joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412130
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x412197
mov eax, dword [esp + 0x28]
push ebp
push esi
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x41218a
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x412182
cmp eax, 3
jne 0x412187
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret

Function at 0x4121f0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x41225b
push ebp
push edi
push 0xf01ff
mov ecx, 0x422e20
call fcn.00404900
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x41224e
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41224b
cmp dword [esp + 0x14], 4
jne 0x41224b
mov ebx, 1
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
mov eax, ebx
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x4123a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x2a0
lea eax, [esp + 0x110]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4123c5
xor eax, eax
add esp, 0x2a0
ret
lea ecx, [esp + 0x10]
push 0x100
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
je 0x4123e1
xor eax, eax
add esp, 0x2a0
ret
lea edx, [esp + 0x10]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x4123f6
add esp, 0x2a0
ret
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push esi
mov edx, ecx
push edi
mov esi, dword [eax]
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
mov ecx, 0x1a
and eax, 0xff
cdq
idiv ecx
mov eax, dword [esp + 0x2ac]
add dl, 0x41
mov byte [eax], dl
mov eax, dword [esp + 0xd]
and eax, 0xff
cdq
idiv ecx
mov eax, dword [esp + 0x2b0]
add dl, 0x41
mov byte [eax], dl
call sub.WS2_32.dll_WSACleanup
pop edi
mov eax, 1
pop esi
add esp, 0x2a0
ret
Function at 0x412500
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x500c
call fcn.00418b70
push ebx
push ebp
push esi
push edi
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [str.List]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
push edx
push eax
push ecx
push 0x80000002
mov dword [esp + 0x28], 7
mov dword [esp + 0x30], 0x2800
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4126bf
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor edx, edx
lea ebp, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4125d2
cmp edx, 0xa
jae 0x4125d2
mov esi, dword [esp + 0x5020]
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4125a8
test cl, cl
je 0x4125a4
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4125a8
add eax, 2
add esi, 2
test cl, cl
jne 0x412584
xor eax, eax
jmp 0x4125ad
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4126bf
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc edx
lea ebp, [ecx + ebp + 1]
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x412576
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0x281d]
mov byte [esp + 0x281c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x5020]
push 0x2800
lea edx, [esp + 0x2820]
push edi
push edx
lea esi, [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
inc ebp
call ebx
test eax, eax
je 0x412697
mov dword [esp + 0x14], 0
mov edi, 0x421030
mov ecx, dword [edi]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41264f
add edi, 4
cmp edi, 0x421044
jl 0x412630
mov edi, dword [esp + 0x14]
jmp 0x412654
mov edi, 1
mov edx, dword [esp + 0x5020]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x412689
test edi, edi
jne 0x412689
mov eax, 0x2800
lea ecx, [esp + ebp + 0x281c]
sub eax, ebp
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call ebx
lea ebp, [eax + ebp + 1]
push esi
call ebx
lea esi, [esi + eax + 1]
push esi
call ebx
test eax, eax
jne 0x412623
mov eax, dword [esp + 0x10]
mov ecx, dword [str.List]
inc ebp
lea edx, [esp + 0x281c]
push ebp
push edx
mov edx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
push eax
push ecx
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x500c
ret
Function at 0x4126d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x5008
call fcn.00418b70
push edi
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [str.List]
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
push edx
push eax
push ecx
push 0x80000002
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0x2800
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x412801
push ebx
xor ebx, ebx
mov ecx, 0x9ff
lea edi, [esp + 0x2811]
mov byte [esp + 0x2810], bl
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebp
push edx
lea ebp, [esp + 0x18]
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4127d8
push esi
xor edi, edi
mov esi, 0x421030
mov eax, dword [esi]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x412781
add esi, 4
cmp esi, 0x421044
jl 0x412766
jmp 0x412786
mov edi, 1
mov ecx, dword [esp + 0x501c]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4127c3
test edi, edi
jne 0x4127c3
mov edx, 0x2800
lea eax, [esp + ebx + 0x2818]
sub edx, ebx
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call esi
lea ebx, [ebx + eax + 1]
jmp 0x4127c9
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call esi
lea ebp, [eax + ebp + 1]
push ebp
call esi
test eax, eax
jne 0x41275f
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [str.List]
inc ebx
lea ecx, [esp + 0x2814]
push ebx
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
push edx
push eax
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop ebp
pop ebx
pop edi
add esp, 0x5008
ret

Function at 0x412960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x12c
push esi
push edi
xor dl, dl
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
mov byte [esp + 0x30], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x422dc0
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 1
stosb byte es:[edi], al
call fcn.00404900
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [esp + 0x138]
push 0x104
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00404550
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x3c]
push str.Group
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x412a0c
lea eax, [esp + 0x10]
push eax
call fcn.004126d0
add esp, 4
push esi
call fcn.00411fa0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x12c
ret
Function at 0x412ad0
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x324
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x412cc8
cmp dword [esp + 0x330], ebx
je 0x412cc8
cmp dword [esp + 0x334], ebx
je 0x412cc8
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x231]
mov byte [esp + 0x230], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x230]
push str.Drivers
push ecx
call esi
xor edx, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x11], edx
mov byte [esp + 0x10], bl
mov word [esp + 0x15], dx
call fcn.00419310
lea eax, [esp + 0x10]
push 6
push eax
lea ecx, [esp + 0x20]
call fcn.00419550
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
test eax, eax
jne 0x412b84
push 7
lea ecx, [esp + 0x14]
push str.123456
push ecx
call ebp
call fcn.00407ab0
test al, al
je 0x412bbd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
and eax, 0xffff
mov dword [esp + 0x10], edx
push eax
push 0x421104
lea eax, [esp + 0x18]
mov word [esp + 0x1c], dx
push 6
push eax
mov byte [esp + 0x26], dl
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x230]
push 0x104
lea edx, [esp + 0x2c]
push ecx
push edx
stosb byte es:[edi], al
call ebp
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
call esi
push 0x104
lea edx, [esp + 0x2c]
push str..sys
push edx
call fcn.00404550
mov ecx, dword [esp + 0x344]
add esp, 0xc
lea eax, [esp + 0x28]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x422e10
stosb byte es:[edi], al
call fcn.00404900
lea edx, [esp + 0x130]
push eax
push edx
call ebp
lea eax, [esp + 0x10]
push 0x104
lea ecx, [esp + 0x130]
push eax
push ecx
call fcn.00404550
push 0x104
lea edx, [esp + 0x13c]
push str..sys
push edx
call fcn.00404550
add esp, 0x18
cmp esi, ebx
je 0x412ca4
push ebx
push ebx
push 3
lea eax, [esp + 0x138]
push 1
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00411f10
add esp, 0x18
mov esi, eax
mov edx, dword [esp + 0x340]
mov ecx, dword [esp + 0x33c]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
call ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x324
ret
xor eax, eax
pop ebx
add esp, 0x324
ret
Function at 0x412e90
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [esp + 0xc]
push str.drivers_
push ecx
call fcn.00404550
mov esi, dword [esp + 0x11c]
push 0x104
lea edx, [esp + 0x18]
push esi
push edx
call fcn.00404550
push 0x104
lea eax, [esp + 0x24]
push str..sys
push eax
call fcn.00404550
add esp, 0x24
