joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x34353637
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x443df8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xa0f38e4c
mov esi, eax
xor esi, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, esi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 0x84
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x443db0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x4505bc]
test edx, edx
je 0x443e58
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x4505c0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x443e30
inc edi
cmp edx, edi
jne 0x443e20
jmp 0x443e58
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x443e58
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x4505c4]
push edx
call fcn.004403a0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x443e65
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x443e71
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x34353637
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x443ef3
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xa0f38e4c
mov esi, eax
xor esi, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, esi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x84
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x443eb0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x4505bc]
test ecx, ecx
je 0x443f5c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x4505c0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x443f31
inc ebx
cmp ecx, ebx
jne 0x443f20
jmp 0x443f5c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x443f5c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x4505c4]
push ecx
call fcn.004403a0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x444026
mov dword [esp + 8], 0x34353637
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x443fd6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xa0f38e4c
mov ebx, eax
xor ebx, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, ebx
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x84
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x443f90
mov eax, dword [esp + 8]
mov ecx, dword [0x4505bc]
test ecx, ecx
je 0x44401e
xor edx, edx
mov ebx, dword [0x4505c0]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x444000
inc edx
cmp ecx, edx
jne 0x443ff0
jmp 0x44401e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x44401e
push 0
push 0
push esi
push 3
push dword [0x4505c4]
push ecx
call fcn.004403a0
add esp, 0x18
test eax, eax
js 0x444026
mov eax, dword [esp + 0x10]
test edi, edi
je 0x444039
xor ecx, ecx
cmp eax, 0xc0000011
je 0x444037
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x34353637
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x4440c3
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xa0f38e4c
mov esi, eax
xor esi, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, esi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x84
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x444080
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x4505bc]
test ecx, ecx
je 0x44412c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x4505c0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xe6919031
je 0x444101
inc ebx
cmp ecx, ebx
jne 0x4440f0
jmp 0x44412c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x44412c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x4505c4]
push ecx
call fcn.004403a0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x4441f6
mov dword [esp + 8], 0x34353637
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x4441a6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xa0f38e4c
mov ebx, eax
xor ebx, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, ebx
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x84
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x444160
mov eax, dword [esp + 8]
mov ecx, dword [0x4505bc]
test ecx, ecx
je 0x4441ee
xor edx, edx
mov ebx, dword [0x4505c0]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x4441d0
inc edx
cmp ecx, edx
jne 0x4441c0
jmp 0x4441ee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x4441ee
push 0
push 0
push esi
push 3
push dword [0x4505c4]
push ecx
call fcn.004403a0
add esp, 0x18
test eax, eax
js 0x4441f6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x444200
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x444230
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 0xc], bx
add ebx, 2
mov word [esp + 0xe], bx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x34353637
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x4442f3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, eax
xor ebx, 0xa0f38e4c
mov ebp, eax
xor ebp, 0x5f0c71b3
or eax, 0x20f38e4c
and eax, ebp
lea eax, [ebx + eax*2]
xor eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x84
mov edi, dword [esp]
mov byte [esp + edi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x4442b0
mov eax, dword [esp + 4]
mov edi, dword [0x4505bc]
test edi, edi
je 0x444342
xor ebx, ebx
mov ebp, dword [0x4505c0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x81105f7a
je 0x444321
inc ebx
cmp edi, ebx
jne 0x444310
jmp 0x444342
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x444342
lea eax, [esp + 0x18]
push esi
push eax
push edx
push ecx
push 4
push dword [0x4505c4]
push edi
call fcn.004403a0
add esp, 0x1c
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x484f74
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x430724], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x48502e
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x430720], eax
inc ebx
cmp ebx, 0x100
jb 0x484f94
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x48505a
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x430720]
sub edi, 1
jne 0x485039
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x48508c
nop dword [eax]
cmp cl, 0x23
jne 0x485073
cmp byte [esi], cl
jne 0x485073
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x430720]
test cl, cl
jne 0x485064
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0xa04592
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jns 0xa045a6
add ecx, 3
sar ecx, 2
xor eax, eax
cmp ecx, eax
jle 0xa045b7
xor dword [edx + eax*4], ebx
inc eax
cmp ecx, eax
jg 0xa045af
pop ebx
pop ebp
ret 0xc
Function at 0x401510
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401522
mov eax, dword [0x4dd09f]
shl eax, 2
mov dword [0x4dd0a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004cf694
pop edx
call fcn.004cf294
call fcn.004cfbb8
push 0
call fcn.004d0edc
pop ecx
push 0x4dd048
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4dd0a7], eax
push 0
jmp fcn.004d8be8

Function at 0x4033bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x4e63b0
push 0xa
push 0x403450
mov eax, dword [0x4e62ec]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x4033e0
call fcn.004356f0
push ebx
mov eax, dword [0x4e62ec]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4033f7
call fcn.004356f0
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x403409
call fcn.004356f0
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x4e63b4], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x4e63b8], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x4e63bc], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x4e63c0], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x4e63c4], ecx
add edx, dword [eax + 0x14]
mov dword [0x4e63c8], edx
pop esi
pop ebx
ret

Function at 0x41f344
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41f3e2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x41f3a6
cmp byte [ebx + 0x10], 0
jne 0x41f3a6
cmp byte [ebx + 0x3c], 0
jne 0x41f3a6
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x41f3c7
lea edx, [ebp - 4]
mov eax, dword [0x4e5dbc]
call fcn.0044b01c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41001c]
call fcn.00433220
call fcn.00446f54
jmp 0x41f3c7
lea edx, [ebp - 8]
mov eax, dword [0x4e5dbc]
call fcn.0044b01c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41001c]
call fcn.00433220
call fcn.00446f54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f3e9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00447e98
ret

Function at 0x41fc60
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x41fcae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0041f2c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41fcc7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x41fcd0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041f2c8
dec esi
jne 0x41fcf2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x42150c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4e65f0
cmp dword [edi], 0
jne 0x421588
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4e65ec]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ddbe4
mov ecx, 2
call fcn.00445a60
mov edx, 0x4214e4
lea eax, [esi + 5]
call fcn.00421504
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00421504
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42155d
mov dword [0x4e65ec], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x424c50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x424dcb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00447ef4
mov eax, dword [ebp - 4]
call fcn.004244e8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x424ca2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00448698
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004258fc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x424d81
xor eax, eax
push ebp
push 0x424d7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00424850
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00424e00
test al, al
je 0x424d58
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00447fdc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x424d58
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00447f2c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004247b0
test al, al
je 0x424d52
mov eax, dword [ebp - 8]
call fcn.00447f2c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0044804c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00424c50
dec ebx
cmp ebx, 0xffffffff
jne 0x424d01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424d81
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00424850
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
call fcn.00447f2c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0042483c
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004247b0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424dd2
lea eax, [ebp - 0x3c]
call fcn.00447e90
lea eax, [ebp - 8]
mov edx, 2
call fcn.00447e98
ret

Function at 0x4257d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0042455c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00447f2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004247b0
test al, al
jne 0x425840
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e60b0]
mov dl, 1
mov eax, dword [0x42330c]
call fcn.00433424
call fcn.00446f54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42584c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00447f2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004247b0
test al, al
jne 0x4258ad
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e60b4]
mov dl, 1
mov eax, dword [0x42330c]
call fcn.00433424
call fcn.00446f54
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042458c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x425eac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x425fd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00424850
xor eax, eax
push ebp
push 0x425faf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00424e00
test al, al
je 0x425f93
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00425d8c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00447fdc
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x425f93
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00447f2c
push eax
push edi
push esi
call sub.ADVAPI32.DLL_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004247b0
test al, al
je 0x425f8f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00447f2c
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0044804c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00425d8c
pop ecx
inc edi
dec ebx
jne 0x425f37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425fb6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00424850
ret
Function at 0x425fe4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x426232
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00424850
xor eax, eax
push ebp
push 0x426208
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00424e00
test al, al
je 0x4261ec
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00447fdc
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4261ec
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00447f2c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004247b0
test al, al
je 0x4261e0
mov eax, dword [ebp - 4]
call fcn.00447f2c
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0044804c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004258fc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4261e0
xor eax, eax
push ebp
push 0x4261d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00424850
xor eax, eax
push ebp
push 0x4261bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00447f2c
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0044804c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00424854
mov eax, dword [ebp - 4]
call fcn.00447f2c
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0044804c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004258fc
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x426198
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00425eac
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00425fe4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42619f
mov eax, dword [ebp - 0x24]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x42606f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42620f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00424850
ret