joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440220
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1080
call fcn.00475630
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1080], ecx
mov dword [ebp - 0x100c], 0xffffffff
xor eax, eax
mov word [ebp - 0x1008], ax
push 0xffe
push 0
lea ecx, [ebp - 0x1006]
push ecx
call fcn.00472990
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x44031b
mov byte [ebp - 0x107c], 0x33
mov byte [ebp - 0x107b], 0x34
mov byte [ebp - 0x107a], 0x32
mov byte [ebp - 0x1079], 0x38
mov byte [ebp - 0x1078], 0x62
mov byte [ebp - 0x1077], 0x66
mov byte [ebp - 0x1076], 0x36
mov byte [ebp - 0x1075], 0x65
mov byte [ebp - 0x1074], 0x34
mov byte [ebp - 0x1073], 0x31
mov byte [ebp - 0x1072], 0x64
mov byte [ebp - 0x1071], 0x65
mov byte [ebp - 0x1070], 0x34
mov byte [ebp - 0x106f], 0x30
mov byte [ebp - 0x106e], 0x62
mov byte [ebp - 0x106d], 0x35
xor edx, edx
mov byte [ebp - 0x106c], dl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00401ff0
push eax
lea ecx, [ebp - 0x107c]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.__s___p_S__y__o__s__x___s_
push 0x800
lea eax, [ebp - 0x1008]
push eax
call fcn.00474cf2
add esp, 0x1c
jmp 0x440345
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00401ff0
push eax
mov edx, dword [ebp + 8]
push edx
push str.__s___y__o__s__x___s_
push 0x800
lea eax, [ebp - 0x1008]
push eax
call fcn.00474cf2
add esp, 0x18
push 0x44
push 0
lea ecx, [ebp - 0x1068]
push ecx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x1068], 0x44
mov dword [ebp - 0x103c], 1
xor edx, edx
mov word [ebp - 0x1038], dx
push 0x10
push 0
lea eax, [ebp - 0x101c]
push eax
call fcn.00472990
add esp, 0xc
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x1068]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4403ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4a0ccc
push 0x4a0cc0
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
mov eax, dword [ebp - 0x100c]
jmp 0x440428
push 0xffffffffffffffff
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x100c], 0
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 0x10
Function at 0x441550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x24
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.00472990
add esp, 0xc
push 0x11c
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x158], 0x11c
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4415f3
xor eax, eax
jmp 0x441683
push 0x4a1314
push 0x4a1328
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44161c
lea ecx, [ebp - 0x34]
push ecx
call dword [ebp - 0x10]
jmp 0x441626
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 8]
mov dword [eax], 0x2d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x154]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x150]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
mov dx, word [ebp - 0x44]
mov word [ecx + 0x10], dx
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x3e]
mov byte [eax + 0x12], cl
mov edx, dword [ebp + 8]
mov ax, word [ebp - 0x34]
mov word [edx + 0x13], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x15], eax
mov eax, 1
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 4
Function at 0x4416a0
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49415c
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x224]
call fcn.0040b370
mov dword [ebp - 4], 0
lea eax, [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x684]
call fcn.00441550
test eax, eax
jne 0x441732
push str.GetTrustDbHeader_failed
push 0x4a1344
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040b430
jmp 0x4418f8
movzx ecx, word [ebp - 0x651]
push ecx
movzx edx, byte [ebp - 0x652]
push edx
movzx eax, word [ebp - 0x654]
push eax
mov ecx, dword [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0x65c]
push edx
mov eax, dword [ebp - 0x660]
push eax
push str._d__d__d__d__d__d.tdb
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00474cf2
add esp, 0x24
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x680]
push eax
call fcn.0040aa60
add esp, 4
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
mov dword [ebp - 0x68c], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x68c]
call fcn.00401ff0
push eax
push str._sTrustDb_s
push 0x104
lea edx, [ebp - 0x42c]
push edx
call fcn.00474cf2
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x680]
call fcn.00401ce0
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x441801
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040b430
jmp 0x4418f8
xor ecx, ecx
mov word [ebp - 0x634], cx
push 0x206
push 0
lea edx, [ebp - 0x632]
push edx
call fcn.00472990
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea ecx, [ebp - 0x634]
push ecx
call fcn.0040a8a0
add esp, 0xc
push 0
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x441899
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x42c]
push edx
push str._s____s_error:0x_x
push 0x4a13c8
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040b430
jmp 0x4418f8
lea eax, [ebp - 0x634]
push eax
mov ecx, dword [ebp - 0x684]
add ecx, 0x40
call fcn.00401f70
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x42c]
push edx
push str._s____s
push 0x4a13fc
call fcn.00401340
add esp, 4
push eax
call fcn.004013f0
add esp, 0x10
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040b430
xor eax, eax
jne 0x4416d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x441920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 1
push 0x23
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x441968
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cant_get_appdata_folder:0x_x
push 0x4a141c
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x44199d
push 0x4a1464
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00472b79
add esp, 0xc
push 0x4a1468
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00472b79
add esp, 0xc
mov dword [ebp - 4], 1
xor edx, edx
jne 0x441930
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x443ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494418
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x443f20
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x443f2c
mov al, 1
jmp 0x4440cf
mov dword [ebp - 0x10], 8
call fcn.0040fe40
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0040fe40
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040c9c0
add esp, 8
movzx eax, al
test eax, eax
je 0x443f6f
xor al, al
jmp 0x4440cf
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00417550
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00443260
mov ecx, eax
call fcn.004442c0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00401d40
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00443260
mov ecx, eax
call fcn.004442c0
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00444920
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x443fea
cmp dword [ebp - 0x6c], 1
je 0x443ff1
cmp dword [ebp - 0x6c], 3
je 0x44408b
jmp 0x4440a3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00443260
mov ecx, eax
call fcn.004442c0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x444054
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00443260
mov ecx, eax
call fcn.004442c0
push eax
call fcn.0047515f
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x444054
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004044e0
mov al, byte [ebp - 0x61]
jmp 0x4440cf
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x444077
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004044e0
mov al, byte [ebp - 0x62]
jmp 0x4440cf
cmp dword [ebp - 0x38], 0
jne 0x444089
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040a680
jmp 0x4440bb
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004044e0
mov al, byte [ebp - 0x63]
jmp 0x4440cf
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004044e0
mov al, byte [ebp - 0x64]
jmp 0x4440cf
jmp 0x443f82
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x449cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
neg edx
sbb edx, edx
and edx, 0x100
add edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.00453990
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449d60
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x14
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.00453990
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449d4b
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x14]
jmp 0x449d66
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x18]
jmp 0x449d66
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x449d70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push 0
push 0x4a191c
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00453990
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x449dc2
jmp 0x449e03
push 4
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 4
push 0
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00453990
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x449df6
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x44a370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f17
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c1280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
add eax, 4
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x10]
neg edx
sbb edx, edx
and edx, 0x100
add edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xc
call fcn.00453990
push eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a51d
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 8
call fcn.00453990
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047159e
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 8
call fcn.00453990
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a4e1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042deb0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x18
call fcn.0042e090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0042ed20
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0047311d
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x20], 1
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x30]
add edx, 0x18
push edx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov eax, dword [ebp - 0x2c]
or eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
jmp 0x44a538
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0047311d
add esp, 4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x30]
add edx, 0x1c
push edx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov eax, dword [ebp - 0x2c]
or eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
jmp 0x44a538
mov ecx, dword [ebp - 0x30]
add ecx, 0x1c
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov edx, dword [ebp - 0x2c]
or edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x44a550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push 0
push 0x4a19ac
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00453990
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44a5a2
jmp 0x44a5f6
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.0042e050
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.00453990
push eax
push 1
push 0
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00453990
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44a5e9
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x44a9f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 4
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.00453990
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ab4d
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 8
call fcn.00453990
push eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047159e
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 8
call fcn.00453990
push eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44ab0a
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x20]
call fcn.0044beb0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.0047311d
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x30], 1
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c]
add eax, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 8]
jmp 0x44ab6f
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0047311d
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
jmp 0x44ab6f
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x44ab80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
push 0x20006
push 0
push 0x4a19c4
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00453990
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44abc2
jmp 0x44ac08
push 0x10
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0044bed0
push eax
push 3
push 0
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00453990
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44abfb
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x44af60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xc
call fcn.00453990
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44b099
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.00453990
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 8]
push ecx
call fcn.0047159e
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.00453990
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b064
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [edx]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0044bdd0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0047311d
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x20], 1
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
jmp 0x44b0ad
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0047311d
add esp, 4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
jmp 0x44b0ad
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4