joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44435d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x44440d
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44440d
jmp 0x4443c7
test eax, eax
jne 0x4443f9
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x210]
call fcn.0044435d
test eax, eax
jne 0x4443f9
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push dword [ebp - 0x210]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x4443ad
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret 8

Function at 0x444422
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
jne 0x444438
push 6
pop eax
jmp 0x44447b
cmp dword [ebp + 8], ebx
jne 0x444466
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444466
cmp dword [ebp + 0x10], ebx
jne 0x44445f
cmp dword [ebp - 4], 2
jbe 0x444466
mov eax, 0xb7
jmp 0x44447b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
leave
ret 0x14

Function at 0x444549
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push 0x41e3a0
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4445c0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x41e410
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 3
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4445b7
cmp dword [ebp - 4], 4
je 0x4445ae
cmp dword [ebp - 4], 3
jne 0x4445b7
xor ebx, ebx
cmp dword [ebp - 0xc], 1
setne bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret
Function at 0x4446bc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
test ebx, ebx
je 0x444763
mov edi, 0x104
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x444763
mov eax, edi
push 0x401bb0
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
test eax, eax
js 0x444763
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea edx, reloc.ADVAPI32.dll_TraceMessage
mov ecx, edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.00441bda
test eax, eax
js 0x444763
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
movzx eax, dx
push eax
shr edx, 0x10
push edx
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
movzx eax, dx
push eax
shr edx, 0x10
push edx
push 0x41d104
mov eax, 0x104
mov ecx, ebx
call fcn.0042c95b
add esp, 0x14
test eax, eax
js 0x444763
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret

Function at 0x444778
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push 0x41e460
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44485b
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x41e4b8
push dword [ebp - 0x420]
xor esi, esi
inc esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44484e
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x44484e
push esi
push 0x41e4f4
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x41e504
mov eax, 0x105
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
add esp, 0x10
test eax, eax
js 0x444848
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00440bc3
test eax, eax
je 0x444848
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x10
jl 0x444802
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004655f1
leave
ret
Function at 0x444997
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
je 0x444a82
push eax
push 0x41e5d8
mov eax, 0x104
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
test eax, eax
js 0x444a82
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov ebx, 0x20019
call fcn.0044eae9
test eax, eax
je 0x4449f7
mov ebx, 0x20119
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ebx
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444a81
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x41e648
push dword [ebp - 0x418]
xor ebx, ebx
inc ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444a75
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
jne 0x444a75
mov edi, ebx
lea ebx, reloc.ADVAPI32.dll_TraceMessage
mov edx, esi
call fcn.00440330
test eax, eax
je 0x444a75
mov edx, ebx
mov eax, 0x104
call fcn.0042c88c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret 4

Function at 0x444b65
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x144
push 0
push esi
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [esi], 0
add esp, 0xc
push 0x32
lea ebx, [esi + 0xe0]
push ebx
push 0x1010
push 0x400
call edi
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
push ebx
mov dword [esi + 0x14], eax
push 0x12
xor eax, eax
push 0x400
mov word [ebx], ax
call edi
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
mov dword [esi + 4], eax
add esi, 0x18
push esi
push EventRegister
push 0x400
call edi
mov eax, dword [ebp + 8]
push 0x32
mov dword [eax + 0xc], esi
lea esi, [eax + 0x7c]
push esi
push reloc.ADVAPI32.dll_EventRegister
push 0x400
call edi
mov eax, dword [ebp + 8]
push 0x32
push ebx
mov dword [eax + 0x10], esi
push 0x10
xor eax, eax
push 0x400
mov word [ebx], ax
call edi
movzx eax, word [ebx]
xor ecx, ecx
cmp cx, ax
je 0x444c41
mov edi, dword [sym.imp.USER32.dll_CharNextW]
push 0x30
pop ecx
cmp cx, ax
je 0x444c41
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
imul eax, eax, 0xa
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.msvcrt.dll__wtoi]
add dword [esi + 8], eax
pop ecx
push ebx
call edi
push eax
call edi
mov ebx, eax
movzx eax, word [ebx]
xor ecx, ecx
cmp cx, ax
jne 0x444c10
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x444f58
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
inc ebx
push ebx
push 0
push 0x41c408
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop ecx
test eax, eax
jne 0x444fd5
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41e6d4
push dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444fc8
xor ebx, ebx
cmp dword [ebp - 8], 4
jne 0x444fc8
cmp dword [ebp - 0xc], ebx
sete bl
push dword [ebp - 4]
call esi
test ebx, ebx
je 0x445086
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x41e6f8
push 0x80000002
call edi
test eax, eax
jne 0x44502c
and dword [ebp - 8], eax
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x41e754
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445027
xor ebx, ebx
cmp dword [ebp - 0xc], 4
jne 0x445027
cmp dword [ebp - 8], ebx
sete bl
push dword [ebp - 4]
call esi
test ebx, ebx
je 0x445086
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x41e770
push 0x80000001
call edi
test eax, eax
jne 0x445086
and dword [ebp - 8], eax
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x41e7e4
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445081
xor ebx, ebx
cmp dword [ebp - 0xc], edi
jne 0x445081
cmp dword [ebp - 8], ebx
sete bl
push dword [ebp - 4]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x445092
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x4016a0
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4450e9
lea eax, [ebp - 8]
push eax
call dword [sym.imp.msvcrt.dll_time]
pop ecx
push 4
lea eax, [ebp - 8]
push eax
push 3
push esi
push 0x401428
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x445161
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, ecx
xor esi, esi
test edi, edi
je 0x44527a
push 0x41e81c
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4451ae
push 0x41e838
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4451ae
inc esi
jmp 0x44527a
mov edi, 0x104
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44527a
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x41e85c
mov eax, edi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
test eax, eax
js 0x44527a
cmp dword [ebp + 8], reloc.ADVAPI32.dll_TraceMessage
jne 0x445265
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 2
push esi
push 0x4017a8
push 0x80000002
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44527a
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x445222
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push esi
push 0x41e87c
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x420]
xor esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44527a
push 0xffff
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call fcn.0044328c
mov esi, eax
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret 4
Function at 0x445e81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
mov esi, eax
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 1
cmp dword [ebp + 0x10], ebx
je 0x445fa4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x445ead
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x15]
xor ecx, ecx
push 2
pop edx
mov dword [ebp + 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x445ef6
push 0x41e968
push 2
pop eax
push eax
call fcn.004400fc
mov eax, 0x8007000e
jmp 0x445ff7
mov eax, dword [0x467fbc]
cmp eax, 0xff
jne 0x445f0c
call fcn.00440ef5
mov dword [0x467fbc], eax
test eax, eax
je 0x445f94
push eax
mov eax, dword [ebp + 0x10]
push esi
push 0x41e980
mov ecx, ebx
call fcn.0042c95b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
test eax, eax
jne 0x445f59
inc eax
cmp dword [ebp - 8], eax
jne 0x445f59
xor edi, edi
mov dword [ebp - 0xc], eax
jmp 0x445f94
mov eax, dword [ebp + 0x10]
push esi
push 0x41e994
mov ecx, ebx
call fcn.0042c95b
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
test eax, eax
jne 0x445f8f
inc eax
cmp dword [ebp - 8], eax
je 0x445f52
mov edi, 0x80004005
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
cmp dword [ebp - 0xc], 0
pop ecx
jne 0x445fd4
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445fcf
cmp dword [ebp - 8], 1
jne 0x445fcf
mov edi, ebx
jmp 0x445fd8
mov edi, 0x80004005
test edi, edi
js 0x445ff5
test esi, esi
jne 0x445fe1
mov esi, 0x41d420
push esi
push dword [ebp + 0xc]
push 0x41e9a0
push 4
pop esi
call fcn.00440126
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x446332
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
xor esi, esi
lea ebx, [edi + 0x10]
mov ecx, esi
mov dword [ebp - 8], ebx
cmp dword [ebx], esi
jne 0x446466
push 0x80
mov dword [ebp - 4], 0x80004005
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov dword [ebx], eax
test eax, eax
je 0x44646d
mov eax, dword [edi + 4]
test eax, eax
js 0x446392
cmp eax, 1
jle 0x44637f
cmp eax, 3
jne 0x446392
mov eax, 0x41e9dc
mov edi, ebx
call fcn.0044056c
mov ecx, eax
jmp 0x446466
cmp dword [edi + 0xc], esi
je 0x446454
push 0x208
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x446451
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x446445
push 0x5c
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x4463dd
add eax, 2
mov edi, eax
jmp 0x4463e0
mov edi, dword [edi + 0xc]
push ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.004402ab
push edi
mov eax, 0x104
mov edi, ebx
call fcn.0042c8f1
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.00441bda
test eax, eax
js 0x446445
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx ecx, dx
push ecx
shr edx, 0x10
push edx
push 0x41d104
mov eax, 0x104
mov ecx, ebx
call fcn.0042c95b
mov edi, dword [ebp - 8]
add esp, 0x14
mov eax, ebx
call fcn.0044056c
xor esi, esi
mov dword [ebp - 4], eax
inc esi
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
jne 0x446463
mov ebx, dword [ebp - 8]
mov eax, 0x41e9ec
mov edi, ebx
call fcn.0044056c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
setns al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446ffd
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
push edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
xor ebx, ebx
mov eax, ebx
sub eax, 0
je 0x44705a
dec eax
je 0x447053
dec eax
je 0x44704c
dec eax
je 0x447045
mov edi, 0x40418c
jmp 0x44705f
mov edi, 0x4043f8
jmp 0x44705f
mov edi, 0x404568
jmp 0x44705f
mov edi, 0x4041dc
jmp 0x44705f
mov edi, 0x4044a4
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x447142
xor ecx, ecx
mov eax, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x447136
inc dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x110]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x447136
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x41ed74
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push edi
push dword [ebp - 0x124]
call fcn.00446e3e
push dword [ebp - 0x114]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x447136
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor ecx, ecx
jmp 0x447097
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x447156
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
inc ebx
cmp ebx, 5
jl 0x44702e
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
Function at 0x44716e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xdc], ebx
test ebx, ebx
jne 0x44719e
mov eax, 0x80004003
jmp 0x4473a2
mov edi, dword [edi]
test edi, edi
je 0x4473a0
xor esi, esi
mov dword [ebp - 0xd8], esi
mov eax, dword [edi]
test eax, eax
je 0x447395
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd4], esi
call fcn.00446a48
test eax, eax
jne 0x447395
lea eax, [ebp - 0xd0]
push eax
push 0x4042f0
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x447395
lea eax, [ebp - 0xd0]
push eax
push 0x41ed9c
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
xor esi, esi
push esi
lea eax, [ebp - 0xd4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0xd0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x447395
mov ecx, dword [edi]
mov eax, 0xc8
lea edx, [ebp - 0xd0]
call fcn.00446744
test eax, eax
je 0x447389
mov eax, dword [edi]
cmp dword [eax + 4], 3
jne 0x447259
cmp dword [eax], 4
je 0x447389
mov esi, dword [eax + 0xc]
test esi, esi
je 0x447387
push esi
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xd4]
call fcn.00443e3c
mov ebx, eax
test ebx, ebx
je 0x447381
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd8]
jne 0x447286
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
xor esi, esi
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [edi]
push reloc.KERNEL32.dll_InitializeCriticalSection
pop eax
lea edx, [ebp - 0xd0]
call fcn.00446744
test eax, eax
je 0x4472f6
lea ecx, [ebp - 0xd0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4472cc
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0x4045c0
push ebx
push esi
call fcn.00444422
mov eax, dword [edi]
lea ecx, [ebp - 0xd0]
call fcn.00446a48
test eax, eax
js 0x44733a
lea ecx, [ebp - 0xd0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x447310
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0x404620
push ebx
push esi
call fcn.00444422
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x447372
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd8]
jne 0x447348
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 0x4045cc
push ebx
xor esi, esi
push esi
call fcn.00444422
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xdc]
jmp 0x447389
mov ebx, dword [ebp - 0xdc]
xor esi, esi
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [edi + 4]
test edi, edi
jne 0x4471b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret