joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426f90
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x200c
call fcn.0046d4a0
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x2008], eax
cmp dword [esp + 0x2010], 0
push ebx
push ebp
push esi
je 0x4270da
push 0x1ffe
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.0046adc0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea ecx, [edi + 0x248]
push ecx
push str._s__X_:
lea edx, [esp + 0x1c]
push 0x1000
push edx
call fcn.00468098
mov edx, dword [esp + 0x2030]
add esp, 0x14
lea ecx, [esp + 0x2020]
push ecx
push edx
mov ecx, 0x1000
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0x1c]
push edx
call fcn.004679c2
push 0x4a280c
lea eax, [esp + 0x24]
push 0x1000
push eax
call fcn.0046837e
lea eax, [edi + 0x40]
add esp, 0x1c
lea edx, [eax + 2]
jmp 0x427040
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427040
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub eax, edx
sar eax, 1
je 0x427072
lea esi, [edi + 4]
push esi
call ebx
lea ecx, [esp + 0x10]
push ecx
mov eax, edi
call fcn.00426f00
push esi
call ebp
lea eax, [esp + 0x10]
xor edx, edx
lea esi, [eax + 2]
jmp 0x427080
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427080
sub eax, esi
sar eax, 1
add eax, 0xfffffffe
je 0x4270c6
cmp word [esp + edx*2 + 0x10], 0xa
jne 0x4270a3
mov word [esp + edx*2 + 0x10], 0x20
lea eax, [esp + 0x10]
add edx, 1
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4270b0
sub eax, esi
sar eax, 1
add eax, 0xfffffffe
cmp edx, eax
jb 0x427094
lea esi, [edi + 4]
push esi
call ebx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call ebp
mov ecx, dword [esp + 0x2014]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004677d8
add esp, 0x200c
ret

Function at 0x427e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488d18
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7b8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x24], ebx
mov edi, dword [esp + 0x34]
push 0
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push edi
call fcn.004024a0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
mov esi, dword [esp + 0x3c]
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov ebp, esp
push esi
call fcn.004024a0
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov byte [esp + 0x30], bl
call fcn.00427aa0
mov ebx, eax
mov byte [esp + 0x24], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427ea9
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427eca
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x427ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488d18
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7b8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x24], ebx
mov edi, dword [esp + 0x34]
push ebx
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push edi
call fcn.004024a0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
mov esi, dword [esp + 0x3c]
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov ebp, esp
push esi
call fcn.004024a0
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov byte [esp + 0x30], bl
call fcn.00427aa0
mov ebx, eax
mov byte [esp + 0x24], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427f88
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427fa9
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x429ac0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
push edi
push str.In_RebootSystemNow
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x429af7
xor eax, eax
pop edi
add esp, 0x18
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x429af0
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop edi
add esp, 0x18
ret
Function at 0x42a120
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x42a162
cmp dword [esp + 8], 0
jne 0x42a162
mov eax, 1
cmp byte [esp + 0x11a], al
je 0x42a164
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004677d8
add esp, 0x120
ret

Function at 0x42a180
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x42a1b8
mov eax, 1
cmp dword [esp + 8], eax
je 0x42a1ba
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004677d8
add esp, 0x120
ret

Function at 0x42a1d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x42a21e
cmp dword [esp + 8], 0
jne 0x42a21e
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004677d8
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
xor eax, eax
call fcn.004677d8
add esp, 0x120
ret

Function at 0x42a300
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.0046adc0
add esp, 0xc
lea ecx, [esp]
push ecx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov word [esi], 0
jl 0x42a350
lea edx, [esp]
push edx
jmp 0x42a355
push str.C:Program_Files
push 0x104
push esi
call fcn.00467e2b
mov ecx, dword [esp + 0x214]
add esp, 0xc
xor ecx, esp
call fcn.004677d8
add esp, 0x20c
ret

Function at 0x42a600
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x204
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x200], eax
push edi
push 0x1fe
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.0046adc0
add esp, 0xc
push str.ARP_DeleteUninstallEntry__
call fcn.00426a70
mov edi, eax
call fcn.00426f90
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x498c0c
lea ecx, [esp + 0x14]
push 0x100
push ecx
call fcn.00468098
add esp, 0x18
lea edx, [esp + 4]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [esp + 0x204]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004677d8
add esp, 0x204
ret
Function at 0x42cea0
Capabilities:
Identify system language via api

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebp, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push str._____Language_IDs____
mov dword [esp + 0x14], eax
call fcn.00426a70
mov edi, eax
call fcn.00426f90
movzx eax, si
add esp, 4
push eax
push eax
push str.__User_Default_UI_Language_____d_____x
call fcn.00426a70
mov edi, eax
call fcn.00426f90
movzx eax, bx
add esp, 0xc
push eax
push eax
push str.__System_Default_UI_Language___d_____x
call fcn.00426a70
mov edi, eax
call fcn.00426f90
movzx eax, bp
add esp, 0xc
push eax
push eax
push str.__User_Default_Language_ID_____d_____x
call fcn.00426a70
mov edi, eax
call fcn.00426f90
movzx eax, word [esp + 0x1c]
add esp, 0xc
push eax
push eax
push str.__System_Default_Language_ID___d_____x
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
call fcn.0042cfb0
movzx ecx, ax
push ecx
call fcn.0042cfb0
movzx edx, ax
push edx
push str.__Language_ID_To_Be_Used_______d_____x
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42cfb0
Capabilities:
Identify system language via api

Disassembly:
push esi
xor ecx, ecx
movzx esi, ax
mov edx, 0x4be3d8
jmp 0x42cf90
cmp dword [edx], esi
je 0x42cfa1
add ecx, 1
add edx, 0x10
cmp ecx, 0x26
jb 0x42cf90
pop esi
ret
shl ecx, 4
mov ax, word [ecx + 0x4be3dc]
pop esi
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp si, di
movzx eax, ax
jne 0x42cfeb
cmp si, ax
jne 0x42cfeb
pop edi
mov eax, esi
pop esi
pop ebx
jmp 0x42cf80
xor eax, eax
movzx edx, bx
mov ecx, 0x4be3d8
cmp dword [ecx], edx
je 0x42d00b
add eax, 1
add ecx, 0x10
cmp eax, 0x26
jb 0x42cff5
pop edi
pop esi
movzx eax, bx
pop ebx
ret
pop edi
shl eax, 4
movzx eax, word [eax + 0x4be3dc]
pop esi
pop ebx
ret

Function at 0x42d140
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp si, di
movzx eax, ax
jne 0x42d193
cmp si, bx
jne 0x42d193
cmp si, ax
jne 0x42d193
push str.This_IS_a_Fully_Localized_OS
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret
push str.NOT_a_Fully_Localized_OS
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42d740
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
push str._StartNetworkConnection__
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42d7a9
push str.ERROR:_Could_not_load_Winsock_DLL
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004677d8
add esp, 0x1a0
ret
mov ecx, dword [esp + 0x19c]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004677d8
add esp, 0x1a0
ret
Function at 0x42eae0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x238
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push edi
push 0x1fe
lea eax, [esp + 0x3e]
push 0
push eax
mov word [esp + 0x44], 0
call fcn.0046adc0
add esp, 0xc
push str.FindInstallSection__
call fcn.00426a70
mov edi, eax
call fcn.00426f90
lea ebx, [esi + 0x14]
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42eb30
sub eax, edx
sar eax, 1
jne 0x42ec76
mov ecx, dword [esi]
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
lea edi, [esi + 4]
push edi
push 0
push str.Manufacturer
push ecx
call ebp
test eax, eax
je 0x42ebba
push 0
push 0x100
lea edx, [esp + 0x40]
push edx
push 1
push edi
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x42ebba
lea edx, [esi + 0x214]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x10], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42eb87
sub eax, dword [esp + 0x10]
push edi
sar eax, 1
je 0x42ebd8
mov eax, dword [esi]
push edx
lea edx, [esp + 0x40]
push edx
push eax
call ebp
test eax, eax
jne 0x42ebe8
mov edx, dword [esi]
push edi
push eax
lea ecx, [esp + 0x40]
push ecx
push edx
call ebp
test eax, eax
jne 0x42ebe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004677d8
add esp, 0x238
ret
mov ecx, dword [esi]
push 0
lea eax, [esp + 0x40]
push eax
push ecx
call ebp
test eax, eax
je 0x42ebba
push 0
push 0x100
lea edx, [esp + 0x40]
push edx
push 1
push edi
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x42ebba
mov ebp, dword [esi + 0x41c]
lea eax, [esp + 0x38]
push eax
push 0x100
push ebx
mov word [ebx], 0
call fcn.00467e2b
mov ecx, dword [esi]
add esp, 0xc
push edi
push ebp
push ebx
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
jne 0x42ec76
call fcn.0042a000
test eax, eax
je 0x42ecb6
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [esp + 0x14]
cmp ax, 9
jne 0x42ec90
push 0x100
mov eax, str..NTamd64
mov ecx, ebx
call fcn.004296b0
mov eax, dword [esi]
add esp, 4
push edi
push ebp
push ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x42ebba
mov ecx, dword [esp + 0x23c]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004677d8
add esp, 0x238
ret
cmp ax, 6
jne 0x42ebba
push 0x100
mov eax, str..NTia64
mov ecx, ebx
call fcn.004296b0
mov ecx, dword [esi]
add esp, 4
push edi
push ebp
push ebx
push ecx
jmp 0x42ec68
push 0x100
mov eax, str..NTx86
mov ecx, ebx
call fcn.004296b0
mov edx, dword [esi]
add esp, 4
push edi
push ebp
push ebx
push edx
jmp 0x42ec68
Function at 0x431b80
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebx
mov esi, ecx
push esi
push str.SaveValueToHKLM__s__s
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
mov ecx, esi
call fcn.00431a40
mov esi, eax
test esi, esi
je 0x431bd4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
push str.SaveValueToHKLM__RegCreateKeyEx_failed
call fcn.00426a70
mov ebx, 0x3f3
mov ecx, eax
call fcn.00427100
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x431c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov esi, eax
push esi
push str.GetValueFromHKLM__s__s
mov dword [esp + 0x20], 0
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x431c79
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x24]
push ecx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
push str.GetValueFromHKLM__RegOpenKeyEx_failed
call fcn.00426a70
mov ecx, eax
call fcn.00427100
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0xc

Function at 0x431ca0
Capabilities:
Delete registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov esi, eax
push esi
push str.DeleteValueFromHKLM__s__s
mov dword [esp + 0x20], 0
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x431d08
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
push str.DeleteValueFromHKLM__RegOpenKeyEx_failed
call fcn.00426a70
mov ecx, eax
call fcn.00427100
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4
Function at 0x431e60
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x618
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x614], eax
push ebx
push esi
mov esi, dword [esp + 0x624]
push edi
mov edi, dword [esp + 0x62c]
push 0x1fe
lea eax, [esp + 0x426]
push 0
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
mov word [esp + 0x42c], 0
call fcn.0046adc0
push 0x1fe
lea ecx, [esp + 0x232]
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov word [esp + 0x238], 0
call fcn.0046adc0
push 0x1fe
lea edx, [esp + 0x3e]
push 0
push edx
mov word [esp + 0x44], 0
call fcn.0046adc0
add esp, 0x24
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x431f2d
cmp ebx, 2
jne 0x431f12
xor eax, eax
jmp 0x432076
push str.RegOpenKeyEx_Failed
call fcn.00426a70
mov ecx, eax
call fcn.00427100
add esp, 4
mov eax, ebx
jmp 0x432076
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
push edx
push 0
mov esi, 0x104
push eax
mov dword [esp + 0x30], esi
call ebx
cmp eax, 0x103
je 0x431fb8
test eax, eax
jne 0x431fb8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x431fa3
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x234]
push ecx
push 0
push edx
mov dword [esp + 0x30], esi
call ebx
cmp eax, 0x103
jne 0x431f61
jmp 0x431fb8
push eax
push str.__RegDeleteValue_failed__err_d_
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 8
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x434]
push ecx
push 0
push edx
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x432067
test esi, esi
jne 0x432069
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x420]
push eax
push ecx
push 0x498c0c
lea edx, [esp + 0x2c]
push 0x100
push edx
call fcn.00468098
add esp, 0x14
lea ecx, [esp + 0x20]
call fcn.00432090
lea eax, [esp + 0x20]
push eax
push str.CReg::DeleteSecureKeyFromHKLM__s_
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00432090
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00431e60
lea edx, [esp + 0x20]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x431f33
xor esi, esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x620]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004677d8
add esp, 0x618
ret 8
Function at 0x432bf0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x98
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0046adc0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x432c41
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
cmp dword [esp + 0x14], 2
pop esi
jne 0x432c81
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x432c67
jne 0x432c81
mov eax, dword [esp + 8]
test eax, eax
ja 0x432c67
jne 0x432c81
cmp word [esp + 0xc], 0x893
jbe 0x432c81
mov eax, 1
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004677d8
add esp, 0xa0
ret
mov ecx, dword [esp + 0x9c]
xor ecx, esp
xor eax, eax
call fcn.004677d8
add esp, 0xa0
ret

Function at 0x4332d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp], eax
jne 0x4332e9
add esp, 0xc
ret
push esi
push eax
call fcn.00468b45
mov esi, eax
add esp, 4
test esi, esi
je 0x433314
mov ecx, dword [esp + 4]
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x43331b
push esi
call fcn.00468c08
add esp, 4
xor eax, eax
pop esi
add esp, 0xc
ret
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0x4988c8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
push esi
je 0x43330c
call fcn.00468c08
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.0046f7f0
add esp, 0x10
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x433360
Capabilities:
Check if file exists
Copy file
Move file
Set file attributes

Disassembly:
sub esp, 0x420
mov eax, dword [0x4bc7b8]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
push ebx
push ebp
push esi
xor ebp, ebp
cmp eax, ebp
push edi
mov edi, dword [esp + 0x438]
mov esi, edx
mov dword [esp + 0x14], ecx
mov word [esp + 0x220], bp
je 0x4333b0
push eax
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.00467e2b
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea eax, [esp + 0x224]
push eax
call ebx
test edi, edi
mov word [esp + 0x18], bp
je 0x4333dd
push edi
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.00467e2b
add esp, 0xc
push esi
lea edx, [esp + 0x1c]
push edx
call ebx
cmp dword [esp + 0x43c], ebp
je 0x433423
lea esi, [esp + 0x18]
lea ebx, [esp + 0x220]
call fcn.004335a0
test eax, eax
jg 0x433423
mov eax, esi
push eax
mov ecx, ebx
push ecx
push str.CopyFileVersionChk____s_is_not_newer_than__s
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
xor eax, eax
jmp 0x433508
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x224]
push eax
push str.CopyFile____s_____s
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 0xc
push 0x20
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x433500
call esi
mov ebx, eax
push ebx
push str.CopyFile___failed__gle___d_
call fcn.00426a70
mov ecx, eax
call fcn.00427100
add esp, 8
cmp ebx, 2
je 0x433521
cmp ebx, 3
je 0x433521
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x228]
push edx
call ebx
test eax, eax
jne 0x433500
lea eax, [esp + 0x220]
push eax
push str.File_moved_to_REBOOT_temp_location.
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 8
push 4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x228]
push edx
call ebx
push str._____REBOOT_NEEDED___
mov ebp, 1
call fcn.00426a70
mov edi, eax
call fcn.00426f90
add esp, 4
mov eax, dword [esp + 0x14]
or dword [eax], ebp
call esi
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004677d8
add esp, 0x420
ret
mov eax, ebx
jmp 0x433508