joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40104b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x403a30
sub esp, 0x510
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x50c], eax
push 0x400
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x104
call fcn.00407af0
add esp, 0xc
cmp dword [0x43ce7c], 1
jne 0x403a8b
mov eax, 1
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00407adf
add esp, 0x510
ret
push esi
push edi
push str.X64_Plant
push 0x43cf88
call fcn.00401041
mov ecx, 0x10
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43cc98
add esp, 8
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403ab7
lea edi, [esp + 0x10]
sub eax, edx
add edi, 0xffffffff
lea esp, [esp]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403ad0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push str.Delect_Uninstall_Register_Path___s
push 0x43cf88
call fcn.00401041
add esp, 0xc
lea edx, [esp + 8]
push edx
push 1
push 0
lea eax, [esp + 0x1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403b49
push str.No_Uninstall_Register
push 0x43cf88
call fcn.00401041
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00407adf
add esp, 0x510
ret
push str.Have_Uninstall_Register
push 0x43cf88
call fcn.00401041
mov eax, dword [esp + 0x10]
add esp, 8
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x414]
push edx
push 0
push 0
push str.ProductGuid
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x403bb8
push str.No_Product_GUID_Key
push 0x43cf88
call fcn.00401041
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00407adf
add esp, 0x510
ret
push str.Have_Product_GUID_Key
push 0x43cf88
call fcn.00401041
mov ecx, dword [esp + 0x51c]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x510
ret
Function at 0x401050
Capabilities:
Delete registry key

Disassembly:
jmp 0x4028d0
sub esp, 0x404
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
push edi
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00407af0
mov ecx, 0x10
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43cc98
add esp, 0xc
movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x402913
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402927
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push str.Delect_Uninstall_Register_Path__X64____s
push 0x43cf88
call fcn.00401041
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
add esp, 0xc
push 0
push 0x200
lea edx, [esp + 0x14]
push edx
push 0x80000002
call ebx
test eax, eax
je 0x402a40
push str.Delect_Uninstall_Register_fail__XP_64_bit___
push 0x43cf88
call fcn.00401041
add esp, 8
mov ecx, 0x43cf88
call fcn.00401037
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43cc98
movsb byte es:[edi], byte [esi]
mov ecx, eax
jmp 0x4029b0
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4029b0
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4029c4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
push eax
and ecx, 3
push str.Delect_Uninstall_Register_Path__XP_64_bit____s
push 0x43cf88
rep movsb byte es:[edi], byte [esi]
call fcn.00401041
add esp, 0xc
push 0
push 0x100
lea ecx, [esp + 0x14]
push ecx
push 0x80000002
call ebx
test eax, eax
je 0x402a40
push str.Delect_Uninstall_Register_fail__XP_64_bit___
push 0x43cf88
call fcn.00401041
add esp, 8
mov ecx, 0x43cf88
call fcn.00401037
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00407adf
add esp, 0x404
ret
push str.Delect_Uninstall_Register_success__
push 0x43cf88
call fcn.00401041
mov ecx, dword [esp + 0x414]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x404
ret
Function at 0x40105f
Capabilities:
Delete registry key
Read .ini file

Disassembly:
jmp 0x403c60
sub esp, 0x508
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x504], eax
push esi
push edi
push 0x43ce80
push 0x104
lea eax, [esp + 0x10]
push eax
push str.69B83310_5AC2_11D8_ADAF_00065B37CF9A
push str.PROPERTY_GUID
push str.DrvUninstall
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, 0xb
mov esi, str.SystemCurrentControlSetControlMediaSets_
lea edi, [esp + 0x10c]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403cb3
lea edi, [esp + 0x10c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403cc8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10c]
push ecx
push str.Delect_Property_Register_Path___s
push 0x43cf88
call fcn.00401041
add esp, 0xc
lea edx, [esp + 0x10c]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
pop edi
pop esi
je 0x403d48
push str.Delect_Property_Register_fail__
push 0x43cf88
call fcn.00401041
add esp, 8
mov ecx, 0x43cf88
call fcn.00401037
xor eax, eax
mov ecx, dword [esp + 0x504]
xor ecx, esp
call fcn.00407adf
add esp, 0x508
ret
mov ecx, dword [esp + 0x504]
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x508
ret
Function at 0x401064
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
jmp 0x403850
mov eax, 0x1110
call fcn.004081f0
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x110c], eax
lea eax, [esp + 4]
push eax
push 0x1000
lea ecx, [esp + 0x10]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [esp + 4]
shr eax, 2
cmp eax, 0x400
mov dword [esp], 0x400
ja 0x403894
mov dword [esp], eax
push ebp
xor ebp, ebp
cmp dword [esp + 4], ebp
jbe 0x4039b2
push ebx
push esi
push edi
mov edx, dword [esp + ebp*4 + 0x18]
push edx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x403976
push 0x104
lea eax, [esp + 0x101c]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x403976
push 0x43cb90
call fcn.004079c2
push eax
call fcn.0040793e
lea ecx, [esp + 0x1020]
push ecx
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040793e
push esi
push eax
call fcn.004072e0
add esp, 0x18
test eax, eax
jne 0x40398c
mov esi, section..data
mov edx, dword [esi]
push edx
call fcn.004079c2
push eax
call fcn.0040793e
mov ebx, eax
lea eax, [esp + 0x1020]
push eax
call fcn.004079c2
push eax
call fcn.0040793e
push ebx
push eax
call fcn.004072e0
add esp, 0x18
test eax, eax
jne 0x403953
add esi, 4
cmp esi, str.USBVID_0ac8PID_0331MI_00
jl 0x403915
jmp 0x403976
lea ecx, [esp + 0x1018]
push ecx
push str.Kill__s
push 0x43cf88
call fcn.00401041
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebp, 1
cmp ebp, dword [esp + 0x10]
jb 0x4038a4
jmp 0x4039af
lea edx, [esp + 0x1018]
push edx
push str.Kill__s
push 0x43cf88
call fcn.00401041
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1110]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x1110
ret
Function at 0x401082
Capabilities:
Delete registry key

Disassembly:
jmp 0x403db0
sub esp, 0x108
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push edi
push str.Enter_RemoveDevice__
push 0x43cf88
mov dword [esp + 0x10], 0
call fcn.00401041
push esi
call fcn.004079c2
push eax
call fcn.0040818d
mov dx, word [0x435d9c]
mov ecx, dword [str.Enum_]
mov word [esp + 0x20], dx
add esp, 0x10
mov dword [esp + 0xc], ecx
mov edx, eax
jmp 0x403e10
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403e10
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403e22
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push str.EnumUSBVID_0000PID_0000
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x80000002
call esi
lea eax, [esp + 0xc]
push eax
push 0x80000002
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x18]
push edx
push 0x80000002
call edi
test eax, eax
jne 0x403e88
lea eax, [esp + 0xc]
push eax
push 0x80000002
call esi
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x18]
push eax
push 0x80000002
call edi
mov ecx, dword [esp + 8]
push ecx
mov edi, eax
call esi
mov ecx, dword [esp + 0x10c]
xor eax, eax
test edi, edi
pop edi
setne al
pop esi
xor ecx, esp
call fcn.00407adf
add esp, 0x108
ret
Function at 0x401091
Capabilities:
Get common file path
Write and execute a file
Write file on windows

Disassembly:
jmp 0x405cf0
push ebp
lea ebp, [esp - 0x294]
sub esp, 0x314
mov eax, dword [0x43b10c]
xor eax, ebp
mov dword [ebp + 0x290], eax
push ebx
push esi
push edi
lea eax, [ebp + 0x18c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, str.UninVmsep.bat
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405d27
lea edi, [ebp + 0x18c]
sub eax, edx
add edi, 0xffffffff
jmp 0x405d40
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x405d40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x104
lea ecx, [ebp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov cl, byte [ebp + eax + 0x88]
mov byte [ebp + eax - 0x7c], cl
add eax, 1
test cl, cl
jne 0x405d70
lea edx, [ebp - 0x7c]
push 0x5c
push edx
call fcn.004088c0
add esp, 8
test eax, eax
je 0x405d97
mov byte [eax], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405e7c
mov eax, str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405dd0
sub eax, edx
mov edi, eax
lea eax, [ebp + 0x88]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405de6
sub eax, edx
mov edx, eax
lea eax, [ebp + 0x18c]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405e00
sub eax, esi
lea eax, [eax + edx*2 + 0x14]
add eax, edi
call fcn.004088f0
mov esi, esp
lea ecx, [ebp + 0x18c]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp + 0x88]
push eax
mov ecx, eax
push ecx
push str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405e41
push 0
sub eax, edx
lea edx, [ebp - 0x80]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp + 0x18c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
call fcn.00407adf
add ebp, 0x294
mov esp, ebp
pop ebp
ret
Function at 0x4010b4
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
jmp 0x4019b0
sub esp, 0x250
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x24c], eax
mov eax, dword [esp + 0x254]
push 0x104
lea ecx, [esp + 0x14c]
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4019fb
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00407adf
add esp, 0x250
ret
lea eax, [esp + 0x148]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401a05
mov edx, dword [str.infoem.inf]
mov ecx, dword [0x434f00]
mov dword [eax], edx
mov edx, dword [0x434f04]
mov dword [eax + 4], ecx
mov cx, word [0x434f08]
mov dword [eax + 8], edx
push edi
lea edx, [esp + 0xc]
mov word [eax + 0xc], cx
push edx
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401a67
xor eax, eax
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00407adf
add esp, 0x250
ret
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebp
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
push esi
test byte [esp + 0x18], 0x10
jne 0x401ab0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00401055
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push eax
push esi
call fcn.0040105a
add esp, 0x10
cmp eax, 1
jne 0x401aad
push 0
push eax
lea ecx, [esp + 0x4c]
push ecx
call ebp
push esi
call ebx
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x250
ret
Function at 0x401118
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
jmp 0x401fa0
push ecx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push 0x128
mov dword [esp + 0xc], esi
call fcn.00407a75
add esp, 4
mov edi, eax
push edi
push esi
mov dword [edi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40207a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x40207a
push edi
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40207a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004079c2
push eax
call fcn.0040818d
mov esi, eax
lea eax, [edi + 0x24]
push eax
call fcn.004079c2
push eax
call fcn.0040818d
add esp, 0x10
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402042
test dl, dl
je 0x40203e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402042
add ecx, 2
add eax, 2
test dl, dl
jne 0x402022
xor eax, eax
jmp 0x402047
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402065
mov eax, dword [edi + 8]
push eax
push 1
push 0x1f0fff
call ebx
test eax, eax
je 0x402065
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x10]
push edi
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402000
mov esi, dword [esp + 0x10]
pop ebp
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret
Function at 0x4019b0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
jmp 0x4019b0
sub esp, 0x250
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x24c], eax
mov eax, dword [esp + 0x254]
push 0x104
lea ecx, [esp + 0x14c]
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4019fb
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00407adf
add esp, 0x250
ret
lea eax, [esp + 0x148]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401a05
mov edx, dword [str.infoem.inf]
mov ecx, dword [0x434f00]
mov dword [eax], edx
mov edx, dword [0x434f04]
mov dword [eax + 4], ecx
mov cx, word [0x434f08]
mov dword [eax + 8], edx
push edi
lea edx, [esp + 0xc]
mov word [eax + 0xc], cx
push edx
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401a67
xor eax, eax
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00407adf
add esp, 0x250
ret
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebp
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
push esi
test byte [esp + 0x18], 0x10
jne 0x401ab0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00401055
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push eax
push esi
call fcn.0040105a
add esp, 0x10
cmp eax, 1
jne 0x401aad
push 0
push eax
lea ecx, [esp + 0x4c]
push ecx
call ebp
push esi
call ebx
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x250
ret
Function at 0x402690
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x402690
sub esp, 0x118
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
mov ebx, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x4026ef
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402736
cmp eax, 2
jne 0x40270b
push str.Key_not_found._n
push 0x43cf88
call fcn.00401041
add esp, 8
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00407adf
add esp, 0x118
ret
push str.Error_opening_key._n
push 0x43cf88
call fcn.00401041
add esp, 8
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00407adf
add esp, 0x118
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, edi
cmp byte [esi - 1], 0x5c
je 0x402751
mov byte [esi], 0x5c
add esi, 1
mov byte [esi], 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4027cb
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x20]
push edx
push esi
call ebp
push edi
push ebx
call fcn.00401046
add esp, 8
test eax, eax
je 0x4027ca
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402786
pop ebp
mov byte [esi - 1], 0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x120]
pop esi
neg eax
pop edi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.00407adf
add esp, 0x118
ret
Function at 0x4028d0
Capabilities:
Delete registry key

Disassembly:
jmp 0x4028d0
sub esp, 0x404
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
push edi
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00407af0
mov ecx, 0x10
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43cc98
add esp, 0xc
movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x402913
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402927
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push str.Delect_Uninstall_Register_Path__X64____s
push 0x43cf88
call fcn.00401041
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
add esp, 0xc
push 0
push 0x200
lea edx, [esp + 0x14]
push edx
push 0x80000002
call ebx
test eax, eax
je 0x402a40
push str.Delect_Uninstall_Register_fail__XP_64_bit___
push 0x43cf88
call fcn.00401041
add esp, 8
mov ecx, 0x43cf88
call fcn.00401037
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43cc98
movsb byte es:[edi], byte [esi]
mov ecx, eax
jmp 0x4029b0
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4029b0
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4029c4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
push eax
and ecx, 3
push str.Delect_Uninstall_Register_Path__XP_64_bit____s
push 0x43cf88
rep movsb byte es:[edi], byte [esi]
call fcn.00401041
add esp, 0xc
push 0
push 0x100
lea ecx, [esp + 0x14]
push ecx
push 0x80000002
call ebx
test eax, eax
je 0x402a40
push str.Delect_Uninstall_Register_fail__XP_64_bit___
push 0x43cf88
call fcn.00401041
add esp, 8
mov ecx, 0x43cf88
call fcn.00401037
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00407adf
add esp, 0x404
ret
push str.Delect_Uninstall_Register_success__
push 0x43cf88
call fcn.00401041
mov ecx, dword [esp + 0x414]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x404
ret
Function at 0x403850
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
jmp 0x403850
mov eax, 0x1110
call fcn.004081f0
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0x110c], eax
lea eax, [esp + 4]
push eax
push 0x1000
lea ecx, [esp + 0x10]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [esp + 4]
shr eax, 2
cmp eax, 0x400
mov dword [esp], 0x400
ja 0x403894
mov dword [esp], eax
push ebp
xor ebp, ebp
cmp dword [esp + 4], ebp
jbe 0x4039b2
push ebx
push esi
push edi
mov edx, dword [esp + ebp*4 + 0x18]
push edx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x403976
push 0x104
lea eax, [esp + 0x101c]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x403976
push 0x43cb90
call fcn.004079c2
push eax
call fcn.0040793e
lea ecx, [esp + 0x1020]
push ecx
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040793e
push esi
push eax
call fcn.004072e0
add esp, 0x18
test eax, eax
jne 0x40398c
mov esi, section..data
mov edx, dword [esi]
push edx
call fcn.004079c2
push eax
call fcn.0040793e
mov ebx, eax
lea eax, [esp + 0x1020]
push eax
call fcn.004079c2
push eax
call fcn.0040793e
push ebx
push eax
call fcn.004072e0
add esp, 0x18
test eax, eax
jne 0x403953
add esi, 4
cmp esi, str.USBVID_0ac8PID_0331MI_00
jl 0x403915
jmp 0x403976
lea ecx, [esp + 0x1018]
push ecx
push str.Kill__s
push 0x43cf88
call fcn.00401041
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebp, 1
cmp ebp, dword [esp + 0x10]
jb 0x4038a4
jmp 0x4039af
lea edx, [esp + 0x1018]
push edx
push str.Kill__s
push 0x43cf88
call fcn.00401041
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1110]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0x1110
ret