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push ebp
call esi
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebp
mov dword [esp + 0x40], eax
call esi
mov eax, dword [esp + 0x40]
lea eax, [eax + edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 0x28
test esi, esi
je 0x4029c6
push str.Running_the_pre_installation_script_failed_r_n
push esi
call sub.MSVCRT.dll_strcpy
push ebp
lea eax, [esi + edi]
push dword [esp + 0x28]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add eax, esi
push ebp
and byte [eax + edi], 0
call ebx
push esi
call fcn.004025ef
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x24
jmp 0x4029d1
push str.Out_of_memory_
call fcn.004025ef
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll_remove]
mov eax, dword [esp + 0x14]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4029e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 4], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x402a6e
cmp dword [ebp + 8], eax
je 0x402a6e
cmp dword [ebp - 8], eax
je 0x402a6e
cmp dword [ebp - 4], eax
je 0x402a6e
cmp esi, eax
je 0x402a6e
push 0x40c440
call dword [ebp + 8]
call ebx
push edi
call fcn.00402a76
push dword [ebp + 0xc]
call dword [ebp - 4]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402a67
call esi
call dword [ebp - 8]
mov eax, edi
jmp 0x402a71
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402a76
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.PyImport_ImportModule
push edi
call esi
push str.PyObject_SetAttrString
push edi
mov ebx, eax
call esi
push str.PyObject_GetAttrString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp + 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 4], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
xor esi, esi
mov dword [ebp - 0x14], eax
cmp ebx, esi
je 0x402b68
cmp dword [ebp + 8], esi
je 0x402b68
cmp dword [ebp - 8], esi
je 0x402b68
cmp dword [ebp - 4], esi
je 0x402b68
cmp dword [ebp - 0xc], esi
je 0x402b68
cmp dword [ebp - 0x10], esi
je 0x402b68
cmp eax, esi
je 0x402b68
push str.__builtin__
call ebx
mov edi, eax
pop ecx
cmp edi, esi
je 0x402b4c
push str.ValueError
push edi
call dword [ebp + 8]
push str.OSError
push edi
mov dword [0x40d874], eax
call dword [ebp + 8]
add esp, 0x10
mov dword [0x40da0c], eax
mov esi, 0x40b170
push 0
push esi
call dword [ebp - 4]
push eax
push dword [esi]
push edi
call dword [ebp - 8]
add esi, 0x10
add esp, 0x14
cmp esi, 0x40b1d0
jl 0x402b31
mov eax, dword [ebp - 0xc]
mov dword [0x40d8e8], eax
mov eax, dword [ebp - 0x10]
mov dword [0x40d8ec], eax
mov eax, dword [ebp - 0x14]
mov dword [0x40d6e4], eax
xor eax, eax
jmp 0x402b6b
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031b5
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov ebx, eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40332c
cmp dword [ebp - 4], ecx
je 0x40332c
cmp dword [ebp - 8], ecx
je 0x40332c
cmp dword [ebp - 0xc], ecx
je 0x40332c
cmp ebx, ecx
je 0x40332c
cmp dword [ebp - 0x10], ecx
je 0x40332c
cmp eax, ecx
je 0x40332c
cmp dword [ebp - 0x14], ecx
je 0x40332c
mov esi, dword [ebp + 0xc]
cmp esi, ecx
je 0x403328
cmp byte [esi], cl
je 0x403328
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__open]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
pop ecx
jne 0x4032a6
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
add eax, 0x40
push str.Could_not_open_postinstall_script__s_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 3
jmp 0x40332e
push str.Running_Script...
push 0x3ec
push dword [0x40d8f0]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call dword [ebp + 8]
push edi
call fcn.00402a76
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp - 4]
push 3
lea eax, [ebp - 0x38]
pop esi
push eax
push ebx
mov dword [ebp + 8], esi
call dword [sym.imp.MSVCRT.dll__fstat]
add esp, 0x14
test eax, eax
jne 0x403318
mov edi, dword [ebp - 0x24]
lea eax, [edi + 5]
add eax, esi
and al, 0xfc
call fcn.00406790
mov esi, esp
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x403318
add eax, esi
push esi
mov byte [eax], 0xa
and byte [eax + 1], 0
call dword [ebp - 8]
pop ecx
mov dword [ebp + 8], eax
call dword [ebp - 0xc]
push ebx
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [ebp + 8]
pop ecx
jmp 0x40332f
push 2
jmp 0x40332e
push 1
pop eax
lea esp, [ebp - 0x44]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403494
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406790
push ebx
push ebp
push esi
push edi
push dword [0x40da08]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40c420
push eax
push ebx
mov esi, str.Setup
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40c560
call fcn.004035e7
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40da08]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40c6e0
call fcn.004035e7
add esp, 0xc
push dword [0x40da08]
push 0x50
push 0x40d880
push ebx
push str.build_info
push esi
call edi
push dword [0x40da08]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40da08]
mov dword [0x40c434], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40da08]
mov dword [0x40d878], eax
push 0xa
push 0x40d8d0
push ebx
push str.target_version
push esi
call edi
push dword [0x40da08]
push 0x50
push 0x40d820
push ebx
push str.name
push str.metadata
call edi
push dword [0x40da08]
push 0x104
push 0x40c5c0
push ebx
push str.install_script
push esi
call edi
push 0x40c560
call fcn.0040366c
push eax
mov dword [0x40d8e0], eax
call fcn.0040339f
pop ecx
pop ecx
push dword [0x40c544]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x40da08]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x4035ce
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x40da18]
test eax, eax
je 0x4035de
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
add esp, 0x1000
ret
Function at 0x403749
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
lea eax, [ebp - 0x15c]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push str._s.bat
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x260]
push 0x40bfbc
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
push str.:Repeat_n
push eax
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x15c]
mov edi, str.del___s__n
push eax
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x15c]
push eax
push str.if_exist___s__goto_Repeat_n
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x260]
push eax
push edi
push dword [ebp - 4]
call esi
add esp, 0x40
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
push 0x44
lea eax, [ebp - 0x58]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x58]
push eax
push 0x40b0b0
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x260]
push ebx
push eax
push ebx
mov word [ebp - 0x28], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403868
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x10]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40386d
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x5b
push eax
mov dword [ebp - 8], eax
call esi
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40392e
inc ebx
push 0x5d
push ebx
call esi
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x40392e
and byte [edi], 0
inc edi
push 0xa
push edi
call esi
xor esi, esi
pop ecx
cmp eax, esi
pop ecx
je 0x4038bf
and byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push esi
push ebx
push dword [0x40b0b8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4038f2
push esi
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403924
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, esi
je 0x40391b
cmp eax, 2
je 0x40391b
push esi
push str.Could_not_delete_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403933
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x5b
push eax
mov dword [ebp - 8], eax
call esi
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4039f4
inc ebx
push 0x5d
push ebx
call esi
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4039f4
and byte [edi], 0
inc edi
push 0x3d
push edi
call esi
xor esi, esi
pop ecx
cmp eax, esi
pop ecx
je 0x4039f4
and byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push esi
push ebx
push dword [0x40b0b8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4039b8
push esi
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4039ea
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
je 0x4039e1
cmp eax, 2
je 0x4039e1
push esi
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039f9
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x403a10
pop esi
ret
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
inc esi
cmp dword [eax], 1
jle 0x403a2b
movsx eax, byte [esi]
push 8
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x403a3c
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movsx eax, byte [esi]
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 8
test eax, eax
jne 0x403a10
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x403a49
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x403a60
pop esi
ret
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
inc esi
cmp dword [eax], 1
jle 0x403a7b
movsx eax, byte [esi]
push 8
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x403a8c
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movsx eax, byte [esi]
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 8
test eax, eax
jne 0x403a60
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x403a99
Capabilities:
Delete file
Read file on windows

Disassembly:
mov eax, 0x1014
call fcn.00406790
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
push edi
push 0x5b
push dword [esp + 0x1028]
call esi
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
je 0x403ad1
inc eax
push 0x5d
push eax
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
jne 0x403ad8
xor eax, eax
jmp 0x403c51
and byte [ebx], 0
inc ebx
push ebx
push 0x40c310
mov dword [esp + 0x14], ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403c4e
push ebp
push edi
push edi
mov dword [esp + 0x24], str._remove
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCRT.dll__tempnam]
mov esi, dword [sym.imp.MSVCRT.dll_freopen]
mov ebp, eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, 0x40ba78
add eax, 0x40
push eax
push edi
push ebp
call esi
add esp, 0x14
test eax, eax
jne 0x403b43
push eax
push eax
push str.freopen_stderr
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
push edi
push ebp
call esi
add esp, 0xc
test eax, eax
jne 0x403b6b
push eax
push eax
push str.freopen_stdout
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403bb0
lea eax, [esp + 0x18]
push eax
push 2
push ebx
push esi
call fcn.004031b5
add esp, 0x10
cmp eax, 0x80000000
jne 0x403ba9
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._Could_not_load_Python_
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, dword [sym.imp.MSVCRT.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
add eax, 0x40
push eax
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call esi
push 0x40ba18
push ebp
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
lea eax, [esp + 0x3c]
push edi
push 0x1000
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
mov ebx, eax
call esi
push ebp
call dword [sym.imp.MSVCRT.dll_remove]
and byte [esp + ebx + 0x54], 0
add esp, 0x30
cmp byte [esp + 0x24], 0
pop ebp
je 0x403c3e
push 0
lea eax, [esp + 0x24]
push str.uninstall_script
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0xc]
push 0x40c310
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
add esp, 0x1014
ret