joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a8d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x98], eax
push esi
mov esi, ecx
call fcn.0049a09c
mov cl, byte [esi]
cmp cl, 0x41
jl 0x49a8ec
cmp cl, 0x5a
jg 0x49a8ec
movsx edx, cl
sub edx, 0x41
jmp 0x49a8fc
cmp cl, 0x61
jl 0x49a90c
cmp cl, 0x7a
jg 0x49a90c
movsx edx, cl
sub edx, 0x61
cmp eax, 2
jne 0x49a924
test edx, edx
je 0x49a90c
xor eax, eax
inc eax
cmp edx, eax
jne 0x49a90e
xor eax, eax
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0x9c
leave
ret
cmp eax, 3
jne 0x49a90c
push esi
call fcn.00498cc4
pop ecx
test eax, eax
je 0x49a90c
push ebx
add edx, 0x41
push edx
lea eax, [ebp - 0x6c]
push str.__c:
push eax
xor ebx, ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocStringLen
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x49a9bd
push 0x227
call fcn.00564e4a
pop ecx
push ebx
mov esi, eax
mov dword [esi + 4], 0x227
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
push dword [esi + 4]
lea eax, [ebp - 0x78]
push esi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49a9ad
cmp dword [esi + 0x1c], 7
jne 0x49a9ad
inc ebx
push esi
call fcn.00564e3f
pop ecx
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
jmp 0x49a90e

Function at 0x4aa66d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edx, 0x3020100
xor eax, eax
mov dword [eax + ecx + 0xc], edx
add eax, 4
add edx, 0x4040404
cmp eax, 0x100
jb 0x4aa67e
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 1], bl
xor esi, esi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
lea edi, [eax + ecx + 0xc]
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov dl, byte [edi]
add al, dl
add byte [ebp - 1], al
movzx eax, byte [ebp - 1]
lea eax, [eax + ecx + 0xc]
mov bl, byte [eax]
inc esi
mov byte [edi], bl
mov byte [eax], dl
cmp esi, dword [ebp + 0xc]
jb 0x4aa6ca
xor esi, esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jb 0x4aa6a0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4aaad4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4aab44
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4aab0d
push ebx
call esi
test eax, eax
je 0x4aab0d
mov ecx, dword [esp + 0x10]
push eax
call fcn.00401ec0
jmp 0x4aab31
push 7
call edi
mov ebx, eax
test ebx, ebx
je 0x4aab47
push ebx
call esi
test eax, eax
je 0x4aab47
mov ecx, dword [esp + 0x10]
push eax
call fcn.00401ec0
mov ecx, dword [esp + 0x10]
call fcn.004aaa49
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret 4
push 0xd
call edi
mov ebx, eax
test ebx, ebx
je 0x4aab96
push ebx
call esi
mov esi, eax
test esi, esi
je 0x4aab96
push 0xffffffffffffffff
push esi
call fcn.004287e0
pop ecx
pop ecx
mov edi, eax
test edi, edi
je 0x4aab8f
mov ecx, dword [esp + 0x10]
push edi
call fcn.00401ec0
push edi
call fcn.00564e3f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor esi, esi
inc esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
jmp 0x4aab41
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor esi, esi
jmp 0x4aab85

Function at 0x4ab0a5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab0d7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x4ab113
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [esi + 0x408], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x408]
test esi, esi
je 0x4ab110
push esi
jmp 0x4ab0cc
mov eax, dword [ebp - 8]
pop esi
leave
ret 4

Function at 0x4ab118
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab141
push eax
jmp 0x4ab17d
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [esi + 0x408], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x408]
test esi, esi
jne 0x4ab17c
mov eax, dword [ebp - 8]
jmp 0x4ab185
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
leave
ret 4
Function at 0x4ab18a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
lea eax, [ebp - 0x60]
push eax
push 0xf003f
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab1d5
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x4ab22a
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x64], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x60]
mov dword [esi + 0x408], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x408]
test esi, esi
je 0x4ab227
push esi
jmp 0x4ab1ca
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0xa8
leave
ret

Function at 0x4ab4ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4ab4f7
push eax
jmp 0x4ab526
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [esi + 0x408], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x408]
cmp esi, edi
jne 0x4ab525
xor eax, eax
inc eax
jmp 0x4ab52e
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x4ab5bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 0xff
xor edi, edi
inc edi
push eax
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
call fcn.00564e4a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4ab5f6
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
jmp 0x4ab693
push dword [ebp + 8]
mov ecx, esi
call fcn.004ab118
mov dword [ebp - 4], eax
cmp eax, edi
je 0x4ab611
cmp eax, 7
je 0x4ab611
cmp eax, 2
jne 0x4ab675
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4ab63c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ab677
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4ab65f
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
jne 0x4ab691
push dword [esi + 0x408]
jmp 0x4ab634
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x4ab688
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4ab691
push ebx
call fcn.00564e3f
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4ab69a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
inc edi
mov esi, ecx
mov dword [ebp - 4], edi
mov ebx, edi
call fcn.004ab118
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004ab0a5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], edi
je 0x4ab6de
cmp dword [ebp - 4], 7
je 0x4ab6de
cmp dword [ebp - 4], 2
je 0x4ab6de
mov eax, dword [ebp + 0xc]
jmp 0x4ab772
push eax
call fcn.00564e4a
mov edi, eax
pop ecx
test edi, edi
jne 0x4ab6f5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ab6d6
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab719
push eax
jmp 0x4ab74f
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab73c
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4ab770
push dword [esi + 0x408]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
je 0x4ab767
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4ab770
push edi
call fcn.00564e3f
pop ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ab779
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab7b8
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
jmp 0x4ab7f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab7e9
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret 8

Function at 0x4ab7fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab841
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4ab887
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab878
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
pop esi
leave
ret 0xc

Function at 0x4ab993
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
xor edi, edi
mov dword [ebp - 8], 3
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab9d2
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4aba09
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ab9fe
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 0xc
Function at 0x4aba0f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
push 0x20019
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4aba5c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4abaa8
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [esi + 0x408], eax
test eax, eax
jne 0x4aba91
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4aba9a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059ca15
leave
ret 8

Function at 0x4abab9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
mov ebx, dword [ebp + 0x9c]
push esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 8]
push eax
push dword [esi]
mov dword [ebp - 0x80], 0x104
mov dword [ebp - 0x78], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4abb1a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4abb62
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xa0]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esi + 0x408], eax
cmp eax, edi
jne 0x4abb4c
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4abb56
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x78], edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059ca15
add ebp, 0x94
leave
ret 8
Function at 0x4abbfc
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0x94]
push esi
push edi
mov edi, dword [ebp + 0x98]
push edi
mov esi, ecx
mov dword [ebp - 0x80], 1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfe
jle 0x4abc44
xor eax, eax
jmp 0x4abcc5
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x7c]
push eax
push 0x20006
xor edi, edi
push edi
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4abc7a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4abc3d
lea eax, [ebp - 0x78]
push eax
call fcn.0059bf90
pop ecx
inc eax
push eax
lea eax, [ebp - 0x78]
push eax
push 1
push edi
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4abcab
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x80], edi
cmp dword [esi + 4], edi
jne 0x4abcb9
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059ca15
add ebp, 0x8c
leave
ret 8

Function at 0x4abcdf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abd16
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4abd61
push dword [ebp + 0xc]
call fcn.0059bf90
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abd47
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp dword [esi + 4], 0
jne 0x4abd56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x4abe67
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abe9e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4abee1
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abec7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp dword [esi + 4], 0
jne 0x4abed6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop esi
pop ebx
leave
ret 8

Function at 0x4abee7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
push dword [esi]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abf1e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4abf61
push 8
lea eax, [ebp + 0xc]
push eax
push 3
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4abf47
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp dword [esi + 4], 0
jne 0x4abf56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x4abfe7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 0x408], eax
cmp eax, edi
je 0x4ac01c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4ac054
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xc]
push eax
push edi
push edi
push edi
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 4]
mov dword [esi + 0x408], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x408]
cmp esi, edi
je 0x4ac051
push esi
jmp 0x4ac012
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8

Function at 0x4ac1aa
Capabilities:
Delete registry key

Disassembly:
push esi
push 0
push dword [esp + 0xc]
mov esi, ecx
call fcn.004ab2f6
test eax, eax
je 0x4ac1dd
push dword [esp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [esi + 0x408], eax
test eax, eax
je 0x4ac1dd
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4ac1e0
xor eax, eax
inc eax
pop esi
ret 4
Function at 0x4b07dc
Capabilities:
Read file on windows

Disassembly:
push dword [ecx]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call fcn.005a54a5
add esp, 0x10
ret 8

Function at 0x4b07f3
Capabilities:
Write file on windows

Disassembly:
push dword [ecx]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call fcn.005a3f38
add esp, 0x10
ret 8

Function at 0x4b080a
Capabilities:
Write file on windows

Disassembly:
push dword [ecx]
push 1
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.005a3f38
add esp, 0x10
ret 8

Function at 0x4b0acc
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.004b06fc
test eax, eax
je 0x4b0b2f
push dword [esi]
call fcn.0059e805
test byte [esi + 4], 1
pop ecx
je 0x4b0b08
lea eax, [esi + 0x28]
push eax
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi]
call fcn.005a51b6
push eax
call fcn.005a57d4
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi]
call fcn.0059fb57
mov eax, dword [esi + 0x14]
pop ecx
test eax, eax
jne 0x4b0b1c
mov eax, 0x80
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and dword [esi], 0
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4b0baa
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
push esi
mov esi, ecx
jne 0x4b0bbd
xor eax, eax
jmp 0x4b0c3b
push edi
call fcn.004b0acc
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esi + 0x14]
push eax
push ebx
call edi
push dword [ebp + 0xc]
and dword [esi], 0
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.0059fa8d
add esp, 0xc
cmp dword [esi], 0
jne 0x4b0c14
call fcn.005a5c04
cmp dword [eax], 0xd
jne 0x4b0c0f
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4b0c0f
push dword [ebp + 0xc]
push ebx
push esi
call fcn.0059fa8d
add esp, 0xc
cmp dword [esi], 0
je 0x4b0c24
cmp dword [ebp + 8], 0xffffffff
jne 0x4b0c2a
lea eax, [esi + 0x14]
push eax
push ebx
call edi
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0xffffffff
je 0x4b0c33
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, esi
call fcn.004b06fc
pop edi
pop esi
pop ebx
pop ebp
ret 8