joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029f3
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
mov edi, 0x104
push edi
push 0x41e0f8
push dword [ebp + 8]
call fcn.0040c26a
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpynA]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x348]
push eax
call esi
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402acb
lea eax, [ebp - 0x114]
push 0x41e0f4
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x402aa9
lea eax, [ebp - 0x114]
push 0x41e0f0
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x402aa9
lea eax, [ebp - 0x114]
push edi
push eax
push dword [ebp + 8]
call fcn.0040c26a
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x244]
push eax
call esi
test byte [ebp - 0x140], 0x10
lea eax, [ebp - 0x244]
push eax
je 0x402aa3
call fcn.004029f3
pop ecx
jmp 0x402aa9
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x402a43
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call fcn.0040254d
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ca7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 8]
xor edi, edi
push eax
push edi
push 3
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403cd9
xor eax, eax
jmp 0x403dfa
push ebx
push esi
push 4
lea eax, [ebp - 0xc]
pop ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x403d2a
mov eax, dword [ebp - 0x10]
dec eax
je 0x403d8f
dec eax
dec eax
je 0x403d69
dec eax
jne 0x403d2a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x403d2a
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
jge 0x403d34
mov dword [ebp - 4], edi
cmp edi, edi
jne 0x403d46
push dword [ebp + 8]
call fcn.0040c415
test eax, eax
pop ecx
je 0x403d46
inc dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 1
je 0x403dbc
cmp ebx, 2
jbe 0x403dec
cmp ebx, 4
ja 0x403dec
lea eax, [ebp - 4]
push 4
push eax
push ebx
jmp 0x403ddf
cmp dword [ebp - 0xc], 1
jb 0x403d27
cmp dword [ebp - 0xc], 4
ja 0x403d27
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x403d27
push 3
jmp 0x403db6
lea eax, [ebp - 0x64]
push 0x50
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0040c94b
add esp, 0x10
test eax, eax
je 0x403d27
lea eax, [ebp - 0x64]
push eax
call fcn.004130c6
pop ecx
mov dword [ebp - 4], eax
push 1
pop ebx
jmp 0x403d2a
lea eax, [ebp - 0x64]
push 0xa
push eax
push dword [ebp - 4]
call fcn.0041309c
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x64]
push eax
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop esi
pop ebx
pop edi
leave
ret
Function at 0x404746
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
lea eax, [ebp - 4]
push eax
push 0x41aa60
push 1
push 0
push 0x41aa50
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x404841
push dword [ebp + 8]
call fcn.0040bce3
push dword [ebp + 0xc]
call fcn.0040bd09
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push dword [ebp + 8]
push str._s_s.LNK
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 4]
add esp, 0x18
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp + 0x1c]
call fcn.0040bc3c
test eax, eax
pop ecx
jne 0x4047da
push dword [ebp + 0x20]
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push esi
push edx
mov ecx, dword [eax]
push 0x41aa70
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x40482e
lea eax, [ebp - 0x620]
push 0x208
push eax
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x620]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
pop esi
jl 0x404841
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x4058ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [0x4210ec]
call fcn.0040122c
add esp, 0x10
test eax, eax
je 0x4058f9
xor eax, eax
jmp 0x40597a
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
mov edi, 0x4000
push eax
push edi
push dword [0x42151c]
push dword [ebp + 8]
call esi
test eax, eax
je 0x40595b
cmp dword [ebp + 0xc], ebx
jbe 0x405969
push dword [ebp + 0xc]
push dword [0x42151c]
push dword [0x4210ec]
call fcn.0040141b
add esp, 0xc
test eax, eax
jne 0x40595b
cmp dword [ebp + 0xc], ebx
jbe 0x405969
lea eax, [ebp + 0xc]
push ebx
push eax
push edi
push dword [0x42151c]
push dword [ebp + 8]
jmp 0x40591f
push dword [0x4210ec]
call fcn.00401577
pop ecx
jmp 0x4058f2
push dword [0x4210ec]
call fcn.00401577
neg eax
sbb eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40597f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, 0x421734
mov edi, 0x104
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
push 0
mov esi, str.Uninstall
push str.CPLUninstallName
push esi
call fcn.0040c615
add esp, 0x18
test eax, eax
jne 0x4059d8
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
push 0
push str.UninstallShortcutName
push esi
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x405bd0
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
push 0
push str.UninstallSilentToolPath
push esi
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x405a55
lea eax, [ebp - 0x10c]
push eax
call fcn.00402f1e
lea eax, [ebp - 0x10c]
push eax
push str.Path
push str.UninstallSilentTool
call fcn.00402ad0
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
push 0x423224
push str.UninstallSilentToolArg
push esi
call fcn.0040c615
lea eax, [ebp - 0x10c]
push eax
call fcn.00402f1e
lea eax, [ebp - 0x10c]
push eax
push 0x41e644
push str.UninstallSilentTool
call fcn.00402ad0
add esp, 0x38
push 0x420d70
push str.WizardStamp
push str.Window
call fcn.00402ad0
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, 0x42183c
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405bc2
push 9
push 0x41e638
push eax
call fcn.0040cb25
add esp, 0xc
test eax, eax
jne 0x405aba
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x405bbb
push edi
mov edi, dword [ebp - 8]
push 0x422a9c
push edi
call fcn.0040cb25
add esp, 0xc
test eax, eax
jne 0x405ad3
push edi
jmp 0x405aaf
mov al, byte [0x421b94]
push 1
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
push edi
call fcn.0040cb25
add esp, 0xc
test eax, eax
push edi
je 0x405aaf
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xffffffffffffffff
push 0x10e
push esi
call section..text
add esp, 0xc
mov dword [0x4210ec], eax
test eax, eax
je 0x405bbb
mov edi, 0x422200
push edi
call fcn.0040c939
pop ecx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x405b48
push dword [0x4210ec]
call fcn.0040180f
pop ecx
jmp 0x405bbb
push str.IFUI
push edi
call fcn.004058ce
pop ecx
pop ecx
test eax, eax
push edi
jne 0x405b62
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x405b3a
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x4221fc]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
push str.IFFL
push dword [0x4221fc]
call fcn.004058ce
pop ecx
test eax, eax
pop ecx
je 0x405b3a
mov eax, dword [0x4210f8]
test eax, eax
je 0x405bab
push str.IFWB
push dword [0x421ba4]
push eax
call fcn.00405877
add esp, 0xc
test eax, eax
je 0x405b3a
push dword [0x4210ec]
call fcn.0040180f
test eax, eax
pop ecx
je 0x405bc6
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
xor eax, eax
jmp 0x405bd3
push 3
push esi
call fcn.0040c3bf
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406067
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x405de6
push dword [0x4221f4]
push 0x423
push dword [0x422730]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov esi, 0x423010
mov edi, 0x104
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push ebx
push str.ProgramGroupFolder
push str.General
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x4060e7
lea eax, [ebp - 0x104]
push eax
call fcn.0040c42f
test eax, eax
pop ecx
je 0x4060e7
push 1
push ebx
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0040bd1b
pop ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x42272c], 1
jne 0x406123
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push ebx
push str.PostInfoPath
push str.Info
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x406123
push 1
push ebx
lea eax, [ebp - 0x104]
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x421dd4], 1
jne 0x4061ca
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push ebx
push str.RunAppPath
push 0x41e5e8
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x4061ca
push esi
lea eax, [ebp - 0x208]
push edi
push eax
push 0x423224
push str.RunAppArg
push 0x41e5e8
call fcn.0040c615
lea eax, [ebp - 0x104]
push eax
call fcn.0040c076
push eax
call fcn.0040c42f
add esp, 0x20
