joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b480
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4273d4]
jne 0x40b48a
repz ret
jmp fcn.0041168c

Function at 0x41733c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4273d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e43f
and dword [ebp - 0x14], 0
cmp dword [0x45ee2c], 0
mov dword [ebp - 0x18], eax
jne 0x4173ef
push 0x4037fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417497
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037f0
push ebx
call edi
test eax, eax
je 0x417497
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037e0
push ebx
mov dword [0x45ee2c], eax
call edi
push eax
call esi
push 0x4037cc
push ebx
mov dword [0x45ee30], eax
call edi
push eax
call esi
push 0x4037b0
push ebx
mov dword [0x45ee34], eax
call edi
push eax
call esi
mov dword [0x45ee3c], eax
test eax, eax
je 0x4173ef
push 0x403798
push ebx
call edi
push eax
call esi
mov dword [0x45ee38], eax
mov eax, dword [0x45ee38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417448
cmp dword [0x45ee3c], ecx
je 0x417448
push eax
call esi
push dword [0x45ee3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417448
test ebx, ebx
je 0x417448
call edi
test eax, eax
je 0x41743f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41743f
test byte [ebp - 8], 1
jne 0x417448
or dword [ebp + 0x10], 0x200000
jmp 0x41747b
mov eax, dword [0x45ee30]
cmp eax, dword [ebp - 0x18]
je 0x41747b
push eax
call esi
test eax, eax
je 0x41747b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41747b
mov eax, dword [0x45ee34]
cmp eax, dword [ebp - 0x18]
je 0x41747b
push eax
call esi
test eax, eax
je 0x41747b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45ee2c]
call esi
test eax, eax
je 0x417497
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417499
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b480
leave
ret
Function at 0x41f660
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.0041e810
cmp dword [0x7ffbb0], 0x37
jne 0x41f6f1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x40442c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404438
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x7ffbb4]
mov edx, dword [0x7fc020]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
mov ecx, 0x204920a6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3be61741
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov eax, 0xb5
mov ecx, 0x74bb
mov ebx, 0x1c6b
test edx, edx
je 0x40128d
cmp dword [ebp + 0xc], esi
je 0x40128d
cmp edx, dword [ebp + 0xc]
jae 0x40128d
sub dword [ebp + 0xc], edx
lea esp, [esp]
mov eax, 0x86d90545
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011d0
mov esi, 0x1790
lea ebx, [ebx]
mov eax, 0x4d4873ed
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011f0
inc edi
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, edi
sub eax, ecx
jne 0x401227
inc edi
cmp edi, 0x2f3f
jl 0x401203
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test edi, edi
je 0x401250
mov edx, dword [ebp + 8]
jmp 0x401240
mov al, byte [ecx + edx + 1]
sub al, 0xa
xor byte [ecx + edx], al
inc ecx
cmp ecx, edi
jb 0x401240
mov edi, edi
mov eax, 0xa57eb503
imul ebx
add edx, ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401250
inc esi
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x401280
inc esi
cmp esi, 0x3fb
jl 0x401265
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, 0x7e8b
mov edx, 0x8c
cmp eax, 0x8c
cmovl eax, edx
dec ecx
jne 0x401297
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402630
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov ebx, 0x1790
mov eax, 0x52
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], esi
je 0x402813
cmp dword [ebp + 0x10], esi
jne 0x402661
cmp dword [ebp + 0x18], esi
je 0x402813
mov ecx, 0x14af
mov edx, 0x3a
jmp 0x402670
cmp eax, 0x3a
cmovg eax, edx
dec ecx
jne 0x402670
lea esp, [esp]
inc edi
mov eax, 0x2aaaaaab
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x40269b
inc edi
cmp edi, 0x271d
jl 0x402680
mov ecx, dword [ebp + 0xc]
mov edx, 0x5a4d
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 8], eax
cmp word [ecx], dx
jne 0x402813
cmp dword [eax], 0x4550
jne 0x402813
mov eax, dword [eax + 0x7c]
mov dword [ebp - 4], eax
xor edi, edi
inc edi
mov eax, 0x38e38e39
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x4026eb
inc edi
cmp edi, 0x2863
jl 0x4026d0
cmp dword [ebp - 4], esi
je 0x402813
mov edi, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [edi + 0x78]
add edi, ecx
mov ebx, 0x6e1b
lea esp, [esp]
mov eax, 0x78787879
imul ebx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402710
mov eax, dword [edi + 0x20]
add eax, ecx
mov dword [ebp - 8], eax
jmp 0x402730
inc esi
mov eax, esi
and eax, 0x80000003
jns 0x40273f
dec eax
or eax, 0xfffffffc
inc eax
jne 0x402742
inc esi
cmp esi, 0x2f94
jl 0x402730
mov ecx, 0xb88
nop
