joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45adbc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff9d0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, str.name
lea eax, [ebp - 0x104]
push eax
lea edx, [esi + 4]
push edx
push 0x100
lea ecx, [esi + 4]
mov edx, ebx
mov eax, 0x80000000
call fcn.00461a08
cmp byte [ebp - 0x104], 0
je 0x45ae10
lea ecx, [ebp - 0x104]
push ecx
push edi
call fcn.00498e7c
add esp, 8
push ebx
lea eax, [esi + 0x97]
push eax
lea edx, [ebp - 0x230]
push edx
call fcn.0049bdcc
add esp, 0xc
lea ecx, [ebp - 0xa30]
lea eax, [esi + 4]
lea edx, [ebp - 0x230]
push ecx
push eax
mov eax, 0x80000000
push 0x800
lea ecx, [esi + 4]
call fcn.00461a08
test al, al
jne 0x45af02
push ebx
lea edx, [esi + 0xa6]
push edx
lea ecx, [ebp - 0x230]
push ecx
call fcn.0049bdcc
add esp, 0xc
lea eax, [ebp - 0xe30]
push eax
lea edx, [esi + 4]
push edx
push 0x400
lea ecx, [esi + 4]
lea edx, [ebp - 0x230]
mov eax, 0x80000000
call fcn.00461a08
test al, al
jne 0x45ae97
xor eax, eax
jmp 0x45af7d
xor edx, edx
mov dl, byte [ebp - 0xe30]
cmp edx, 0x22
jne 0x45aeac
lea ecx, [ebp - 0xe2f]
jmp 0x45aeb2
lea ecx, [ebp - 0xe30]
push ecx
lea eax, [ebp - 0xa30]
push eax
call fcn.00498e7c
add esp, 8
push 0x22
lea edx, [ebp - 0xa30]
push edx
call fcn.00498f49
add esp, 8
test eax, eax
je 0x45aeda
mov byte [eax], 0
lea eax, [esi + 0xbc]
push eax
lea edx, [ebp - 0xa30]
push edx
call fcn.00498f6d
add esp, 8
test eax, eax
je 0x45aef7
mov byte [eax], 0
lea eax, [ebp - 0xa30]
call fcn.0040f5a4
lea edx, [esi + 0xbc]
push edx
lea ecx, [ebp - 0xa30]
push ecx
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45af20
xor eax, eax
jmp 0x45af7d
xor esi, esi
push 0x800
lea eax, [ebp - 0x1630]
push eax
lea edx, [ebp - 0xa30]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push 0x2c
lea ecx, [ebp - 0x1630]
push ecx
call fcn.00498f61
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45af60
lea esi, [ebx + 1]
push esi
call fcn.0049d6d0
pop ecx
mov esi, eax
mov byte [ebx], 0
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 1
push edx
push 0
push esi
lea ecx, [ebp - 0x1630]
push ecx
call sub.SHELL32.DLL_ExtractIconExA
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c78c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffc00
push ebx
mov ebx, eax
lea edx, [ebp - 0x400]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
lea eax, [ebp - 0x400]
call fcn.0040be48
mov edx, 0x4ab084
mov ecx, 6
call fcn.0040f580
test eax, eax
jne 0x45c8ee
mov edx, 0x4ab08b
mov eax, ebx
call fcn.00459c98
test eax, eax
jne 0x45c7f7
mov edx, str.rarreg.txt
mov eax, ebx
call fcn.00459c98
test eax, eax
je 0x45c8ee
lea edx, [ebp - 0x1000]
lea eax, [ebp - 0x800]
call fcn.0044cb6c
test al, al
je 0x45c8ee
push 0x400
lea ecx, [ebp - 0x1400]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x4ab08b
lea eax, [ebp - 0x1400]
call fcn.0040be48
push eax
call fcn.00498e7c
add esp, 8
push 0
lea edx, [ebp - 0x1400]
push edx
lea ecx, [ebp - 0x800]
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x45c894
lea eax, [ebp - 0x1400]
call fcn.00464dd0
lea eax, [ebp - 0x1400]
call fcn.0040c35c
push 0x4ab08b
lea edx, [ebp - 0x1400]
push edx
call fcn.00498da0
add esp, 8
push 0
lea ecx, [ebp - 0x1400]
push ecx
lea eax, [ebp - 0x800]
push eax
call sub.KERNEL32.DLL_CopyFileA
lea edx, [ebp - 0x800]
push edx
call fcn.0049ba38
pop ecx
push dword [0x4c6eec]
call sub.USER32.DLL_SetForegroundWindow
mov al, 1
call fcn.0040eb6c
mov byte [0x4b41ac], al
mov eax, 0x4c6f00
call fcn.0045a93c
cmp byte [0x4b41ac], 0
je 0x45c8ee
push 0x30
mov eax, 0x368
call fcn.004129c8
push eax
mov eax, 0x367
call fcn.004129c8
push eax
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c8f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff1fc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x1004]
mov eax, ebx
call fcn.0040acd8
lea edx, [ebp - 0x1804]
mov eax, edi
call fcn.0040ad28
push ebx
lea ecx, [ebp - 0x404]
push ecx
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0xc04]
mov edx, 0x400
call fcn.00464700
lea ecx, [ebp - 0x804]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0xc04]
push eax
call fcn.00498eac
pop ecx
mov ecx, eax
lea eax, [ebp - 0xc04]
mov edx, ebx
call fcn.0040f580
test eax, eax
je 0x45c9bf
push 0x5c
lea ecx, [ebp - 0x404]
push ecx
call fcn.00498f61
add esp, 8
mov esi, eax
test eax, eax
je 0x45c9bf
lea edx, [ebp - 0x404]
cmp esi, edx
jbe 0x45c9bf
mov al, byte [esi - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3a
je 0x45c9bf
xor ecx, ecx
mov cl, al
cmp ecx, 0x5c
je 0x45c9bf
mov byte [esi], 0
lea eax, [ebp - 0x404]
push eax
call fcn.0049a80c
pop ecx
push 1
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045c264
cmp eax, 0xffffffff
jne 0x45c9e8
push 1
lea ecx, [ebp - 0x1804]
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0045c264
cmp eax, 1
je 0x45ca62
cmp eax, 2
je 0x45ca51
inc eax
jne 0x45ca12
push ebx
mov eax, 0x1f5
call fcn.004129c8
push eax
lea edx, [ebp - 0x1e04]
push edx
call fcn.0049bdcc
add esp, 0xc
jmp 0x45ca32
mov eax, 0x1fc
call fcn.004129c8
push eax
push ebx
push str._s_n_s
lea edx, [ebp - 0x1e04]
push edx
call fcn.0049bdcc
add esp, 0x10
push 0x10
mov eax, 0x66
call fcn.004129c8
push eax
lea edx, [ebp - 0x1e04]
push edx
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
lea ecx, [ebp - 0x804]
push ecx
call fcn.0049a80c
pop ecx
xor eax, eax
jmp 0x45ca64
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ca6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
push 0x4aaeb4
push edi
call fcn.00498e30
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x41d], 0
je 0x45caf0
xor eax, eax
test bl, bl
mov dword [ebp - 8], eax
je 0x45cab5
mov dword [ebp - 8], 1
push 0x4ab082
push edi
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45cad0
mov edx, dword [esi + 0x520]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x45caf0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0045dee8
xor edx, edx
mov eax, esi
call fcn.0045905c
jmp 0x45cccd
mov eax, esi
call fcn.0045eeec
cmp dword [0x4c988c], 0
je 0x45cbe1
mov edx, str.FlatView
mov eax, 0x4aaeb7
xor ecx, ecx
call fcn.00461bc4
test eax, eax
je 0x45cb21
test bl, bl
je 0x45cccd
lea edx, [ebp - 0x40c]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d50
push 0x4ab082
push edi
call fcn.00498e30
add esp, 8
test eax, eax
je 0x45cb79
mov eax, 0x4c7c4c
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.00457bac
test eax, eax
je 0x45cb79
test bl, bl
je 0x45cb6b
lea eax, [ebp - 0x40c]
call fcn.0040be48
mov edx, eax
jmp 0x45cb6d
xor edx, edx
mov eax, esi
call fcn.00459e2c
jmp 0x45cccd
lea edx, [ebp - 0x80c]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
lea eax, [ebp - 0x80c]
push eax
lea edx, [ebp - 0xc0c]
push edx
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0xc0c]
call fcn.0040c42c
lea eax, [ebp - 0xc0c]
xor edx, edx
call fcn.004647b8
mov eax, esi
call fcn.0045ea0c
test al, al
je 0x45cccd
lea eax, [ebp - 0x80c]
call fcn.0040be48
mov edx, eax
mov eax, esi
call fcn.0045905c
jmp 0x45cccd
lea edx, [ebp - 0x100c]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x45cc97
lea ecx, [ebp - 0x100c]
push ecx
lea eax, [ebp - 0x140c]
push eax
call fcn.00498e7c
add esp, 8
lea edx, [ebp - 0x180c]
lea eax, [ebp - 0x100c]
call fcn.0040caec
lea eax, [ebp - 0x140c]
call fcn.0040c35c
lea eax, [ebp - 0x180c]
call fcn.0040c35c
lea edx, [ebp - 0x180c]
lea eax, [ebp - 0x140c]
call fcn.0040f55c
test eax, eax
jne 0x45cc97
cmp dword [esi + 0x520], 0
jle 0x45cc5e
mov byte [esi + 0x41d], 1
jmp 0x45cc8c
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
push ecx
push 0x11
push dword [esi]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, 0x4c6f00
mov edx, dword [ebp - 0xc]
call fcn.0045ee50
push dword [ebp - 0xc]
mov ecx, dword [0x4cd5f4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor edx, edx
mov eax, esi
call fcn.0045905c
jmp 0x45cccd
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004647b8
test al, al
jne 0x45ccb1
mov eax, 0x4ab082
xor edx, edx
call fcn.004647b8
test bl, bl
je 0x45ccc4
lea eax, [ebp - 0x100c]
call fcn.0040be48
mov edx, eax
jmp 0x45ccc6
xor edx, edx
mov eax, esi
call fcn.0045905c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d5c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
call sub.USER32.DLL_GetCursorPos
lea edx, [ebp - 0x14]
push edx
push dword [ebx]
call sub.USER32.DLL_ScreenToClient
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x1012
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [ebp - 0xc], 1
jne 0x45d634
test ebx, ebx
jne 0x45d634
test esi, esi
jne 0x45d634
test eax, eax
je 0x45d638
xor edx, edx
jmp 0x45d63d
mov edx, 1
mov eax, edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d648
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa78
push ebx
push esi
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov esi, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.00464700
push 0x4001
lea ecx, [ebp - 0x560]
push 0x160
push ecx
lea eax, [ebp - 0x400]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 0x28
push 0
lea edx, [ebp - 0x588]
push edx
call fcn.00498cfc
mov dword [ebp - 0x588], 3
mov ecx, dword [ebp - 0x55c]
add esp, 0xc
mov dword [ebp - 0x56c], ecx
mov dword [ebp - 0x584], esi
xor eax, eax
mov dword [ebp - 0x580], eax
mov eax, 0x3d4
call fcn.004129c8
mov dword [ebp - 0x574], eax
lea edx, [ebp - 0x588]
push edx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebx]
call sub.USER32.DLL_SetFocus
mov byte [ebx + 0x1c], 1
push 0
push esi
push 0x1017
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ea0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0045eeec
cmp dword [0x4c988c], 0
je 0x45eae6
lea edx, [ebp - 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x400]
call fcn.0040c338
mov esi, eax
cmp esi, 0xffffffff
je 0x45ea90
call fcn.00464794
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x45ea90
lea edx, [ebp - 0x800]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
lea eax, [ebp - 0x800]
call fcn.0040c42c
lea edx, [ebp - 0x800]
push edx
call fcn.0049a80c
pop ecx
xor eax, eax
jmp 0x45eae8
cmp dword [0x4c6ef0], 0
je 0x45eaa4
push dword [0x4c6ef0]
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.0045e96c
xor edx, edx
mov eax, ebx
mov dword [0x4c988c], edx
call fcn.0045e364
mov eax, ebx
call fcn.0045eb70
mov byte [0x4c749c], 0
mov eax, 0x4c7470
call fcn.0047d6a8
mov eax, 0x4c7428
call fcn.0045f098
mov eax, 0x4c7428
call fcn.0045f220
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f6c8
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
mov esi, eax
mov dword [esi], edx
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x4ab3e8
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x45f72c
lea eax, [ebp - 0x560]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
lea edx, [ebp - 0x160]
push 0x160
push edx
lea ecx, [ebp - 0x560]
push 0
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push dword [esi]
call sub.USER32.DLL_SendMessageA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460990
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ecx
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
mov esp, ebp
pop ebp
ret
Function at 0x461080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4ab538
call fcn.004992ac
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.004611b8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x4610d7
lea ecx, [ebx + 0x400]
jmp 0x4610d9
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040ff58
mov word [ebp - 0x14], 0
jmp 0x461129
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461410
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff664
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x461441
xor eax, eax
jmp 0x461590
mov edx, esi
mov eax, 0x80000001
call fcn.00461597
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x461480
mov eax, dword [ebp - 4]
call fcn.00461735
xor eax, eax
jmp 0x461590
xor ebx, ebx
mov dword [ebp - 0x14], 0xc8
mov dword [ebp - 0x18], 0x3e8
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x4d4]
push eax
push edx
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x14]
push ecx
push 0
push eax
lea edx, [ebp - 0xec]
push edx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x4614da
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4d4]
lea eax, [ebp - 0xec]
push ecx
push dword [ebp - 0x10]
push 0
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x461482
xor ebx, ebx
mov dword [ebp - 0x1c], 0xc8
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x59c]
push ecx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x46157e
lea eax, [ebp - 0x59c]
push eax
push edi
push str._s_s
lea edx, [ebp - 0x79c]
push edx
call fcn.0049bdcc
add esp, 0x10
lea ecx, [ebp - 0x59c]
push ecx
push esi
push str._s_s
lea eax, [ebp - 0x99c]
push eax
call fcn.0049bdcc
add esp, 0x10
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
lea eax, [ebp - 0x99c]
push edx
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x46157e
lea edx, [ebp - 0x99c]
lea eax, [ebp - 0x79c]
call fcn.00461410
inc ebx
jmp 0x4614dc
mov eax, dword [ebp - 4]
call fcn.00461735
mov eax, dword [ebp - 8]
call fcn.00461735
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4615cd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
cmp byte [esi], 0
je 0x46166c
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46166c
xor ebx, ebx
mov dword [ebp - 8], 0xc8
lea eax, [ebp - 0x10]
lea edx, [ebp - 8]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0xd8]
push ecx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x461653
lea eax, [ebp - 0xd8]
push eax
push esi
push str._s_s
lea edx, [ebp - 0x2d8]
push edx
call fcn.0049bdcc
add esp, 0x10
lea edx, [ebp - 0x2d8]
mov eax, edi
call fcn.004615cd
inc ebx
jmp 0x4615fe
mov eax, dword [ebp - 4]
call fcn.00461735
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x46166c
inc dword [0x4cd1ec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4617d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00461673
mov ebx, eax
test ebx, ebx
je 0x46181b
push esi
call fcn.00498eac
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00461735
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x461838
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.004107bc
test eax, eax
je 0x4618a9
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00461673
mov ebx, eax
test ebx, ebx
je 0x4618e4
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.00410844
mov eax, esi
call fcn.00410af4
add eax, eax
lea edx, [ebp - 0xac]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00461735
jmp 0x4618e4
mov eax, esi
call fcn.00410af4
add eax, eax
add eax, 2
push eax
call fcn.0049768c
pop ecx
mov ebx, eax
mov ecx, 0x1000000
mov edx, ebx
mov eax, esi
call fcn.00410820
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004617d8
mov dword [ebp - 0xc], eax
push ebx
call fcn.004974c8
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x461900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00461673
mov ebx, eax
test ebx, ebx
je 0x461935
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00461735
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x461958
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00461673
mov ebx, eax
test ebx, ebx
je 0x46198d
push dword [ebp + 8]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00461735
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x461a08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.004616e4
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x461a4a
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00461735
test esi, esi
jne 0x461a54
cmp dword [ebp + 8], 0
jne 0x461a64
push dword [ebp + 0xc]
push edi
call fcn.00498e7c
add esp, 8
xor eax, eax
jmp 0x461a66
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461a8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.004107bc
test eax, eax
je 0x461b0a
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004616e4
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.00410844
mov esi, 1
test ebx, ebx
je 0x461af5
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.00461735
test esi, esi
jne 0x461aff
cmp dword [ebp + 8], 0
ja 0x461b03
xor ebx, ebx
jmp 0x461b42
mov ebx, 1
jmp 0x461b42
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0049768c
pop ecx
mov esi, eax
push esi
push 0x4ab550
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00461a08
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00410844
push esi
call fcn.004974c8
pop ecx
test bl, bl
jne 0x461b50
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.00410b08
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461b5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.004616e4
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x461ba5
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00461735
test esi, esi
jne 0x461baf
cmp dword [ebp - 0x10], 0
jne 0x461bb8
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x461bba
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.004616e4
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x461c4d
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.00461735
test edi, edi
jne 0x461c57
cmp dword [ebp - 0xc], 0
jne 0x461c80
cmp dword [ebp + 0xc], 0
je 0x461c6e
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00498c8c
add esp, 0xc
jmp 0x461c7c
push esi
push 0
push dword [ebp + 0x10]
call fcn.00498cfc
add esp, 0xc
xor eax, eax
jmp 0x461c83
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461c9c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push 0x100
lea ecx, [ebp - 0x100]
mov eax, ebx
call fcn.00461751
test al, al
je 0x461ccb
lea edx, [ebp - 0x100]
push edx
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x461ce0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov esi, ecx
mov ebx, eax
push 0x100
lea ecx, [ebp - 0x104]
mov eax, ebx
call fcn.00461751
test al, al
je 0x461d32
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
push edx
push 0x20006
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x461d32
push esi
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [ebp - 4]
call fcn.00461735
pop esi
pop ebx
mov esp, ebp
pop ebp
ret