joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0f30
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
cmp edi, 1
jne 0x4f0f6d
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4f0f4c
pop edi
xor eax, eax
pop esi
ret 0x14
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esi + 0x10]
push 1
push dword [esp + 0x20]
push eax
call fcn.004f1020
pop edi
mov eax, 1
pop esi
ret 0x14
cmp edi, 2
je 0x4f0f45
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4f0f81
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4f0f45
cmp byte [esi + 8], 0
push ebx
je 0x4f0f95
push 0x5e86c4
push eax
call fcn.0059be19
jmp 0x4f0fa0
push 0x5e7ae0
push eax
call fcn.0059be30
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4f0faf
pop ebx
pop edi
pop esi
ret 0x14
cmp edi, 3
jne 0x4f0fd4
push ebx
push 2
push 1
push 0x5e86cc
call fcn.0059ce08
mov ecx, dword [esi + 0x10]
add esp, 0x10
test ecx, ecx
je 0x4f0fe9
push str.UTF_16
jmp 0x4f0fe4
test edi, edi
jne 0x4f0fe9
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4f0fe9
push str.UTF_8
call fcn.004e7930
push dword [esp + 0x20]
mov ecx, esi
push dword [esp + 0x20]
push dword [esi + 0x10]
push edi
push dword [esp + 0x24]
push ebx
call fcn.004f1020
push ebx
call fcn.0059bc17
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x4f48c0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004e3c30
push 0x10
mov dword [ebp - 4], 0
mov dword [esi], vtable.ip_socket.0
call fcn.00501ce1
add esp, 4
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], 0xffffffff
jne 0x4f4937
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276d
jne 0x4f4937
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x38], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4f49e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4f49f1
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 1
push 4
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.004e3d90
test al, al
jne 0x4f4a24
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4f4a24
mov eax, dword [ecx]
push str.SO_REUSEADDR_is_off_n
push ecx
call dword [eax + 0x18]
add esp, 8
mov ecx, dword [esi + 0x24]
pop esi
test ecx, ecx
je 0x4f4a3c
mov eax, dword [ecx]
push str._socket_reset_n
push 3
push ecx
call dword [eax + 0x14]
add esp, 0xc
ret

Function at 0x4f4a40
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.004f49e0
mov eax, dword [esi + 0x40]
mov ecx, 2
push dword [esp + 0x10]
mov word [eax], cx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi + 0x40]
mov ebx, dword [esp + 0xc]
push ebx
mov word [ecx + 2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esi + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4f4a92
push dword [esp + 0x10]
mov eax, dword [ecx]
push ebx
push str._connecting_to__s:_d..._n
push 3
push ecx
call dword [eax + 0x14]
add esp, 0x14
push 0
push 0x10
push dword [esi + 0x40]
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_connect]
push eax
mov ecx, esi
call fcn.004e4210
mov bl, al
test bl, bl
je 0x4f4ac5
mov edx, dword [esi + 0x24]
test edx, edx
je 0x4f4ac5
mov ecx, dword [edx]
push str._connected_n
push edx
call dword [ecx + 0x18]
add esp, 8
call fcn.004df1e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov al, bl
mov dword [esi + 0x1c], edx
mov dword [esi + 0x14], edx
pop esi
pop ebx
ret 8
Function at 0x4f78b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x48], 0xf
mov dword [esi + 0x44], 0
mov byte [esi + 0x34], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x60], 0xf
mov dword [esi + 0x5c], 0
mov byte [esi + 0x4c], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
push 0
call fcn.004ddca0
mov byte [ebp - 4], 4
xor eax, eax
mov word [esi + 0x78], ax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x94], 0xf
mov dword [esi + 0x90], eax
mov byte [esi + 0x80], al
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fc560
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x68
push 0xffffffffffffffff
push 0x5d2227
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp + 0x60], edi
xor bl, bl
mov byte [ebp + 0x67], bl
mov dword [ebp - 4], 0
push dword [edi + 0x1c]
lea ecx, [ebp - 0x3c]
call fcn.004b8fc0
mov byte [ebp - 4], 1
push str.SELECT_name__sql_FROM_sqlite_master_WHERE_type_IN__table__view__AND_upper_name___upper__objName_
lea ecx, [ebp + 0x18]
call fcn.0040e5f0
mov byte [ebp - 4], 2
lea eax, [ebp + 0x18]
cmp dword [ebp + 0x2c], 0x10
cmovae eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004b9250
mov esi, dword [ebp + 0x70]
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.004b9e00
lea ecx, [ebp - 0x3c]
call fcn.004b9750
test al, al
je 0x4fc6da
push str.name
lea ecx, [ebp + 0x30]
call fcn.0040e5f0
mov byte [ebp - 4], 3
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004b9c10
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x30]
call fcn.0040e4b0
push 0x5e9f60
lea ecx, [ebp + 0x30]
call fcn.0040e5f0
mov byte [ebp - 4], 6
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x48]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004b9c10
mov byte [ebp - 4], 8
lea ecx, [ebp + 0x30]
call fcn.0040e4b0
push esi
lea eax, [ebp]
push eax
call fcn.00415230
add esp, 8
mov edi, dword [ebp + 0x74]
test al, al
je 0x4fc66f
push edi
lea eax, [ebp + 0x48]
push eax
call fcn.00415230
add esp, 8
test al, al
je 0x4fc66f
mov bl, 1
mov byte [ebp + 0x67], bl
jmp 0x4fc6c0
cmp dword [esi + 0x14], 0x10
jb 0x4fc677
mov esi, dword [esi]
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
mov ecx, dword [eax]
push esi
push str.database_object__s_is_not_equal_to_specified_n
push eax
call dword [ecx + 0x18]
add esp, 0xc
cmp dword [edi + 0x14], 0x10
jb 0x4fc693
mov edi, dword [edi]
mov esi, dword [ebp + 0x60]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push str.specified_sql:__s_n
push eax
call dword [ecx + 0x10]
lea edx, [ebp + 0x48]
cmp dword [ebp + 0x5c], 0x10
cmovae edx, dword [ebp + 0x48]
mov eax, dword [esi]
mov ecx, dword [eax]
push edx
push str.database_sql:__s_n
push eax
call dword [ecx + 0x10]
add esp, 0x18
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x48]
call fcn.0040e4b0
mov byte [ebp - 4], 2
lea ecx, [ebp]
call fcn.0040e4b0
jmp 0x4fc6f3
cmp dword [esi + 0x14], 0x10
jb 0x4fc6e2
mov esi, dword [esi]
mov eax, dword [edi]
mov ecx, dword [eax]
push esi
push str.database_object__s_is_not_exists_n
push eax
call dword [ecx + 0x18]
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.004b9940
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.0040e4b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004b9160
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x68]
pop ebp
ret 8
Function at 0x4fd4f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
lea ebp, [esp - 0x20]
sub esp, 0x20
push 0xffffffffffffffff
push 0x5d24b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
mov dword [ebp + 0x1c], 0
lea eax, [ebp - 0x54]
push esi
mov esi, ecx
mov dword [ebp - 0xbc], 0x61eab4
mov dword [ebp - 0xac], 0x619ab8
mov dword [ebp + 0x18], eax
mov dword [ebp - 0x54], vtable.std::ios_base.0
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 2
lea eax, [ebp - 0xa4]
push 0
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp + 0x1c], 2
call fcn.00414350
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xbc], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xc0], eax
lea eax, [ebp - 0xa4]
mov ecx, eax
mov dword [ebp + 0x18], eax
call fcn.004147e0
mov byte [ebp - 4], 4
mov dword [ebp - 0xa4], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 4], 6
lea ecx, [ebp]
push 0xffffffffffffffff
push 0
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
push esi
mov dword [ebp + 0x14], 0xf
mov dword [ebp + 0x10], 0
mov byte [ebp], 0
call fcn.0040ea60
mov byte [ebp - 4], 7
lea eax, [ebp]
push 0x619500
push eax
push str._nerror:
push dword [esi + 0x30]
lea eax, [esi + 0x18]
push str._nline_number:
push eax
lea eax, [ebp - 0xac]
push str.file:
push eax
call fcn.004bd5c0
add esp, 8
push eax
call fcn.004bd870
add esp, 8
push eax
call fcn.004bd5c0
add esp, 8
mov ecx, eax
call fcn.004bab70
push eax
call fcn.004bd5c0
add esp, 8
push eax
call fcn.004bd870
add esp, 8
push eax
call fcn.004bd5c0
add esp, 8
mov byte [ebp - 4], 6
mov eax, dword [ebp + 0x14]
cmp eax, 0x10
jb 0x4fd67b
inc eax
lea ecx, [ebp]
push eax
push dword [ebp]
call fcn.0040ee30
mov esi, dword [ebp + 0x28]
lea ecx, [ebp - 0xbc]
push esi
mov dword [ebp + 0x14], 0xf
mov dword [ebp + 0x10], 0
mov byte [ebp], 0
call fcn.00412c40
mov dword [ebp + 0x1c], 3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00412c60
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp + 0x18], eax
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x54], vtable.std::ios_base.0
call fcn.004ffd5c
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop esi
lea esp, [ebp + 0x20]
pop ebp
ret 4
