joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7cf
Capabilities:
Check if file exists
Delete directory

Disassembly:
push 0x6c
mov eax, 0x47c3c3
call fcn.004267c5
mov esi, ecx
call fcn.00409c4e
mov ecx, eax
call fcn.00414b9a
push eax
lea ecx, [ebp - 0x70]
call fcn.00407a3e
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x60], eax
je 0x40b9b9
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040778e
xor eax, eax
mov edi, str.HaoKanWallPaper.exe
inc eax
push edi
mov byte [ebp - 4], al
call fcn.00458389
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00407868
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
push 1
xor edi, edi
lea ecx, [ebp - 0x40]
test eax, eax
pop eax
cmovne edi, eax
lea eax, [ebp - 0x70]
push eax
call fcn.00406ff0
push 0x48101c
call fcn.00458389
pop ecx
push eax
push 0x48101c
lea ecx, [ebp - 0x40]
call fcn.00407868
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
push 1
pop eax
cmovne edi, eax
mov dword [ebp - 0x74], edi
test edi, edi
je 0x40b8d8
call fcn.00409c4e
mov ecx, eax
call fcn.00414ba6
push eax
lea ecx, [ebp - 0x28]
call fcn.00407a3e
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x40b8ca
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407a3e
mov ecx, esi
call fcn.0040befd
xor eax, eax
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], al
call fcn.0040782f
cmp dword [ebp + 8], 0
je 0x40b93a
call fcn.00409c4e
mov ecx, eax
call fcn.00414ad0
push eax
lea ecx, [ebp - 0x28]
call fcn.00407a3e
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
je 0x40b92c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x40b92c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407a3e
mov ecx, esi
call fcn.0040befd
xor eax, eax
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], al
call fcn.0040782f
call fcn.00409c4e
mov ecx, eax
call fcn.00414ba6
push eax
lea ecx, [ebp - 0x58]
call fcn.00407a3e
cmp dword [ebp - 0x48], 0
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
je 0x40b98f
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call ebx
test eax, eax
je 0x40b98f
push 0
push 0x480424
lea ecx, [ebp - 0x58]
call fcn.004087e6
cmp eax, 0xffffffff
je 0x40b98f
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call edi
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call edi
cmp dword [ebp - 0x74], 0
je 0x40b9a9
xor eax, eax
inc eax
mov byte [esi + 0x10], al
lea ecx, [ebp - 0x58]
call fcn.0040782f
lea ecx, [ebp - 0x40]
call fcn.0040782f
lea ecx, [ebp - 0x70]
call fcn.0040782f
call fcn.00426780
ret 4
Function at 0x40b9c9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
mov edi, 0xf013f
mov dword [ebp - 4], esi
push edi
push esi
push str.SOFTWARE
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ba3c
push esi
lea eax, [ebp - 8]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x480424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40ba1e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ba3c
push str.AppInfo
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
leave
ret

Function at 0x40ba40
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x47c3f0
call fcn.004267c5
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x30]
push eax
mov ebx, 0xf003f
xor edi, edi
push ebx
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x40bad6
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
push 0x4815f4
push dword [ebp - 0x30]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40bad1
push 0x480424
lea ecx, [ebp - 0x28]
call fcn.00407a3e
mov dword [ebp - 4], edi
mov edi, 0x481600
push edi
call fcn.00458389
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
push dword [ebp - 0x30]
call esi
call fcn.00426780
ret

Function at 0x40bb89
Capabilities:
Delete registry key

Disassembly:
push 0x24
mov eax, 0x47c3f0
call fcn.004267c5
push 0x480424
lea ecx, [ebp - 0x28]
call fcn.00407a3e
mov esi, str.RunOne
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0xf003f
mov dword [ebp - 0x2c], edi
push ebx
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x40bc39
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push 0x4815f4
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x40bc14
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x4815fc
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40bc39
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret
Function at 0x40bde4
Capabilities:
Terminate process

Disassembly:
push 0x1c
mov eax, 0x47c4ab
call fcn.004267c5
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push esi
call fcn.00407a3e
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x40be29
push esi
call fcn.004167ac
pop ecx
test eax, eax
jle 0x40be29
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40be29
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret 4

Function at 0x40befd
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a0
mov eax, 0x47c1b1
call fcn.004267c5
mov edi, ecx
xor ebx, ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.0040778e
mov esi, 0x481264
mov byte [ebp - 4], 1
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00407868
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c075
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40c075
push 0x2e
pop eax
cmp word [ebp - 0x27c], ax
je 0x40bf63
cmp word [ebp - 0x27a], 0
je 0x40bf63
cmp word [ebp - 0x27a], ax
jne 0x40bfa2
cmp word [ebp - 0x278], 0
je 0x40bf63
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00407a3e
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push eax
je 0x40c021
call fcn.0040778e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00407868
push 0x48066c
call fcn.00458389
pop ecx
push eax
push 0x48066c
lea ecx, [ebp - 0x28]
call fcn.00407868
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040778e
mov ecx, edi
call fcn.0040befd
jmp 0x40c05c
call fcn.0040778e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 4
call fcn.00407868
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040778e
mov ecx, edi
call fcn.0040c0bf
lea ecx, [ebp - 0x28]
call fcn.0040782f
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040782f
jmp 0x40bf63
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40c0a7
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x58]
call fcn.0040782f
lea ecx, [ebp + 8]
call fcn.0040782f
call fcn.00426780
ret 0x18
Function at 0x40c10a
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0040bb89
mov ecx, esi
call fcn.0040c136
mov ecx, esi
call fcn.0040c151
mov ecx, esi
call fcn.0040ba40
mov ecx, esi
call fcn.0040b9c9
mov ecx, esi
pop esi
jmp fcn.0040b72e

Function at 0x40c505
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x47bdec
call fcn.004267c5
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov dword [ebp - 4], edi
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040790f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c57b
push str.513BFE2D_1F1B_4271_A90A_55CA0DF545C8
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret

Function at 0x40c589
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49f068]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea ecx, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 8]
push str.513BFE2D_1F1B_4271_A90A_55CA0DF545C8
call fcn.00407a3e
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x20], 0
je 0x40c5fc
push str.InprocServer32
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x1c]
call fcn.0040782f
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0042675a
leave
ret 4
Function at 0x40c921
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x20
mov eax, 0x47bdec
call fcn.004267c5
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor edi, edi
push 0x481a00
mov dword [ebp - 0x2c], edi
call fcn.00407a3e
mov esi, str.A72BE049_F7B9_418B_922E_F2DCF91D247B
mov dword [ebp - 4], edi
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
mov esi, 0x481a54
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
je 0x40c9ee
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x480574
push dword [ebp - 0x2c]
call esi
push 0x481a58
push dword [ebp - 0x2c]
call esi
push str.InprocServer32
push dword [ebp - 0x2c]
call edi
push str.ProgID
push dword [ebp - 0x2c]
call edi
push str.Programmable
push dword [ebp - 0x2c]
call edi
push str.TypeLib
push dword [ebp - 0x2c]
call edi
push str.VersionIndependentProgID
push dword [ebp - 0x2c]
call edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
call edi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret 4
Function at 0x40ca0d
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x47c692
call fcn.004267c5
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x38], ebx
push 0x481a00
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call fcn.00407a3e
mov esi, str.1AAA06A7_B8EB_44B6_9372_B85FD8BD332F
mov dword [ebp - 4], edi
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
mov esi, 0x481a54
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
mov esi, 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
test eax, eax
jne 0x40cb23
lea eax, [ebp - 0x2c]
push eax
push esi
push edi
push 0x481b24
push dword [ebp - 0x34]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40cb03
lea eax, [ebp - 0x30]
push eax
push 0xf013f
push 0
push 0x481054
push dword [ebp - 0x2c]
call ebx
test eax, eax
jne 0x40cae0
push str.win32
push dword [ebp - 0x30]
call esi
push str.win64
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x30]
call edi
push 0x481054
push dword [ebp - 0x2c]
call esi
push str.FLAGS
push dword [ebp - 0x2c]
call esi
push str.HELPDIR
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
push 0x481b24
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call edi
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret 4

Function at 0x40cb33
Capabilities:
Delete registry key

Disassembly:
push 0x20
mov eax, 0x47bdec
call fcn.004267c5
xor esi, esi
lea ecx, [ebp - 0x28]
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
mov dword [ebp - 0x2c], esi
call fcn.00407a3e
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cbc3
mov esi, 0x481c00
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040790f
mov esi, str.HkWallPaperIO
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret
Function at 0x40cbd1
Capabilities:
Delete registry key

Disassembly:
push 0x20
mov eax, 0x47bdec
call fcn.004267c5
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
and dword [ebp - 0x2c], 0
push 0x481a00
call fcn.00407a3e
and dword [ebp - 4], 0
mov esi, str.C961B1D2_637B_4660_83A2_D2F8730B1E7D
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
mov esi, 0x481a54
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cc89
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.InprocServer32
push dword [ebp - 0x2c]
call esi
push str.Programmable
push dword [ebp - 0x2c]
call esi
push str.TypeLib
push dword [ebp - 0x2c]
call esi
push str.Version
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret 4

Function at 0x40cc99
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x47c692
call fcn.004267c5
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x38], ebx
push 0x481a00
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call fcn.00407a3e
mov esi, str.0FE36CAB_B745_42A3_8968_11815E5240FD
mov dword [ebp - 4], edi
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
mov esi, 0x481a54
push esi
call fcn.00458389
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407868
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
mov esi, 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
test eax, eax
jne 0x40cdaf
lea eax, [ebp - 0x2c]
push eax
push esi
push edi
push 0x481b24
push dword [ebp - 0x34]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40cd8f
lea eax, [ebp - 0x30]
push eax
push 0xf013f
push 0
push 0x481054
push dword [ebp - 0x2c]
call ebx
test eax, eax
jne 0x40cd6c
push str.win32
push dword [ebp - 0x30]
call esi
push str.win64
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x30]
call edi
push 0x481054
push dword [ebp - 0x2c]
call esi
push str.FLAGS
push dword [ebp - 0x2c]
call esi
push str.HELPDIR
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
push 0x481b24
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call edi
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret 4
Function at 0x40d04d
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x47c692
call fcn.004267c5
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x28]
push str.SOFTWAREClassesCLSID_
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
call fcn.00407a3e
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d0bb
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.0040cbd1
cmp dword [ebp - 0x2c], 0
je 0x40d0bb
push dword [ebp - 0x2c]
call esi
push str.CLSID_
call fcn.00458389
pop ecx
push eax
push str.CLSID_
lea ecx, [ebp - 0x28]
call fcn.0040790f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push bind
call ebx
test eax, eax
jne 0x40d10b
push dword [ebp - 0x30]
mov ecx, edi
call fcn.0040cbd1
cmp dword [ebp - 0x30], 0
je 0x40d10b
push dword [ebp - 0x30]
call esi
push str.TypeLib_
call fcn.00458389
pop ecx
push eax
push str.TypeLib_
lea ecx, [ebp - 0x28]
call fcn.0040790f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push bind
call ebx
test eax, eax
jne 0x40d15b
push dword [ebp - 0x34]
mov ecx, edi
call fcn.0040cc99
cmp dword [ebp - 0x34], 0
je 0x40d15b
push dword [ebp - 0x34]
call esi
mov edi, str.SOFTWAREClassesDirectory_background_shellexContextMenuHandlers_
push edi
call fcn.00458389
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040790f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x38]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x40d1c3
mov edi, str.HkWallPaperShell
push edi
call fcn.00458389
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040790f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x38]
call esi
lea ecx, [ebp - 0x28]
call fcn.0040782f
call fcn.00426780
ret
Function at 0x40d36b
Capabilities:
Delete registry key

Disassembly:
push 0x234
mov eax, 0x47c76a
call fcn.004267c5
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004558f0
push 0x480424
lea eax, [ebp - 0x218]
push str._sService
push eax
call fcn.0040a7e5
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.0041f896
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], esi
call fcn.0041f8ca
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x40d3d2
push 0xf013f
jmp 0x40d3d7
push 0xf003f
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d40b
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x240]
call fcn.0041f8a9
call fcn.00426780
ret