joyce8/EMBER2024-capa huggingface dataset:
Function at 0x672a48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x672b51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 0xc8]
inc eax
je 0x672b36
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x218]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x672b68
call fcn.0040528c
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004051e8
push 3
push 0x672b6c
push 0x672b6c
mov eax, dword [ebp - 8]
call fcn.00405148
push eax
push 0x672b70
mov eax, dword [ebp - 4]
call fcn.00455b70
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 2
jne 0x672b29
mov eax, dword [0x6ebc54]
mov ax, word [eax]
push eax
push 0x40
push 0x672b6c
lea edx, [ebp - 0x10]
mov eax, 0x4e6e
call fcn.006ccb24
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404f9c
mov eax, dword [ebp - 0xc]
call fcn.00405148
push eax
push 0
call sub.user32.dll_MessageBoxExA
mov eax, dword [ebp - 4]
mov dword [eax + 0x24c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x672b58
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cbc
ret
Function at 0x672bc0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
call fcn.00405138
xor eax, eax
push ebp
push 0x672d4f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 0xc8]
inc eax
je 0x672d26
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 0xc4]
dec eax
test eax, eax
jl 0x672d26
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, 0x672d68
call fcn.0040528c
mov dword [ebp - 0x18], eax
jmp 0x672c79
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov edx, 1
call fcn.004051e8
mov edx, dword [ebp - 0x24]
mov eax, 0x672d68
call fcn.0040528c
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
mov eax, 0x672d68
call fcn.0040528c
test eax, eax
jg 0x672c59
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.00403efc
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.00403efc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x672824
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x672d12
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0040528c
test eax, eax
jle 0x672d0a
mov eax, dword [ebp - 0x20]
call fcn.00405148
push eax
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x672d0a
mov byte [ebp - 0x29], 1
jmp 0x672d12
inc dword [ebp - 0x14]
dec dword [ebp - 0x34]
jne 0x672cce
lea eax, [ebp - 0xc]
call fcn.0040eba0
inc dword [ebp - 0x1c]
dec dword [ebp - 0x30]
jne 0x672c2d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x672d56
lea eax, [ebp - 0x38]
call fcn.00404c98
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404cbc
ret
Function at 0x685078
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x685080
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68522f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x685244
call fcn.00404d30
mov eax, dword [0x6f3624]
mov eax, dword [eax + 0x340]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
lea ecx, [ebp - 8]
mov eax, dword [0x6f3624]
mov eax, dword [eax + 0x340]
mov eax, dword [eax + 0x218]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x685250
mov edx, 0x68525c
mov eax, dword [ebp - 8]
call fcn.00448ed8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
call fcn.00404d30
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00685300
mov eax, dword [ebp - 0x34]
call fcn.00405148
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [ebp - 0x10]
call fcn.00409ef0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov eax, dword [eax + 0x218]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xc]
mov dl, 1
call fcn.00491164
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x685268
mov edx, 0x685274
mov eax, dword [ebp - 0xc]
call fcn.00448ed8
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0xc]
call fcn.00404d30
mov edx, dword [ebp - 0x10]
mov eax, 0x685244
call fcn.0040528c
test eax, eax
jle 0x6851ae
jmp 0x68519d
mov edx, dword [ebp - 0x10]
mov eax, 0x685244
call fcn.0040528c
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.004051e8
mov edx, dword [ebp - 0x10]
mov eax, 0x685244
call fcn.0040528c
test eax, eax
jg 0x685181
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405094
je 0x6851c9
mov eax, dword [ebp - 8]
call fcn.00405148
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [ebp - 0x40]
mov ecx, 0x685280
mov edx, dword [ebp - 8]
call fcn.00404f9c
mov eax, dword [ebp - 0x40]
call fcn.00409bcc
test al, al
je 0x6851f7
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x685207
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685236
lea eax, [ebp - 0x40]
mov edx, 5
call fcn.00404cbc
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404cbc
ret
Function at 0x1001c6ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001c6fd
pop dword [ebp - 8]
mov eax, 0xb696113a
add eax, 0x596bb5c3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x80af6aed
add dword [ebp - 0x18], 0xcda2da5e
mov dword [ebp - 0x14], 0x59fa38f9
add dword [ebp - 0x14], 0xd839134c
mov dword [ebp - 0x10], 0xaa7ee3e3
add dword [ebp - 0x10], 0xa1cd604b
mov dword [ebp - 0xc], 0xe1510c97
sub dword [ebp - 0xc], 0xe1510c97
lea eax, [ebp - 0x18]
push eax
mov eax, 0x44fba852
add eax, 0xcb09e8ba
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa5debdc0
sub dword [ebp - 0x18], 0x316c546a
mov dword [ebp - 0x14], 0x49e6adff
add dword [ebp - 0x14], 0xf785b376
mov dword [ebp - 0x10], 0xc2d6c2a6
add dword [ebp - 0x10], 0xa098a9c6
mov dword [ebp - 0xc], 0x7790a80
add dword [ebp - 0xc], 0xf886f580
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x5f116
push 0
call eax
mov ecx, 0x463c95f8
sub ecx, 0x463c48d1
mov esi, eax
mov edx, 0x2a948660
add edx, 0xe5720da0
add edx, dword [ebp - 8]
mov edi, 0xabccec44
add edi, 0xddd2f774
xor dword [ebp - 4], 0x37f83ba6
mov ebx, dword [edx]
add dword [ebp - 4], 0xb5a5866b
add ebx, edi
sub dword [ebp - 4], esi
mov dword [esi], ebx
xor dword [ebp - 4], esi
add esi, 0x32d2e202
add esi, 0xcd2d1e02
add edx, 0x53301fde
add edx, 0xaccfe026
loop 0x1001c81a
add eax, 0xd5da3ace
sub eax, 0xd5d9135f
xor ebx, ebx
add ebx, eax
add eax, 0xfbe9617a
sub eax, 0xfbe96175
mov ecx, 0xa74e0b81
add ecx, 0x68b1f47f
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4c9bcc]
sub esp, 0x14
adc al, 0x56
push edi
mov esi, 0x190

Function at 0x417e1f
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx

Function at 0x417e27
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx

Function at 0x417e37
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
Function at 0x417e3f
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx

Function at 0x417e47
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx

Function at 0x417e4f
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add byte [ebp + 0x5110244c], cl
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
dec esp
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x15
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x417ed5
invalid
mov dword [eax], eax
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
adc byte [ebp + 0x521c2444], cl
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx

Function at 0x417e7f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
pushfd
adc eax, 0x448d004c
and al, 0x10
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
sbb al, 0x8d
push esp
and al, 0x18
push ecx
push edx
push 0
add byte [eax + 0x64], ch
pushal
dec esp
add byte [eax - 1], dl
rcr dword [ebp + 0x5b], cl
test eax, eax
jne 0x417eca
invalid
Function at 0x417e8f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
pushfd
adc eax, 0x448d004c
and al, 0x10
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
sbb al, 0x8d
push esp
and al, 0x18
push ecx
push edx
push 0
add byte [eax + 0x64], ch
pushal
dec esp
add byte [eax - 1], dl
rcr dword [ebp + 0x5b], cl
test eax, eax
jne 0x417eca
invalid

Function at 0x417eaf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
pushfd
adc eax, 0x448d004c
and al, 0x10
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
sbb al, 0x8d
push esp
and al, 0x18
push ecx
push edx
push 0
add byte [eax + 0x64], ch
pushal
dec esp
add byte [eax - 1], dl
rcr dword [ebp + 0x5b], cl
test eax, eax
jne 0x417eca
invalid

Function at 0x420c3b
Capabilities:
Encode data using xor

Disassembly:
sahf
jle 0x420c82
je 0x3edfec72
rcl byte [edx]
xor dword [edi + 0x1eac6d9], 0x2c55897d
push esi

Function at 0x465ab3
Capabilities:
Encode data using xor

Disassembly:
test bl, dh
mov ebp, 0x91d43a06
push edx
pop edi
mov edi, ebp
push ebp
pop ebx
invalid
jae 0x465aec
int 0xeb
adc eax, 0x336f23fa
push ds
xor ebx, dword [esi]
invalid
pop ebx
imul eax, dword [edi - 0x49], 0x43675f77
pushal
or dword [0xcb92df43], edx
mov ebp, es
jb 0x465a97
add edx, esi
sal byte [edx + esi*8], 0x92
rep movsd dword es:[edi], dword [esi]
mov ah, 0x45
inc edi
pop esp
or al, 0x76
aas
out 0x73, al
and dword [edi + 0x50], edx
adc eax, dword [edi]
sub dword [edi], ecx
pop ebp
jmp 0x66282d04
movsd dword es:[edi], dword [esi]
and al, 0x83
rcl byte [ebx - 0x32], cl
ja 0x465a76
inc edi
pop es
push ss
mov dword [0x4590b584], eax
js 0x465b40
and al, 0xb3
cli
cmpsb byte [esi], byte es:[edi]
int1
test dword [ebx - 0x3d06d06f], edx
push ss
jne 0x465a9f
das
stc
ret 0x7516
mov cl, 0xa5
sal byte [ebx + 0x57e14251], 1
xchg esp, eax
invalid
push eax
xor esp, dword [edi + 0x17]
pop ss
pushal
xor esi, esp
loope 0x465b3e
in eax, dx
inc edi
popfd
popfd
movsb byte es:[edi], byte [esi]
idiv dword [ecx + 0x7558b384]
and al, 0x21
bound esi, qword [bx + si]
movsb byte es:[edi], byte [esi]
xor al, 0x21
inc esp
and eax, esi
inc esp
and dh, byte [ecx]
cmpsb byte [esi], byte es:[edi]
aad 0xa6
rol byte [ebx - 0x48], 1
jecxz 0x465b15
add dh, dh
lds edi, [esi - 0x6f]
xchg ecx, eax
mul dword [edx + ebp*8 + 0xd]
jb 0x465b59
insd dword es:[edi], dx
xor byte [ebx + 5], ah
adc eax, 0x930e3ba1
pop esp
sbb al, 0xf8
sbb ah, byte [ebp + 0xb]
loopne 0x465b06
out dx, al
invalid
Function at 0x40102d
Capabilities:
Shutdown system

Disassembly:
jmp 0x405140
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40515e
add esp, 0x14
ret
push esi
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4051b9
mov ecx, dword [esp + 0x1c]
push 1
push eax
push eax
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x4051c0
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x2c], 0
call esi
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x401041
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x401cd0
sub esp, 0x118
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
mov ebx, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x401d2f
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401d76
cmp eax, 2
jne 0x401d4b
push str.Key_not_found._n
push 0x43bba0
call fcn.0040103c
add esp, 8
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00406884
add esp, 0x118
ret
push str.Error_opening_key._n
push 0x43bba0
call fcn.0040103c
add esp, 8
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00406884
add esp, 0x118
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, edi
cmp byte [esi - 1], 0x5c
je 0x401d91
mov byte [esi], 0x5c
add esi, 1
mov byte [esi], 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x401e0b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x20]
push edx
push esi
call ebp
push edi
push ebx
call fcn.00401041
add esp, 8
test eax, eax
je 0x401e0a
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x401dc6
pop ebp
mov byte [esi - 1], 0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x120]
pop esi
neg eax
pop edi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.00406884
add esp, 0x118
ret
Function at 0x401046
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x402f30
sub esp, 0x510
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x50c], eax
push esi
push edi
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x104
call fcn.004068a0
push str.X86_Plant
push 0x43bba0
call fcn.0040103c
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x43b960
add esp, 0x14
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402f91
lea edi, [esp + 0x10]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402fa3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push str.Delect_Uninstall_Register_Path___s
push 0x43bba0
call fcn.0040103c
add esp, 0xc
lea edx, [esp + 8]
push edx
push 1
push 0
lea eax, [esp + 0x1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40301c
push str.No_Uninstall_Register
push 0x43bba0
call fcn.0040103c
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00406884
add esp, 0x510
ret
push str.Have_Uninstall_Register
push 0x43bba0
call fcn.0040103c
mov eax, dword [esp + 0x10]
add esp, 8
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x414]
push edx
push 0
push 0
push str.ProductGuid
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40308b
push str.No_Product_GUID_Key
push 0x43bba0
call fcn.0040103c
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.00406884
add esp, 0x510
ret
push str.Have_Product_GUID_Key
push 0x43bba0
call fcn.0040103c
mov ecx, dword [esp + 0x51c]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00406884
add esp, 0x510
ret