joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464960
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [rcx]
xor ebx, ebx
lea r8, [rsp + 0x68]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4649e3
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x60], ebx
jne 0x4649e3
cmp dword [rsp + 0x64], ebx
mov eax, 1
cmove ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
ret

Function at 0x464b70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x298
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x288], rbp
mov qword [rsp + 0x280], rsi
mov rsi, rcx
movsxd rcx, r8d
mov qword [rsp + 0x278], rdi
add rcx, rdx
lea rdx, [0x004a9dfc]
xor edi, edi
call fcn.00486ac0
test rax, rax
mov rbp, rax
je 0x464bfd
mov rdx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rbx, rax
lea rcx, [rsp + 0x70]
sub rbx, rdx
mov r8, rbx
call fcn.00487090
mov rax, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rsi
sub ebp, eax
mov rdx, rax
mov byte [rsp + rbx + 0x70], dil
inc ebp
mov r8d, ebp
call fcn.00464b70
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsi]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov rbp, qword [rsp + 0x288]
jne 0x464c98
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x64], edi
jne 0x464c98
cmp dword [rsp + 0x60], edi
jne 0x464c98
mov rcx, qword [rsi]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, 1
test eax, eax
cmove edi, ecx
mov eax, edi
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsp + 0x280]
add rsp, 0x298
ret
Function at 0x464cc0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov qword [rsp + 0x460], rbx
mov qword [rsp + 0x458], rbp
mov rbx, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x450], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x448], rdi
mov edi, r9d
xor r8d, r8d
mov r9d, 0x20019
mov rbp, rdx
xor esi, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x464e99
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x464d3f
mov rdx, rbp
mov rcx, rbx
call fcn.004646f0
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x464e99
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x240]
mov r9d, 0x1f4
xor edx, edx
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x464e4b
lea rbx, [rsp + 0x40]
sub rbx, rbp
inc esi
mov rcx, rbp
nop
nop
movzx eax, byte [rcx]
inc rcx
test al, al
mov byte [rbx + rcx - 1], al
jne 0x464da0
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x004a9dfc]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x240]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x464de3
mov r9d, dword [rsp + 0x488]
mov rcx, qword [rsp + 0x470]
lea rdx, [rsp + 0x40]
xor edi, edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
call fcn.00464cc0
test eax, eax
je 0x464e20
dec esi
mov edi, 1
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x240]
mov r9d, 0x1f4
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x464d96
mov rbx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x464e99
mov rcx, qword [rbx]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x464e99
cmp dword [rsp + 0x480], eax
je 0x464e92
cmp dword [rsp + 0x490], eax
je 0x464e92
mov rcx, rbp
call fcn.00487800
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.00464b70
mov eax, 1
jmp 0x464e9b
xor eax, eax
mov rdi, qword [rsp + 0x448]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x458]
mov rbx, qword [rsp + 0x460]
add rsp, 0x468
ret
Function at 0x464ed0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x278
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x258], rdi
lea rdi, [rcx + 8]
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x250], r12
lea rdx, str.CNXT_XYZ_UIU
mov rcx, rdi
mov qword [rsp + 0x248], r13
mov r12, r9
mov r13, r8
xor esi, esi
call fcn.00488120
test eax, eax
je 0x464f91
mov rdx, rbx
mov rcx, rdi
call fcn.00488120
test eax, eax
je 0x464f91
lea rcx, [rsp + 0x40]
sub rcx, rdi
movzx eax, byte [rdi]
inc rdi
test al, al
mov byte [rcx + rdi - 1], al
jne 0x464f43
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x004a9dfc]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x464f80
jmp 0x464fae
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x464fa0
mov rcx, qword [rbp]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rbp, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
test eax, eax
jne 0x46501d
mov eax, dword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x30]
mov edi, 1
mov dword [rsp + 0x28], eax
mov r9d, edi
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmove esi, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x258]
mov eax, esi
mov rsi, qword [rsp + 0x260]
add rsp, 0x278
ret
Function at 0x465050
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x278
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x258], rdi
lea rdi, [rcx + 8]
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x250], r12
lea rdx, str.CNXT_XYZ_UIU
mov rcx, rdi
mov qword [rsp + 0x248], r13
mov r12, r9
mov r13, r8
xor esi, esi
call fcn.00488120
test eax, eax
je 0x465111
mov rdx, rbx
mov rcx, rdi
call fcn.00488120
test eax, eax
je 0x465111
lea rcx, [rsp + 0x40]
sub rcx, rdi
movzx eax, byte [rdi]
inc rdi
test al, al
mov byte [rcx + rdi - 1], al
jne 0x4650c3
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x004a9dfc]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x465100
jmp 0x46512e
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x465120
mov rcx, qword [rbp]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x268]
test eax, eax
mov rbx, qword [rsp + 0x270]
jne 0x4651a8
mov eax, dword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x30]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov eax, esi
mov rsi, qword [rsp + 0x260]
add rsp, 0x278
ret
Function at 0x4651d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x268
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x258], rbp
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x248], rdi
lea rdi, [rcx + 8]
mov rbx, rdx
mov rsi, rcx
lea rdx, str.CNXT_XYZ_UIU
mov rcx, rdi
mov qword [rsp + 0x240], r12
mov rbp, r9
mov r12, r8
call fcn.00488120
test eax, eax
je 0x465291
mov rdx, rbx
mov rcx, rdi
call fcn.00488120
test eax, eax
je 0x465291
lea rcx, [rsp + 0x40]
sub rcx, rdi
nop
nop
movzx eax, byte [rdi]
inc rdi
test al, al
mov byte [rcx + rdi - 1], al
jne 0x465240
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x004a9dfc]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x465280
jmp 0x4652ae
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x4652a0
mov rcx, qword [rsi]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, qword [rsp + 0x250]
test eax, eax
jne 0x465320
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
test eax, eax
mov ecx, 1
cmove edi, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x465320
mov eax, dword [rbx]
jmp 0x465322
xor eax, eax
mov r12, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x248]
mov rbp, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x260]
add rsp, 0x268
ret
Function at 0x465350
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x268
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x258], rbp
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x248], rdi
lea rdi, [rcx + 8]
mov rbx, rdx
mov rbp, rcx
lea rdx, str.CNXT_XYZ_UIU
mov rcx, rdi
mov qword [rsp + 0x240], r12
xor esi, esi
mov r12, r8
call fcn.00488120
test eax, eax
je 0x465404
mov rdx, rbx
mov rcx, rdi
call fcn.00488120
test eax, eax
je 0x465404
lea rcx, [rsp + 0x40]
sub rcx, rdi
movzx eax, byte [rdi]
inc rdi
test al, al
mov byte [rcx + rdi - 1], al
jne 0x4653b8
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x004a9dfc]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4653f3
jmp 0x46541e
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x465410
mov rcx, qword [rbp]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdi, qword [rsp + 0x248]
mov rbp, qword [rsp + 0x258]
test eax, eax
mov rbx, qword [rsp + 0x260]
jne 0x46547f
mov rcx, qword [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x240]
mov eax, esi
mov rsi, qword [rsp + 0x250]
add rsp, 0x268
ret
Function at 0x4654a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, reloc.SHELL32.dll_IsUserAnAdmin
mov rcx, qword [rcx]
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x290], rsi
lea rax, [rsp + 0x50]
mov rsi, r8
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x280], r12
xor r12d, r12d
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov ebp, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x465615
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x170]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x46560a
mov rbx, qword [rsi]
inc ebp
cmp rbx, 0x1f4
jae 0x4655a5
cmp rbx, 0xffffffffffffffff
lea rax, [rbx + 1]
mov qword [rsi], rax
je 0x4655a5
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
add rcx, 4
call fcn.00486ab0
lea rdx, [rsp + 0x60]
mov qword [rsi + rbx*8 + 0x200], rax
movzx ecx, byte [rdx]
inc rax
inc rdx
test cl, cl
mov byte [rax - 1], cl
jne 0x465595
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x170]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x465551
mov rdi, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsi]
mov r12, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x298]
add rsp, reloc.SHELL32.dll_IsUserAnAdmin
ret
Function at 0x470ba0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x348
mov qword [rsp + 0x340], rbx
mov qword [rsp + 0x338], rdi
mov rbx, rcx
call fcn.004545a0
test eax, eax
je 0x470c31
lea rdx, str.CSetupApp::CloseMMSYSWindow_n
lea rcx, [rsp + 0x120]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x120]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x470c03
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
lea rdx, [rsp + 0x220]
mov rcx, rbx
call fcn.004709e0
lea rdx, [rsp + 0x220]
lea rcx, [0x00470860]
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.004545a0
mov rbx, qword [rsp + 0x340]
test eax, eax
je 0x470cd5
lea rdx, str.CSetupApp::CloseMMSYSWindow_n
lea rcx, [rsp + 0x120]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x20203a54495845
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x120]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x470ca7
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x338]
add rsp, 0x348
ret
Function at 0x479c10
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x3a8
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x398], rsi
mov qword [rsp + 0x390], rdi
mov qword [rsp + 0x78], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x479cc1
xor r8d, r8d
lea rdx, str.CSetupNT4_::_DoUninstall_n
lea rcx, [rsp + 0x80]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x180], rdx
lea rdi, [rsp + 0x180]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x80]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x479c90
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x180]
call fcn.004548a0
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x38], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [0x004b6970]
lea rcx, [rsp + 0x50]
call fcn.0049b290
mov rsi, rax
lea rdx, str.WINACHSF
lea rcx, [rsp + 0x48]
call fcn.0049b290
mov rbx, rax
lea rdx, [0x004a9dfc]
lea rcx, [rsp + 0x40]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.0049b804
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.0049b804
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x68]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x60]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x58]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x70]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, str.__U__S
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.004223c0
test eax, eax
jne 0x479e1b
call fcn.004545a0
test eax, eax
je 0x479e1b
mov r8, qword [rsp + 0x38]
lea rdx, str.FAILED_SpawnApp_:_csSetupPath___s_n
lea rcx, [rsp + 0x80]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x80]
call fcn.004548a0
call fcn.004545a0
test eax, eax
je 0x479ea2
xor r8d, r8d
lea rdx, str.CSetupNT4_::_DoUninstall_n
lea rcx, [rsp + 0x80]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x180], rdx
lea rdi, [rsp + 0x180]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x80]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x479e70
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x180]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x3a0]
mov rsi, qword [rsp + 0x398]
mov rdi, qword [rsp + 0x390]
add rsp, 0x3a8
ret
Function at 0x47c2a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub rsp, 0x388
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x378], rbp
mov qword [rsp + 0x370], rsi
mov qword [rsp + 0x368], rdi
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x47c34e
xor r8d, r8d
lea rdx, str.CInstallVideo::StopMCE_n
lea rcx, [rsp + 0x260]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x260]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x47c320
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.004548a0
xor ebp, ebp
mov dword [rsp + 0x130], ebp
mov r8d, 0x12c
xor edx, edx
lea rcx, [rsp + 0x134]
call fcn.00499630
mov rdx, qword [0x004dfd00]
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov rcx, rsi
call fcn.0047bb90
test eax, eax
je 0x47c456
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x47c456
mov dword [rsp + 0x130], 0x130
lea rdx, [rsp + 0x130]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x47c44d
nop
nop
nop
lea rdx, [rsp + 0x15c]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea rcx, [rsp + 0x20]
call fcn.0049b664
mov rdx, qword [rsp + 0x20]
cmp dword [rdx - 8], 0
je 0x47c427
lea rdx, str.EHRECVR.EXE
lea rcx, [rsp + 0x20]
call fcn.0049a400
cmp eax, 0xffffffff
je 0x47c427
mov r8d, dword [rsp + 0x138]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x47c43d
lea rdx, [rsp + 0x130]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x47c44d
jmp 0x47c3d0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebp, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004545a0
test eax, eax
je 0x47c4cf
mov r8d, ebp
lea rdx, str.CInstallVideo::StopMCE_:_bRetVal___d_n
lea rcx, [rsp + 0x260]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x260]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x47c4a0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov eax, ebp
mov rbx, qword [rsp + 0x380]
mov rbp, qword [rsp + 0x378]
mov rsi, qword [rsp + 0x370]
mov rdi, qword [rsp + 0x368]
add rsp, 0x388
ret
Function at 0x47d420
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
mov rax, qword [0x004dfd00]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
bt eax, 0x1f
jb 0x47d4a2
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x47d49d
test edi, edi
je 0x47d489
lea rdx, str.Global_
mov rcx, rbx
call fcn.0049b398
mov rax, rbx
jmp 0x47d4a5
lea rdx, str.Local_
mov rcx, rbx
call fcn.0049b398
mov rax, rbx
jmp 0x47d4a5
mov rax, rbx
jmp 0x47d4a5
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x47f760
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x160
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x30], rax
xor ebx, ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47f8c3
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x004ae580]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47f835
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.0049b398
lea rcx, [rsp + 0x30]
call fcn.0049b664
lea rdx, str.MILLENNIUM
lea rcx, [rsp + 0x30]
call fcn.0049a400
cmp eax, 0xffffffff
jne 0x47f82b
lea rdx, [0x004aefa0]
lea rcx, [rsp + 0x30]
call fcn.0049a400
cmp eax, 0xffffffff
je 0x47f835
mov ebx, 1
jmp 0x47f8b7
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x004abdd0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47f8b7
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.0049b398
lea rcx, [rsp + 0x30]
call fcn.0049b664
lea rdx, str.MILLENNIUM
lea rcx, [rsp + 0x30]
call fcn.0049a400
cmp eax, 0xffffffff
jne 0x47f8b2
lea rdx, [0x004aefa0]
lea rcx, [rsp + 0x30]
call fcn.0049a400
cmp eax, 0xffffffff
je 0x47f8b7
mov ebx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov eax, ebx
add rsp, 0x160
pop rbx
ret