joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bb90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc14
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xc10], eax
movups xmm0, xmmword [0x4b121c]
mov eax, dword [0x4b123c]
push ebx
push esi
movups xmmword [esp + 0x18], xmm0
push 0x1da
movups xmm0, xmmword [0x4b122c]
mov dword [esp + 0x3c], eax
mov ebx, edx
lea eax, [esp + 0x40]
mov dword [esp + 0x14], 0
push 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
movups xmmword [esp + 0x34], xmm0
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push esi
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
lea eax, [esp + 0x224]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bd26
push 0x7fe
push eax
mov word [esp + 0x420], ax
lea eax, [esp + 0x422]
push eax
call fcn.0048e770
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
add esp, 0xc
mov dword [esp + 8], 0x400
push eax
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4ad29c
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x43bd26
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xc]
push eax
push 0x20119
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bd26
lea eax, [esp + 8]
mov dword [esp + 8], 0x400
push eax
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4ad29c
push dword [esp + 0x20]
call esi
test eax, eax
jne 0x43bcf8
lea eax, [esp + 0x418]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x10]
call esi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.0048d815
add esp, 0xc14
ret
mov ecx, dword [esp + 0xc18]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0xc14
ret
Function at 0x43c950
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1478
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1470], eax
push esi
push 0x800
lea eax, [esp + 0xc74]
push 0
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 8]
push 0x58
push 0
push eax
call fcn.0048e770
mov eax, dword [InitializeSListHead]
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [0x4def88]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc70]
mov dword [esp + 0x24], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x58
mov dword [esp + 0x40], 0x81824
mov dword [esp + 0x18], 0x4b137c
mov dword [esp + 0x3c], 0x4b13a8
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x50], 0
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
test eax, eax
je 0x43cacc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x270], ax
lea eax, [esp + 0x272]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0xc70]
push 0x2e
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x43cae4
push 0x206
push eax
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0xc70]
lea esi, [esp + 0x60]
push 0x5c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x43ca96
movzx ecx, word [eax]
test cx, cx
je 0x43ca8f
mov edx, esi
sub eax, edx
nop dword [eax + eax]
mov word [esi], cx
add esi, 2
movzx ecx, word [eax + esi]
test cx, cx
jne 0x43ca80
xor eax, eax
mov word [esi], ax
jmp 0x43caa9
lea eax, [esp + 0xc70]
push eax
lea eax, [esp + 0x66]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x62]
mov edx, 0x4b13c4
push 0x30
push eax
mov ecx, 0x4ae480
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1470]
xor ecx, esp
call fcn.0048d815
add esp, 0x1478
ret
movups xmm0, xmmword [0x4b121c]
mov eax, dword [0x4b123c]
push 0x7dc
movups xmmword [esp + 0x474], xmm0
mov dword [esp + 0x494], eax
lea eax, [esp + 0x498]
movups xmm0, xmmword [0x4b122c]
push 0
push eax
movups xmmword [esp + 0x48c], xmm0
call fcn.0048e770
lea eax, [esp + 0x274]
add esp, 0xc
sub esi, eax
sar esi, 1
lea eax, [eax + esi*2]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push eax
lea eax, [esp + 0x474]
push eax
call esi
push 0x4b1240
lea eax, [esp + 0x474]
push eax
call esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x20106
push 0
push 0
push 0
lea eax, [esp + 0x48c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0xc70]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0xc74]
push eax
push 1
push 0
push 0x4b1268
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043b6e0
mov ecx, dword [esp + 0x1474]
mov eax, 1
pop esi
xor ecx, esp
call fcn.0048d815
add esp, 0x1478
ret
Function at 0x43cbd0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20106
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43cc47
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4b1254
push dword [esp + 8]
call esi
push 0x4b128c
push dword [esp + 8]
call esi
push 0x4b1268
push dword [esp + 8]
call esi
push 0x4b12a0
push dword [esp + 8]
call esi
push 0x4b127c
push dword [esp + 8]
call esi
push 0x4b12b4
push dword [esp + 8]
call esi
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x43d980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push esi
mov esi, dword [esp + 0x81c]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x824]
push eax
push 0x20119
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43da3a
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x400
push eax
lea eax, [esp + 0x18]
push eax
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43da12
cmp word [esp + 0x18], 1
jne 0x43da30
push eax
push 1
push 0xf1
push edi
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x43da30
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x818]
pop edi
pop esi
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret
Function at 0x43e540
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
push 0x28bf
push 0x4b2264
mov edx, 0x4b22a8
mov ecx, 0x80000002
call fcn.0043d980
push 0x28c0
push 0x4b2314
mov edx, 0x4b2330
mov ecx, 0x80000002
call fcn.0043d980
push 0x28c1
push 0x4b2398
mov edx, 0x4b23b8
mov ecx, 0x80000002
call fcn.0043d980
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b2460
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.user32.dll_SendMessageW]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43e633
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b24d4
push dword [esp + 0x24]
call ebp
test eax, eax
jne 0x43e62d
cmp word [esp + 0x20], ax
jne 0x43e62d
push eax
push 1
push 0xf1
push 0x28c2
push dword [0x4def88]
call ebx
push eax
call edi
push dword [esp + 0x10]
call esi
push 0x28c3
push 0x4b24fc
mov edx, 0x4b15f0
mov ecx, 0x80000001
call fcn.0043d980
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b2518
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e6bd
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x400
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b25a0
push dword [esp + 0x24]
call ebp
test eax, eax
jne 0x43e6b7
push eax
push 1
push 0xf1
push 0x28c4
push dword [0x4def88]
call ebx
push eax
call edi
push dword [esp + 0x10]
call esi
push 0x28c5
push 0x4b25c4
mov edx, 0x4b2518
mov ecx, 0x80000002
call fcn.0043d980
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b2518
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e751
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x400
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b25f4
push dword [esp + 0x24]
call ebp
test eax, eax
jne 0x43e74b
cmp dword [esp + 0x1c], 0x200
jne 0x43e74b
push eax
push 1
push 0xf1
push 0x28c6
push dword [0x4def88]
call ebx
push eax
call edi
push dword [esp + 0x10]
call esi
push 0x28c7
push 0x4b2620
mov edx, 0x4b2648
mov ecx, 0x80000002
call fcn.0043d980
mov ecx, dword [esp + 0x828]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret
Function at 0x4430a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b15f0
push 0x80000001
call esi
mov edi, dword [sym.imp.user32.dll_SendMessageW]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44311f
push 0
push 0
push 0xf0
push 0x28f8
push dword [0x4def88]
call ebx
push eax
call edi
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b2880
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b15f0
push 0x80000001
call esi
test eax, eax
jne 0x44317e
push eax
push eax
push 0xf0
push 0x28f9
push dword [0x4def88]
call ebx
push eax
call edi
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b289c
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b15f0
push 0x80000001
call esi
test eax, eax
jne 0x4431dd
push eax
push eax
push 0xf0
push 0x28fa
push dword [0x4def88]
call ebx
push eax
call edi
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b28bc
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b15f0
push 0x80000001
call esi
test eax, eax
jne 0x44323c
push eax
push eax
push 0xf0
push 0x28fb
push dword [0x4def88]
call ebx
push eax
call edi
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b28d8
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b2918
push 0x80000002
call esi
test eax, eax
jne 0x44329b
push eax
push eax
push 0xf0
push 0x28fc
push dword [0x4def88]
call ebx
push eax
call edi
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b28f0
push dword [esp + 0x28]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x28fd
push 0x4b2978
mov edx, 0x4b29a0
mov ecx, 0x80000002
call fcn.0043d980
push 0x28fe
push 0x4b29f0
mov edx, 0x4b2a08
mov ecx, 0x80000002
call fcn.0043d980
push 0x28ff
push 0x4b2a58
mov edx, 0x4b2a80
mov ecx, 0x80000001
call fcn.0043d980
push 0x2900
push 0x4b2ad8
mov edx, 0x4b2af0
mov ecx, 0x80000002
call fcn.0043d980
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x443690
Capabilities:
Delete file

Disassembly:
mov eax, 0x1450
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x144c], eax
push ebx
push ebp
push edi
push 0x7fc
lea eax, [esp + 0x258]
mov dword [esp + 0x254], 0
push 0
push eax
call fcn.0048e770
push 0x7fc
lea eax, [esp + 0xc6c]
mov dword [esp + 0xc68], 0
push 0
push eax
call fcn.0048e770
add esp, 0x18
push 0x28c8
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov edi, eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x14], 5
lea eax, [esp + 0x250]
mov dword [esp + 0x24], 0x400
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
push 0x1073
push edi
call ebx
lea eax, [esp + 0xc58]
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
push 0x1073
push edi
mov dword [esp + 0x34], 0x400
call ebx
cmp word [esp + 0x250], 0
jne 0x4437cc
mov edx, 0x4ad0a4
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0xa54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0xa50]
mov edx, 0x4b10d4
push 0x30
push eax
mov ecx, 0x4ae480
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x144c]
xor ecx, esp
call fcn.0048d815
add esp, 0x1450
ret
mov edx, 0x4ad7fc
mov ecx, 0x4b0870
call fcn.004773a0
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0xc58]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4ae628
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x24
mov edx, 0x4adcec
mov ecx, 0x4b0870
call fcn.004773a0
push eax
lea eax, [esp + 0x50]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne 0x4438b8
lea eax, [esp + 0x250]
mov dword [esp + 0x26], 0
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x22], xmm0
call dword [sym.imp.kernel32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x24e], 0x5c
jne 0x44386c
mov word [esp + eax*2 + 0x24e], cx
jmp 0x443874
mov word [esp + eax*2 + 0x252], cx
mov eax, dword [0x4def88]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x250]
mov dword [esp + 0x14], eax
mov eax, 0x44
mov word [esp + 0x1c], ax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push ebp
push 0x1008
push edi
call ebx
mov ecx, dword [esp + 0x1458]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1450
ret
Function at 0x4438d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa48
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xa44], eax
push 0x7fc
lea eax, [esp + 0x24c]
mov dword [esp + 0x248], 0
push 0
push eax
call fcn.0048e770
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x28c8
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [esp + 0x244]
mov dword [esp + 8], 5
mov dword [esp + 0x14], ecx
lea ecx, [esp]
push ecx
push eax
push 0x1073
push 0x28c8
push dword [0x4def88]
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
cmp word [esp + 0x244], 0
jne 0x4439c2
mov edx, 0x4ad0a4
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x3c]
mov edx, 0x4ad0e0
push 0x30
push eax
mov ecx, 0x4ae480
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
mov ecx, dword [esp + 0xa44]
xor ecx, esp
call fcn.0048d815
add esp, 0xa48
ret
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 8], eax
lea eax, [esp + 0x244]
mov dword [esp + 0x14], eax
lea eax, [esp]
push eax
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x4c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x4ade70
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0xa44]
xor ecx, esp
call fcn.0048d815
add esp, 0xa48
ret

Function at 0x443a50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x840
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x83c], eax
push 0x7fc
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0
push 0
push eax
call fcn.0048e770
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x288c
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [esp + 0x3c]
mov dword [esp + 8], 2
mov dword [esp + 0x14], ecx
lea ecx, [esp]
push ecx
push eax
push 0x1073
push 0x288c
push dword [0x4def88]
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 0x1f4
call dword [sym.imp.kernel32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x48]
push eax
push 0x4af6a8
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x83c]
xor ecx, esp
call fcn.0048d815
add esp, 0x840
ret
Function at 0x443b20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b32c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
test eax, eax
jne 0x443bfe
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x400
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x4b331c
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x443bb9
cmp word [esp + 0x18], 1
push eax
push 1
push 0xf1
jne 0x443be4
push 0x2a05
jmp 0x443be9
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b331c
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 1
push 0xf1
push 0x2a04
push dword [0x4def88]
call edi
push eax
call esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push 0x4b3348
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x443ca4
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x4b33a4
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x443c78
cmp word [esp + 0x18], 1
jne 0x443c9a
push eax
push 1
push 0xf1
push 0x2a06
push dword [0x4def88]
call edi
push eax
call esi
jmp 0x443c9a
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 4
push 0
push 0x4b33a4
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x818]
pop edi
pop esi
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret
Function at 0x443cc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x80c], eax
lea eax, [esp]
push eax
push 0x20119
push 0
push 0x4b33e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x443ea5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 8]
push esi
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x400
push eax
push 0
push 0x4b3490
push dword [esp + 0x20]
call ebx
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
test eax, eax
jne 0x443d5d
cmp word [esp + 0x18], 0
jne 0x443d5d
push 0
push 1
push 0xf1
push 0x2a10
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b34e0
push dword [esp + 0x20]
call ebx
test eax, eax
jne 0x443d9c
cmp word [esp + 0x18], ax
jne 0x443d9c
push eax
push 1
push 0xf1
push 0x2a11
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b3530
push dword [esp + 0x20]
call ebx
test eax, eax
jne 0x443ddb
cmp word [esp + 0x18], ax
jne 0x443ddb
push eax
push 1
push 0xf1
push 0x2a12
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b3580
push dword [esp + 0x20]
call ebx
test eax, eax
jne 0x443e1a
cmp word [esp + 0x18], ax
jne 0x443e1a
push eax
push 1
push 0xf1
push 0x2a13
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b35d0
push dword [esp + 0x20]
call ebx
test eax, eax
jne 0x443e59
cmp word [esp + 0x18], ax
jne 0x443e59
push eax
push 1
push 0xf1
push 0x2a14
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b3620
push dword [esp + 0x20]
call ebx
test eax, eax
jne 0x443e98
cmp word [esp + 0x18], ax
jne 0x443e98
push eax
push 1
push 0xf1
push 0x2a15
push dword [0x4def88]
call edi
push eax
call esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0048d815
add esp, 0x810
ret
Function at 0x443ec0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b33e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x444053
push ebx
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push esi
push edi
push eax
push eax
push 0xf0
push 0x2a10
push dword [0x4def88]
call ebx
mov edi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b3490
push dword [esp + 0x24]
call esi
push 0
push 0
push 0xf0
push 0x2a11
push dword [0x4def88]
call ebx
push eax
call edi
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b34e0
push dword [esp + 0x24]
call esi
push 0
push 0
push 0xf0
push 0x2a12
push dword [0x4def88]
call ebx
push eax
call edi
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b3530
push dword [esp + 0x24]
call esi
push 0
push 0
push 0xf0
push 0x2a13
push dword [0x4def88]
call ebx
push eax
call edi
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b3580
push dword [esp + 0x24]
call esi
push 0
push 0
push 0xf0
push 0x2a14
push dword [0x4def88]
call ebx
push eax
call edi
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b35d0
push dword [esp + 0x24]
call esi
push 0
push 0
push 0xf0
push 0x2a15
push dword [0x4def88]
call ebx
push eax
call edi
xor eax, 1
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4b3620
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 8
ret