joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcbc
push esi
push edi
mov eax, 0x556390
call fcn.00525a60
mov word [ebp - 0x24], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x14
mov esi, 0x5497a2
lea edi, [ebp - 0x13c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x5498a6
lea edi, [ebp - 0x240]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x5499aa
lea edi, [ebp - 0x344]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x24], 0x20
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
inc dword [ebp - 0x18]
mov ecx, dword [0x577298]
mov eax, dword [ecx]
call fcn.004e0430
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.005310d4
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005310a4
mov word [ebp - 0x24], 0x2c
mov edx, 0x550564
lea eax, [ebp - 0xc]
call fcn.00530f44
inc dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00519840
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005310a4
push dword [ebp - 0x38]
cmp dword [ebp - 4], 0
je 0x407e95
mov ecx, dword [ebp - 4]
jmp 0x407e9a
mov ecx, 0x550566
push ecx
lea eax, [ebp - 0x344]
push eax
call fcn.005258c0
add esp, 0xc
mov edx, dword [ebp + 8]
cmp edx, 0x10
ja case.0x407ebc.0
mov dl, byte [edx + 0x407ec3]
jmp dword [edx*4 + 0x407ed4]
push str.0001AEGISI2.exe
lea eax, [ebp - 0x344]
push eax
call fcn.00525614
add esp, 8
jmp case.0x407ebc.0
push str.0002AEGISI2.exe
lea edx, [ebp - 0x344]
push edx
call fcn.00525614
add esp, 8
jmp case.0x407ebc.0
push str.0004AEGISI2.exe
lea ecx, [ebp - 0x344]
push ecx
call fcn.00525614
add esp, 8
jmp case.0x407ebc.0
push str.0008AEGISI2.exe
lea eax, [ebp - 0x344]
push eax
call fcn.00525614
add esp, 8
jmp case.0x407ebc.0
push str.0010AEGISI2.exe
lea edx, [ebp - 0x344]
push edx
call fcn.00525614
add esp, 8
push str._silent__install
lea ecx, [ebp - 0x240]
push ecx
call fcn.00527ea0
add esp, 8
mov word [ebp - 0x24], 0x38
lea edx, [ebp - 0x344]
lea eax, [ebp - 0x10]
call fcn.00530f44
inc dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0051970c
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005310a4
pop ecx
test cl, cl
je 0x407fe3
push 0
push 0
lea eax, [ebp - 0x240]
push eax
lea edx, [ebp - 0x344]
push edx
push 0x5505cd
push 0
call sub.SHELL32.DLL_ShellExecuteA
call fcn.00407cec
mov al, 1
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005310a4
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x408001
xor eax, eax
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005310a4
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408008
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcbc
push esi
push edi
mov eax, 0x556424
call fcn.00525a60
mov word [ebp - 0x24], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x14
mov esi, 0x549aae
lea edi, [ebp - 0x13c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x549bb2
lea edi, [ebp - 0x240]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x549cb6
lea edi, [ebp - 0x344]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x24], 0x20
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
inc dword [ebp - 0x18]
mov ecx, dword [0x577298]
mov eax, dword [ecx]
call fcn.004e0430
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.005310d4
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005310a4
mov word [ebp - 0x24], 0x2c
mov edx, 0x5505d2
lea eax, [ebp - 0xc]
call fcn.00530f44
inc dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00519840
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005310a4
push dword [ebp - 0x38]
cmp dword [ebp - 4], 0
je 0x4080e1
mov ecx, dword [ebp - 4]
jmp 0x4080e6
mov ecx, 0x5505d4
push ecx
lea eax, [ebp - 0x344]
push eax
call fcn.005258c0
add esp, 0xc
mov edx, dword [ebp + 8]
dec edx
je 0x40810b
dec edx
je 0x408121
sub edx, 2
je 0x408137
sub edx, 4
je 0x40814d
jmp 0x408161
push str.0001AEGISI5.exe
lea eax, [ebp - 0x344]
push eax
call fcn.00525614
add esp, 8
jmp 0x408161
push str.0002AEGISI5.exe
lea edx, [ebp - 0x344]
push edx
call fcn.00525614
add esp, 8
jmp 0x408161
push str.0004AEGISI5.exe
lea ecx, [ebp - 0x344]
push ecx
call fcn.00525614
add esp, 8
jmp 0x408161
push str.0008AEGISI5.exe
lea eax, [ebp - 0x344]
push eax
call fcn.00525614
add esp, 8
cmp dword [0x57a800], 0
je 0x408172
mov edx, dword [0x57a800]
jmp 0x408177
mov edx, 0x55063c
push edx
push str._vendor__s__force__silent__install
lea eax, [ebp - 0x240]
push eax
call fcn.00527ea0
add esp, 0xc
mov word [ebp - 0x24], 0x38
lea edx, [ebp - 0x344]
lea eax, [ebp - 0x10]
call fcn.00530f44
inc dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0051970c
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005310a4
pop ecx
test cl, cl
je 0x408223
push 0
push 0
lea eax, [ebp - 0x240]
push eax
lea edx, [ebp - 0x344]
push edx
push 0x55063d
push 0
call sub.SHELL32.DLL_ShellExecuteA
lea ecx, [ebp - 0x240]
push ecx
push str.AEGISParm__s
push 0x15
call fcn.00403208
add esp, 0xc
push 0x1388
call sub.KERNEL32.DLL_Sleep
call fcn.00407cec
mov al, 1
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005310a4
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x408241
xor eax, eax
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005310a4
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408248
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffccc
push esi
push edi
mov dword [ebp - 4], 0x80000002
mov dword [ebp - 8], 0x104
xor eax, eax
mov dword [ebp - 0xc], eax
mov esi, 0x549dba
lea edi, [ebp - 0x230]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
cmp dword [0x57e904], 3
ja 0x40832b
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.EnumNetworkMDC8021X
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push str.RegOpenKeyEx__d
push 0x15
call fcn.00403208
add esp, 0xc
push dword [ebp - 0x14]
push str.RegEnumKeyEx__d
push 0x15
call fcn.00403208
add esp, 0xc
cmp dword [ebp - 0x10], 0
jne 0x4082f2
cmp dword [ebp - 0x14], 0
je 0x40830f
push str.if__lRet___LONG_ERROR_NO_MORE_ITEMS__passed
push 0x15
call fcn.00403208
add esp, 8
push dword [ebp + 8]
call fcn.00407dbc
pop ecx
jmp 0x40840f
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x408405
push str.SYSTEMCurrentControlSetServicesAegisP
lea edx, [ebp - 0x230]
push edx
call fcn.00527ea0
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 1
push 0
lea eax, [ebp - 0x230]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete dl
and edx, 1
push edx
push str.AEGISInstalled__d
push 0x15
call fcn.00403208
add esp, 0xc
cmp dword [ebp - 0x10], 0
jne 0x4083f3
mov dword [ebp - 0x20], str.DeleteFlag
push 0x104
push 0
lea ecx, [ebp - 0x334]
push ecx
call fcn.00525570
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x334]
push edx
lea ecx, [ebp - 0x24]
push ecx
push 0
push dword [ebp - 0x20]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete al
and eax, 1
push eax
push str.DeleteFlag___d
push 0x15
call fcn.00403208
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 0x10], 0
jne 0x4083fe
push dword [ebp + 8]
call fcn.00408008
pop ecx
jmp 0x40840f
push dword [ebp + 8]
call fcn.00408008
pop ecx
jmp 0x40840f
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
setne al
and eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x425844
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [sym.WMP54Gv4.exe__MainFrm]
cmp byte [eax + 0x47], 0
je 0x425891
mov edx, dword [0x577298]
mov ecx, dword [edx]
cmp byte [ecx + 0x4b], 0
jne 0x425891
push 6
mov eax, dword [0x577298]
mov edx, dword [eax]
push dword [edx + 0x24]
call sub.USER32.DLL_ShowWindow
mov eax, dword [sym.WMP54Gv4.exe__MainFrm]
call fcn.004dcebc
push 0
mov edx, dword [0x577298]
mov ecx, dword [edx]
push dword [ecx + 0x24]
call sub.USER32.DLL_ShowWindow
pop ecx
pop ebp
ret
Function at 0x42a7ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
push edx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x45e648
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 0x1c], eax
jmp 0x42a7ea
mov eax, dword [0x577298]
mov eax, dword [eax]
call fcn.004dfdbc
mov edx, dword [sym.WMP54Gv4.exe__MainFrm]
cmp byte [edx + 0xccb], 0
jne 0x42a7de
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4309ec