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402750
mov eax, dword [edi + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, 0x3224
mov dword [ebp - 0xc], eax
mov eax, 0xd62b80d7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402773
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test eax, eax
je 0x4027e1
mov eax, 0x1c6a
mov esi, 0x89
mov ecx, 0x2a
lea esp, [esp]
cmp ecx, esi
cmovg ecx, esi
dec eax
jne 0x4027b0
xor esi, esi
cmp dword [edi + 0x18], esi
jbe 0x4027e1
nop
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi*4]
add eax, edx
push eax
push dword [ebp + 0x10]
call fcn.00403040
add esp, 8
test eax, eax
jne 0x40281c
mov edx, dword [ebp + 0xc]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4027c0
mov ebx, 0x67a8
mov eax, 0x2c0b02c1
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4027e6
mov ebx, dword [ebp - 0x14]
lea esp, [esp]
mov eax, 0xdbeb61f
imul ebx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402800
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp + 0xc]
cmp ecx, edi
jbe 0x402839
mov eax, dword [ebp - 4]
add eax, edi
cmp ecx, eax
jb 0x402813
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, 0x2b09
mov edi, 0x715c
mov esi, 0x54a9
lea ebx, [ebx]
mov eax, 0x4bda12f7
imul ebx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402f10
mov eax, 0x5e39
dec eax
jne 0x402f28
jmp 0x402f30
mov eax, 0x84210843
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402f30
mov eax, 0x86d90545
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402f45
lea ebx, [ebx]
inc ecx
mov eax, ecx
and eax, 0x80000001
jns 0x402f6f
dec eax
or eax, 0xfffffffe
inc eax
jne 0x402f72
inc ecx
cmp ecx, 0x271d
jl 0x402f60
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
jbe 0x40302f
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dword [ebp - 0x10], ecx
mov dl, byte [ebx + edx]
inc byte [eax + 0x103]
mov al, byte [eax + 0x103]
mov byte [ebp - 1], dl
movzx edx, al
mov eax, dword [ebp + 8]
add edx, ecx
movzx eax, byte [eax + 0x101]
movzx ecx, byte [edx]
add eax, ecx
mov ecx, dword [ebp + 8]
mov edi, 0x3224
mov byte [ecx + 0x101], al
movzx eax, al
inc eax
add eax, ecx
push eax
push edx
mov esi, 0xa3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
call fcn.004033d0
add esp, 8
mov eax, 0x473c1ab7
imul edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402fe0
mov eax, dword [ebp - 8]
mov edx, 0xd3
mov cl, byte [eax]
mov eax, dword [ebp - 0xc]
add cl, byte [eax]
mov eax, 0x45fe
cmp esi, edx
cmovl esi, edx
dec eax
jne 0x403007
mov edx, dword [ebp + 0xc]
movzx eax, cl
mov ecx, dword [ebp - 0x10]
inc ebx
mov al, byte [eax + ecx]
xor al, byte [ebp - 1]
mov byte [ebx + edx - 1], al
mov eax, dword [ebp + 8]
cmp ebx, dword [ebp + 0x10]
jb 0x402f91
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45448c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x45448c
lcall 0x5de5, 0x8b10c483
jmp loc.00969668
Function at 0x401820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x401857
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac8e
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0051edd0
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x40188a
push edi
push esi
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x40189a
push esi
push 0x59aecc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x854]
push 0
push eax
call fcn.0051edd0
mov ax, word [ebp + 0x18]
add esp, 0xc
mov word [ebp - 0x828], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x858], 0x44
movups xmmword [ebp - 0x814], xmm0
push eax
lea eax, [ebp - 0x858]
mov dword [ebp - 0x82c], 1
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401842
cmp dword [ebp + 0x10], 0
je 0x401929
push dword [ebp + 0x14]
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x814]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x810]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051ac8e
mov esp, ebp
pop ebp
ret 0x14

Function at 0x401960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x401a2d
mov eax, dword [0x59aedc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
push 0x38
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x12], xmm0
movq xmm0, qword [str.runas]
push 0
push eax
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
movq qword [ebp - 0x24], xmm0
call fcn.0051edd0
add esp, 0xc
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], ebx
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401a2d
cmp dword [ebp + 0x10], 0
je 0x401a0c
push dword [ebp + 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ac8e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051ac8e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], esi
mov eax, dword [0x5ca600]
test al, 1
jne 0x40b37e
or eax, 1
mov dword [0x5ca600], eax
call fcn.00406e20
test eax, eax
je 0x40b47d
mov edx, dword [eax]
cmp edx, vtable.ATL::CAtlStringMgr.0
jne 0x40b487
lock inc dword [eax + 0x14]
add eax, 8
add eax, 0x10
push 0x587bc0
mov dword [0x5ca604], eax
call fcn.0051a968
add esp, 4
mov eax, dword [0x5ca604]
cmp dword [eax - 0xc], 0
jne 0x40b455
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallDllRepairOfficial
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b455
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0051edd0
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b434
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5ca604
call fcn.00405730
mov ecx, dword [0x5ca604]
add ecx, 0xfffffff0
push ecx
call fcn.00405650
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [esi], eax
mov eax, esi
pop esi
call fcn.0051ac8e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004071e0
mov ecx, eax
call dword [edx + 0xc]
jmp 0x40b369
Function at 0x411040
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575f58
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
mov edx, str.MasterPDF
lea ecx, [ebp - 0x10]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 1
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x41109e
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4110b3
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4110b5
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push str.SoftwareClients_s
push eax
call fcn.0041f560
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.00411a50
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x10]
push str.SOFTWARERegisteredApplications
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or edi, 0xffffffff
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x41113b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411139
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411139
push 0
push dword [ecx + 4]
call ebx
jmp 0x41113b
call edx
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41117c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411178
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411178
push 0
push dword [edx + 4]
call ebx
jmp 0x41117c
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x4111be
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4111ba
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4111ba
push 0
push dword [edx + 4]
call ebx
jmp 0x4111be
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411330
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575fc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edx, edx
mov ecx, str.PdfRecommand
mov eax, str.MasterPDF
cmove eax, ecx
lea ecx, [ebp - 0x10]
push eax
call fcn.00404e80
mov dword [ebp - 4], 0
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x41138d
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4113a2
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4113a4
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push str.SoftwareClients_s
push eax
call fcn.0041f560
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.00411a50
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x10]
push str.SOFTWARERegisteredApplications
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x411428
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411426
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411426
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x411428
call edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x41146e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41146a
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41146a
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41146e
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
mov ebx, 0x20019
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4119a6
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41199d
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.0053beaa
add esp, 8
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x41199d
push edi
call fcn.00529806
add esp, 4
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x4119ca
mov eax, dword [ebp - 0xc]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4119ca
cmp ebx, 0x20019
jne 0x4119ca
mov edx, dword [ebp - 0x10]
mov ebx, 0x20119
jmp 0x411938
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576098
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x411fc0
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411fd5
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x411fd7
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x14], 0
call fcn.0041f560
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.Progid
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x412033
xor edi, edi
jmp 0x412047
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0053bd35
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41209c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41209a
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41209a
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret