joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420500
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x420517
xor eax, eax
jmp 0x420695
cmp dword [ebp + 0x18], 2
jge 0x420524
xor eax, eax
jmp 0x420695
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00414070
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
call fcn.004393f0
add esp, 4
add eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
test ecx, ecx
jne 0x42055e
mov dword [ebp - 0x10], 1
jmp 0x420565
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x5c
jne 0x42057a
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov byte [eax], 0
push 0x5c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x4205a9
xor eax, eax
jmp 0x420695
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
push 0x5c
mov eax, dword [ebp - 8]
push eax
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4205ef
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043a1e0
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
mov eax, dword [ebp + 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x420689
mov edx, dword [ebp + 0x14]
push edx
call fcn.00415220
add esp, 4
test eax, eax
jne 0x420689
mov eax, dword [ebp + 0x14]
push eax
push 0x469dd8
call fcn.004145f0
add esp, 8
mov ecx, dword [ebp + 0x14]
push ecx
push str._r_nCreate_Directory___s__r_n
call fcn.00426800
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
add eax, 1
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x420669
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
push 0
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 4]
mov byte [eax], 0x5c
jmp 0x420635
push 0
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp + 0x14]
push edx
call fcn.00415220
add esp, 4
test eax, eax
jne 0x420689
xor eax, eax
jmp 0x420695
mov eax, dword [ebp + 0x14]
push eax
call fcn.004393f0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4207e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x420807
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x420899
lea edx, [ebp - 0x404]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ebp + ecx - 0x404]
test edx, edx
jne 0x420834
xor eax, eax
jmp 0x4209c3
lea eax, [ebp - 0x404]
push eax
call fcn.004393f0
add esp, 4
lea ecx, [ebp + eax - 0x404]
mov dword [ebp - 0x408], ecx
mov edx, dword [ebp - 0x408]
movzx eax, byte [edx - 1]
cmp eax, 0x5c
je 0x420877
mov ecx, dword [ebp - 0x408]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x408]
add edx, 1
mov dword [ebp - 0x408], edx
push str.Setup32_
mov eax, dword [ebp - 0x408]
push eax
call fcn.00439aa0
add esp, 8
add eax, dword [ebp - 0x408]
mov dword [ebp - 0x408], eax
jmp 0x4208f4
push 0x400
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.00414070
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call fcn.004393f0
add esp, 4
lea ecx, [ebp + eax - 0x404]
mov dword [ebp - 0x408], ecx
mov edx, dword [ebp - 0x408]
movzx eax, byte [edx - 1]
cmp eax, 0x5c
je 0x4208f4
mov ecx, dword [ebp - 0x408]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x408]
add edx, 1
mov dword [ebp - 0x408], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x40c]
movzx edx, byte [ecx]
test edx, edx
je 0x420951
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x40c]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 0x40c]
add eax, 1
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x408]
movzx edx, byte [ecx]
cmp edx, 0x3a
jne 0x420940
mov eax, dword [ebp - 0x408]
mov byte [eax], 0x7e
mov ecx, dword [ebp - 0x408]
add ecx, 1
mov dword [ebp - 0x408], ecx
jmp 0x4208fd
mov edx, dword [ebp - 0x408]
mov byte [edx], 0
push 0x5c
lea eax, [ebp - 0x404]
push eax
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x42097e
xor eax, eax
jmp 0x4209c3
mov ecx, dword [ebp - 0x408]
mov byte [ecx], 0
lea edx, [ebp - 0x404]
push edx
call fcn.0041e3a0
add esp, 4
mov eax, dword [ebp - 0x408]
mov byte [eax], 0x5c
lea ecx, [ebp - 0x404]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004029e0
add esp, 0xc
test eax, eax
jne 0x4209be
xor eax, eax
jmp 0x4209c3
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x420df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str.SoftwareDIaLOGIKa
push 0x46a9b0
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 0x46a9b8
call fcn.004147f0
add esp, 0x10
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x68]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x420e82
push 0x46a9e4
call fcn.004147f0
add esp, 4
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004395b0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
add ecx, dword [ebp + 0x18]
mov byte [ecx - 1], 0
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x420ef3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], 1
lea ecx, [ebp - 0x78]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x420edf
push 0x46aa08
call fcn.004147f0
add esp, 4
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.004395b0
add esp, 0xc
mov eax, dword [ebp + 0x14]
add eax, dword [ebp + 0x18]
mov byte [eax - 1], 0
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4214d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 2
jge 0x4214e3
xor eax, eax
jmp 0x4215c6
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
cmp dword [ebp + 8], 0
je 0x4214f9
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
test edx, edx
jne 0x421500
xor eax, eax
jmp 0x4215c6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax - 1]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jb 0x421538
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x20
jge 0x421538
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x421514
mov edx, dword [ebp + 8]
push edx
push str.GETINI_Define__s_r_n
call fcn.004147f0
add esp, 8
push 0x3a
mov eax, dword [ebp + 8]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4215c1
push 0x3a
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call fcn.00439480
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4215c1
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x474cad
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4215c1
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x422af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 2
jl 0x422b12
cmp dword [ebp + 0x10], 0
je 0x422b12
cmp dword [ebp + 0xc], 0
je 0x422b12
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x422b16
xor eax, eax
jmp 0x422b83
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x422b37
xor eax, eax
jmp 0x422b83
mov edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x422b6f
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esp, ebp
pop ebp
ret
Function at 0x4235c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x4235d6
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4235d8
jmp 0x423652
cmp dword [ebp + 0x14], 0
jne 0x4235e5
mov dword [ebp + 0x14], 0x474cac
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
or eax, 0xf003f
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x423608
jmp 0x423652
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x423628
mov dword [ebp - 4], str.success
jmp 0x42362f
mov dword [ebp - 4], 0x46a650
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.Delete_Registry_Value___s___s__s_r_n
call fcn.004145f0
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x423b90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x423bc7
xor eax, eax
jmp 0x423cad
mov ecx, dword [ebp - 0x808]
mov byte [ecx], 0
mov edx, dword [ebp - 0x808]
add edx, 1
mov dword [ebp - 0x808], edx
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x423bf6
mov edx, dword [ebp - 0x808]
movsx eax, byte [edx]
test eax, eax
jne 0x423bfd
xor eax, eax
jmp 0x423cad
mov ecx, dword [ebp - 0x808]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x46a7dc
call fcn.004145f0
add esp, 0xc
mov eax, dword [ebp - 0x808]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Set_Uninst_Display__s_to__s_r_n
call fcn.00426800
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x46a824
lea eax, [ebp - 0x804]
push eax
call fcn.00439aa0
add esp, 0x10
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x804]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x423c6b
xor eax, eax
jmp 0x423cad
mov eax, dword [ebp - 0x808]
push eax
call fcn.004393f0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp - 0x808]
push ecx
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x424060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1820
call fcn.00439b40
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 0x1808], eax
cmp dword [ebp - 0x1808], 0
je 0x4240b7
push 0x2c
mov ecx, dword [ebp - 0x1808]
add ecx, 1
push ecx
call fcn.00439480
add esp, 8
mov dword [ebp - 0x180c], eax
cmp dword [ebp - 0x180c], 0
jne 0x4240be
xor eax, eax
jmp 0x424283
mov edx, dword [ebp - 0x1808]
mov byte [edx], 0
mov eax, dword [ebp - 0x1808]
add eax, 1
mov dword [ebp - 0x1808], eax
mov ecx, dword [ebp - 0x180c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x180c]
add edx, 1
mov dword [ebp - 0x180c], edx
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x424112
mov edx, dword [ebp - 0x1808]
movsx eax, byte [edx]
test eax, eax
je 0x424112
mov ecx, dword [ebp - 0x180c]
movsx edx, byte [ecx]
test edx, edx
jne 0x424119
xor eax, eax
jmp 0x424283
mov eax, dword [ebp - 0x1808]
push eax
mov ecx, dword [ebp - 0x180c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x46a8f4
call fcn.004145f0
add esp, 0x10
mov eax, dword [ebp - 0x1808]
push eax
mov ecx, dword [ebp - 0x180c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.Get_Uninst_Info_from__s:_s_for__s__r_n
call fcn.00426800
add esp, 0x10
mov eax, dword [ebp - 0x1808]
push eax
push 0x46a94c
lea ecx, [ebp - 0x1804]
push ecx
call fcn.00439aa0
add esp, 0xc
lea edx, [ebp + eax - 0x1804]
mov dword [ebp - 0x1810], edx
mov eax, dword [ebp + 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x46a964
lea ecx, [ebp - 0x804]
push ecx
call fcn.00439aa0
add esp, 0x10
lea edx, [ebp - 0x804]
push edx
push str.key_s_r_n
call fcn.004147f0
add esp, 8
lea eax, [ebp - 0x1814]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4241d4
xor eax, eax
jmp 0x424283
mov edx, dword [ebp - 0x1810]
lea eax, [ebp - 0x1804]
sub edx, eax
mov ecx, 0x1000
sub ecx, edx
mov dword [ebp - 0x1820], ecx
mov dword [ebp - 0x1818], 1
lea edx, [ebp - 0x1820]
push edx
mov eax, dword [ebp - 0x1810]
push eax
lea ecx, [ebp - 0x1818]
push ecx
push 0
mov edx, dword [ebp - 0x180c]
push edx
mov eax, dword [ebp - 0x1814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x424231
mov ecx, dword [ebp - 0x1810]
mov byte [ecx], 0
cmp dword [ebp - 0x1818], 4
jne 0x424263
mov edx, dword [ebp - 0x1810]
mov eax, dword [edx]
mov dword [ebp - 0x181c], eax
mov ecx, dword [ebp - 0x181c]
push ecx
push 0x46a9ac
mov edx, dword [ebp - 0x1810]
push edx
call fcn.00439aa0
add esp, 0xc
mov eax, dword [ebp - 0x1814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1804]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041e2f0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x4242a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], 1
mov dword [ebp - 0x818], 0
push 0x2c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x424307
push 0x2c
mov ecx, dword [ebp - 0x808]
add ecx, 1
push ecx
call fcn.00439480
add esp, 8
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x42430e
xor eax, eax
jmp 0x4244d8
mov edx, dword [ebp - 0x808]
mov byte [edx], 0
mov eax, dword [ebp - 0x808]
add eax, 1
mov dword [ebp - 0x808], eax
mov ecx, dword [ebp - 0x80c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x80c]
add edx, 1
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x424362
mov edx, dword [ebp - 0x808]
movsx eax, byte [edx]
test eax, eax
je 0x424362
mov ecx, dword [ebp - 0x80c]
movsx edx, byte [ecx]
test edx, edx
jne 0x424369
xor eax, eax
jmp 0x4244d8
push 0x46aa34
mov eax, dword [ebp - 0x808]
push eax
call fcn.00414180
add esp, 8
test eax, eax
jne 0x42439c
mov dword [ebp - 0x810], 1
mov ecx, dword [ebp - 0x808]
add ecx, 3
mov dword [ebp - 0x808], ecx
jmp 0x4243e2
push 0x46aa38
mov edx, dword [ebp - 0x808]
push edx
call fcn.00414180
add esp, 8
test eax, eax
jne 0x4243e2
mov dword [ebp - 0x810], 4
mov eax, dword [ebp - 0x808]
add eax, 3
mov dword [ebp - 0x808], eax
mov ecx, dword [ebp - 0x80c]
push ecx
call fcn.00418aa0
add esp, 4
mov dword [ebp - 0x818], eax
mov edx, dword [ebp - 0x808]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
push 0x46aa3c
call fcn.004145f0
add esp, 0x10
mov edx, dword [ebp - 0x808]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
push str.Save_Uninst_Info__s_to__s:_s_r_n
call fcn.00426800
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x46aa84
lea eax, [ebp - 0x804]
push eax
call fcn.00439aa0
add esp, 0x10
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x804]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x42445e
xor eax, eax
jmp 0x4244d8
cmp dword [ebp - 0x810], 1
jne 0x4244a0
mov eax, dword [ebp - 0x80c]
push eax
call fcn.004393f0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
mov edx, dword [ebp - 0x810]
push edx
push 0
mov eax, dword [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4244c6
push 4
lea edx, [ebp - 0x818]
push edx
mov eax, dword [ebp - 0x810]
push eax
push 0
mov ecx, dword [ebp - 0x808]
push ecx
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x4244f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x42453b
mov eax, dword [ebp + 0x1c]
sub eax, 1
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.00414070
add esp, 0xc
mov eax, dword [ebp + 0x18]
add eax, dword [ebp + 0x1c]
mov byte [eax - 1], 0
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004393f0
add esp, 4
jmp 0x4245a7
mov edx, dword [ebp + 0x1c]
sub edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x424587
mov edx, dword [ebp + 0x1c]
sub edx, 1
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00414070
add esp, 0xc
mov edx, dword [ebp + 0x18]
add edx, dword [ebp + 0x1c]
mov byte [edx - 1], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004393f0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x425300
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8810
call fcn.00439b40
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Remove_all_lines_containing__s_in__s_r_n
call fcn.004145f0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x404]
push ecx
call fcn.00426060
add esp, 4
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
lea ecx, [ebp - 0x804]
push ecx
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 0x8810], eax
cmp dword [ebp - 0x8810], 0
jne 0x42538a
mov eax, 1
jmp 0x425497
mov edx, dword [ebp - 0x8810]
mov byte [edx], 0
lea eax, [ebp - 0x804]
push eax
call fcn.0041cd50
add esp, 4
push 0x46b0e8
lea ecx, [ebp - 0x404]
push ecx
call fcn.0043aeb1
add esp, 8
mov dword [ebp - 0x8808], eax
cmp dword [ebp - 0x8808], 0
jne 0x4253cf
mov eax, 1
jmp 0x425497
push 0x46b0ec
lea edx, [ebp - 0x804]
push edx
call fcn.0043aeb1
add esp, 8
mov dword [ebp - 0x880c], eax
cmp dword [ebp - 0x880c], 0
jne 0x42540b
mov eax, dword [ebp - 0x8808]
push eax
call fcn.0043ad76
add esp, 4
mov eax, 1
jmp 0x425497
mov ecx, dword [ebp - 0x8808]
push ecx
push 0x8000
lea edx, [ebp - 0x8804]
push edx
call fcn.0043bf75
add esp, 0xc
test eax, eax
je 0x42545e
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x8804]
push ecx
call fcn.00414420
add esp, 8
test eax, eax
jne 0x42545c
lea edx, [ebp - 0x8804]
push edx
push 0x46b0f0
mov eax, dword [ebp - 0x880c]
push eax
call fcn.0043b3bc
add esp, 0xc
jmp 0x42540b
mov ecx, dword [ebp - 0x8808]
push ecx
call fcn.0043ad76
add esp, 4
mov edx, dword [ebp - 0x880c]
push edx
call fcn.0043ad76
add esp, 4
push 1
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret