joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402520
Capabilities:
Create process on windows
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40379c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
mov eax, dword [str.deltemp.bat]
mov ecx, dword [0x40625c]
mov edx, dword [0x406260]
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
lea ecx, [eax + edx*8]
mov eax, 0x25e22709
shl ecx, 3
mul ecx
sub ecx, edx
lea eax, [esp + 0x224]
shr ecx, 1
add ecx, edx
shr ecx, 7
push ecx
push eax
lea ecx, [esp + 0x24]
push str._syiruideletemp_08X.bat
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x1c]
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402717
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x330], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], 1
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x120]
push 0x104
push eax
push 0
mov byte [esp + 0x33c], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x120]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x334], 3
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x330], 2
call fcn.004020f2
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x120]
push eax
lea edx, [esp + 0x124]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._echo_off_r_n:Repeat_r_ndel___s___r_nif_exist___s__tgoto_Repeat_r_nrd__q___s__r_ndel___0_r_n
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x24]
add esp, 0x14
lea edx, [esp + 0x18]
mov ecx, dword [eax - 8]
push 0
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x330], 1
call fcn.004020f2
lea ecx, [esp + 8]
mov byte [esp + 0x330], 0
call fcn.004020f2
lea ecx, [esp + 0x10]
mov dword [esp + 0x330], 0xffffffff
call fcn.004020f2
mov ecx, dword [esp + 0x328]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x32c
ret
Function at 0x402730
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x110]
push 0
mov esi, ecx
push edi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x40276b
push 0x40629c
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret 8
push edi
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x40669c
push str.SOFTTYPE
push str.SETUPINFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x40279a
pop edi
pop esi
add esp, 0x104
ret 8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
mov edx, dword [esp + 0x118]
add esp, 4
mov dword [edx], eax
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret 8

Function at 0x402920
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
mov ebx, ecx
push edi
xor ebp, ebp
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebp
push ebp
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x402965
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402983
push ebp
push 0x406394
push ebx
call fcn.00402370
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 8
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4029ba
lea edx, [esp + 0x34]
push edi
push edx
call ebx
add esp, 8
test eax, eax
jne 0x402990
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x140]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x128
ret 8
Function at 0x4029e0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
push 0x20000000
push 0
mov ebx, ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x402a17
push eax
push 0x4063d8
push ebx
call fcn.00402370
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x2c]
push 0x10020
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x402a7a
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
call ebp
pop ebp
cmp eax, 0x424
push esi
jne 0x402a58
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0x4063c8
push edi
push ebx
call fcn.00402450
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
lea ecx, [esp + 0xc]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402ac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x402ac0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 0
push 0x4063b8
push ebx
call fcn.00402370
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402af2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 0
push 0x4063a8
push ebx
call fcn.00402370
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 4

Function at 0x402b10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4037b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
mov dword [esp + 0x14], 0
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push esi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x402b89
mov al, byte [eax + ecx - 1]
cmp al, 0x5c
je 0x402b89
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
push 0x4063ec
lea ecx, [esp + 8]
call fcn.004020ec
mov edx, dword [esp + 4]
push edx
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004020f2
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x402c30
Capabilities:
Get common file path

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0x17
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x402c54
xor eax, eax
pop esi
pop ecx
ret 4
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x402c6d
pop esi
pop ecx
ret 4
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
dec ecx
cmp byte [ecx + esi - 1], 0x5c
je 0x402c8f
push 0x40603c
push esi
call edi
push 0x40640c
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x402d10
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4037d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push ebp
push str.software_s
push eax
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402db8
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x14]
mov edi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x402daf
push ebp
mov ecx, esi
call fcn.00402f00
lea ecx, [esp + 0x10]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
call fcn.004020f2
mov eax, esi
jmp 0x402ddf
push ebx
push 0x406500
push edi
jmp 0x402dc3
mov edx, dword [esp + 0x28]
push edx
push 0x406464
push eax
push esi
call fcn.00402450
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004020f2
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x402e00
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4037f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [esp + 0x28]
lea eax, [esp + 0xc]
push ebx
push str.software_s
push eax
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x402ec3
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402eb2
push ebx
mov ecx, edi
call fcn.00402f00
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.004020f2
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
push 0
push 0x406500
push esi
push edi
call fcn.00402450
add esp, 0x10
push 0
push 0x406464
push esi
push edi
call fcn.00402450
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004020f2
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x402f00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x40381b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
mov dword [esp + 0x10], ecx
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x130]
lea eax, [esp + 0x10]
push ebp
push str.software_s
push eax
mov dword [esp + 0x134], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push edx
push 0x80000002
call ebx
mov esi, eax
test esi, esi
jne 0x402fec
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push 0x104
push eax
push esi
push ecx
call edi
test eax, eax
jne 0x402f90
inc esi
cmp esi, 2
jl 0x402f74
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
test esi, esi
jne 0x402fd1
lea eax, [esp + 0x14]
push eax
push str.software
push 0x80000002
call ebx
mov esi, eax
test esi, esi
jne 0x402fec
mov ecx, dword [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x14]
mov esi, eax
push edx
call edi
test esi, esi
jne 0x402fec
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004020f2
mov eax, 1
jmp 0x403017
mov eax, dword [esp + 0x18]
push 0
push 0x406510
push esi
push eax
call fcn.00402450
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004020f2
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 4
Function at 0x403040
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40383b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
mov ecx, esi
push eax
mov dword [esp + 0x124], ebx
call fcn.00402b10
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov ecx, esi
call fcn.00402cb0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x4063ec
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov ecx, esi
call fcn.00402c30
lea eax, [esp + 0x14]
push 0x406454
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x4063ec
lea ecx, [esp + 0x14]
call fcn.004020ec
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x406444
lea ecx, [esp + 0x14]
call fcn.004020ec
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, esi
call fcn.004032e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.004020f2
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x403190
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40385b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
mov ecx, esi
push eax
mov dword [esp + 0x124], ebx
call fcn.00402bd0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov ecx, esi
call fcn.00402cb0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x4063fc
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov ecx, esi
call fcn.00402c30
lea eax, [esp + 0x14]
push 0x40645c
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x4063fc
lea ecx, [esp + 0x14]
call fcn.004020ec
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x406444
lea ecx, [esp + 0x14]
call fcn.004020ec
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, esi
call fcn.004032e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.004020f2
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x4032e0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x40387b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x114]
mov dword [esp + 0x110], esi
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov ecx, edx
push eax
call fcn.00402c30
test eax, eax
je 0x40342b
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
push str..
lea ecx, [esp + 0xc]
mov dword [esp + 0x234], esi
call fcn.004020ec
mov eax, dword [esp + 8]
lea edx, [esp + 0x110]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__findfirst]
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x4033b5
lea ecx, [esp + 8]
mov dword [esp + 0x230], eax
call fcn.004020f2
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
add esp, 0x22c
ret
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__findnext]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__mbscmp]
lea ecx, [esp + 0x12c]
push 0x40610c
push ecx
call ebp
add esp, 8
test eax, eax
je 0x4033f5
lea edx, [esp + 0x12c]
push 0x406108
push edx
call ebp
add esp, 8
test eax, eax
je 0x4033f5
inc esi
cmp esi, 1
jae 0x403407
lea eax, [esp + 0x118]
push eax
push edi
call ebx
add esp, 8
test eax, eax
je 0x4033c3
push edi
call dword [sym.imp.MSVCRT.dll__findclose]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], 0xffffffff
call fcn.004020f2
pop ebp
pop ebx
test esi, esi
jne 0x403436
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x228]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret

Function at 0x403460
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov edi, ecx
push 0x80000002
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4034b9
mov ecx, dword [esp + 8]
push str.YiRuiClient
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4034b9
pop edi
mov eax, 1
pop esi
pop ecx
ret
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallYiRuiClient
push 0x406530
push esi
push edi
call fcn.00402450
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x4034e0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov edi, ecx
push 0x80000002
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403539
mov ecx, dword [esp + 8]
push str.YiRuiServer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403539
pop edi
mov eax, 1
pop esi
pop ecx
ret
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallYiRuiServer
push 0x406594
push esi
push edi
call fcn.00402450
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x414410
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x492beb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00487060
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414492
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004846d8
mov eax, dword [eax]
push 0x528d94
push eax
call fcn.00477334
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004872eb
test bl, bl
je 0x414492
push 0x528d94
lea ecx, [esp + 0xc]
call fcn.0048767b
push 0x528da0
lea ecx, [esp + 0xc]
call fcn.0048767b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4144ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004872eb
jmp 0x414599
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414552
lea edx, [esp + 0x7c]
push 0x528d9c
push edx
call fcn.00477334
add esp, 8
test eax, eax
je 0x414552
lea eax, [esp + 0x7c]
push 0x528d98
push eax
call fcn.00477334
add esp, 8
test eax, eax
je 0x414552
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4144e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004872eb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414d90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x414df2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc