joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a930
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55625f
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x61308c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
call fcn.0042ada0
mov esi, eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x42a9c5
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42a9a8
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404be0
xor eax, eax
mov dword [ebp - 0x14], 7
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00407af0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x42a9de
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404be0
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
mov dword [ebp - 0x30], 0
call fcn.005336c4
add esp, 8
test eax, eax
jne 0x42aa6b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov eax, dword [0x618d28]
cmovae esi, dword [ebp - 0x28]
test eax, eax
jne 0x42aa53
push 0x70
call fcn.005120b2
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00409ee0
mov byte [ebp - 4], 0
mov dword [0x618d28], eax
push esi
push str.delete_setuplog_file__S_
push 0x37
push str.DrvSetupLog.cpp
push 8
push eax
call fcn.0040a3e0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42aa87
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404be0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005120a1
mov esp, ebp
pop ebp
ret
Function at 0x42cbc0
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61308c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x42cc39
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cc39
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0052d340
push esi
push edi
lea eax, [ebp - 0x20c]
push 0x5d7358
push eax
call fcn.0042cba0
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx], eax
pop edi
setne al
xor ecx, ebp
pop ebx
call fcn.005120a1
mov esp, ebp
pop ebp
ret 8

Function at 0x4317e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557407
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x61308c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov byte [ebp - 4], 4
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x438e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438eae
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x438eb4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x438ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, ecx
push 0x594ac4
push esi
mov dword [ebp - 8], 0
call edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438f31
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594864
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
cmp eax, 0x80ea8
jb 0x438f49
push 0x594da4
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x70bf0
jb 0x438f5e
push 0x594b5c
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x709fc
jb 0x438f73
push 0x594bcc
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x707fe
jb 0x438f88
push 0x594dac
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x60632
jb 0x438f9d
push 0x594db4
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x6040e
jb 0x438fb2
push 0x594dc0
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x6004f
jb 0x438fc7
push 0x594dcc
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x5cbf5
jb 0x438fdc
push 0x594dd4
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x5c733
jb 0x438ff1
push 0x594de0
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x5c615
jb 0x439000
push 0x594dec
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43949a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x59483c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4394a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x43949a
push 4
lea eax, [ebp - 0xc]
mov edx, 0x594768
push eax
push ecx
push 0x594864
call fcn.00438e60
add esp, 0x10
test al, al
je 0x43949a
cmp dword [ebp - 0xc], 0
je 0x43949a
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4394e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439543
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x59483c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439549
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x439543
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x439560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4395c3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x59483c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4395c9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x4395c3
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4395e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439643
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x5948e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439649
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x439643
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x439660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0Setup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4396c6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.InstallSuccess
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
test eax, eax
je 0x43971f
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439736
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x594994
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
test eax, eax
je 0x43972e
call esi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call esi
cmp dword [ebp - 4], 1
jne 0x4396c6
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call esi
cmp dword [ebp - 4], 1
je 0x439727
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v2.0.50727
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4397a3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594a9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4397a9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x4397a3
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4397c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v1.1.4322
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439823
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594b34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439829
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x439823
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x439840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x61308c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
push eax
push 0x20019
push 0
push str.SoftwareMicrosoft.NETFrameworkPolicy_v1.0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4398c1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.3705
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x4398d1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005120a1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005120a1
mov esp, ebp
pop ebp
ret

Function at 0x4398f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
push 0x594e5c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x104
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43995e
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594854
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4399b0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x59484c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4399b8
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4399d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
push 0x594e60
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x104
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x439a3e
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594854
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push 0x594768
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439a90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x59484c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439a98
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
push 0x594e64
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x104
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x439b1e
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594854
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439b70
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x59484c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439b78
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
push 0x594e68
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x104
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x439bfe
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x5948f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439c50
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5948f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439c58
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
push 0x594e6c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x439ce5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594a18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439d38
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0x104
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0Setup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439d30
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x594a20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x439d32
push 0x104
push edi
push ecx
push 0x594a20
mov edx, str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0
call fcn.00438e60
mov eax, dword [ebp - 8]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push str.2.0.50727
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v2.0.50727
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439de2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594aac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439de9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x439de4
push 0x104
push esi
push ecx
push 0x594ab4
mov edx, str.SoftwareMicrosoftNET_Framework_SetupNDP_v2.0.50727
call fcn.00438e60
mov eax, dword [ebp - 8]
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.1.1.4322
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v1.1.4322
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439e8f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x594b44
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x439e95
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret