joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419068
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x424320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x424de4
mov dword [ebp - 0x14], 0x424de4
mov dword [0x424de4], 0
mov dword [0x424de8], 0
call fcn.004061c0
mov dword [0x424de4], eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41ef04
mov esi, eax
push 0x66
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp byte [edx], 0
jne 0x407e8b
xor ecx, ecx
jmp 0x407e99
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407e90
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00404b70
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040f3e9
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040ec4d
mov esi, eax
cmp esi, 0x424de4
je 0x407f13
mov eax, dword [0x424de4]
mov ecx, 0x424de4
push dword [eax + 4]
call fcn.00405f40
mov eax, dword [0x424de4]
mov ecx, 0x424de4
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
mov dword [eax + 4], eax
mov eax, dword [0x424de4]
push esi
mov dword [eax], eax
mov eax, dword [0x424de4]
mov dword [eax + 8], eax
mov dword [0x424de8], 0
call fcn.004064d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401dd0
cmp dword [ebp - 0x18], 0x10
jb 0x407f31
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x424de4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409840
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x40984d
mov eax, dword [esi]
jmp 0x40984f
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409866
test al, 0x10
je 0x409866
mov eax, 1
pop esi
ret
cmp dword [esi + 0x14], 8
jb 0x40986e
mov esi, dword [esi]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
neg eax
pop esi
sbb eax, eax
inc eax
ret
Function at 0x409880
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419372
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], 0
mov ax, word [0x41f0b8]
movdqu xmm0, xmmword [str.WebInstaller]
mov word [ebp - 0x14], ax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x232]
movdqu xmmword [ebp - 0x2c], xmm0
push eax
movq xmm0, qword [0x41f0b0]
mov dword [ebp - 0x23c], esi
movq qword [ebp - 0x1c], xmm0
call sub.MSVCR120.dll_memset
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push eax
push 0x104
mov dword [ebp - 0x238], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4099ce
cmp word [ebp - 0x234], 0
jne 0x409948
xor ecx, ecx
jmp 0x409960
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409951
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.00404f00
cmp word [ebp - 0x2c], 0
jne 0x40997a
xor ecx, ecx
jmp 0x40998f
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409980
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00404820
cmp dword [esi + 0x14], 8
jb 0x4099a5
mov eax, dword [esi]
jmp 0x4099a7
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4099b7
test al, 0x10
jne 0x4099ce
cmp dword [esi + 0x14], 8
jb 0x4099c1
mov eax, dword [esi]
jmp 0x4099c3
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x409ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41943b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x23c], 0
push 0xffffffffffffffff
push eax
push 0x4243b0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
call fcn.00404940
push 0xb
push str.InstallPath
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.00404820
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a006
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409ffa
push 0x41e084
mov ecx, esi
call fcn.004041c0
jmp 0x40a04e
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x218], ax
jne 0x40a026
xor ecx, ecx
jmp 0x40a03f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a030
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00404f00
cmp dword [ebp - 0x220], 8
jb 0x40a066
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x40a090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41943b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x23c], 0
push 0xffffffffffffffff
push eax
push 0x424ea0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
call fcn.00404940
xor eax, eax
mov dword [ebp - 4], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a197
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.tWebResourceInstallPath
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a18b
push 0x41e084
mov ecx, esi
call fcn.004041c0
jmp 0x40a1de
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x218], ax
jne 0x40a1b7
xor ecx, ecx
jmp 0x40a1cf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a1c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00404f00
cmp dword [ebp - 0x220], 8
jb 0x40a1f6
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x40a310
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4194d1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
push 0x10
push eax
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x20], 0
movq qword [ebp - 0x1f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
xor eax, eax
mov dword [edi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [edi + 0x10], 0
mov ecx, edi
push esi
mov word [edi], ax
call fcn.00404940
push 1
mov dword [ebp - 4], 0
mov ecx, edi
push 0x41e080
mov dword [ebp - 0x3c], 1
call fcn.00404820
xor eax, eax
mov dword [ebp - 0x24], 7
push eax
push 0x41e084
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
call fcn.00404f00
mov dword [ebp - 4], 1
xor esi, esi
mov ebx, 0x1a
movzx eax, byte [ebp + esi - 0x20]
cdq
idiv ebx
add dl, 0x41
movsx ax, dl
movzx eax, ax
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040d350
inc esi
cmp esi, 0x10
jl 0x40a3e3
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00404e00
cmp dword [ebp - 0x24], 8
jb 0x40a426
push dword [ebp - 0x38]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x40a760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4195a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push 0x424ea0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00404940
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00404e00
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a823
cmp dword [edi + 0x10], eax
je 0x40a800
cmp dword [edi + 0x14], 8
jb 0x40a802
mov edi, dword [edi]
jmp 0x40a802
xor edi, edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x30]
test eax, eax
je 0x40a854
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x18], 8
jb 0x40a837
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x40a825
Function at 0x40a870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4195e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
push 0x424ea0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00404940
mov byte [ebp - 4], 1
lea ebx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 0x18]
cmovae ebx, dword [ebp + 8]
add eax, eax
push 0xffffffffffffffff
push 0
push esi
mov dword [ebp - 0x30], eax
call fcn.00404e00
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a949
cmp dword [edi + 0x10], eax
je 0x40a928
cmp dword [edi + 0x14], 8
jb 0x40a92a
mov edi, dword [edi]
jmp 0x40a92a
xor edi, edi
push dword [ebp - 0x30]
push ebx
push 1
push 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
test eax, eax
je 0x40a99f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x14], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x40a95f
push dword [ebp - 0x28]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x40a981
push dword [ebp + 8]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x40a94b
Function at 0x40a9b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419618
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push 0x4243b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00404940
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR120.dll__time64]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 8
call dword [sym.imp.MSVCR120.dll_rand]
cdq
mov ecx, 0x2710
idiv ecx
push 0xb
inc edx
lea ecx, [ebp - 0x2c]
push str.WebResource
mov dword [ebp - 0x14], edx
call fcn.00404820
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40aa87
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.irandom
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x30]
test eax, eax
je 0x40aab7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x18], 8
jb 0x40aa9b
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x40aa89
Function at 0x40aad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419648
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], 7
push 0xffffffffffffffff
push eax
push 0x4243b0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
call fcn.00404940
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR120.dll__time64]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 8
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x30]
push 0xb
push str.WebResource
call fcn.00404820
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x34]
push ecx
push 1
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ab9b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push str.irandom
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ab9b
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x18]
jmp 0x40ab9e
or esi, 0xffffffff
cmp dword [ebp - 0x1c], 8
jb 0x40abb0
push dword [ebp - 0x30]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x40ae30
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4196e8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x424320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x15
xor eax, eax
mov dword [ebp - 0x10], 7
push str.RemoveEmptyDirectory
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
call fcn.00404f00
push esi
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00406380
add esp, 4
xor dl, dl
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.004030c0
cmp dword [ebp - 0x40], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x40aeb3
push dword [ebp - 0x54]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
jb 0x40aedc
push dword [ebp - 0x24]
call edi
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x40aee4
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x27
xor eax, eax
mov dword [ebp - 0x28], 7
push str.RemoveEmptyDirectory_completed_with_::
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], ax
call fcn.00404f00
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.0040c510
cmp dword [ebp - 0x28], 8
jb 0x40af2b
push dword [ebp - 0x3c]
call edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c0c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4199b8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0xffffffffffffffff
push eax
push 0x4243b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00404940
push 0xb
push str.WebResource
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00404820
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x5c]
push ecx
push 1
lea eax, [ebp - 0x40]
mov dword [ebp - 0x14], 0xffffffff
cmovae eax, dword [ebp - 0x40]
push 0
push eax
push 0x80000002
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
test eax, eax
jne 0x40c27d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.irandom
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or esi, 0xffffffff
test eax, eax
lea eax, [ebp - 0x1c]
mov ecx, esi
cmove ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
mov dword [ebx], ecx
push eax
push 0
push 0
push str.iUpdateId
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
cmove esi, dword [ebp - 0x14]
mov dword [ebx + 4], esi
xor esi, esi
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push esi
push esi
push esi
push str.tWebResourceInstallPath
push dword [ebp - 0x5c]
mov dword [ebp - 0x18], 0xc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c251
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 1
add eax, 2
push eax
call fcn.0040d110
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0
push str.tWebResourceInstallPath
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c26a
push esi
lea ecx, [ebp - 0x58]
call fcn.004041c0
lea ecx, [ebx + 8]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp ecx, eax
je 0x40c241
push 0xffffffffffffffff
push 0
push eax
call fcn.00404940
cmp dword [ebp - 0x44], 8
jb 0x40c26a
push dword [ebp - 0x58]
call edi
add esp, 4
jmp 0x40c26a
lea ecx, [ebx + 8]
cmp ecx, 0x4243d0
je 0x40c26a
push 0xffffffffffffffff
push 0
push 0x4243d0
call fcn.00404940
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40c27d
push esi
call edi
add esp, 4
cmp dword [ebp - 0x2c], 8
jb 0x40c28b
push dword [ebp - 0x40]
call edi
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret
Function at 0x40c2b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4199e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x424320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
xor esi, esi
mov word [ebp - 0x28], ax
push 0x4243b0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], esi
call fcn.00404940
push 0xb
push str.WebResource
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00404820
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 1
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c350
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
mov ecx, 1
cmove esi, ecx
cmp dword [ebp - 0x14], 8
jb 0x40c362
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004176f4
mov esp, ebp
pop ebp
ret