joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e609
Capabilities:
Query service status

Disassembly:
push 0x1a0
mov eax, 0x7b2a17
call fcn.00720838
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 0x1a0], eax
test ebx, ebx
je 0x44e6cf
lea eax, [ebp - 0x19c]
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44e7db
mov eax, dword [ebp - 0x198]
cmp eax, edi
je 0x44e756
sub eax, 1
je 0x44e698
sub eax, 1
je 0x44e690
sub eax, 1
je 0x44e68b
sub eax, 1
je 0x44e698
sub eax, 1
je 0x44e690
sub eax, 1
je 0x44e686
sub eax, 1
je 0x44e698
xor al, al
jmp 0x44e69a
cmp edi, 7
jmp 0x44e693
cmp edi, 1
jmp 0x44e693
cmp edi, 4
setne al
jmp 0x44e69a
mov al, 1
test al, al
jne 0x44e75e
and dword [ebp - 0x1a8], 0
lea eax, [ebp - 0x1ac]
push eax
mov dword [ebp - 0x1ac], 1
call fcn.0044d2ca
inc esi
pop ecx
mov ecx, dword [ebp - 0x1a4]
cmp esi, ebx
jb 0x44e63a
call fcn.00405a2d
push 2
pop esi
push esi
push eax
lea ecx, [ebp - 0x180]
call fcn.00404fa8
lea eax, [ebp - 0x180]
mov dword [ebp - 4], esi
push str.Service_
push eax
call fcn.00401ea3
pop ecx
pop ecx
push 0x7e2108
push ebx
push str._within
push edi
mov ecx, eax
call fcn.0044d34e
add esp, 4
push eax
push str._failed_to
push dword [ebp - 0x1a0]
push ecx
call fcn.00403f8c
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
mov ecx, eax
call fcn.00413514
push eax
call fcn.00401ea3
pop ecx
pop ecx
lea ecx, [ebp - 0x180]
call fcn.004052de
mov al, 1
call fcn.007207e2
ret
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0xc8]
call fcn.00404fa8
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], 1
push str.Encountered_state
push eax
call fcn.00401ea3
push edi
mov ecx, eax
call fcn.0044d34e
add esp, 0xc
push eax
push 0x7e20cc
push dword [ebp - 0x1a0]
push str._while_waiting_for_service_
push dword [ebp - 0x198]
call fcn.0044d34e
push eax
push ecx
call fcn.00401ea3
add esp, 0xc
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00403f8c
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
jmp 0x44e850
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.00404fa8
and dword [ebp - 4], 0
lea eax, [ebp - 0xc8]
push str.Failed_to_query_service_
push eax
call fcn.00401ea3
pop ecx
pop ecx
push esi
push 0x7e2080
push edi
mov ecx, eax
call fcn.0044d34e
add esp, 4
push eax
push str._while_waiting_for_service_to
push dword [ebp - 0x1a0]
push ecx
call fcn.00403f8c
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
push eax
call fcn.00401ea3
pop ecx
pop ecx
mov ecx, eax
call fcn.00413514
lea ecx, [ebp - 0xc8]
call fcn.004052de
xor al, al
jmp 0x44e758
Function at 0x45ed25
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x45ed37
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x45ed7c
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x45edf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x45edf9
pop esi
ret

Function at 0x45f106
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x45f11d
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x45f13d
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, 0xcbf29ce4
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0x10
mov ebx, 0x84222325
mov dword [ebp - 4], edx
mov esi, eax
jb 0x45f15e
mov esi, dword [eax]
mov ecx, eax
jb 0x45f164
mov ecx, dword [eax]
mov eax, dword [eax + 0x10]
and dword [ebp + 8], 0
add eax, ecx
mov edi, eax
xor ecx, ecx
sub edi, esi
cmp esi, eax
cmova edi, ecx
test edi, edi
je 0x45f1a7
movsx eax, byte [esi]
push 0x100
cdq
xor edx, dword [ebp - 4]
xor eax, ebx
push 0x1b3
push edx
push eax
call fcn.00720db0
mov ebx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
inc esi
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x45f17c
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x45f1ae
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0x10
mov ebx, 0x811c9dc5
mov esi, eax
jb 0x45f1c6
mov esi, dword [eax]
mov ecx, eax
jb 0x45f1cc
mov ecx, dword [eax]
mov eax, dword [eax + 0x10]
and dword [ebp + 8], 0
add eax, ecx
mov edi, eax
xor ecx, ecx
sub edi, esi
cmp esi, eax
cmova edi, ecx
test edi, edi
je 0x45f20f
mov cl, byte [esi]
lea edx, [ecx - 0x41]
lea eax, [ecx + 0x20]
cmp dl, 0x19
movzx eax, al
movzx ecx, cl
cmovbe ecx, eax
movsx eax, cl
xor eax, ebx
imul ebx, eax, 0x1000193
inc esi
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x45f1e4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x45f2f9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f1ae

Function at 0x45f392
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f13d

Function at 0x45f431
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f216

Function at 0x460876
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x314], 0xffffffff
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], esi
cmp eax, 0x3e7
ja 0x4608c9
imul eax, eax, 0x3e8
mov dword [ebp - 0x318], eax
jmp 0x4608d3
mov dword [ebp - 0x31c], 1
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ecx + 0x38]
call fcn.006c01e1
mov eax, dword [ebp - 0x314]
add esp, 0x14
test eax, eax
jns 0x460925
lea eax, [ebp - 0x324]
mov dword [ebp - 0x324], 0x64
push eax
mov dword [ebp - 0x320], esi
call fcn.0040d649
pop ecx
xor eax, eax
jmp 0x460949
lea ecx, [ebp - 0x31c]
inc eax
push ecx
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x310]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret 4
Function at 0x46bec1
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x7e54e0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x46bf20
push str.GetPhysicallyInstalledSystemMemory
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x6c], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46bf20
lea ecx, [ebp - 0x6c]
push ecx
call eax
test eax, eax
je 0x46bf20
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], ecx
jmp 0x46bf92
push ebx
push 0x3c
xor ebx, ebx
mov dword [ebp - 0x64], 0x40
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00739c90
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x46bf5b
mov eax, dword [ebp - 0x5c]
mov dword [esi + 0xe0], eax
mov eax, dword [ebp - 0x58]
mov dword [esi + 0xe4], eax
jmp 0x46bf91
push edi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x24], 0x20
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
pop edi
cmp eax, 0xffffffff
jne 0x46bf85
mov eax, ebx
xor ebx, ebx
inc ebx
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret

Function at 0x47d0d1
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x47d10a
movzx eax, byte [ebx]
push 0x100
cdq
push 0x1b3
xor edx, ecx
xor eax, esi
push edx
push eax
call fcn.00720db0
inc ebx
mov esi, eax
mov ecx, edx
sub edi, 1
jne 0x47d0e7
pop edi
mov eax, esi
mov edx, ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x490a17
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x490b6f
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x490b6d
cmp eax, edi
jne 0x490a58
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x490b6d
cmp eax, edi
jne 0x490a58
test dword [esi + 0x50], edx
je 0x490b7b
cmp eax, 0x2e
jne 0x490a73
push 5
lea ecx, [esi + 0x24]
call fcn.004922ea
mov ecx, esi
call fcn.00492328
jmp 0x490b58
cmp eax, 0x5c
jne 0x490ac5
mov ecx, esi
call fcn.00492328
test byte [esi + 0x50], 0x80
je 0x490ab9
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x490aa2
push 4
lea ecx, [esi + 0x24]
call fcn.004922ea
mov ecx, esi
call fcn.00492328
jmp 0x490b5f
cmp al, 0x42
jne 0x490ab9
push 4
lea ecx, [esi + 0x24]
call fcn.004922ea
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x490a96
mov ecx, esi
call fcn.00490b85
jmp 0x490b58
cmp eax, 0x5b
jne 0x490ae5
mov ecx, esi
call fcn.00492328
mov ecx, esi
call fcn.00490ff3
cmp dword [esi + 0x4c], 0x5d
je 0x490a67
push 4
jmp 0x490b7d
cmp eax, 0x28
jne 0x490b01
mov ecx, esi
call fcn.00492328
mov ecx, esi
call fcn.0049277b
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x490b7b
jmp 0x490b4d
cmp eax, 0x5e
jne 0x490b0a
push 2
jmp 0x490a8e
cmp eax, 0x24
jne 0x490b16
push 3
jmp 0x490a8e
cmp eax, 0x2a
je 0x490b77
cmp eax, 0x2b
je 0x490b77
cmp eax, 0x3f
je 0x490b77
cmp eax, 0x7b
je 0x490b77
cmp eax, 0x7d
jne 0x490b34
test dword [esi + 0x50], edx
je 0x490b73
cmp eax, 0x5d
jne 0x490b3e
test dword [esi + 0x50], edx
je 0x490ade
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004903a3
mov bl, 1
mov ecx, esi
call fcn.00492328
test bl, bl
je 0x490b5f
mov ecx, esi
call fcn.00492356
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x490a2d
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x490b7d
push 0xa
jmp 0x490b7d
push 5
mov ecx, esi
call fcn.00491cb0
int3

Function at 0x4af620
Capabilities:
Delete registry key

Disassembly:
push 0x34
mov eax, 0x7bf1d8
call fcn.00720838
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi], ebx
jne 0x4af63e
xor al, al
jmp 0x4af6ca
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00409509
pop ecx
pop ecx
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
jne 0x4af69f
cmp dword [esi + 0x14], ebx
je 0x4af6c0
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00409509
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004aef00
lea ecx, [ebp - 0x40]
call fcn.004066fd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [esi + 0x1c]
call fcn.004af1b7
pop ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, esi
mov edi, eax
call fcn.004af113
jmp 0x4af6b5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov edi, eax
test edi, edi
je 0x4af6be
cmp edi, 2
jne 0x4af6c0
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.004066fd
mov al, bl
call fcn.007207e2
ret 4
Function at 0x4af965
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.00721650
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1020], esi
mov ebx, dword [ecx]
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x4afa6c
push 0x1000
lea eax, [ebp - 0x101c]
push 0
push eax
call fcn.00739c90
xor ecx, ecx
mov dword [ebp - 0x1028], 0x1000
add esp, 0xc
mov dword [ebp - 0x1020], ecx
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1024], eax
cmp dword [edi + 0x10], ecx
jne 0x4af9d2
mov edi, ecx
jmp 0x4af9da
cmp dword [edi + 0x14], 8
jb 0x4af9da
mov edi, dword [edi]
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1020]
push eax
push ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4afa6c
cmp dword [ebp - 0x1020], 3
jne 0x4afa6c
lea eax, [ebp - 0x1030]
push eax
push 5
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, 1
jne 0x4afa6c
push dword [ebp - 0x1030]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x102c]
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.00403b67
push dword [ebp - 0x102c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00402438
lea ecx, [ebp - 0x1c]
call fcn.00403a4c
jmp 0x4afa7a
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret 8
Function at 0x4afde4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [esi + 0x10], ecx
lea edi, [esi + 0x1c]
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
mov dword [esi + 0x18], ecx
push ebx
push eax
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
call fcn.00409476
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.00402a6f
lea ecx, [ebp - 0x1c]
call fcn.00403a4c
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
je 0x4afea2
and dword [ebp - 0x20], 0
mov ecx, ebx
cmp dword [ebx + 0x14], 8
jb 0x4afe51
mov ecx, dword [ebx]
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [esi + 0x18]
push eax
push 0
push ecx
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x4afe73
cmp dword [ebp - 0x20], 0
je 0x4afea2
push edi
push dword [ebp - 0x20]
mov ecx, edi
call fcn.0044367e
cmp dword [ebx + 0x14], 8
jb 0x4afe86
mov ebx, dword [ebx]
lea eax, [ebp - 0x20]
push eax
push dword [edi]
lea eax, [esi + 0x18]
push eax
mov eax, dword [ebp - 0x24]
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4afebb
xor ecx, ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
mov dword [esi + 0x18], ecx
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret 8

Function at 0x4b039c
Capabilities:
Delete registry value

Disassembly:
push 0x1c
mov eax, 0x7b0907
call fcn.00720838
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi], ebx
jne 0x4b03b7
xor al, al
jmp 0x4b0416
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00409509
pop ecx
pop ecx
test byte [esi + 0x20], 2
mov dword [ebp - 4], ebx
jne 0x4b03ed
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004b0cb5
test al, al
je 0x4b03ed
mov eax, dword [esi + 0x20]
mov ecx, esi
or eax, 2
push eax
call fcn.004b04a9
test al, al
je 0x4b040c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4b040a
cmp eax, 2
jne 0x4b040c
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.004066fd
mov al, bl
call fcn.007207e2
ret 4
Function at 0x4b04f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4b0508
xor al, al
jmp 0x4b0570
mov ecx, dword [esi + 0x20]
test cl, 2
jne 0x4b0546
movzx eax, byte [esi + 0x24]
or ecx, 2
push eax
push ecx
call fcn.004afc72
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 4]
push eax
push dword [esi + 0x1c]
call fcn.004b014f
add esp, 0x18
test al, al
je 0x4b0546
mov ecx, esi
call fcn.004af113
mov eax, dword [ebp - 4]
or dword [esi + 0x20], 2
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
sub ecx, edx
cmp dword [eax + 0x14], 8
jb 0x4b055b
mov eax, dword [eax]
push ecx
push edx
push 3
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
pop esi
leave
ret 8

Function at 0x4b05b6
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi], edi
je 0x4b066a
mov ecx, dword [esi + 0x20]
test cl, 2
jne 0x4b0608
movzx eax, byte [esi + 0x24]
or ecx, 2
push eax
push ecx
call fcn.004afc72
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 4]
push eax
push dword [esi + 0x1c]
call fcn.004b014f
add esp, 0x18
test al, al
je 0x4b0608
mov ecx, esi
call fcn.004af113
mov eax, dword [ebp - 4]
or dword [esi + 0x20], 2
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
jb 0x4b0619
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push eax
push 5
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], edi
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
cmp eax, 1
jne 0x4b066a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4b0646
mov eax, dword [eax]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 3
push edi
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
sete al
jmp 0x4b066c
xor al, al
pop edi
pop esi
leave
ret 8
Function at 0x4b0672
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x7bf36f
call fcn.00720838
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi], ebx
jne 0x4b0690
xor al, al
jmp 0x4b0710
test byte [esi + 0x20], 2
jne 0x4b06f0
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.004afde4
cmp dword [ebp - 0x20], 4
mov dword [ebp - 4], ebx
jne 0x4b06ba
lea ecx, [ebp - 0x38]
call fcn.004b0ab6
cmp eax, dword [ebp + 0xc]
jne 0x4b06ba
mov bl, 1
jmp 0x4b06cc
mov eax, dword [esi + 0x20]
mov ecx, esi
or eax, 2
push eax
call fcn.004b04a9
test al, al
jne 0x4b06e0
lea ecx, [ebp - 0x1c]
call fcn.0040c847
lea ecx, [ebp - 0x38]
call fcn.00403a4c
mov al, bl
jmp 0x4b0710
lea ecx, [ebp - 0x1c]
call fcn.0040c847
lea ecx, [ebp - 0x38]
call fcn.00403a4c
cmp dword [edi + 0x14], 8
jb 0x4b06f8
mov edi, dword [edi]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ebx
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
call fcn.007207e2
ret 8

Function at 0x4b0805
Capabilities:
Set registry value

Disassembly:
push 0x4c
mov eax, 0x7bf39c
call fcn.00720838
mov ebx, ecx
mov dword [ebp - 0x58], ebx
cmp dword [ebx], 0
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jne 0x4b0828
xor al, al
jmp 0x4b08f2
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x4b083b
cmp byte [ebp + 0x10], al
jne 0x4b083b
mov al, 1
jmp 0x4b08f2
xor ecx, ecx
inc ecx
test byte [ebx + 0x20], 2
mov dword [ebp - 0x54], ecx
jne 0x4b08c2
push esi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.004afde4
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 1
jne 0x4b0882
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.004b0bda
push edi
mov ecx, eax
call fcn.004b0cdc
lea ecx, [ebp - 0x50]
mov bl, al
call fcn.004066fd
test bl, bl
jne 0x4b0897
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebx + 0x20]
mov ecx, ebx
or eax, 2
push eax
call fcn.004b04a9
test al, al
jne 0x4b08ac
mov byte [ebp - 0x54], al
lea ecx, [ebp - 0x1c]
call fcn.0040c847
lea ecx, [ebp - 0x38]
call fcn.00403a4c
mov al, byte [ebp - 0x54]
jmp 0x4b08f2
lea ecx, [ebp - 0x1c]
call fcn.0040c847
lea ecx, [ebp - 0x38]
call fcn.00403a4c
mov eax, dword [edi + 0x10]
xor ecx, ecx
inc ecx
cmp dword [esi + 0x10], 0
jne 0x4b08cc
xor esi, esi
jmp 0x4b08d4
cmp dword [esi + 0x14], 8
jb 0x4b08d4
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4b08dc
mov edi, dword [edi]
add eax, eax
push eax
push edi
push ecx
push 0
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
call fcn.007207e2
ret 0xc

Function at 0x4b0cb5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4b0cc3
mov eax, dword [eax]
xor edx, edx
push edx
push edx
push edx
push edx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
setne al
pop ebp
ret 4