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00411fa0
add esp, 4
pop edi
pop esi
add esp, 0x104
ret
Function at 0x413d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x314
push ebx
push ebp
push esi
mov esi, dword [esp + 0x324]
xor ebx, ebx
cmp esi, ebx
jne 0x413d42
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
cmp dword [0x423664], ebx
jne 0x413d96
push 5
push 0x41cbc4
push 6
push 0x423634
push 0x2b
call fcn.00416590
push 3
push 0x41cbcc
push 4
push 0x42363c
push 0x14
call fcn.00416590
push 0x22
push 0x41cbd0
push 0x23
push 0x423640
push 0x10
call fcn.00416590
add esp, 0x3c
mov dword [0x423664], 1
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], bl
mov byte [esp + 0x11c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
push ecx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strncpy]
push eax
mov dword [esp + 0x20], ebx
call esi
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
mov edi, 0x423640
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x423640
push edx
call esi
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x24]
push ecx
lea ecx, [esp + 0x12c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x18
lea edx, [esp + 0x10]
lea eax, [esp + 0x220]
lea ecx, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x128]
push 0x423634
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
pop edi
je 0x413e95
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov esi, 0x42363c
lea eax, [esp + 0x21c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x413ec5
cmp cl, bl
je 0x413ec1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x413ec5
add eax, 2
add esi, 2
cmp cl, bl
jne 0x413ea1
xor eax, eax
jmp 0x413eca
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x413ed3
mov ebp, 0x10001
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
Function at 0x414170
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x348
push ebx
push ebp
push edi
mov edi, dword [esp + 0x358]
test edi, edi
je 0x4142f2
mov ecx, dword [esp + 0x35c]
test ecx, ecx
je 0x4142f2
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x110], 0
and ecx, 3
push 0x104
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x110]
push str.drivers_
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x4142f2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x110]
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
push edx
push str._s.sys
lea eax, [esp + 0x14]
push 0x103
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x214]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4142f2
push esi
lea eax, [esp + 0x244]
lea ecx, [esp + 0x114]
push eax
push ecx
push 0x420694
lea edx, [esp + 0x1c]
push 0x103
push edx
call edi
push 1
push 1
push 1
lea eax, [esp + 0x30]
push 1
push eax
call fcn.00413fd0
add esp, 0x28
test eax, eax
je 0x4142c2
lea ecx, [esp + 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [esp + 0x360]
lea edx, [esi + ebp + 2]
cmp edx, eax
jge 0x4142d9
mov edx, dword [esp + 0x35c]
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x248]
lea eax, [edx + ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ebp, [esi + ebp + 1]
lea ecx, [esp + 0x218]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414248
test ebp, ebp
pop esi
je 0x4142df
inc ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0x348
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x348
ret
Function at 0x414300
Capabilities:
Set registry value

Disassembly:
sub esp, 0x54c
push ebp
mov ebp, dword [esp + 0x554]
push esi
push edi
test ebp, ebp
jne 0x414320
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x54c
ret
mov cl, 0xc5
mov al, 0xca
mov byte [esp + 0x14], cl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], cl
mov byte [esp + 0x25], cl
mov byte [esp + 0x2d], al
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
mov dl, 0xe2
push 0x22
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
push 0x23
mov dl, 0xf7
push ecx
push 0x10
mov byte [esp + 0x20], 0xe3
mov byte [esp + 0x21], 0xcf
mov byte [esp + 0x22], 0xc1
mov byte [esp + 0x23], 0xf1
mov byte [esp + 0x24], 0xf5
mov byte [esp + 0x25], 0xdb
mov byte [esp + 0x26], 0xce
mov byte [esp + 0x27], 0xe6
mov byte [esp + 0x29], 0xe4
mov byte [esp + 0x2a], 0xe0
mov byte [esp + 0x2b], 0xc0
mov byte [esp + 0x2c], 0xde
mov byte [esp + 0x2e], 0xd1
mov byte [esp + 0x30], 0xde
mov byte [esp + 0x32], 0xe0
mov byte [esp + 0x34], 0xdc
mov byte [esp + 0x36], dl
mov byte [esp + 0x37], 0xd1
mov byte [esp + 0x38], 0xec
mov byte [esp + 0x3a], dl
mov byte [esp + 0x3b], 0xd7
mov byte [esp + 0x3c], 0xc6
mov byte [esp + 0x3d], 0xff
mov byte [esp + 0x3e], 0xf1
mov byte [esp + 0x3f], 0xc0
mov byte [esp + 0x40], 0xc3
call fcn.00416590
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x16d]
mov byte [esp + 0x16c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x16c]
push 0x400
push edx
stosb byte es:[edi], al
call fcn.00414170
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x414431
pop edi
pop esi
pop ebp
add esp, 0x54c
ret
lea eax, [esp + 0x158]
push esi
push eax
call fcn.00416b80
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x38]
push ebp
stosw word es:[edi], ax
push ecx
push 0x420694
lea edx, [esp + 0x68]
push 0x103
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x1c
lea eax, [esp + 0x158]
lea ecx, [esp + 0x54]
push esi
push eax
push 3
push str.Config
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x54c
ret

Function at 0x4150f0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 2
push 1
push 0x40000000
push ebx
xor edi, edi
call fcn.004167f0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
je 0x41513d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
push ecx
push esi
call fcn.004168b0
add esp, 0x10
test eax, eax
je 0x415130
mov edi, 1
push esi
call fcn.004169c0
add esp, 4
test edi, edi
jne 0x415144
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x415240
Capabilities:
Access peb ldr_data
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x419ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov al, 0x9a
push esi
mov byte [esp + 0x30], al
mov byte [esp + 0x38], al
push edi
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x2c]
push 0x14
push eax
push 0x26
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 1
mov dword [esp + 0x7c], edi
mov byte [esp + 0x38], 0x95
mov byte [esp + 0x39], 0xe3
mov byte [esp + 0x3a], 0xee
mov byte [esp + 0x3b], 0xef
mov byte [esp + 0x3c], 0x91
mov byte [esp + 0x3d], 0xed
mov byte [esp + 0x3e], 0xfa
mov byte [esp + 0x3f], 0xfe
mov byte [esp + 0x41], pe_nt_image_headers32
mov byte [esp + 0x42], 0xcd
mov byte [esp + 0x43], 0xd5
mov byte [esp + 0x44], 0xa5
mov byte [esp + 0x45], 0xc9
mov byte [esp + 0x46], 0xc6
mov byte [esp + 0x47], 0xcf
mov byte [esp + 0x49], pe_nt_image_headers32
mov byte [esp + 0x4a], 0xea
mov byte [esp + 0x4b], 0xf3
call fcn.00404870
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0xc]
push esi
push edx
push str.Install
lea ecx, [esp + 0x2c]
mov dword [esp + 0x74], 0
call fcn.00404900
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x415428
mov al, 0x99
push 0x1c
mov byte [esp + 0x44], al
mov byte [esp + 0x5c], al
lea eax, [esp + 0x44]
lea ecx, [esp + 0x10]
push eax
push 0x29
mov byte [esp + 0x4d], 0xdd
mov byte [esp + 0x4e], 0xc4
mov byte [esp + 0x4f], 0xd9
mov byte [esp + 0x50], 0xbb
mov byte [esp + 0x51], 0xce
mov byte [esp + 0x52], 0xc6
mov byte [esp + 0x53], 0x9e
mov byte [esp + 0x54], 0x8f
mov byte [esp + 0x55], 0xc6
mov byte [esp + 0x56], 0xc7
mov byte [esp + 0x57], 0xdb
mov byte [esp + 0x58], 0xba
mov byte [esp + 0x59], 0xf3
mov byte [esp + 0x5a], 0xff
mov byte [esp + 0x5b], 0xfb
mov byte [esp + 0x5c], 0x87
mov byte [esp + 0x5d], 0xec
mov byte [esp + 0x5e], 0xee
mov byte [esp + 0x5f], 0xf0
mov byte [esp + 0x60], 0x9d
mov byte [esp + 0x61], 0xf3
mov byte [esp + 0x62], pe_nt_image_headers32
mov byte [esp + 0x63], 0xed
mov byte [esp + 0x65], 0xc3
mov byte [esp + 0x66], 0xde
mov byte [esp + 0x67], 0xcd
call fcn.00404870
push edi
push esi
mov byte [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x415402
lea ecx, [esp + 0xc]
mov byte [esp + 0x64], al
call fcn.004048c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x64], 0xffffffff
call fcn.004048c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
lea ecx, [esp + 0xc]
call fcn.00404900
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x64], 0
call fcn.004048c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x64], 0xffffffff
call fcn.004048c0
mov ecx, dword [esp + 0x5c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 8