Function at 0x512c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x3c]
xor edx, edx
push ebp
mov ecx, ebx
mov dword [esp + 0xc], 1
neg ecx
mov dword [esp + 8], 0
mov eax, ecx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
bts ebp, eax
cmp eax, 0x20
push esi
cmovae edx, ebp
xor ebp, edx
cmp eax, 0x40
mov eax, dword [esp + 0x3c]
cmovae edx, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x40]
push edi
call fcn.005c0640
mov edx, dword [esp + 0x28]
mov ecx, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], ecx
push eax
add ebp, 0xffffffff
lea eax, [esp + 0x24]
push eax
adc edx, 0xffffffff
mov dword [esp + 0x38], ebp
and ebp, dword [esp + 0x48]
lea eax, [ebx + 0x40]
mov dword [esp + 0x3c], edx
and edx, dword [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x2c], edx
call fcn.00511ee0
mov ebx, dword [esp + 0x70]
add esp, 0x10
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x20]
mov dword [ebx], eax
mov dword [ecx], 0
cmp dword [ebx], 0
jle 0x512d35
nop dword [eax + eax]
mov eax, dword [esp + 0x18]
xor edx, edx
div edi
mov dword [esp + 0x18], edx
add al, 0x30
mov edx, dword [ecx]
mov ecx, dword [esp + 0x54]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x5c]
inc dword [ecx]
dec dword [ebx]
sub esi, 1
je 0x512d39
mov eax, 0xcccccccd
mul edi
mov edi, edx
shr edi, 3
cmp dword [ebx], 0
jg 0x512d00
test esi, esi
jne 0x512d71
mov esi, dword [esp + 0x24]
mov eax, edi
push ebx
push 0
neg esi
xor edx, edx
push 1
mov ecx, esi
call fcn.005c05f0
push edx
push eax
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, esi
call fcn.005c05f0
add eax, ebp
adc edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x74]
push eax
push dword [edx]
jmp 0x512e31
mov edi, dword [esp + 0x1c]
jle 0x512e0f
nop dword [eax + eax]
mov eax, dword [esp + 0x10]
cmp edi, eax
jb 0x512e11
mov edx, dword [esp + 0x14]
ja 0x512d96
cmp ebp, edx
jbe 0x512e11
mov eax, ebp
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add ebp, eax
mov eax, edx
adc edi, ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
shld ecx, eax, 2
shld edi, ebp, 1
shl eax, 2
add ebp, ebp
add edx, eax
mov eax, dword [esp + 0x10]
adc eax, ecx
mov ecx, dword [esp + 0x24]
shld eax, edx, 1
neg ecx
add edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, ebp
mov edx, edi
call fcn.005c0640
mov edx, dword [esp + 0x5c]
add al, 0x30
mov ecx, dword [esp + 0x54]
dec esi
and ebp, dword [esp + 0x30]
and edi, dword [esp + 0x34]
mov edx, dword [edx]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x5c]
inc dword [ecx]
dec dword [ebx]
test esi, esi
jg 0x512d80
mov eax, dword [esp + 0x10]
jmp 0x512e11
xor eax, eax
test esi, esi
je 0x512e1f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret
push ebx
push eax
push dword [esp + 0x1c]
push dword [esp + 0x34]
push dword [esp + 0x48]
push edi
push ebp
push dword [ecx]
push dword [esp + 0x78]
push dword [esp + 0x78]
call fcn.00515450
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x544780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3fb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor eax, eax
mov dword [ebp - 0x2c], 7
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0
xor bl, bl
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [esi + 4]
push eax
call fcn.0050bd30
add esp, 8
lea eax, [ebp - 0x10]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push eax
mov eax, dword [esi + 0x24]
or eax, 0x20019
push eax
push 0
push ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x544850
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call fcn.0050bd30
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x544850
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bc930
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x544865
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x544880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3fe9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.005453a0
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
xor eax, eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
call fcn.0050bd30
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x54497c
cmp dword [ebp - 0x18], 3
jne 0x54497c
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x544953
push eax
mov ecx, esi
call fcn.005454f0
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x10]
push ecx
push dword [esi]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push 0
push 0
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x544968
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.00545210
push 0
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00503be0
push 0x6340e8
lea eax, [ebp - 0x74]
push eax
call fcn.005879e4
int3

Function at 0x5449b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push esi
push edi
mov esi, ecx
call fcn.005453a0
xor eax, eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.0050bd30
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x544a60
cmp dword [ebp - 0x14], 0xb
jne 0x544a60
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp ecx, 8
jb 0x544a4a
inc ecx
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.00545210
push 0
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00503be0
push 0x6340e8
lea eax, [ebp - 0x78]
push eax
call fcn.005879e4
int3
Function at 0x544a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
mov esi, ecx
call fcn.005453a0
xor eax, eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.0050bd30
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x544b3f
mov eax, dword [ebp - 0x14]
cmp eax, 4
je 0x544b14
cmp eax, 5
jne 0x544b3f
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ecx, 8
jb 0x544b2c
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.00545210
push 0
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00503be0
push 0x6340e8
lea eax, [ebp - 0x74]
push eax
call fcn.005879e4
int3
Function at 0x544b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d406e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push edi
mov dword [ebp - 0x18], ebx
call fcn.005453a0
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0050bd30
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x544d7d
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x544c05
cmp eax, 2
je 0x544c05
cmp eax, 6
jne 0x544d7d
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x544d67
shr edi, 1
xor ecx, ecx
mov edx, 2
mov byte [ebp - 0x20], 1
lea esi, [edi + 1]
mov eax, esi
mov dword [ebp - 0x2c], esi
mul edx
mov dword [ebp - 0x28], esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005021d8
mov ebx, eax
add esp, 4
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x44]
push ebx
push 0
push 0
push ecx
push dword [eax + 0x1c]
mov byte [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp edi, esi
jb 0x544c81
push 0
push 0x130
push str...FoundationincludePoco_Buffer.h
push str.index____used
call fcn.00510790
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x88]
push ebx
mov word [ebx + edi*2], ax
call fcn.004bedb0
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0050be40
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x5c]
add esp, 8
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov byte [esi], 0
call fcn.0040edc0
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x544cf0
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.0040ee30
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp eax, 8
jb 0x544d1d
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.004bc930
xor eax, eax
mov dword [ebp - 0x74], 7
push ebx
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
call fcn.00501fb5
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x544d52
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x544d3d
push esi
lea eax, [ebp - 0x88]
mov ecx, ebx
push eax
call fcn.00545210
push 0
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00503be0
push 0x6340e8
lea eax, [ebp - 0x70]
push eax
call fcn.005879e4
int3
Function at 0x545540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
mov esi, ecx
call fcn.005453a0
xor eax, eax
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call fcn.0050bd30
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
call fcn.0050bd30
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
add esp, 0x10
lea ecx, [ebp - 0x3c]
cmp dword [ebp - 0x10], 8
cmovae edx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
cmp dword [ebp - 0x28], 8
push eax
cmovae ecx, dword [ebp - 0x3c]
push edx
push 1
push 0
push ecx
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x5455eb
push dword [ebp + 8]
mov ecx, esi
call fcn.00545190
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, 8
jb 0x545601
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.004bc930
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
cmp eax, 8
jb 0x54562a
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8