joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7aae4c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x7aaede
xor eax, eax
push ebp
push 0x7aaed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.007aadb8
test al, al
jne 0x7aae8c
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
je 0x7aae96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7aaede
mov esi, dword [ebp - 4]
mov edx, dword [esi + 0x3c]
mov eax, esi
call fcn.007aad1c
mov ebx, eax
mov edx, 0xf8
mov eax, ebx
call fcn.007aadb8
test al, al
jne 0x7aaebd
cmp dword [ebx], 0x4550
je 0x7aaec7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7aaede
mov dword [ebp - 8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7aaede
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x7ab14c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [0xa40b08]
cmp dword [eax], 2
jne 0x7ab1cc
test esi, esi
je 0x7ab168
test ebx, ebx
jne 0x7ab16c
xor eax, eax
jmp 0x7ab1d5
mov edx, esi
mov eax, ebx
call fcn.007aad24
test al, al
je 0x7ab1bb
test edi, edi
je 0x7ab18e
push esp
push edi
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x7ab1bb
mov eax, ebx
call fcn.007ab118
test al, al
je 0x7ab1ab
push esp
push 0x40
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x7ab1bb
push esp
push 4
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7ab1d5
mov edx, esi
mov eax, ebx
call fcn.007aad24
xor al, 1
jmp 0x7ab1d5
mov edx, esi
mov eax, ebx
call fcn.007ab018
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x7ab414
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x7ab5fd
cmp dword [ebp + 8], 0
je 0x7ab5fd
cmp dword [ebp - 0xc], 0
je 0x7ab5fd
test ebx, ebx
je 0x7ab5fd
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_IsBadCodePtr
test eax, eax
jne 0x7ab5fd
mov eax, dword [ebp - 4]
call fcn.007aaf50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x7ab5fd
mov eax, dword [ebp - 0xc]
call fcn.0040a278
push eax
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, ebx
call fcn.007ab310
mov esi, eax
test esi, esi
je 0x7ab5fd
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, esi
cmp eax, dword [ebp - 0x34]
jbe 0x7ab5f0
movzx edx, byte [esi]
cmp dl, byte [0xa06cb0]
jne 0x7ab5f0
inc eax
mov esi, dword [eax]
jmp 0x7ab5f0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.007aad1c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
call fcn.0040a278
mov edx, eax
mov eax, dword [ebp - 0x18]
call fcn.00425674
test eax, eax
jne 0x7ab5ec
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.007aad1c
mov ebx, eax
jmp 0x7ab5e3
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edi, esi
cmp eax, edi
je 0x7ab531
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x34]
jbe 0x7ab531
mov eax, dword [ebp - 8]
mov eax, dword [eax]
movzx eax, byte [eax]
cmp al, byte [0xa06cb0]
jne 0x7ab531
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp edi, dword [eax]
jne 0x7ab5e0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
je 0x7ab5fd
xor eax, eax
push ebp
push 0x7ab5ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x40
mov edx, 4
mov eax, dword [ebp - 8]
call fcn.007ab14c
test al, al
jne 0x7ab57b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7ab5fd
lea eax, [ebp + 8]
mov ecx, 0x40
mov edx, 4
call fcn.007ab14c
test al, al
jne 0x7ab59b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7ab5fd
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
test eax, eax
jne 0x7ab5c0
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
xchg dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7ab5db
mov dword [ebp - 0x10], esi
jmp 0x7ab5fd
add ebx, 4
cmp dword [ebx], 0
jne 0x7ab500
add dword [ebp - 0x14], 0x14
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
jne 0x7ab4c0
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7b0cf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x7b0d00
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b0e67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040961c
test eax, eax
jne 0x7b0d76
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.0040a40c
mov eax, dword [ebp - 4]
call fcn.0040a278
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
mov eax, dword [ebp - 4]
call fcn.0040a278
lea edx, [ebp - 0x24]
call fcn.004258d8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.007b0c54
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0040954c
mov eax, dword [0xa40838]
cmp byte [eax], 0
je 0x7b0e0e
lea eax, [ebp - 0x1c]
push eax
call sub.ole32.dll_CoCreateGuid
lea eax, [ebp - 0xc]
mov edx, 0x27
call fcn.0040a1c8
mov eax, dword [ebp - 0xc]
call fcn.00409628
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409e4c
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.ole32.dll_StringFromGUID2
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a370
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00423184
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.0040954c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040961c
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040a6b4
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a4e4
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.0042be0c
jmp 0x7b0e37
mov eax, ebx
mov edx, 0x105
call fcn.0040a40c
mov eax, dword [ebx]
call fcn.0040a278
push eax
push 0
push 0x7b0e74
mov eax, dword [ebp - 4]
call fcn.0040a278
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b0e6e
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00409184
lea eax, [ebp - 0xc]
call fcn.0040916c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409184
ret
Function at 0x7b4200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b4328
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x94], 0
je 0x7b42ec
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
cmp dword [ebp - 8], 0
jne 0x7b4279
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b56b4
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5778
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040954c
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
je 0x7b42dc
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b42d8
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x7b42c8
je 0x7b42c4
dec eax
je 0x7b42cc
sub eax, 3
je 0x7b42d0
jmp 0x7b42d4
mov bl, 5
jmp 0x7b42de
mov bl, 3
jmp 0x7b42de
mov bl, 2
jmp 0x7b42de
mov bl, 4
jmp 0x7b42de
xor ebx, ebx
jmp 0x7b42de
xor ebx, ebx
jmp 0x7b42de
xor ebx, ebx
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
jmp 0x7b4305
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x40]
test eax, eax
je 0x7b4303
movzx ebx, byte [eax + 0x10]
jmp 0x7b4305
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b432f
lea eax, [ebp - 0x14]
call fcn.00409124
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x7b5a24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b5b3a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x94], 0
je 0x7b5ae0
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x7c]
call fcn.0040954c
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.007b5000
test al, al
je 0x7b5ad2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
mov edi, eax
push edi
mov eax, dword [ebx + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b5ad2
cmp dword [ebp - 0x18], 3
jne 0x7b5ad2
push esi
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push edi
mov eax, dword [ebx + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete byte [ebp - 0xd]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.007b5000
jmp 0x7b5b1f
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov ebx, eax
test ebx, ebx
je 0x7b5b1f
cmp byte [ebx + 0x10], 5
jne 0x7b5b1f
mov edx, dword [esi]
mov eax, dword [ebx + 0x18]
cmp edx, eax
jge 0x7b5b0a
mov dword [esi], eax
jmp 0x7b5b1f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x14]
xchg ecx, eax
call fcn.00404b78
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b5b41
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x7b5b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b5c89
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x94], 0
je 0x7b5c2b
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
xor ebx, ebx
mov eax, dword [ebp + 8]
movzx edx, byte [ebp + 0xc]
mov byte [eax], dl
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
je 0x7b5c1d
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b5c1d
cmp dword [ebp - 0x14], 4
jne 0x7b5c1d
cmp dword [ebp - 0x10], 4
jne 0x7b5c1d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
setne byte [eax]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
jmp 0x7b5c6e
xor ebx, ebx
mov eax, dword [ebp + 8]
movzx edx, byte [ebp + 0xc]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x40]
test eax, eax
je 0x7b5c6e
movzx edx, byte [eax + 0x10]
cmp dl, 1
jne 0x7b5c5d
mov edx, dword [ebp + 8]
movzx eax, byte [eax + 0x11]
mov byte [edx], al
mov bl, 1
jmp 0x7b5c6e
cmp dl, 2
jne 0x7b5c6e
cmp dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
setne byte [eax]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b5c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x7b5c9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b5e18
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x94], 0
je 0x7b5d72
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x7c]
call fcn.0040954c
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.007b5000
test al, al
je 0x7b5d61
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [ebx + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b5d61
cmp dword [ebp - 0x18], 4
jne 0x7b5d61
cmp dword [ebp - 0x14], 4
jne 0x7b5d61
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [ebx + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete byte [ebp - 0xd]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.007b5000
jmp 0x7b5df5
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov ebx, eax
test ebx, ebx
je 0x7b5df0
movzx eax, byte [ebx + 0x10]
cmp al, 1
jne 0x7b5d9d
movzx eax, byte [ebx + 0x11]
mov dword [esi], eax
mov byte [ebp - 0xd], 1
jmp 0x7b5df5
cmp al, 6
jne 0x7b5db1
fld qword [ebx + 0x18]
call fcn.004050d4
mov dword [esi], eax
mov byte [ebp - 0xd], 1
jmp 0x7b5df5
cmp al, 2
jne 0x7b5dc0
mov eax, dword [ebx + 0x14]
mov dword [esi], eax
mov byte [ebp - 0xd], 1
jmp 0x7b5df5
cmp al, 3
jne 0x7b5de9
lea eax, [ebp - 0x1c]
mov edx, dword [ebx + 0x14]
call fcn.0040a2e0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
call fcn.00406430
mov dword [esi], eax
cmp dword [ebp - 0x14], 0
jle 0x7b5df5
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
jmp 0x7b5df5
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
jmp 0x7b5df5
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b5e1f
lea eax, [ebp - 0x1c]
call fcn.00409124
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x7b5e2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b5fb4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x94], 0
je 0x7b5f49
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
xor ebx, ebx
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
je 0x7b5f3b
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
mov edi, eax
push edi
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b5f3b
cmp dword [ebp - 0x18], 7
jne 0x7b5f3b
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.0040a40c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push edi
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov edx, dword [ebp - 0x10]
mov eax, 0x7b5fd4
call fcn.0040a860
mov edi, eax
test edi, edi
jle 0x7b5f1a
mov eax, dword [ebp - 0x10]
call fcn.0040961c
mov ecx, eax
sub ecx, edi
inc ecx
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040a6fc
lea eax, [ebp - 0x10]
mov ecx, 0x7b5fe8
mov edx, 0x7b5ffc
call fcn.0079e7d0
test al, al
jne 0x7b5f1a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
jmp 0x7b5f91
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x40]
mov esi, eax
test esi, esi
je 0x7b5f91
movzx eax, byte [esi + 0x10]
cmp al, 4
jne 0x7b5f75
mov edx, dword [esi + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov bl, 1
jmp 0x7b5f91
cmp al, 3
jne 0x7b5f91
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x14]
call fcn.004258d8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b5fbb
lea eax, [ebp - 0x1c]
call fcn.00409124
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409184
ret
Function at 0x7b762c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b776a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x94], 0
je 0x7b76c6
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x7c]
call fcn.0040954c
mov byte [ebp - 0x11], 0
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.007b5000
test al, al
je 0x7b76b5
push edi
mov eax, dword [ebp + 0xc]
push eax
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [ebx + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete byte [ebp - 0x11]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.007b5000
jmp 0x7b774f
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x7c]
call fcn.0040954c
mov byte [ebp - 0x11], 0
cmp byte [ebx + 0x9c], 0
jne 0x7b774f
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.007b5000
test al, al
jne 0x7b76fc
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.007b5000
jmp 0x7b774f
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.007b393c
mov esi, eax
mov byte [esi + 0x10], 5
mov eax, edi
call fcn.004048f0
mov dword [esi + 0x14], eax
mov edx, dword [esi + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, edi
call fcn.00404b78
mov dword [esi + 0x18], edi
mov byte [ebp - 0x11], 1
mov byte [ebx + 0x85], 1
cmp byte [ebx + 0x84], 0
jne 0x7b7743
mov eax, ebx
call fcn.007b6eb0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.007b5000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b7771
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409184
ret
Function at 0x7b7780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b78b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x94], 0
je 0x7b7825
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
xor ebx, ebx
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
je 0x7b7817
cmp byte [ebp + 8], 0
je 0x7b77eb
mov dword [ebp - 0x14], 1
jmp 0x7b77f0
xor eax, eax
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.007b5000
jmp 0x7b7895
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
xor ebx, ebx
cmp byte [esi + 0x9c], 0
jne 0x7b7895
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
jne 0x7b7859
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
jmp 0x7b7895
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.007b393c
mov byte [eax + 0x10], 1
movzx edx, byte [ebp + 8]
mov byte [eax + 0x11], dl
mov bl, 1
mov byte [esi + 0x85], 1
cmp byte [esi + 0x84], 0
jne 0x7b7889
mov eax, esi
call fcn.007b6eb0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b78b7
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409184
ret
Function at 0x7b78c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp - 8]
call fcn.00409208
xor eax, eax
push ebp
push 0x7b79d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [esi + 0x94], 0
je 0x7b7955
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
je 0x7b7947
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040a278
push eax
mov eax, dword [esi + 0x8c]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.007b5000
jmp 0x7b79b9
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x7c]
call fcn.0040954c
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.007b5000
test al, al
jne 0x7b797e
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
jmp 0x7b79b9
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.007b393c
mov byte [eax + 0x10], 2
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov bl, 1
mov byte [esi + 0x85], 1
cmp byte [esi + 0x84], 0
jne 0x7b79ad
mov eax, esi
call fcn.007b6eb0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007b5000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b79db
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409184
ret