joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6561c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
push ebp
push esi
push edi
mov ebp, edx
mov esi, ecx
test esi, esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
je 0x656396
test ebp, ebp
je 0x656396
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x656200
sub eax, edx
cmp eax, 0x26
jne 0x656396
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x656217
sub eax, edx
cmp eax, 0x26
jne 0x656396
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x1f8]
rep stosd dword es:[edi], eax
mov ecx, 0x5a
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, 0x64
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1f4
stosb byte es:[edi], al
call fcn.00651e70
mov ecx, esi
call fcn.00656080
cmp eax, 1
jne 0x656396
mov ecx, ebp
call fcn.00656120
cmp eax, 1
jne 0x656396
push 0x16b
lea edx, [esp + 0x8c]
mov ecx, esi
call fcn.00654590
test eax, eax
jne 0x656396
call fcn.00654e60
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x94]
push ecx
push closesocket
call esi
test eax, eax
jne 0x656396
mov eax, dword [esp + 0x10]
test eax, eax
je 0x656396
call fcn.00654e60
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
call esi
test eax, eax
jne 0x65638b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x65638b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x1fc]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0x6ba3e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x65636e
cmp dword [esp + 0x1c], 1
jne 0x65636e
cmp dword [esp + 0x18], 0x27
jne 0x65636e
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
call fcn.00654e60
lea edx, [esp + 0x1f8]
push ebp
push edx
call fcn.006978dd
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
xor eax, eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x656660
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x68
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, edx
mov dword [esp + 8], 0
je 0x6566ec
test esi, esi
jl 0x6566ec
jne 0x656683
pop edi
xor eax, eax
pop esi
add esp, 0x68
ret
mov edx, 0x64
lea ecx, [esp + 0xc]
call fcn.00652980
push 0xf0000000
push 1
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, 1
jne 0x6566e1
mov eax, dword [esp + 8]
test eax, eax
je 0x6566e1
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp + 8]
push 0
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, 0x382
pop esi
add esp, 0x68
ret
pop edi
mov eax, 0x382
pop esi
add esp, 0x68
ret
pop edi
mov eax, 0x325
pop esi
add esp, 0x68
ret

Function at 0x657240
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov edx, ecx
cmp edx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x104
je 0x657392
cmp edi, ebx
je 0x657392
mov ecx, dword [ebp + 8]
cmp ecx, 0xa
jl 0x657392
mov esi, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657384
mov eax, dword [esp + 0x10]
test eax, eax
je 0x657384
lea esp, [esp]
cmp ebx, 0xff
jae 0x65736e
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc ebx
cmp eax, 0x103
je 0x65736e
test eax, eax
jne 0x6572c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x6572c0
cmp eax, 0x106
jb 0x657327
mov dword [esp + 0xc], 0x105
lea edx, [esp + 0xc]
lea ecx, [esp + 0x20]
call fcn.006571a0
mov edi, dword [esp + 0xc]
test edi, edi
jbe 0x6572c0
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
jle 0x6572c0
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x20]
sub esi, eax
cmp ecx, edi
jge 0x6572c0
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [ebp + 8]
inc ecx
inc eax
cmp ecx, edx
jl 0x657353
jmp 0x6572c0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x338
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6577c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
jne 0x6577f5
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.00650cb0
cmp esi, 0xff
jae 0x6578ed
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x6578ed
test eax, eax
jne 0x657803
mov eax, dword [esp + 0xc]
test eax, eax
je 0x657803
cmp eax, 0x106
jb 0x657870
mov dword [esp + 0xc], 0x105
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x657877
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00698b47
add esp, 0xc
test eax, eax
jne 0x657803
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657803
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x657803
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.006574d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x657803
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x657900
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
jne 0x657935
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.00650bc0
cmp esi, 0xff
jae 0x657a2d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x657a2d
test eax, eax
jne 0x657943
mov eax, dword [esp + 0xc]
test eax, eax
je 0x657943
cmp eax, 0x106
jb 0x6579b0
mov dword [esp + 0xc], 0x105
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6579b7
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00698b47
add esp, 0xc
test eax, eax
jne 0x657943
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657943
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x657943
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.006577c0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x657943
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6580a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38c
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
je 0x658292
cmp edx, ebx
je 0x658292
cmp dword [ebp + 8], 0xa
jl 0x658292
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.006515e0
jmp 0x658100
cmp ebx, 0xff
jae 0x658287
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xac]
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
inc ebx
cmp esi, 0x103
je 0x658287
test esi, esi
jne 0x65827b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x658100
movsx ecx, byte [esp + 0x98]
push ecx
call fcn.006988e7
add esp, 4
test eax, eax
je 0x658100
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
lea eax, [esp + 0xa4]
push eax
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658100
mov edx, dword [esp + 0x14]
test edx, edx
je 0x658100
mov ecx, 0x7d
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1a4]
push ecx
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x40]
push ecx
push edx
mov dword [esp + 0x28], 0x1f3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x65827b
cmp dword [esp + 0x1c], 1
jne 0x658100
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658100
cmp eax, 0x1f4
jb 0x658224
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1a0]
call fcn.006571a0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x658100
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
jle 0x658100
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1a0]
sub esi, eax
lea ebx, [ebx]
cmp ecx, edi
jge 0x658100
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [ebp + 8]
inc ecx
inc eax
cmp ecx, edx
jl 0x658260
jmp 0x658100
cmp esi, 0x103
jne 0x658100
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6582a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x104
jne 0x6582d9
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.006512f0
jmp 0x6582f0
cmp esi, 0xff
jae 0x6583fc
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xa4]
push edx
push esi
push ebx
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x6583fc
test eax, eax
jne 0x6582f0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6582f0
movsx eax, byte [esp + 0x90]
push eax
call fcn.006988e7
add esp, 4
test eax, eax
je 0x6582f0
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x9c]
push edx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6582f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6582f0
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6583ec
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x6583ec
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x1c]
push eax
call fcn.006580a0
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
jmp 0x6582f0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6582f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658dc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
cmp esi, ebx
mov ebp, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
je 0x658fcb
cmp ebp, 0xa
jl 0x658fcb
push edi
mov ecx, ebp
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.006563f0
cmp eax, 1
lea ecx, [esp + 0x94]
mov edx, 0x64
jne 0x658e2e
call fcn.0064c990
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064d7c0
jmp 0x658e52
call fcn.0064cd80
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064d5e0
mov edx, 0x64
lea ecx, [esp + 0x1c0]
call fcn.0064daf0
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064d8e0
mov edx, 0x64
lea ecx, [esp + 0x15c]
call fcn.0064da00
lea ecx, [esp + 0x10]
push ecx
xor eax, eax
push 0x20019
mov dword [esp + 0x28], eax
push ebx
lea edx, [esp + 0xa0]
mov dword [esp + 0x30], eax
push edx
mov dword [esp + 0x38], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x40], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658fbb
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x658fbb
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x40]
push ecx
mov ebx, 4
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x658f59
cmp dword [esp + 0x14], ebx
jne 0x658f59
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x658f59
cmp dword [esp + 0x14], ebx
jne 0x658f59
mov ecx, dword [esp + 0x1c]
push ecx
push 0x6ddaa4
lea edx, [esp + 0x28]
push 0xd
push edx
call fcn.006986e4
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x658f43
sub eax, edx
push ebp
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00658ca0
call fcn.006563a0
cmp eax, 1
je 0x658f75
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x100]
call fcn.00658d20
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x164]
call fcn.00658d20
call fcn.006563f0
cmp eax, 1
je 0x658fa3
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x1c8]
call fcn.00658d20
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
pop edi
pop esi
pop ebp
mov eax, 0x338
pop ebx
add esp, 0x214
ret
pop esi
pop ebp
mov eax, 0x325
pop ebx
add esp, 0x214
ret
Function at 0x6590d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3f8
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov ebx, edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], 0x104
je 0x65931f
cmp ebx, 0xa
jl 0x65931f
mov ecx, ebx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064df40
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.0064e610
mov edx, 0x64
lea ecx, [esp + 0x298]
call fcn.0064e7b0
mov edx, 0x64
lea ecx, [esp + 0x1c8]
call fcn.0064e8d0
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.0064d7c0
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.0064da00
mov edx, 0x64
lea ecx, [esp + 0x230]
call fcn.0064ea30
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659312
mov eax, dword [esp + 0x14]
test eax, eax
je 0x659312
cmp ebp, 0xff
jae 0x6592fd
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x300]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x314]
push ecx
push ebp
push edx
mov dword [esp + 0x3c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc ebp
cmp eax, 0x103
je 0x6592fd
test eax, eax
jne 0x6591c3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6591c3
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x30c]
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6591c3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6591c3
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6592ed
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x6592ed
push ebx
push esi
lea edx, [esp + 0x2a0]
call fcn.00658d20
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x1d0]
call fcn.00658d20
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x98]
call fcn.00658d20
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x168]
call fcn.00658d20
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x238]
call fcn.00658d20
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6591c3
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x659820
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x104
jne 0x659855
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.006515e0
cmp esi, 0xff
jae 0x65992b
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65992b
test eax, eax
jne 0x659863
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659863
movsx eax, byte [esp + 0x88]
push eax
call fcn.006988e7
add esp, 4
test eax, eax
je 0x659863
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x94]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659863
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659863
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x14]
push eax
push edx
lea edx, [esp + 0x28]
call fcn.00658d20
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659863
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x659940
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
jne 0x659970
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xff
jae 0x659a0d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x659a0d
test eax, eax
jne 0x659970
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659970
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659970
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659970
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00659820
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659970
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4