test eax, eax
je 0x406197
lea eax, [ebp - 0x104]
push eax
call fcn.0040c076
pop ecx
mov edi, eax
jmp 0x406199
xor edi, edi
lea eax, [ebp - 0x104]
push eax
call fcn.0040c415
test eax, eax
pop ecx
lea eax, [ebp - 0x104]
jne 0x4061b7
push eax
call fcn.0040c115
pop ecx
push 1
lea ecx, [ebp - 0x208]
push edi
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.0040c939
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x420e80], ebx
jne 0x4061f7
push ebx
push 0x4a0
push 0x400
push dword [0x4221f4]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407595
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4075cc
push 0x422a9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x4075ce
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
lea eax, [ebp - 0x208]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x208]
push 0x41e044
mov esi, 0x208
push eax
push esi
call fcn.0040baef
lea eax, [ebp - 0x208]
push 0x422a9c
push eax
push esi
call fcn.0040baef
add esp, 0x18
lea eax, [ebp - 0x208]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
leave
ret
Function at 0x4080a6
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, 0x104
push edi
push esi
push 0x421630
call fcn.0040c076
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpynA]
pop ecx
mov ebx, 0x422bf0
push eax
push ebx
call edi
push esi
push ebx
call fcn.0040bfe2
pop ecx
push eax
push 0x421bb8
call edi
mov ebx, 0x422df8
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
je 0x4082b1
push esi
push ebx
call fcn.0040bfe2
pop ecx
push eax
push 0x422748
call edi
push esi
push 0x422f08
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x4082b1
call fcn.00402875
call fcn.004028fa
push 0x421208
call fcn.0040c998
test eax, eax
pop ecx
je 0x4082b1
mov esi, 0x422514
push esi
push 0
call fcn.00402814
pop ecx
test eax, eax
pop ecx
jne 0x408151
push esi
push str.Desktop
call fcn.0040278f
pop ecx
pop ecx
mov esi, 0x42198c
push esi
push 0xb
call fcn.00402814
pop ecx
test eax, eax
pop ecx
jne 0x408171
push esi
push str.Start_Menu
call fcn.0040278f
pop ecx
pop ecx
mov esi, 0x42284c
push esi
push 2
call fcn.00402814
pop ecx
test eax, eax
pop ecx
jne 0x408191
push esi
push str.Programs
call fcn.0040278f
pop ecx
pop ecx
mov esi, 0x421fe0
push esi
push 7
call fcn.00402814
pop ecx
test eax, eax
pop ecx
jne 0x4081b1
push esi
push str.Startup
call fcn.0040278f
pop ecx
pop ecx
call fcn.0040297f
mov esi, 0x421314
push esi
push 9
call fcn.00402814
pop ecx
test eax, eax
pop ecx
jne 0x4081d6
push esi
push str.SendTo
call fcn.0040278f
pop ecx
pop ecx
and dword [esp + 0x10], 0
push 0x421734
call fcn.00402778
test eax, eax
pop ecx
je 0x4082b1
mov ebp, 0x422200
push ebp
call fcn.00402778
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop ecx
test eax, eax
mov edi, 0x422954
mov ebx, 0x4220f0
je 0x40824b
push edi
call fcn.00402778
test eax, eax
pop ecx
je 0x408248
push 0x423010
call fcn.00402778
test eax, eax
pop ecx
je 0x408245
push ebx
call fcn.00402778
test eax, eax
pop ecx
je 0x40823e
push ebx
mov dword [esp + 0x14], 1
call esi
push 0x423010
call esi
push edi
call esi
push ebp
call esi
push 0x421734
call esi
xor ebp, ebp
cmp dword [esp + 0x10], ebp
je 0x4082b1
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x4082b1
push ebp
push 0x80
push 2
push ebp
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x4221fc], eax
je 0x4082aa
push 0x4000
call fcn.00412ed8
cmp eax, ebp
pop ecx
mov dword [0x42151c], eax
jne 0x4082ba
push dword [0x4221fc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call esi
push ebx
call fcn.0040254d
pop ecx
call fcn.0040807c
xor eax, eax
jmp 0x4082bd
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x408649
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
call fcn.0040249a
test eax, eax
je 0x40867c
push 5
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
test eax, eax
je 0x4087b2
mov dword [0x422f04], 1
leave
ret
push ebx
push esi
push str.WININIT.INI
push 0x422df8
call fcn.0040c26a
pop ecx
mov esi, eax
pop ecx
lea eax, [ebp - 0x10c]
push 0x104
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
lea eax, [ebp - 0x10c]
push esi
push eax
push 0x41e924
push str.Rename
call fcn.0040c714