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x88], 1
jne 0x430a61
cmp dword [ebp - 0x94], 4
jne 0x430a5a
cmp dword [ebp - 0x90], 0xa
jbe 0x430a2f
mov dword [ebp - 4], 3
jmp 0x430a9c
cmp dword [ebp - 0x90], 0
jne 0x430a41
mov dword [ebp - 4], 1
jmp 0x430a9c
cmp dword [ebp - 0x90], 0xa
jne 0x430a53
mov dword [ebp - 4], 2
jmp 0x430a9c
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x430a9c
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x430a9c
cmp dword [ebp - 0x88], 2
jne 0x430a97
cmp dword [ebp - 0x94], 5
jne 0x430a8e
cmp dword [ebp - 0x90], 0
jne 0x430a85
mov dword [ebp - 4], 5
jmp 0x430a9c
mov dword [ebp - 4], 6
jmp 0x430a9c
mov dword [ebp - 4], 4
jmp 0x430a9c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x442a24
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
push dword [ebp + 8]
call fcn.00525720
pop ecx
test eax, eax
jbe 0x442adc
push 0x4000000
push 0
push 0
push 0
push str.WPC51AB
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 8], eax
push dword [ebp - 8]
push str.InternetOpen_______d
push 0x20
call fcn.00403208
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x442ad7
push 0
push 0x80000000
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call sub.WININET.DLL_InternetOpenUrlA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push str.InternetOpenUrl_______d
push 0x20
call fcn.00403208
add esp, 0xc
mov eax, dword [0x577298]
mov eax, dword [eax]
call fcn.004dfdbc
cmp dword [ebp - 0xc], 0
je 0x442ac8
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x442acd
xor edx, edx
mov dword [ebp - 4], edx
push dword [ebp - 8]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x442adc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x443484
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4434c4
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + ecx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov edx, dword [eax*4 + 0x54cc20]
mov ecx, dword [ebp + 8]
shr ecx, 8
xor edx, ecx
mov dword [ebp + 8], edx
inc dword [ebp - 4]
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
jne 0x443493
mov eax, dword [ebp + 8]
pop ecx
pop ebp
ret

Function at 0x443e48
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x100
push 0x100
push 0
lea eax, [ebp - 0x10c]
push eax
call fcn.00525570
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10c]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
test eax, eax
je 0x443eb3
cmp dword [ebp - 0xc], 0
jbe 0x443eb3
cmp byte [0x547d0a], 0
jne 0x443ea1
mov eax, dword [ebp - 4]
call fcn.004258ec
jmp 0x443eb3
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x480]
call fcn.004e29b4
jmp 0x443ec3
mov dl, 1
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x480]
call fcn.004e29b4
mov esp, ebp
pop ebp
ret
Function at 0x458ea0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x547ce4], 3
je 0x458ebc
cmp dword [0x547ce4], 2
jne 0x458f43
mov dword [ebp - 8], 0x104
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x458ef9
push dword [ebp - 0xc]
push str.RegOpenKeyEx_failed__d_n
push 0x1a
call fcn.00403208
add esp, 0xc
xor eax, eax
jmp 0x458f6b
lea edx, [ebp - 8]
push edx
push dword [ebp + 8]
push 0
push 0
push str.Desktop
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x458f23
cmp dword [ebp - 8], 0x104
jbe 0x458f39
push dword [ebp - 0xc]
push str.RegQueryValueEx_failed__d_n
push 0x1a
call fcn.00403208
add esp, 0xc
xor eax, eax
jmp 0x458f6b
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x458f66
push dword [ebp + 8]
push 1
push 0
push 0
push 0
call dword [0x5778cc]
push dword [ebp + 8]
push str.SHGetFolderPath___s_n
push 0x1a
call fcn.00403208
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x45fdd0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc0
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x10], 0xffffffff
xor edx, edx
mov dword [ebp - 0x14], edx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x24], edx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
call fcn.0040326c
mov dword [ebp - 0x30], 0x104
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x340]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
cmp dword [0x547ce4], 3
je 0x45fe3f
cmp dword [0x547ce4], 2
je 0x45fe3f
call sub.ADVAPI32.DLL_RevertToSelf
jmp 0x45fe49
mov eax, 4
jmp 0x45ff47
push 0xff
lea edx, [ebp - 0x23c]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x340]
push ecx
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp - 0xc]
push 0
call dword [0x578918]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x45fe99
cmp dword [ebp - 0x28], 0xea
jne 0x45ff14
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
test edx, edx
je 0x45ff14
xor eax, eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x14]
jae 0x45ff14
cmp dword [ebp - 8], 0
je 0x45ff14
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x23c]
push edx
call fcn.00525a14
add esp, 8
test eax, eax
jne 0x45ff02
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xc]
sub eax, 1
jb 0x45fee0
je 0x45fee9
dec eax
je 0x45fef2
jmp 0x45fefb
mov dword [ebp - 0x34], 1
jmp 0x45ff02
mov dword [ebp - 0x34], 2
jmp 0x45ff02
mov dword [ebp - 0x34], 3
jmp 0x45ff02
mov dword [ebp - 0x34], 4
add dword [ebp - 8], 0x74
inc dword [ebp - 0x24]
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x14]
jb 0x45feb0
cmp dword [ebp - 4], 0
je 0x45ff28
push dword [ebp - 4]
call dword [0x57891c]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x28], 0xea
je 0x45fe67
cmp dword [ebp - 4], 0
je 0x45ff44
push dword [ebp - 4]
call dword [0x57891c]
mov eax, dword [ebp - 0x34]
mov esp, ebp
pop ebp
ret

Function at 0x4616f4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
push 0x57ed98
push 2
push 0
push dword [ebp - 4]
push dword [0x57ed94]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x461745
push dword [ebp - 8]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x461741
mov byte [ebp - 9], 1
jmp 0x461745
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x46174c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xa], 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00461650
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4617b6
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x428]
push eax
lea edx, [ebp - 0x14]
push edx
push 0
push dword [ebp - 8]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4617a0
mov byte [ebp - 9], 1
jmp 0x4617a4
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x4617b0
mov byte [ebp - 0xa], 2
jmp 0x4617ba
mov byte [ebp - 0xa], 1
jmp 0x4617ba
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x4617c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x568ad0
call fcn.00525a60
mov byte [ebp - 0x35], 0
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
call fcn.0046174c
mov byte [ebp - 0x36], al
cmp byte [ebp - 0x36], 2
jne 0x4617f9
mov byte [ebp - 0x35], 0
cmp byte [ebp - 0x36], 0
jne 0x46180b
mov eax, dword [ebp - 0x30]
call fcn.004616a8
mov byte [ebp - 0x36], 1
cmp byte [ebp - 0x36], 1
je 0x46181b
cmp byte [ebp - 0x36], 2
jne 0x4618d3
push 0x57ed98
push 2
push 0
push dword [ebp - 0x30]
push dword [0x57ed94]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x2c], 1
jne 0x461859
push 0
push 0x568a85
push 1
push 0
push dword [ebp - 0x34]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x3c], eax
jmp 0x4618d3
cmp dword [ebp - 0x2c], 3
jne 0x46187a
push 0
push 0
push 3
push 0
push dword [ebp - 0x34]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x3c], eax
jmp 0x4618d3
cmp dword [ebp - 0x2c], 4
jne 0x4618a2
xor edx, edx
mov dword [ebp - 0x40], edx
push 4
lea ecx, [ebp - 0x40]
push ecx
push 4
push 0
push dword [ebp - 0x34]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x3c], eax
jmp 0x4618d3
mov byte [ebp - 0x35], 0
mov word [ebp - 0x18], 8
mov edx, str.It_doesnt_support_this_data_type
lea eax, [ebp - 4]
call fcn.00530f44
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004e5394
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005310a4
cmp dword [ebp - 0x3c], 0
jne 0x4618df
mov byte [ebp - 0x35], 1
jmp 0x4618e3
mov byte [ebp - 0x35], 0
mov al, byte [ebp - 0x35]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x4618f4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
cmp dword [0x57ed94], 0
jne 0x46191a
mov eax, 0x80000002
call fcn.00461630
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004617c4
push 0x57ed98
push 2
push 0
push dword [ebp - 8]
push dword [0x57ed94]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 8]
call fcn.005199f4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 4], 1
jne 0x461974
push dword [ebp - 0x1c]
push dword [ebp + 8]
push 1
push 0
push dword [ebp - 0xc]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x14], eax
jmp 0x4619d6
cmp dword [ebp - 4], 3
jne 0x46199d
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00461c2c
push eax
push 3
push 0
push dword [ebp - 0xc]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x14], eax
jmp 0x4619d6
cmp dword [ebp - 4], 4
jne 0x4619d2
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
call fcn.005298c4
pop ecx
mov dword [ebp - 0x20], eax
push 4
lea ecx, [ebp - 0x20]
push ecx
push 4
push 0
push dword [ebp - 0xc]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x14], eax
jmp 0x4619d6
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0x14], 0
jne 0x4619e2
mov byte [ebp - 0xd], 1
jmp 0x4619e6
mov byte [ebp - 0xd], 0
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x4619fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x461a05
mov eax, dword [ebp - 4]
add esp, 0xfffff5bc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
cmp dword [0x57ed94], 0
jne 0x461a38
mov eax, 0x80000002
call fcn.00461630
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00461650
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x461c14
push 0x104
push 0
lea edx, [ebp - 0x2a48]
push edx
call fcn.00525570
add esp, 0xc
mov dword [ebp - 0x20], 0x104
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x2a48]
push eax
lea edx, [ebp - 0x1c]
push edx
push 0
push dword [ebp - 8]
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
push 0x208
push 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.00525570
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x461c0e
cmp dword [ebp - 0x1c], 1
jne 0x461ad4
lea eax, [ebp - 0x2a48]
push eax
push 0x568aa8
lea edx, [ebp - 0x234]
push edx
call fcn.00527ea0
add esp, 0xc
jmp 0x461bf6
cmp dword [ebp - 0x1c], 2
jne 0x461afa
lea ecx, [ebp - 0x2a48]
push ecx
push 0x568aab
lea eax, [ebp - 0x234]
push eax
call fcn.00527ea0
add esp, 0xc
jmp 0x461bf6
cmp dword [ebp - 0x1c], 4
jne 0x461b57
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 3
push dword [ebp - 0x28]
push 0x100
call fcn.0043fc7c
add esp, 8
mov ecx, dword [ebp - 0x28]
movsx edx, byte [ebp + ecx - 0x2a48]
and edx, 0xff
imul edx
add dword [ebp - 0x24], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jge 0x461b0c
push dword [ebp - 0x24]
push 0x568aae
lea eax, [ebp - 0x234]
push eax
call fcn.00527ea0
add esp, 0xc
jmp 0x461bf6
cmp dword [ebp - 0x1c], 3
jne 0x461bdb
push 0x208
push 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.00525570
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x20], 0x208
ja 0x461bf6
xor edx, edx
mov dword [ebp - 0x28], edx
jmp 0x461bc6
mov ecx, dword [ebp - 0x28]
movsx eax, byte [ebp + ecx - 0x2a48]
push eax
push str._02X
lea edx, [ebp - 0x17]
push edx
call fcn.00527ea0
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
mov al, byte [ebp - 0x17]
mov byte [ebp + ecx - 0x234], al
mov edx, dword [ebp - 0x2c]
mov cl, byte [ebp - 0x16]
mov byte [ebp + edx - 0x233], cl
add dword [ebp - 0x2c], 2
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
jl 0x461b88
mov edx, dword [ebp - 0x2c]
mov byte [ebp + edx - 0x234], 0
jmp 0x461bf6
lea ecx, [ebp - 0x2a48]
push ecx
push 0x568ab6
lea eax, [ebp - 0x234]
push eax
call fcn.00527ea0
add esp, 0xc
lea edx, [ebp - 0x234]
push edx
push dword [ebp - 0xc]
call fcn.005256f0
add esp, 8
mov byte [ebp - 0xe], 1
jmp 0x461c18
mov byte [ebp - 0xe], 0
jmp 0x461c18
mov byte [ebp - 0xe], 0
push dword [0x57ed98]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, byte [ebp - 0xe]
mov esp, ebp
pop ebp
ret