joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d6c3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x51ede9
call fcn.0049c7ee
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0042b345
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042b379
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x41d703
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d765
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x525e00
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41d740
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41d765
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0042b358
call fcn.0049c7c8
ret 8

Function at 0x41d8be
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x51ee0f
call fcn.0049c822
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x41d8e9
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x41d9a6
push 0x525840
lea ecx, [ebp - 0x828]
call fcn.0040ba50
and dword [ebp - 4], 0
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.004cbbe0
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x529af8
push eax
call fcn.0040c370
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x41d962
call fcn.0041d7ef
jmp 0x41d967
call fcn.0041d89b
push eax
lea ecx, [ebp - 0x828]
call fcn.0040ccb0
lea ecx, [ebp - 0x840]
call fcn.00408700
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.004d4251
pop ecx
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00408700
mov eax, esi
call fcn.0049c7dd
ret 0xc
Function at 0x41d9b0
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x51ee59
call fcn.0049c822
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
mov dword [ebp - 0x838], esi
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
call fcn.004cbbe0
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41da0d
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0040ba50
and dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x41da53
mov eax, dword [esi]
push ebx
push eax
call fcn.004dc14c
pop ecx
pop ecx
test eax, eax
jne 0x41da9b
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x41da83
call fcn.0041d7ef
jmp 0x41da88
call fcn.0041d89b
push eax
mov ecx, esi
call fcn.0040ccb0
lea ecx, [ebp - 0x828]
call fcn.00408700
mov eax, esi
call fcn.0049c7dd
ret 0x10
Function at 0x41e4ee
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
mov esi, ecx
call fcn.004cbbe0
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41e527
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0040c370
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e55f
lea eax, [ebp - 0x20c]
push eax
call fcn.0042d9f4
pop ecx
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004cbbe0
push str.userconfig.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x52607c
push eax
call fcn.0040c370
lea eax, [ebp - 0x61c]
push eax
call fcn.004dc031
add esp, 0x20
lea ecx, [esi + 0x8c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00407300
push ebx
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004cbbe0
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x52607c
push eax
call fcn.0040c370
lea eax, [ebp - 0x824]
push eax
call fcn.004dc031
add esp, 0x20
lea ecx, [esi + 0xa4]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00407300
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004cbbe0
lea eax, [ebp - 0xa44]
push str.XsfyPath
push eax
call fcn.0042de90
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x41e626
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x526068
push eax
call fcn.0040c370
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.00408700
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e664
lea eax, [ebp - 0x414]
push eax
call fcn.0042d9f4
pop ecx
push ebx
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.004cbbe0
push str.Config.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x52607c
push eax
call fcn.0040c370
lea eax, [ebp - 0xa2c]
push eax
call fcn.004dc031
add esp, 0x20
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00407300
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049be04
leave
ret
Function at 0x41e771
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x51ef66
call fcn.0049c822
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040ba50
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x30], edi
jne 0x41e7b2
mov ecx, esi
call fcn.0041d775
mov esi, eax
push esi
call fcn.004dc031
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00407300
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
test eax, eax
je 0x41e959
push 0x5263d4
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041c984
add esp, 0xc
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x88]
push eax
call esi
test eax, eax
je 0x41e80a
xor edi, edi
inc edi
jmp 0x41e94e
lea eax, [ebp - 0x70]
push str.9755104754656314543663180836632607635531116508026850084024582929
push eax
call fcn.00431658
pop ecx
pop ecx
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
push 0x529b44
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0040ba50
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.0040ba50
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00425d23
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.00408700
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00408700
mov esi, dword [ebp - 0x94]
jmp 0x41e91d
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41e899
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040ba50
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push 1
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0041f135
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
lea eax, [ebp - 0x40]
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0041f135
mov byte [ebp - 4], 7
call fcn.0042c384
mov eax, dword [ebp - 0x18]
add esp, 0x3c
sub eax, dword [ebp - 0x1c]
cdq
push 0x18
pop ecx
idiv ecx
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x41e92b
call fcn.0041f20e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00408700
push 0x18
pop eax
add esi, eax
cmp esi, dword [ebp - 0x90]
jne 0x41e88f
jmp 0x41e93b
call fcn.0041f20e
lea ecx, [ebp - 0x58]
call fcn.00408700
xor edi, edi
inc edi
lea ecx, [ebp - 0x94]
call fcn.0041f20e
lea ecx, [ebp - 0x70]
call fcn.00408700
lea ecx, [ebp - 0x88]
call fcn.00408700
lea ecx, [ebp - 0x40]
call fcn.00408700
mov eax, edi
call fcn.0049c7dd
ret 4
Function at 0x41ecb5
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x51efa4
call fcn.0049c822
mov ebx, ecx
call fcn.0041d775
mov esi, eax
push esi
call fcn.004dc031
pop ecx
push eax
lea edi, [ebx + 0xd4]
push esi
mov ecx, edi
call fcn.00407300
mov esi, str.HaoKanWallPaper.cfg
push esi
call fcn.004dc031
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040b840
push str.hkbzgf
push 0x525e38
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0041d878
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.0041cc6e
push str.hkbzgf
mov ecx, esi
call fcn.0041f1e0
test al, al
je 0x41ed9c
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004cbbe0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41ed5b
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.hkbzgf
push eax
push edi
push 0x525e38
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004dc031
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407300
jmp 0x41eda1
mov edi, str.hkbzgf
push edi
mov ecx, esi
call fcn.0041f1e0
test al, al
je 0x41ee61
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004cbbe0
and dword [ebp - 0x220], 0
lea eax, [ebx + 0x5c]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
add esp, 0xc
push eax
call fcn.0041f135
push str.HaoKanWallPaper.cfg
mov byte [ebp - 4], 1
call fcn.004dc031
pop ecx
push eax
push str.HaoKanWallPaper.cfg
lea ecx, [ebp - 0x230]
call fcn.0040b840
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x525e38
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004dc031
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407300
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00408700
push edi
mov ecx, esi
call fcn.0041f1e0
test al, al
je 0x41ee99
push edi
push 0x525e38
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0041d9b0
push eax
mov ecx, esi
call fcn.0040ccb0
lea ecx, [ebp - 0x230]
call fcn.00408700
lea ecx, [ebp - 0x248]
call fcn.00408700
call fcn.0049c7dd
ret
Function at 0x4249a2
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.0049bfd0
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.004cbbe0
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004dc388
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.004cbbe0
push 0x525e00
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.004248a0
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004cbbe0
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.004cbbe0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004dc031
pop ecx
test eax, eax
je 0x424c01
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004cc533
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x424c01
lea eax, [ebp - 0x20c]
push eax
call fcn.004dc031
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.004dc388
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.004248a0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.00424e3b
push esi
call fcn.004d4324
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.004dcbac
add esp, 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x424c01
lea ecx, [ebp - 0x1024]
push ecx
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004248be
xor eax, eax
add esp, 0x28
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call ebx
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x52a2a8
push eax
cmovne esi, ebx
call fcn.004dc56e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x424c01
test esi, esi
jne 0x424ba7
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.004dc8ca
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.004dc031
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.004dc8ca
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.004dc8ca
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.004dc8ca
push edi
call fcn.004dc612
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049be04
leave
ret
Function at 0x424c10
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0049bfd0
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
call fcn.004d4324
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.004dcbac
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004248be
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
xor ecx, ecx
pop edi
inc ecx
test eax, eax
push 0x52a2a8
push ebx
cmovne edi, ecx
call fcn.004dc56e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x424d2c
test edi, edi
jne 0x424ccf
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.004dc8ca
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
call fcn.004dc031
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.004dc8ca
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.004dc8ca
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.004dc8ca
push esi
call fcn.004dc612
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049be04
leave
ret
Function at 0x428b34
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x51ede9
call fcn.0049c7ee
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0042b345
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042b379
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x428b74
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428bd4
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x428baf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428bd4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0042b358
call fcn.0049c7c8
ret 0xc
Function at 0x428ffa
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x51fdf8
call fcn.0049c822
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.004cbbe0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x4290b8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040ba50
and dword [ebp - 4], 0
push 0x525b5c
call fcn.004dc031
pop ecx
push eax
push 0x525b5c
lea ecx, [ebp - 0x230]
call fcn.0040b840
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00428cbd
mov edi, eax
lea ecx, [ebp - 0x230]
test edi, edi
je 0x4290a9
call fcn.00408700
mov eax, edi
jmp 0x429131
or dword [ebp - 4], 0xffffffff
call fcn.00408700
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x42912f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040ba50
mov esi, 0x525b5c
mov dword [ebp - 4], 1
push esi
call fcn.004dc031
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0040b840
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00428cbd
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.00408700
test esi, esi
je 0x42912f
mov eax, esi
jmp 0x429131
xor eax, eax
call fcn.0049c7dd
ret 4
Function at 0x429139
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
je 0x42929a
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42929a
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004cbbe0
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x429286
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x429260
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.004cbbe0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429254
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004cbe7c
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x42928e
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4291cb
push dword [ebp - 0x418]
call ebx
mov eax, esi
jmp 0x42929c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049be04
leave
ret 4

Function at 0x429c7a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x429c9f
xor eax, eax
jmp 0x429d32
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.004cbbe0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429d30
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x429d0e
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004dbd6c
pop ecx
pop ecx
test eax, eax
je 0x429d20
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x429ced
jmp 0x429d23
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049be04
leave
ret 4