joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cead0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push esi
mov esi, dword [esp + 0x5b4]
cmp word [esi], 0
je 0x4cebc3
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cebc3
push edi
xor edi, edi
mov dword [esp + 0xc], 0xc8
lea eax, [esp + 0x14]
push eax
push edi
push edi
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4ceba1
lea eax, [esp + 0x1c]
push eax
push esi
push 0x567d44
lea eax, [esp + 0x1b8]
push 0x200
push eax
call fcn.00404ce0
add esp, 0x14
lea eax, [esp + 0x1ac]
push eax
push ebx
call fcn.004cead0
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
inc edi
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4ceb46
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
je 0x4cebb1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4cebc3
inc dword [0x5dfbd0]
mov ecx, dword [esp + 0x5a8]
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x5a4
ret 8

Function at 0x4cebe0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push 0x557718
push edi
push esi
call fcn.004cd480
test al, al
jne 0x4cec4f
push 0x200
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004cfe00
test al, al
je 0x4cec4f
mov eax, dword [0x5dfbd4]
test eax, eax
jne 0x4cec40
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4cec4f
push 0
push eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x404
ret 8
Function at 0x4cec70
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push 0x557718
push esi
push SysReAllocString
call fcn.004cd480
test al, al
jne 0x4ced2d
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4cecd6
test ax, ax
mov eax, 0x557698
jne 0x4cecbb
mov eax, 0x557718
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x10]
push 0x200
push eax
call fcn.00404ce0
add esp, 0x14
jmp 0x4cece9
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004bd090
mov eax, dword [0x5dfbd4]
test eax, eax
jne 0x4ced1a
lea eax, [esp + 4]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0052f708
add esp, 0x404
ret 4
push 0
push eax
lea eax, [esp + 0xc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x404
ret 4

Function at 0x4ced50
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x420]
push edi
push ebx
push esi
call fcn.004cd480
test al, al
jne 0x4cedd3
push 0x200
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.004cfe00
test al, al
je 0x4cedd3
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cedd3
push edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4cedd3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x408
ret 0xc

Function at 0x4cedf0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
push edi
mov edi, dword [esp + 0x418]
push edi
push esi
push SysReAllocString
call fcn.004cd480
test al, al
jne 0x4ceea3
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4cee56
test ax, ax
mov eax, 0x557698
jne 0x4cee3b
mov eax, 0x557718
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.00404ce0
add esp, 0x14
jmp 0x4cee69
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004bd090
lea eax, [esp + 8]
push eax
push 0x20006
push 0
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ceea3
push edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 8]
test eax, eax
je 0x4ceea3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x408
ret 8
Function at 0x4cf240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x18]
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push SysReAllocString
call fcn.004cd8d0
test al, al
jne 0x4cf2d1
push edi
push esi
push SysReAllocString
call fcn.004cfe80
mov edi, eax
mov dword [esp + 8], 8
test edi, edi
je 0x4cf2c1
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x30]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cf2c1
cmp dword [esp + 8], esi
je 0x4cf2c1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop esi
add esp, 0x10
ret 0x10

Function at 0x4cf2e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
push eax
mov eax, edi
cdq
push edx
push eax
push dword [esp + 0x38]
push esi
push ebx
call fcn.004cd8d0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
test al, al
je 0x4cf31e
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret 0x10
push esi
push ebx
call fcn.004cfe80
mov ebx, eax
mov dword [esp + 0xc], 4
test ebx, ebx
je 0x4cf366
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x3c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cf366
cmp dword [esp + 0xc], esi
je 0x4cf366
mov edi, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4cf380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x828]
push ebp
mov ebp, dword [esp + 0x830]
push esi
mov esi, dword [esp + 0x824]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x82c]
push edi
mov edi, dword [esp + 0x83c]
mov dword [esp + 0x14], eax
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4cf49e
test esi, esi
je 0x4cf3f4
cmp esi, 0x80000001
je 0x4cf3f4
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4cf49e
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5c
je 0x4cf49e
test esi, esi
jne 0x4cf40d
mov eax, 0x557718
jmp 0x4cf41f
mov eax, 0x567cb0
cmp esi, 0x80000001
je 0x4cf41f
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004bd090
push 0x400
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push eax
call fcn.004a25d0
lea eax, [esp + 0x20]
push eax
call fcn.004cd980
push edi
test eax, eax
jne 0x4cf490
test ebp, ebp
je 0x4cf47c
push ebp
push ebx
call fcn.00531230
add esp, 0xc
xor edi, edi
mov eax, edi
jmp 0x4cf52a
push 0
push ebx
call fcn.00531c60
add esp, 0xc
xor edi, edi
mov eax, edi
jmp 0x4cf52a
push ebx
push eax
call fcn.004bcb40
mov edi, eax
jmp 0x4cf52a
push edi
test ebp, ebp
je 0x4cf4ac
push ebp
push ebx
call fcn.00531230
jmp 0x4cf4b4
push 0
push ebx
call fcn.00531c60
add esp, 0xc
cmp byte [0x589b11], 0
sete al
test al, al
je 0x4cf4c9
mov eax, edi
jmp 0x4cf52a
push dword [esp + 0x10]
push esi
call fcn.004cfe80
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
test eax, eax
je 0x4cf50f
lea ecx, [esp + 0x18]
push ecx
push ebx
lea ecx, [esp + 0x24]
push ecx
push 0
push dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cf50f
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4cf52a
push edi
test ebp, ebp
je 0x4cf51d
push ebp
push ebx
call fcn.00531230
jmp 0x4cf525
push 0
push ebx
call fcn.00531c60
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x814
ret 0x18
Function at 0x4cf550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
push eax
mov eax, ebx
cdq
push edx
push eax
push dword [esp + 0x30]
push esi
push SysReAllocString
call fcn.004cd8d0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
test al, al
je 0x4cf58c
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret 0xc
push edi
push esi
push SysReAllocString
call fcn.004cfe80
mov edi, eax
mov dword [esp + 0xc], 4
test edi, edi
je 0x4cf5d9
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x38]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cf5d9
cmp dword [esp + 0xc], esi
je 0x4cf5d9
mov ebx, dword [esp + 0x10]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret 0xc

Function at 0x4cf620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x818
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [esp + 0x824]
push ebx
mov ebx, dword [esp + 0x824]
push ebp
mov ebp, dword [esp + 0x834]
push esi
mov esi, dword [esp + 0x828]
push edi
mov edi, dword [esp + 0x838]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4cf705
test esi, esi
je 0x4cf689
cmp esi, 0x80000001
je 0x4cf689
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4cf705
cmp word [ebx], 0x5c
je 0x4cf705
test esi, esi
jne 0x4cf69a
mov eax, 0x557718
jmp 0x4cf6ac
mov eax, 0x567cb0
cmp esi, 0x80000001
je 0x4cf6ac
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004bd090
push 0x400
push ebx
lea eax, [esp + 0x2c]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x20]
push eax
call fcn.004a25d0
lea eax, [esp + 0x24]
push eax
call fcn.004cd980
test eax, eax
je 0x4cf6f0
mov ebp, eax
push dword [esp + 0x840]
push ebp
push edi
call fcn.004bd090
mov al, 1
jmp 0x4cf79f
mov ebx, dword [esp + 0x840]
push ebx
push ebp
push edi
call fcn.004bd090
cmp byte [0x589b11], 0
sete al
test al, al
je 0x4cf726
mov al, 1
jmp 0x4cf79f
push dword [esp + 0x14]
push esi
call fcn.004cfe80
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], 0
test eax, eax
je 0x4cf793
lea ecx, [ebx + ebx]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push edi
lea ecx, [esp + 0x28]
push ecx
push 0
push dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x1c]
mov esi, eax
test esi, esi
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4cf793
mov eax, dword [esp + 0x14]
shr eax, 1
test ebx, ebx
jne 0x4cf784
xor eax, eax
mov word [edi], ax
jmp 0x4cf79b
dec ebx
cmp eax, ebx
jb 0x4cf78b
mov eax, ebx
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x4cf79b
push ebx
push ebp
push edi
call fcn.004bd090
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x818
ret 0x18
Function at 0x4cf7f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x818]
push edi
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4cf8d9
cmp word [esi], 0x5c
je 0x4cf8d9
push 0x400
push 0x567cb0
lea eax, [esp + 0x1c]
push eax
call fcn.004bd090
push 0x400
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x18]
push eax
push ebx
push eax
call fcn.004a25d0
mov esi, dword [0x5debcc]
xor edi, edi
test esi, esi
je 0x4cf8e9
mov eax, dword [esi]
lea ecx, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4cf89e
test dx, dx
je 0x4cf89a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4cf89e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4cf878
xor eax, eax
jmp 0x4cf8a3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4cf8b5
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x4cf872
mov eax, edi
jmp 0x4cf98f
mov ecx, dword [esi + 4]
lea edx, [ecx + 2]
jmp 0x4cf8c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cf8c0
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 1]
mov eax, edi
jmp 0x4cf98f
xor edi, edi
cmp byte [0x589b11], 0
sete cl
test cl, cl
je 0x4cf8f0
mov eax, edi
jmp 0x4cf98f
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4cf922
test ax, ax
mov eax, 0x557698
jne 0x4cf907
mov eax, 0x557718
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x20]
push 0x200
push eax
call fcn.00404ce0
add esp, 0x14
jmp 0x4cf935
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bd090
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5dfbd4]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cf989
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4cf989
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
jmp 0x4cf98b
xor esi, esi
shr esi, 1
mov eax, esi
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x80c
ret 8
Function at 0x4d0130
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
push edi
push esi
push SysReAllocString
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call fcn.004ce1b0
test al, al
je 0x4d0169
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 0x10
lea eax, [esp + 8]
push eax
push esi
push SysReAllocString
call fcn.004ce5e0
mov esi, eax
test esi, esi
je 0x4d01a5
push 8
lea eax, [esp + 0x10]
push eax
push 0xb
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 0x10
mov edi, dword [esp + 8]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 0x10

Function at 0x4d01c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x81c]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x818]
push edi
mov edi, dword [esp + 0x820]
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4d027b
test esi, esi
je 0x4d0216
cmp esi, 0x80000001
je 0x4d0216
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4d027b
cmp word [edi], 0x5c
je 0x4d027b
test esi, esi
jne 0x4d0227
mov eax, 0x557718
jmp 0x4d0239
mov eax, 0x567cb0
cmp esi, 0x80000001
je 0x4d0239
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bd090
push 0x400
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x18]
push eax
push ebp
push eax
call fcn.004a25d0
push 1
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.004cd1a0
xor eax, eax
jmp 0x4d02d9
cmp byte [0x589b11], 0
sete al
test al, al
je 0x4d028d
xor eax, eax
jmp 0x4d02d9
lea eax, [esp + 0x10]
push eax
push edi
push esi
call fcn.004ce5e0
mov edi, eax
test edi, edi
je 0x4d02d3
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d02a4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d02d7
mov esi, dword [esp + 0x10]
mov eax, esi
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x808
ret 0x10
Function at 0x4d0300
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x814]
push esi
mov esi, dword [esp + 0x814]
push edi
mov edi, dword [esp + 0x820]
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4d0386
cmp word [esi], 0x5c
je 0x4d0386
push 0x400
push 0x567cb0
lea eax, [esp + 0x18]
push eax
call fcn.004bd090
push 0x400
push esi
lea eax, [esp + 0x18]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
push eax
call fcn.004a25d0
push 1
push edi
lea eax, [esp + 0x18]
push eax
call fcn.004cd1a0
xor eax, eax
jmp 0x4d03ea
cmp byte [0x589b11], 0
sete al
test al, al
je 0x4d0398
xor eax, eax
jmp 0x4d03ea
push ebx
lea eax, [esp + 0x10]
push eax
push esi
push SysReAllocString
call fcn.004ce5e0
mov ebx, eax
test ebx, ebx
je 0x4d03e3
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d03b4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d03e7
mov esi, dword [esp + 0x10]
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0052f708
add esp, 0x808
ret 0xc

Function at 0x4d0410
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push 0
push eax
push dword [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
push SysReAllocString
call fcn.004ce1b0
test al, al
je 0x4d043f
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
push edi
lea eax, [esp + 8]
push eax
push esi
push SysReAllocString
call fcn.004ce5e0
mov edi, eax
test edi, edi
je 0x4d047f
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push dword [esp + 0x2c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 0xc
mov esi, dword [esp + 8]
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x4d0490
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x814]
push edi
mov edi, dword [esp + 0x81c]
call fcn.004cdb60
cmp byte [0x5debc9], 0
je 0x4d055f
cmp word [esi], 0x5c
je 0x4d055f
push ebx
push 0x400
push 0x567cb0
lea eax, [esp + 0x1c]
push eax
call fcn.004bd090
push 0x400
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004bd030
push 0x400
lea eax, [esp + 0x18]
push eax
push edi
push eax
call fcn.004a25d0
mov ebx, dword [esp + 0x828]
xor ecx, ecx
mov edx, 2
lea edi, [ebx*4 + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052f903
add esp, 4
mov esi, eax
push edi
push esi
push 0
push ebx
push ebp
call fcn.004bc720
push 2
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004cd1a0
push esi
call fcn.0052f90c
add esp, 4
xor eax, eax
pop ebx
jmp 0x4d05ac
cmp byte [0x589b11], 0
sete al
test al, al
je 0x4d0571
xor eax, eax
jmp 0x4d05ac
lea eax, [esp + 0xc]
push eax
push esi
push SysReAllocString
call fcn.004ce5e0
mov esi, eax
test esi, esi
je 0x4d05a6
push dword [esp + 0x824]
push ebp
push 3
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d05aa
mov edi, dword [esp + 0xc]
mov eax, edi
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0052f708
add esp, 0x808
ret 0x10
Function at 0x4d05d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004d0910
test eax, eax
je 0x4d05ff
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004d0970
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004d0910
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004d0970
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004d0970
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004d0910
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004d0970
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004d0970
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4d075a
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4d0752
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004d0910
movzx ecx, bl
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8