joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e4c0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x524fc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push ebp
push esi
lea eax, [esp + 0x1c]
push edi
xor edi, edi
push eax
push 0xf003f
push edi
push str.SoftwareClassesCLSID_OBJID.Pro8MR
push reloc.WSOCK32.dll_accept
mov ebp, ecx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46e6bf
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x34]
push edx
push eax
push edi
push edi
push ecx
mov dword [esp + 0x48], 1
mov dword [esp + 0x44], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46e6a4
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
push edx
call fcn.00507da8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x94], edi
mov ecx, dword [eax - 8]
cmp ecx, edi
je 0x46e690
xor esi, esi
cmp ecx, edi
jle 0x46e589
mov cl, byte [esi + eax]
mov eax, esi
cdq
mov ebx, 0xa
idiv ebx
sub cl, dl
push ecx
push esi
lea ecx, [esp + 0x18]
call fcn.00508280
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [eax - 8]
jl 0x46e565
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x6c]
push ecx
push edx
push str._s__x__x__x
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x40], edi
call fcn.004f2884
add esp, 0x18
cmp eax, 4
jne 0x46e690
lea eax, [esp + 0x64]
mov ecx, ebp
push eax
call fcn.0046e6e0
test eax, eax
je 0x46e690
mov ecx, dword [esp + 0x14]
lea edx, [ecx - 0x95e]
mov ecx, dword [esp + 0x24]
lea eax, [ecx + 0x54]
imul edx, eax
mov eax, dword [esp + 0x28]
add edx, 0x22d
cmp eax, edx
jne 0x46e690
mov eax, dword [0x569c90]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
push ecx
lea ecx, [esp + 0x20]
mov bl, 2
push 0x55fc38
push ecx
mov byte [esp + 0xa0], bl
call fcn.005054dc
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push edx
push 0x55fc38
push eax
call fcn.005054dc
add esp, 0x14
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00507aaf
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0xa0], 3
call fcn.00507aaf
mov ecx, ebp
mov byte [esp + 0x9c], bl
call fcn.0046f9b0
lea ecx, [esp + 0x18]
mov byte [esp + 0x94], 1
call fcn.00507d3a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x94], 0
call fcn.00507d3a
lea ecx, [esp + 0x10]
mov dword [esp + 0x94], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareClassesCLSID_OBJID.Pro8MR
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x88
ret
Function at 0x46f7c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x525368
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov eax, dword [0x569c90]
push edi
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x5c], edi
push ecx
push 1
push edi
push str.SoftwareClassesCLSID_OBJID.Pro8
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46f961
push ebx
push ebp
lea edx, [esp + 0x24]
push esi
lea eax, [esp + 0x38]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push eax
push ecx
push edi
push edi
push edx
mov dword [esp + 0x44], 1
mov dword [esp + 0x40], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46f953
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
call fcn.00507ec3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp ecx, edi
je 0x46f953
xor esi, esi
cmp ecx, edi
jle 0x46f884
mov al, byte [esi + eax]
lea ecx, [esp + 0x10]
dec al
push eax
push esi
call fcn.00508280
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [eax - 8]
jl 0x46f86a
lea ecx, [esp + 0x34]
push ecx
call fcn.004f2bfb
mov ebp, dword [esp + 0x78]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push ebp
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push edx
push str._lx__x__x__lx__x
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x40], edi
call fcn.004f2884
add esp, 0x20
cmp eax, 5
jne 0x46f953
mov ebx, dword [esp + 0x18]
cmp ebx, edi
mov edi, dword [esp + 0x20]
jge 0x46f8e2
test edi, edi
jl 0x46f953
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
cmp ecx, eax
jg 0x46f953
cmp dword [ebp], eax
jg 0x46f953
test ebx, ebx
jle 0x46f90c
mov edx, eax
sub edx, ecx
cmp edx, 0x15180
jle 0x46f90c
dec ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x70]
test edi, edi
mov dword [esi], 0xffffffff
jle 0x46f938
sub eax, dword [ebp]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
add edx, ecx
mov ecx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
mov dword [esi], ecx
cmp ebx, 0xffffffff
je 0x46f941
test ebx, ebx
jle 0x46f953
cmp edi, 0xffffffff
je 0x46f94b
cmp dword [esi], 0
jle 0x46f953
mov dword [esp + 0x24], 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop ebx
lea ecx, [esp + 4]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
pop edi
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x46fca0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call fcn.0050c4a3
add esp, 4
mov ecx, dword [ebp + 0x28]
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
push esi
je 0x46fcfa
call fcn.0050c4cc
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push ebx
call fcn.0048df30
mov edx, dword [esp + 0x1c]
add esp, 8
push eax
push esi
push 3
push 0
push 0x563468
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0050c4cc
add esp, 4
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
pop ebx
sete al
ret 4

Function at 0x46fde0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [ecx + 0x18]
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_closesocket
mov dword [esp + 0x18], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46fe4f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.RegUserName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46fe44
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, 1
add esp, 0xc
ret 8
xor eax, eax
add esp, 0xc
ret 8

Function at 0x46fe60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
lea eax, [esp + 4]
push edi
mov ecx, dword [esi + 0x28]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_closesocket
mov dword [esp + 0x20], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46fe98
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x30]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call edi
mov esi, eax
test esi, esi
je 0x46fed5
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
cmp dword [esp + 0xc], 0x14
jbe 0x46fee6
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x20]
test eax, eax
je 0x46fef4
mov dword [eax], 0x12c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x46ff13
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x563468
push eax
call edi
mov esi, eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
sete al
pop esi
add esp, 0xc
ret 0xc
Function at 0x470820
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x47085d
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov cx, word [esp + 0x28]
mov dx, word [esp + 0x2a]
mov word [esi], cx
mov word [esi + 2], dx
pop edi
mov eax, 4
pop esi
add esp, 0x24
ret 4

Function at 0x470870
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
test esi, esi
je 0x470893
lea eax, [esp + 4]
mov dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
mov eax, 4
pop esi
add esp, 0x20
ret 4

Function at 0x4709a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [esp + 0xa8]
test esi, esi
mov dword [esp + 8], 0x19
je 0x470a80
push edi
mov ecx, 6
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x24]
pop edi
cmp eax, 2
jne 0x470a39
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x470a80
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push esi
push eax
push 0
push str.ProductId
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
jmp 0x470a7a
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x470a80
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push eax
mov eax, dword [esp + 0x14]
push str.ProductId
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x14
pop esi
add esp, 0xa0
ret 4
Function at 0x470ba0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x525468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
add ecx, 0x10
push str.Register
lea eax, [esp + 0xc]
xor esi, esi
push ecx
push eax
mov dword [esp + 0x10], esi
call fcn.00507fcf
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push 0x20019
push esi
push edx
push reloc.WSOCK32.dll_accept
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x470c18
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00507d3a
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push edi
push 0x400
call fcn.0050c4a3
mov edx, dword [esp + 0xc]
add esp, 4
mov edi, eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
push esi
push str.REGISTERED
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x470c6b
push 0x563518
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0050c4cc
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x470da0
Capabilities:
Create thread
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
push 0x470cb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x470dda
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffffffffffffffe
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x476070
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x525d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x569c90]
push edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
push ecx
lea ecx, [esp + 8]
call fcn.00508116
mov eax, dword [esp + 4]
mov edi, dword [esp + 0x1c]
lea edx, [esp + 8]
push edx
push 0x20006
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x476117
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x476117
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00507d3a
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
mov esi, dword [esp + 0x2c]
push esi
call fcn.0048d700
mov ecx, dword [esp + 0x10]
add esp, 4
inc eax
push eax
mov eax, dword [esp + 0x2c]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
inc esi
cmp eax, edi
je 0x476152
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x476180
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x525d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x569c90]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], esi
push ecx
lea ecx, [esp + 0x14]
call fcn.00508116
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
push 0x20019
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4762a8
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x18]
push esi
push eax
push esi
push edi
push ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x2c], 1
call ebx
test eax, eax
jne 0x476295
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x476295
push eax
call fcn.0050c4a3
mov ecx, dword [esp + 0x10]
add esp, 4
lea edx, [esp + 0x2c]
mov esi, eax
push edx
lea eax, [esp + 0x18]
push esi
push eax
push 0
push edi
push ecx
call ebx
mov eax, dword [esp + 0x14]
mov edi, 1
cmp eax, edi
jne 0x476252
mov ecx, dword [esp + 0x34]
push esi
call fcn.00507ec3
jmp 0x476254
xor edi, edi
push esi
call fcn.0050c4cc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, ecx
je 0x476270
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00507d3a
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
je 0x4762a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4762d0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x4762f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x476327
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [ecx], edx
ret

Function at 0x476330
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.0048d700
mov ecx, dword [esp + 0xc]
add esp, 4
inc eax
push eax
mov eax, dword [esp + 0x10]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret
Function at 0x476360
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1008
call fcn.004f33a0
mov eax, dword [esp + 0x100c]
test eax, eax
jne 0x47637c
add esp, 0x1008
ret
lea ecx, [esp]
push esi
push ecx
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x101c]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x4763bc
mov ecx, dword [esp + 0x1018]
lea eax, [esp + 0xc]
push eax
call fcn.00507ec3
mov eax, esi
pop esi
add esp, 0x1008
ret

Function at 0x4763d0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x476420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x24]
push 0
push ecx
push 0
push ebx
mov dword [esi], 0
push ebp
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x1c]
test eax, eax
mov dword [edi], ecx
je 0x476467
cmp eax, 0xea
jne 0x4764a0
push ecx
call fcn.0050c4a3
add esp, 4
lea edx, [esp + 0x1c]
mov dword [esi], eax
push edx
push eax
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x47649e
mov ecx, dword [esi]
push ecx
call fcn.0050c4cc
add esp, 4
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x476760
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1008
call fcn.004f33a0
push ebx
mov ebx, dword [esp + 0x1014]
push ebp
mov ebp, dword [esp + 0x1014]
lea eax, [esp + 8]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4767f9
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [esp + 0x14], 0x1000
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push eax
call edi
test eax, eax
je 0x4767cd
cmp eax, 0xea
jne 0x4767ed
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.00476760
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x14], 0x1000
jne 0x4767a7
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x476818
test esi, esi
je 0x476818
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1008
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1008
ret
Function at 0x476830
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x525d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x476880
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x569c90]
push ebx
push edi
mov dword [esp + 0x2c], eax
mov edi, dword [esp + 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [esp + 0x1c], esi
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0x12c
lea ecx, [esp + 0x44]
mov dword [esp + 0x28], 0x12c
call fcn.0050816a
mov edx, dword [esp + 0x20]
push eax
push esi
push edx
call ebx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
je 0x4768ee
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.005081b9
mov ecx, dword [edi + 8]
lea eax, [esp + 0x2c]
push eax
push ecx
mov ecx, edi
call fcn.005067be
inc esi
jmp 0x476899
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
pop edi
cmp eax, ecx
pop ebx
je 0x476903
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x476930
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x525db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esp]
push ebp
xor ebp, ebp
push eax
push 0x20019
push ebp
push ecx
push edx
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x476980
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [0x569c90]
push ebx
push esi
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], eax
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x2c], ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x28]
push ebp
push ecx
push 0x12c
lea ecx, [esp + 0x54]
mov dword [esp + 0x34], 0x12c
call fcn.0050816a
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x476a8c
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.005081b9
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], ebp
push ecx
push 0x20019
push ebp
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x476a8c
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push ebp
push edx
push ebp
push esi
push eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], 1
call ebx
test eax, eax
je 0x476a3a
cmp dword [esp + 0x14], 1
jne 0x476a78
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x34]
inc edx
push ecx
push edx
lea ecx, [esp + 0x44]
call fcn.0050816a
mov ecx, dword [esp + 0x44]
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
push esi
push ecx
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.005081b9
mov eax, dword [edi + 8]
lea edx, [esp + 0x3c]
push edx
push eax
mov ecx, edi
call fcn.005067be
mov ecx, dword [esp + 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x18]
jmp 0x4769a2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
pop edi
pop esi
cmp eax, ecx
pop ebx
je 0x476aa2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x18]
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret