joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494b50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x494b69
mov esi, ebx
mov ebx, eax
jmp 0x494b6b
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x494b7b
mov eax, edi
jmp 0x494b85
push eax
push edi
call fcn.0042a5b0
add esp, 8
test eax, eax
jne 0x494b8d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x494ba9
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x494b94
cmp eax, dword [esi + 4]
jge 0x494bc0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x494bb0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
test eax, eax
jle 0x494be1
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x494bde
dec eax
test eax, eax
jg 0x494bd0
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x494bee
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4f40d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4f4124
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f40e0
sub ecx, edx
sar ecx, 1
je 0x4f4124
push esi
lea edx, [ecx - 1]
xor esi, esi
test edx, edx
je 0x4f411e
nop dword [eax + eax]
mov ax, word [edi + edx*2]
xor word [edi + esi*2], ax
movzx eax, word [edi + esi*2]
xor word [edi + edx*2], ax
movzx ecx, word [edi + edx*2]
dec edx
xor word [edi + esi*2], cx
inc esi
cmp esi, edx
jb 0x4f4100
pop esi
mov eax, edi
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4f4350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x4f4363
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x4f438e
or esi, 0xffffffff
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0x41545351
push eax
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4f43af
or esi, 0xffffffff
pop ebx
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [ebp + 0x10]
push ebx
push edi
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4f43e3
push ebx
or esi, 0xffffffff
call fcn.004f3570
add esp, 4
mov eax, esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
or ecx, 0xffffffff
test eax, eax
cmove esi, ecx
push ebx
call fcn.004f3570
add esp, 4
mov eax, esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5025e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x50260b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x5025f4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x505390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x5053c1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x5053b0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x5064d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x506539
test edi, edi
je 0x506539
push 0
push 0x10000
push dword [ebp + 0x10]
push edi
push 0x80000
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x506533
call sub.api_ms_win_crt_runtime_l1_1_0.dll___doserrno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
push esi
push dword [eax]
push dword [ebp + 0x10]
push edi
push str.Unable_to_create_thread:_entry__p__param__p__errno:__d___doserrno:__d_n
call fcn.004f39e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
push dword [eax]
call fcn.004f1ab0
add esp, 0x18
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
push edi
push esi
push str.Invalid_parameters_p_thread:__p__entry:__p_n
call fcn.004f39e0
add esp, 0xc
mov eax, 0x16
pop edi
pop esi
pop ebp
ret

Function at 0x5069a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x5069b1
mov eax, 0x3ea
pop ebp
ret
mov dword [ebp + 8], eax
pop ebp
jmp fcn.005074f0

Function at 0x506de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
test edx, edx
jne 0x506dfe
mov eax, 0x3ea
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x506e0e
mov eax, 0x3eb
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x506e1a
lea eax, [ebp - 8]
jmp 0x506e27
mov dword [eax], 0
mov dword [eax + 4], 0
push 0
push eax
push dword [ebp + 0x10]
push ecx
push dword [edx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x506e4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x506e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
test edx, edx
jne 0x506e7e
mov eax, 0x3ea
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x506e8e
mov eax, 0x3eb
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x506e9a
lea eax, [ebp - 8]
jmp 0x506ea7
mov dword [eax], 0
mov dword [eax + 4], 0
push 0
push eax
push dword [ebp + 0x10]
push ecx
push dword [edx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x506ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5070a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
test eax, eax
jne 0x5070b6
mov eax, 0x3ea
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x5070c8
mov eax, 0x3eb
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5070ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x507100
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x507118
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x507143
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
jne 0x507165
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x507163
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x507350
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x507363
mov eax, 0x3ea
pop esi
pop ebp
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x507391
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x507391
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004f1a60
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5073a0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x5073b1
mov eax, 0x3ea
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5073cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004f1a60
xor eax, eax
pop ebp
ret
Function at 0x5074f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x507501
mov eax, 0x3ea
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x507524
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x507524
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004f1a60
xor eax, eax
pop ebp
ret

Function at 0x507580
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x507591
mov eax, 0x3ea
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x50759f
mov eax, 0x3eb
pop ebp
ret
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x5075be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5075d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
add esp, 0x10
test eax, eax
jne 0x507667
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x507621
cmp esi, 0xea
jne 0x507632
jmp 0x507623
xor eax, eax
push eax
call fcn.004f1a60
mov esi, eax
add esp, 4
test esi, esi
je 0x50763a
cmp esi, 0x3f1
jne 0x507651
xor esi, esi
cmp dword [ebp - 8], 7
jne 0x507651
mov eax, dword [edi]
lea ecx, [eax*4]
shr ecx, 1
add ecx, eax
mov dword [edi], ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x507930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
add esp, 0x10
test eax, eax
jne 0x5079a8
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp - 4]
push edi
test eax, eax
je 0x50798f
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x50797f
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push eax
call fcn.004f1a60
mov esi, dword [ebp - 4]
add esp, 4
mov edi, eax
jmp 0x507994
mov edi, 0x16
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x507aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
add esp, 0x10
test eax, eax
jne 0x507b09
push esi
push dword [ebp + 0x1c]
mov esi, dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x507ae9
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x507b10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
test edi, edi
jne 0x507b3a
push edi
push edi
push 7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00507aa0
add esp, 0x18
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test edi, edi
je 0x507b59
mov eax, dword [ebp + 0x14]
push dword [eax + esi*4]
call fcn.004f36e0
add ebx, 2
inc esi
add esp, 4
add ebx, eax
cmp esi, edi
jb 0x507b41
add ebx, 2
push 0x506c5151
push ebx
mov dword [ebp + 0x18], ebx
call fcn.004f3590
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x507b80
pop esi
pop edi
mov eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp + 0x18]
add esp, 0xc
shr ecx, 1
xor esi, esi
xor ebx, ebx
mov dword [ebp + 0x18], ecx
test edi, edi
je 0x507bd2
nop dword [eax]
mov eax, dword [ebp + 0x14]
push dword [eax + esi*4]
mov eax, ecx
sub eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*2]
push eax
call fcn.004f3880
mov eax, dword [ebp + 0x14]
push dword [eax + esi*4]
call fcn.004f36b0
mov ecx, dword [ebp + 0x18]
inc ebx
inc esi
add esp, 0x10
add ebx, eax
cmp esi, edi
jb 0x507ba0
mov esi, dword [ebp - 4]
xor eax, eax
mov dword [ebp - 4], eax
mov word [esi + ebx*2], ax
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x507c3c
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp - 4]
lea eax, [ebx + ebx]
push eax
push esi
push 7
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x507c1f
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push eax
call fcn.004f1a60
add esp, 4
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
push esi
call fcn.004f3570
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x507c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
add esp, 0x10
test eax, eax
jne 0x507d06
push eax
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x507cd1
cmp esi, 0xea
jne 0x507cbd
jmp 0x507cd3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
jmp 0x507cf4
xor eax, eax
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
test esi, esi
je 0x507cfc
cmp esi, 0x3f1
jne 0x507d06
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x507d60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005084b0
add esp, 0x10
test eax, eax
jne 0x507db3
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5087e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push ebx
push edi
mov dword [ebp - 4], 0
call fcn.005084b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x508894
cmp esi, 2
jne 0x508857
test byte [0x9538a8], 8
je 0x50895e
push ebx
push edi
push eax
push str.qreg_open_rooted_key_error___x_for_key__s_and_sub_key__s_n
push 0x2a3
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread_64
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x9538a8], 4
je 0x50895e
push ebx
push edi
push esi
push str.qreg_open_rooted_key_error___x_for_key__s_and_sub_key__s_n
push 0x2a6
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread_64
push dword [0x7ad128]
push 4
call fcn.004f21c0
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x5088bc
cmp esi, 0xea
jne 0x5088cd
jmp 0x5088be
xor eax, eax
push eax
call fcn.004f1a60
mov esi, eax
add esp, 4
test esi, esi
je 0x50890d
test byte [0x9538a8], 8
je 0x50894c
push esi
call fcn.004f1b00
push eax
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push str.qreg_query_value_error:_key_name__s:_sub_key_name__s:_value_name__s:_type__d:_status__d__0x_x_:__s_n
push 0x2b4
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread_64
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x38
jmp 0x50894c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x50894c
test byte [0x9538a8], 8
je 0x508947
push edi
push ecx
push eax
push str.Type_mismatch:_type___d_and_actual_type___d_for_key:__s
push 0x2bd
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread_64
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x24
mov esi, 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x508970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
mov dword [ebp - 4], 0
call fcn.005084b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x508a24
cmp esi, 2
jne 0x5089e7
test byte [0x9538a8], 8
je 0x508aee
push ebx
push edi
push eax
push str.qreg_open_rooted_key_error___x_for_key__s_and_sub_key__s_n
push 0x2dd
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x9538a8], 4
je 0x508aee
push ebx
push edi
push esi
push str.qreg_open_rooted_key_error___x_for_key__s_and_sub_key__s_n
push 0x2e0
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread
push dword [0x7ad128]
push 4
call fcn.004f21c0
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x508a4c
cmp esi, 0xea
jne 0x508a5d
jmp 0x508a4e
xor eax, eax
push eax
call fcn.004f1a60
mov esi, eax
add esp, 4
test esi, esi
je 0x508a9d
test byte [0x9538a8], 8
je 0x508adc
push esi
call fcn.004f1b00
push eax
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push str.qreg_query_value_error:_key_name__s:_sub_key_name__s:_value_name__s:_type__d:_status__d__0x_x_:__s_n
push 0x2ee
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x38
jmp 0x508adc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x508adc
test byte [0x9538a8], 8
je 0x508ad7
push edi
push ecx
push eax
push str.Type_mismatch:_type___d_and_actual_type___d_for_key:__s
push 0x2f7
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_qlib_qreg.c
push str.qreg_vread
push dword [0x7ad128]
push 8
call fcn.004f21c0
add esp, 0x24
mov esi, 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x508b00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
je 0x508b6d
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
je 0x508b83
cmp eax, 2
jne 0x508cc2
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
push 0x516c5151
push esi
call fcn.004f36e0
add esp, 4
add eax, 0x208
push eax
call fcn.004f3590
mov edi, eax
add esp, 8
test edi, edi
je 0x508cc2
push esi
push esi
call fcn.004f36e0
add esp, 4
add eax, 0x208
push eax
push edi
call fcn.004f3880
push esi
call fcn.004f36b0
add esp, 0x10
cmp word [edi + eax*2 - 2], 0x5c
lea esi, [edi + eax*2]
je 0x508be3
mov eax, 0x5c
mov word [esi], ax
add esi, 2
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x214], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
jne 0x508c83
lea eax, [ebp - 0x20c]
push eax
push 0x208
push esi
call fcn.004f3880
push edi
push ebx
call fcn.00508b00
add esp, 0x14
test eax, eax
je 0x508c83
lea eax, [ebp - 0x220]
mov dword [ebp - 0x214], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
je 0x508c23
xor eax, eax
mov word [esi - 2], ax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.004f1a60
push edi
call fcn.004f3570
add esp, 8
push dword [ebp - 0x218]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push eax
call fcn.004f1a60
add esp, 4
test eax, eax
je 0x508b6d
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret