joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret

Function at 0x40cb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40cb2f
pop dword [ebp - 0x10]
mov eax, 0x411c3afb
add eax, 0xbf249034
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x59ff619c
sub dword [ebp - 0x20], 0xbad1c51
mov dword [ebp - 0x1c], 0x6fc0c3c1
sub dword [ebp - 0x1c], 0x3d8d777c
mov dword [ebp - 0x18], 0x7f1cb5b3
add dword [ebp - 0x18], 0xcd2f8e7b
mov dword [ebp - 0x14], 0x15953690
add dword [ebp - 0x14], 0xea6ac970
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1e83264e
sub eax, 0x1e41f5b6
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xef34696b
add dword [ebp - 0x20], 0x853dffeb
mov dword [ebp - 0x1c], 0x635c17ae
add dword [ebp - 0x1c], 0xde1049c7
mov dword [ebp - 0x18], 0x3ac5aa94
add dword [ebp - 0x18], 0x28a9c1d8
mov dword [ebp - 0x14], 0x1791f166
add dword [ebp - 0x14], 0xe86e0e9a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc8f7f49d
add eax, 0x37493b9b
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3490d
push 0
call eax
mov ecx, 0x34fd
mov esi, eax
mov edi, 0x41a400
add edi, dword [ebp - 0x10]
mov edx, 0x2b5dda55
add edx, 0xb9e7136d
xor dword [ebp - 4], eax
mov ebx, dword [edi]
xor dword [ebp - 4], 0x1e80e146
sub ebx, edx
mov dword [ebp - 0xc], 0x7592f42c
mov dword [esi], ebx
sub dword [ebp - 4], 0xbf982b09
add esi, 0x76d6a628
add esi, 0x892959dc
add edi, 0xcc41e544
sub edi, 0xcc41e540
loop 0x40cc45
add eax, 0x1f540208
sub eax, 0x1f533b41
mov ebx, eax
add eax, 0xb8aa979b
add eax, 0x4755686a
mov ecx, 0x90b666d7
sub ecx, 0x907666d7
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401cc0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417678
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
push dword [ebp + 8]
call fcn.00401a90
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [edi + 4]
call fcn.004035a0
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
mov ecx, dword [edi + 4]
call fcn.00403680
mov ecx, dword [ebp - 0x44]
mov bl, al
test ecx, ecx
jne 0x401dcc
xor dl, dl
jmp 0x401dde
push dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x44]
test eax, eax
sete dl
test bl, bl
jne 0x401de6
test dl, dl
je 0x401de8
mov bl, 1
mov dword [ebp - 0x48], vtable.RegistryKey.0
test ecx, ecx
je 0x401e06
cmp ecx, dword [ebp - 0x40]
je 0x401dff
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.004032f0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x401e5d
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x401e3e
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401eac
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x401e97
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x401e8d
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401eb1
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x4020a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push edi
mov byte [ebp - 4], 3
call fcn.00401a90
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.004035a0
mov ebx, dword [ebp - 0x44]
test ebx, ebx
jne 0x4021a2
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x4021fa
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4021b0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x4021fa
cmp eax, dword [ebp - 0x40]
je 0x4021f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.004032f0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x402251
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402232
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022a1
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x40228b
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402281
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022a6
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x4022b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417700
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
push dword [ebp + 8]
call fcn.00401a90
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [edi + 4]
call fcn.004035a0
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x4023b2
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x4023fd
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0xb
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 8
push ecx
push 0
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x4c], vtable.RegistryKey.0
mov eax, dword [ebp - 0x48]
sete bl
test eax, eax
je 0x4023fd
cmp eax, dword [ebp - 0x44]
je 0x4023f6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.004032f0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x402454
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402435
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4024a3
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x40248e
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402484
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4024a8
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x4024b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.00401a90
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.004035a0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4025b8
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x4025f0
push 4
lea ecx, [ebp + 8]
push ecx
push 0xb
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x4025f0
cmp eax, dword [ebp - 0x40]
je 0x4025e9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.004032f0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x402647
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402628
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402697
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x402681
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402677
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40269c
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x402730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417700
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
push dword [ebp + 8]
call fcn.00401a90
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [edi + 4]
call fcn.004035a0
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x402832
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x40287d
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 4
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 4
push ecx
push 0
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x4c], vtable.RegistryKey.0
mov eax, dword [ebp - 0x48]
sete bl
test eax, eax
je 0x40287d
cmp eax, dword [ebp - 0x44]
je 0x402876
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.004032f0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x4028d4
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x4028b5
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402923
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x40290e
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402904
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402928
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x402930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.00401a90
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.004035a0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x402a38
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x402a70
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x402a70
cmp eax, dword [ebp - 0x40]
je 0x402a69
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.004032f0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x402ac7
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402aa8
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402b17
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x402b01
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402af7
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402b1c
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040a023
call fcn.0040a023
int3
Function at 0x402b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417740
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x42f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00401570
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4296c0
push ecx
call fcn.00405c40
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.00401a90
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.00401b70
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
call fcn.004035a0
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x402c92
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x402ce6
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], 3
mov eax, dword [esi]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402cbe
xor bl, bl
jmp 0x402cc5
mov eax, dword [ebp + 8]
mov bl, 1
mov dword [esi], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], vtable.RegistryKey.0
test eax, eax
je 0x402ce6
cmp eax, dword [ebp - 0x44]
je 0x402cdf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.004032f0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x402d3d
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402d1e
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d8d
push ecx
push edx
call fcn.0040462c
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x402d77
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x402d6d
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d92
push ecx
push edx
call fcn.0040462c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0040a023
call fcn.0040a023
int3