push esi
call fcn.0040c939
add esp, 0x14
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x40879b
mov esi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push edi
push 2
push ebx
push ebx
push eax
call esi
push ebx
push ebx
push ebx
mov edi, eax
push dword [ebp - 4]
call esi
lea eax, [edi + 1]
push eax
call fcn.00412ed8
push edi
push eax
push dword [ebp - 4]
mov dword [ebp + 8], eax
call fcn.0040caf8
add esp, 0x10
test eax, eax
je 0x408783
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x21c]
push str._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call fcn.00412fc0
add esp, 0x14
cmp eax, ebx
je 0x408783
sub eax, dword [ebp + 8]
push ebx
push ebx
push eax
push dword [ebp - 4]
call esi
push 3
push 0x41e918
push dword [ebp - 4]
call fcn.0040cb25
add esp, 0xc
test eax, eax
je 0x408783
mov dword [0x422f04], 1
cmp dword [ebp + 8], ebx
pop edi
je 0x408792
push dword [ebp + 8]
call fcn.00412e70
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 8]
push 0x41e924
push str.Rename
call fcn.0040c90d
add esp, 0xc
pop esi
pop ebx
leave
ret

Function at 0x4087b4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
lea eax, [ebp - 0x21c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x21c]
push 0x41e044
mov esi, 0x208
push eax
push esi
call fcn.0040baef
lea eax, [ebp - 0x21c]
push 0x422a9c
push eax
push esi
call fcn.0040baef
add esp, 0x18
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
lea eax, [ebp - 0x21c]
push edi
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40887e
inc dword [0x4221f8]
push dword [0x4221f8]
lea eax, [ebp - 0x14]
push 0x41e1f0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push 1
push edi
push eax
push dword [ebp - 4]
call esi
push 4
push 0x4221f8
push 4
push edi
push str.UninstallFolderCount
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x408882
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
lea eax, [ebp - 0x220]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x220]
push 0x41e044
mov esi, 0x208
push eax
push esi
call fcn.0040baef
lea eax, [ebp - 0x220]
push 0x422a9c
push eax
push esi
call fcn.0040baef
add esp, 0x18
lea eax, [ebp - 4]
xor esi, esi
push eax
push 3
lea eax, [ebp - 0x220]
push esi
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408950
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 8]
push eax
push esi
mov ebx, str.UninstallFolderCount
push esi
push ebx
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408946
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push 1
pop edi
cmp dword [ebp - 8], edi
jb 0x40893f
push edi
lea eax, [ebp - 0x18]
push 0x41e1f0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call esi
inc edi
cmp edi, dword [ebp - 8]
jbe 0x40891d
push ebx
push dword [ebp - 4]
call esi
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
leave
ret
Function at 0x408953
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
xor edi, edi
push 3
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408aa1
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4089ab
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x408aa3
mov eax, dword [ebp - 0x10]
push 2
pop ecx
dec eax
push 4
mov dword [ebp - 4], ecx
pop ebx
mov edi, ebx
je 0x408a27
sub eax, ecx
je 0x4089fb
dec eax
jne 0x4089e5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4089e5
mov dword [ebp - 4], 2
dec dword [ebp - 4]
jne 0x408a51
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 1
pop esi
jmp 0x40899b
cmp dword [ebp - 0xc], 1
jb 0x408a22
cmp dword [ebp - 0xc], ebx
ja 0x408a22
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x4089de
push 3
jmp 0x408a4e
mov dword [ebp - 4], ecx
jmp 0x4089e5
lea eax, [ebp - 0x60]
push 0x50
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0040c94b
add esp, 0x10
test eax, eax
je 0x4089de
lea eax, [ebp - 0x60]
push eax
call fcn.004130c6
pop ecx
mov dword [ebp - 4], eax
push 1
pop edi
jmp 0x4089e5
cmp edi, 1
je 0x408a67
cmp edi, 2
jbe 0x408a98
cmp edi, ebx
ja 0x408a98
lea eax, [ebp - 4]
push ebx
push eax
push edi
jmp 0x408a8a
lea eax, [ebp - 0x60]
push 0xa
push eax
push dword [ebp - 4]
call fcn.0041309c
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret