joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe5c00
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0xe5e4e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xe5d18
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push dword [ebp - 4]
push 0xe5e68
push 0xe5e74
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xe5cf6
cmp byte [ebp - 5], 0
je 0xe5cda
mov ebx, 4
mov esi, 4
mov dword [ebp - 0x18], 1
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0xe5eb0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0xe5ed0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0xe5cf6
push 0xe5eb0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0xe5ed0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5d1f
cmp dword [ebp - 0x14], 0
je 0xe5d12
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0xe5f28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe600a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe5fed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5fcb
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe6018
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5fcb
cmp dword [ebp - 0xc], 4
jne 0xe5fcb
cmp dword [ebp - 0x14], 1
jne 0xe5fcb
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5ff4
cmp dword [ebp - 8], 0
je 0xe5fe7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0xe6044
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe60ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0xe60fc
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe60ca
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe6138
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe60ca
cmp dword [ebp - 0xc], 4
jne 0xe60ca
cmp dword [ebp - 0x14], 0
jne 0xe60ca
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe60f3
cmp dword [ebp - 8], 0
je 0xe60e6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0xe6150
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe6207
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe62c0
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xe61e5
cmp byte [ebp - 1], 0
je 0xe61d0
mov ebx, 4
mov esi, 4
xor eax, eax
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0xe62fc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0xe61e5
push 0xe62fc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe620e
cmp dword [ebp - 0x10], 0
je 0xe6201
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe6370
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0xe6555
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
xor ecx, ecx
push ebp
push 0xe6464
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x20]
mov eax, 0xe6564
call fcn.00031d88
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.00013f18
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xe6442
cmp byte [ebp - 5], 0
je 0xe6434
mov edx, 4
mov eax, 4
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push edx
lea edx, [ebp - 0x14]
push edx
push eax
push 0
push 0xe6598
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0xe6442
push 0xe6598
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe646b
cmp dword [ebp - 0x18], 0
je 0xe645e
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret

Function at 0xe671c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe67c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0xe67d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe67a0
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe6804
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe67a0
cmp dword [ebp - 0x14], 4
jne 0xe67a0
cmp dword [ebp - 0x10], 4
jne 0xe67a0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe67c9
cmp dword [ebp - 8], 0
je 0xe67bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0xe680c
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
xor ecx, ecx
push ebp
push 0xe68ac
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xe68bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe688a
test bl, bl
je 0xe6860
mov dword [ebp - 0xc], 4
jmp 0xe6867
mov dword [ebp - 0xc], 2
mov eax, 4
mov edx, 4
push eax
lea eax, [ebp - 0xc]
push eax
push edx
push 0
push 0xe68f0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe68b3
cmp dword [ebp - 8], 0
je 0xe68a6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0xe68f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe69da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xe69bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe699b
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe69e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe699b
cmp dword [ebp - 0x10], 4
jne 0xe699b
cmp dword [ebp - 8], 1
jne 0xe699b
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe69c4
cmp dword [ebp - 0xc], 0
je 0xe69b7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0xe6a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe6af2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe6ad5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe6ab3
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe6b00
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe6ab3
cmp dword [ebp - 0x14], 4
jne 0xe6ab3
cmp dword [ebp - 8], 1
jne 0xe6ab3
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe6adc
cmp dword [ebp - 0x10], 0
je 0xe6acf
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret

Function at 0xe6b28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe6c0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe6bed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe6bcb
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe6c18
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe6bcb
cmp dword [ebp - 8], 4
jne 0xe6bcb
cmp dword [ebp - 0x14], 1
jne 0xe6bcb
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe6bf4
cmp dword [ebp - 0x10], 0
je 0xe6be7
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe6c34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe6d34
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe6d17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe6cf5
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe6d44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe6cf5
cmp dword [ebp - 0x10], 4
jne 0xe6cf5
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, 0
jne 0xe6ce2
cmp eax, 1
jne 0xe6ce2
mov byte [ebp - 1], 1
jmp 0xe6cf5
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, 0
jne 0xe6cf5
cmp eax, 2
jne 0xe6cf5
mov byte [ebp - 1], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe6d1e
cmp dword [ebp - 8], 0
je 0xe6d11
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0xe6d64
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xe6e3d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0xe6e20
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe6dfe
xor eax, eax
mov al, bl
mov dword [ebp - 8], eax
mov eax, 4
mov edx, 4
push eax
lea eax, [ebp - 8]
push eax
push edx
push 0
push 0xe6e4c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe6e27
cmp dword [ebp - 0x10], 0
je 0xe6e1a
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe8d14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xe8db8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0xe8dc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe8d96
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe8e04
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe8d96
cmp dword [ebp - 0x10], 4
jne 0xe8d96
cmp dword [ebp - 8], 1
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe8dbf
cmp dword [ebp - 0x14], 0
je 0xe8db2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0xe8e14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe8eee
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xe8ed1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe8eaf
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe8efc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe8eaf
cmp dword [ebp - 0x14], 4
jne 0xe8eaf
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe8ed8
cmp dword [ebp - 0xc], 0
je 0xe8ecb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0xe8f0c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xe8fdc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.000e8e14
mov dword [ebx], eax
inc dword [ebx]
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xe8fbf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe8f9d
push 4
push ebx
push 4
push 0
push 0xe8fec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe8fc6
cmp dword [ebp - 0xc], 0
je 0xe8fb9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0xe8ffc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe9125
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xe9138
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe9103
mov dword [ebp - 0x10], 8
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00012b94
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe9164
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe90b1
cmp dword [ebp - 0x14], 3
jne 0xe90b1
cmp dword [ebp - 0x10], 8
jne 0xe90b1
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov byte [ebp - 1], 1
mov dword [ebp - 0x10], 8
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00012b94
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe9170
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe9103
cmp dword [ebp - 0x14], 3
jne 0xe9103
cmp dword [ebp - 0x10], 8
jne 0xe9103
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe912c
cmp dword [ebp - 0x18], 0
je 0xe911f
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret
Function at 0xe92a8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0xe92b1
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe95ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00013c3c
push ebp
lea edx, [ebp - 0x1c]
mov eax, 0xe95f8
call fcn.00031d88
mov eax, dword [ebp - 0x1c]
call fcn.000e9180
pop ecx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe9480
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0xe9620
push 0xe962c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x20]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0xe9430
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0xe9660
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jne 0xe9396
push ebp
lea edx, [ebp - 0x24]
mov eax, 0xe9674
call fcn.00031d88
mov eax, dword [ebp - 0x24]
call fcn.000e9180
pop ecx
jmp 0xe93c4
push ebp
lea edx, [ebp - 0x28]
mov eax, 0xe9680
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x28]
call fcn.000e9214
pop ecx
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0xe9688
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jne 0xe9400
push ebp
lea edx, [ebp - 0x30]
mov eax, 0xe969c
call fcn.00031d88
mov eax, dword [ebp - 0x30]
call fcn.000e9180
pop ecx
jmp 0xe945e
push ebp
lea edx, [ebp - 0x34]
mov eax, 0xe96a8
call fcn.00031d88
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x34]
call fcn.000e9214
pop ecx
jmp 0xe945e
push ebp
lea edx, [ebp - 0x3c]
mov eax, 0xe96b0
call fcn.00031d88
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x40]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x3c]
call fcn.000e9214
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe9487
cmp dword [ebp - 0x18], 0
je 0xe947a
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret