joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x414926
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x41481a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41492d
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x414806
test bx, bx
je 0x414802
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x414806
add edx, 4
add ecx, 4
test bx, bx
jne 0x4147e0
xor ecx, ecx
jmp 0x41480b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x414817
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x414820
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x41489a
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x414878
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41492d
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41486c
test dx, dx
je 0x414868
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41486c
add ecx, 4
add eax, 4
test dx, dx
jne 0x414846
xor eax, eax
jmp 0x414871
sbb eax, eax
or eax, 1
test eax, eax
jns 0x41489a
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00415500
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push dword [ebx + 4]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 4
mov eax, dword [eax]
push ecx
push 0
push dword [ebx]
mov dword [ebp - 8], 4
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4148d0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x414917
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x4148fc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x414917
lea esp, [esp]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x4148f0
jmp 0x414917
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x414915
cmp esi, dword [eax + 8]
jne 0x414915
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x414905
mov esi, eax
cmp esi, dword [ebp - 0x14]
je 0x414924
mov eax, dword [ebp + 8]
jmp 0x4147b4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x414940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x414ad6
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x4149ca
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x414add
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x4149b6
test bx, bx
je 0x4149b2
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x4149b6
add edx, 4
add ecx, 4
test bx, bx
jne 0x414990
xor ecx, ecx
jmp 0x4149bb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x4149c7
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x4149d0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x414a4a
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x414a28
mov eax, dword [edi + 0x10]
test eax, eax
je 0x414add
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x414a1c
test dx, dx
je 0x414a18
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x414a1c
add ecx, 4
add eax, 4
test dx, dx
jne 0x4149f6
xor eax, eax
jmp 0x414a21
sbb eax, eax
or eax, 1
test eax, eax
jns 0x414a4a
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00415500
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push dword [ebx + 4]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 3
mov eax, dword [eax]
push ecx
push 0
push dword [ebx]
mov dword [ebp - 8], 1
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x414a80
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x414ac7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x414aac
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x414ac7
lea esp, [esp]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x414aa0
jmp 0x414ac7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x414ac5
cmp esi, dword [eax + 8]
jne 0x414ac5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x414ab5
mov esi, eax
cmp esi, dword [ebp - 0x14]
je 0x414ad4
mov eax, dword [ebp + 8]
jmp 0x414964
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x414af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
cmp esi, eax
je 0x414c86
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x414b7a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x414c8d
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x414b66
test bx, bx
je 0x414b62
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x414b66
add edx, 4
add ecx, 4
test bx, bx
jne 0x414b40
xor ecx, ecx
jmp 0x414b6b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x414b77
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x414b80
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x414c02
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x414bd8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x414c8d
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x414bcc
test dx, dx
je 0x414bc8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x414bcc
add ecx, 4
add eax, 4
test dx, dx
jne 0x414ba6
xor eax, eax
jmp 0x414bd1
sbb eax, eax
or eax, 1
test eax, eax
jns 0x414bfd
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00415500
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x14]
jmp 0x414c04
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ecx
push dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 3
mov eax, dword [eax]
push ecx
push 0
push dword [ebx]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x414c36
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x414c77
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x414c5c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x414c77
nop
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x414c50
jmp 0x414c77
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x414c75
cmp esi, dword [eax + 8]
jne 0x414c75
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x414c65
mov esi, eax
cmp esi, dword [ebp - 0x18]
je 0x414c84
mov eax, dword [ebp + 8]
jmp 0x414b14
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x414ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov esi, dword [eax]
cmp esi, eax
je 0x414e56
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x414d2a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x414e5d
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x414d16
test bx, bx
je 0x414d12
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x414d16
add edx, 4
add ecx, 4
test bx, bx
jne 0x414cf0
xor ecx, ecx
jmp 0x414d1b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x414d27
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
jmp 0x414d30
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x414db2
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x414d88
mov eax, dword [edi + 0x10]
test eax, eax
je 0x414e5d
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x414d7c
test dx, dx
je 0x414d78
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x414d7c
add ecx, 4
add eax, 4
test dx, dx
jne 0x414d56
xor eax, eax
jmp 0x414d81
sbb eax, eax
or eax, 1
test eax, eax
jns 0x414dad
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00415500
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0x14]
jmp 0x414db4
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 1
mov ebx, dword [eax]
test ecx, ecx
jne 0x414de5
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414dd0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [esi + 0x10]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x414e07
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x414e47
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x414e2c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x414e47
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x414e20
jmp 0x414e47
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x414e45
cmp esi, dword [eax + 8]
jne 0x414e45
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x414e35
mov esi, eax
cmp esi, dword [ebp - 0x18]
je 0x414e54
mov eax, dword [ebp + 8]
jmp 0x414cc4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x414e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, dword [eax]
cmp esi, eax
je 0x414ff6
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x414efa
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x414ffd
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x414ee6
test bx, bx
je 0x414ee2
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x414ee6
add edx, 4
add ecx, 4
test bx, bx
jne 0x414ec0
xor ecx, ecx
jmp 0x414eeb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x414ef7
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x414f00
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x414f7a
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x414f58
mov eax, dword [edi + 0x10]
test eax, eax
je 0x414ffd
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x414f4c
test dx, dx
je 0x414f48
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x414f4c
add ecx, 4
add eax, 4
test dx, dx
jne 0x414f26
xor eax, eax
jmp 0x414f51
sbb eax, eax
or eax, 1
test eax, eax
jns 0x414f7a
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.00415500
mov eax, dword [ebp + 0xc]
push 4
mov ecx, dword [eax]
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push dword [ebx]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x414fa7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x414fe7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x414fcc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x414fe7
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x414fc0
jmp 0x414fe7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x414fe5
cmp esi, dword [eax + 8]
jne 0x414fe5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x414fd5
mov esi, eax
cmp esi, dword [ebp - 0x10]
je 0x414ff4
mov eax, dword [ebp + 8]
jmp 0x414e94
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x415010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, dword [eax]
cmp esi, eax
je 0x415196
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp - 4], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp eax, ecx
je 0x41509a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41519d
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x415086
test bx, bx
je 0x415082
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x415086
add edx, 4
add ecx, 4
test bx, bx
jne 0x415060
xor ecx, ecx
jmp 0x41508b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x415097
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
jmp 0x4150a0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x41511a
mov ecx, dword [ebp - 4]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp - 4]
cmp edi, dword [eax]
je 0x4150f8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41519d
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4150ec
test dx, dx
je 0x4150e8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4150ec
add ecx, 4
add eax, 4
test dx, dx
jne 0x4150c6
xor eax, eax
jmp 0x4150f1
sbb eax, eax
or eax, 1
test eax, eax
jns 0x41511a
mov eax, dword [ebp - 4]
push ecx
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp - 4]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.00415500
mov eax, dword [ebp + 0xc]
push 1
mov ecx, dword [eax]
mov eax, dword [ebx + 4]
mov al, byte [eax]
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
push 3
push 0
push dword [ebx]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x415147
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x415187
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x41516c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x415187
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x415160
jmp 0x415187
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x415185
cmp esi, dword [eax + 8]
jne 0x415185
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x415175
mov esi, eax
cmp esi, dword [ebp - 0x10]
je 0x415194
mov eax, dword [ebp - 4]
jmp 0x415034
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x4151b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x415336
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x41523a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41533d
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x415226
test bx, bx
je 0x415222
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x415226
add edx, 4
add ecx, 4
test bx, bx
jne 0x415200
xor ecx, ecx
jmp 0x41522b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x415237
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x415240
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x4152c2
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x415298
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41533d
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41528c
test dx, dx
je 0x415288
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41528c
add ecx, 4
add eax, 4
test dx, dx
jne 0x415266
xor eax, eax
jmp 0x415291
sbb eax, eax
or eax, 1
test eax, eax
jns 0x4152bd
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00415500
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0x14]
jmp 0x4152c4
xor ecx, ecx
mov eax, dword [ebp + 0xc]
push ecx
push dword [ebx + 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebx]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4152e7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x415327
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x41530c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x415327
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x415300
jmp 0x415327
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x415325
cmp esi, dword [eax + 8]
jne 0x415325
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x415315
mov esi, eax
cmp esi, dword [ebp - 0x14]
je 0x415334
mov eax, dword [ebp + 8]
jmp 0x4151d4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3
Function at 0x415350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, dword [eax]
cmp esi, eax
je 0x4154e6
lea eax, [ecx + 0xe14]
push ebx
mov dword [ebp + 8], eax
push edi
mov edi, dword [eax]
lea ebx, [esi + 0x10]
push ebx
mov ecx, eax
call fcn.004145f0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x4153da
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4154ed
mov edx, dword [ebx]
lea ebx, [ebx]
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x4153c6
test bx, bx
je 0x4153c2
mov bx, word [edx + 2]
cmp bx, word [ecx + 2]
jne 0x4153c6
add edx, 4
add ecx, 4
test bx, bx
jne 0x4153a0
xor ecx, ecx
jmp 0x4153cb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x4153d7
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
jmp 0x4153e0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
lea ebx, [esi + 0x10]
cmp dword [eax], edi
je 0x41545a
mov ecx, dword [ebp + 8]
push ebx
call fcn.004145f0
mov edi, eax
mov eax, dword [ebp + 8]
cmp edi, dword [eax]
je 0x415438
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4154ed
mov ecx, dword [ebx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41542c
test dx, dx
je 0x415428
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41542c
add ecx, 4
add eax, 4
test dx, dx
jne 0x415406
xor eax, eax
jmp 0x415431
sbb eax, eax
or eax, 1
test eax, eax
jns 0x41545a
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push ecx
mov ecx, eax
call fcn.004156a0
mov ecx, dword [ebp + 8]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.00415500
mov edx, dword [ebx + 4]
mov ecx, edx
mov eax, dword [ebp + 0xc]
lea ebx, [ecx + 2]
mov edi, dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415467
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push 1
push 0
push dword [esi + 0x10]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x415496
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esi + 0xd], 0
jne 0x4154d7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x4154bc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x4154d7
nop
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x4154b0
jmp 0x4154d7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4154d5
cmp esi, dword [eax + 8]
jne 0x4154d5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4154c5
mov esi, eax
cmp esi, dword [ebp - 0x10]
je 0x4154e4
mov eax, dword [ebp + 8]
jmp 0x415374
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004027b0
int3