joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406bb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x420c63
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x423344]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], 0x403e64
call fcn.0040797a
mov dword [esp + 0x1c], 0
push 4
call fcn.004083fa
mov edi, eax
add esp, 4
test edi, edi
je 0x406c38
call fcn.00407852
mov dword [edi], eax
call fcn.00407611
push 0
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0040793b
mov byte [esp + 0x1c], 1
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
jae 0x406c28
inc eax
mov dword [ebp + 4], eax
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x10]
call fcn.00407963
jmp 0x406c3a
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4

Function at 0x407f94
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423344]
jne 0x407f9e
repz ret
jmp fcn.0040ac35
Function at 0x4127af
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b854
and dword [ebp - 0x14], 0
cmp dword [0x4259a8], 0
mov dword [ebp - 0x18], eax
jne 0x412862
push 0x403db4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41290a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403da8
push ebx
call edi
test eax, eax
je 0x41290a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403d98
push ebx
mov dword [0x4259a8], eax
call edi
push eax
call esi
push 0x403d84
push ebx
mov dword [0x4259ac], eax
call edi
push eax
call esi
push 0x403d68
push ebx
mov dword [0x4259b0], eax
call edi
push eax
call esi
mov dword [0x4259b8], eax
test eax, eax
je 0x412862
push 0x403d50
push ebx
call edi
push eax
call esi
mov dword [0x4259b4], eax
mov eax, dword [0x4259b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4128bb
cmp dword [0x4259b8], ecx
je 0x4128bb
push eax
call esi
push dword [0x4259b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4128bb
test ebx, ebx
je 0x4128bb
call edi
test eax, eax
je 0x4128b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4128b2
test byte [ebp - 8], 1
jne 0x4128bb
or dword [ebp + 0x10], 0x200000
jmp 0x4128ee
mov eax, dword [0x4259ac]
cmp eax, dword [ebp - 0x18]
je 0x4128ee
push eax
call esi
test eax, eax
je 0x4128ee
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4128ee
mov eax, dword [0x4259b0]
cmp eax, dword [ebp - 0x18]
je 0x4128ee
push eax
call esi
test eax, eax
je 0x4128ee
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4259a8]
call esi
test eax, eax
je 0x41290a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41290c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407f94
leave
ret

Function at 0x4203d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x425ad8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4203d7
mov ecx, dword [0x403e34]
mov edx, dword [0x403e38]
mov dword [eax], ecx
mov ecx, dword [0x403e3c]
mov dword [eax + 4], edx
mov dl, byte [0x403e40]
mov dword [eax + 8], ecx
push 0x425ad8
mov byte [eax + 0xc], dl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x43412c]
mov edx, dword [0x432ea8]
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x420480
Capabilities:
Enumerate services

Disassembly:
sub esp, 0x34
mov eax, dword [0x423344]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
xor esi, esi
test edi, edi
jle 0x4204da
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
cmp edi, 0x469
jne 0x4204aa
push 0
push 0
call ebp
call fcn.00420350
xor byte [ebx + esi], al
cmp edi, 0x101e
jne 0x4204d5
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
inc esi
cmp esi, edi
jl 0x42049c
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
call fcn.00407f94
add esp, 0x34
ret
Function at 0x401140
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x415123
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
xor edi, edi
mov esi, 0x811c9dc5
test edx, edx
je 0x415141
movzx eax, byte [edi + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edi
cmp edi, edx
jb 0x415130
pop edi
mov eax, esi
pop esi
ret

Function at 0x41779c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4177b3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4177d0
push edi
mov edx, esi
lea ecx, [ebp - 8]
call fcn.00417687
mov eax, dword [eax]
jmp 0x417824
test edi, edi
je 0x4177f3
mov eax, dword fs:[0x2c]
and dword [edi], 0
mov ecx, dword [eax]
mov eax, dword [0x83436c]
cmp eax, dword [ecx + 0x2c]
jg 0x41782b
mov dword [edi + 4], vtable.boost::system::detail::system_error_category.0
test ebx, 0x400
je 0x417819
mov ecx, esi
call fcn.004175ff
test al, al
je 0x417814
push 4
pop eax
push 0xb
test bl, 0x10
pop ecx
cmovne eax, ecx
jmp 0x417824
push 9
pop eax
jmp 0x417824
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x83436c
call fcn.0064cbb6
cmp dword [0x83436c], 0xffffffff
pop ecx
jne 0x4177ec
push 0x6c596d
mov dword [0x81a660], 0x81a65c
mov dword [vtable.boost::system::error_category::std_category.0], 0x6db944
mov dword [0x81a664], 0x81a658
mov dword [vtable.boost::system::detail::system_error_category.0], 0x6dbcc4
call fcn.0064c9fd
mov dword [esp], 0x83436c
call fcn.0064cb6c
pop ecx
jmp 0x4177ec
Function at 0x4178d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x28
mov eax, 0x695cae
call fcn.0064d018
mov edi, edx
mov ebx, ecx
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4178ee
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x41790d
push 0
mov edx, edi
mov ecx, ebx
call fcn.00417687
jmp 0x4179b5
test eax, 0x400
je 0x417985
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41791e
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d412
push ecx
push 0x2000000
sub esp, 0xc
lea ecx, [ebp - 0x2c]
xor edx, edx
call fcn.004175dd
mov esi, eax
mov dword [ebp - 0x34], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0040d475
cmp esi, 0xffffffff
je 0x4178fd
mov ecx, edi
call fcn.004175ff
test al, al
jne 0x417977
mov edx, dword [ebp - 0x30]
mov ecx, edi
call fcn.00417532
push esi
mov dword [ebx], 9
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4179b5
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
mov edx, eax
mov ecx, edi
mov esi, eax
call fcn.00417532
mov ecx, eax
and esi, 0x10
je 0x41799c
mov edx, dword [ebp - 0x34]
jmp 0x4179a1
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [ebx], eax
cmove ecx, edx
mov dword [ebx + 4], ecx
mov eax, ebx
call fcn.0064cfc2
ret 4

Function at 0x41e706
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x696135
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, 0x81a678
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi], 0x6dc610
inc eax
lock xadd dword [ecx], eax
push dword [ebp + 0xc]
inc eax
lea ecx, [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
call fcn.0040d3df
xor ebx, ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov word [esi + 0x34], bx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea eax, [esi + 0x58]
mov dword [ebp - 4], ebx
push 2
push eax
mov dword [esi + 0x54], 0x6dc600
call fcn.0063a383
pop ecx
mov dword [esi + 0x88], 1
pop ecx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
call fcn.0040d973
mov dword [esi + 0x8c], eax
mov eax, esi
mov dword [esi + 0x54], 0x6dc600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424367
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [edi + 0x20], 0
je 0x42440e
push 8
pop edx
mov eax, esi
mov dword [ebp - 0x39c], 0xb
mov dword [ebp - 0x3a0], edx
cmp dword [esi + 0x14], edx
jb 0x4243aa
mov eax, dword [esi]
lea edx, [ebp - 0x3a0]
push edx
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
je 0x4243ed
cmp ecx, 2
je 0x4243fa
cmp ecx, 0xea
je 0x4243fa
push esi
lea eax, [edi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.00425419
jmp 0x424420
cmp dword [ebp - 0x39c], 0xb
jne 0x4243fa
mov al, 1
jmp 0x4243fc
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.GetValue_failure:_Cannot_get_QWORD_value._The_registry_key_is_closed_or_not_set
push 0x3a
lea ecx, [ebp - 0x398]
call fcn.004253fc
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3

Function at 0x424432
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0x20], 0
mov edi, dword [ebp + 0xc]
je 0x424562
xor edx, edx
mov dword [ebp - 0x39c], 1
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3a0], edx
jb 0x424476
mov eax, dword [esi]
lea ecx, [ebp - 0x3a0]
push ecx
push edx
lea ecx, [ebp - 0x39c]
push ecx
push edx
push eax
push dword [ebx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x42454d
cmp dword [ebp - 0x39c], 1
je 0x4244b1
cmp dword [ebp - 0x39c], 2
jne 0x42454d
test ecx, ecx
je 0x4244cd
push esi
lea eax, [ebx + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.00425419
jmp 0x424570
and dword [edi + 0x10], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4244db
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x3a0]
cmp ecx, 2
ja 0x4244ef
mov al, 1
jmp 0x42454f
shr ecx, 1
dec ecx
push 0
push ecx
mov ecx, edi
call fcn.00414b29
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x424506
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x424510
mov eax, dword [esi]
lea edx, [ebp - 0x3a0]
push edx
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push 0
push eax
push dword [ebx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x424538
push esi
lea ecx, [ebx + 8]
push ecx
push ecx
push eax
jmp 0x4244bc
mov eax, dword [ebp - 0x3a0]
mov ecx, edi
shr eax, 1
push 0
dec eax
push eax
call fcn.00414b29
jmp 0x4244eb
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push esi
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.0042543b
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x427101
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [edi + 0x20], 0
je 0x4271a2
cmp dword [esi + 0x14], 8
mov eax, esi
push 4
pop ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3a0], ebx
jb 0x42713e
mov eax, dword [esi]
lea edx, [ebp - 0x3a0]
push edx
push ecx
lea ecx, [ebp - 0x39c]
push ecx
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
je 0x427181
cmp ecx, 2
je 0x42718d
cmp ecx, 0xea
je 0x42718d
push esi
lea eax, [edi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.00425419
jmp 0x4271b4
cmp dword [ebp - 0x39c], ebx
jne 0x42718d
mov al, 1
jmp 0x42718f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.GetValue_failure:_Cannot_get_DWORD_value._The_registry_key_is_closed_or_not_set
push 0x3a
lea ecx, [ebp - 0x398]
call fcn.004253fc
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3

Function at 0x4292f9
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x429453
mov eax, ecx
mov ebx, 0x10000000
cmp eax, 0x7c
je 0x429453
cmp eax, 0x29
jne 0x429338
cmp dword [esi + 0x10], 0
jne 0x429453
cmp eax, eax
jne 0x429338
test dword [esi + 0x50], ebx
je 0x429461
cmp eax, 0x2e
jne 0x429353
push 5
lea ecx, [esi + 0x24]
call fcn.00429545
mov ecx, esi
call fcn.004292ce
jmp 0x42943c
cmp eax, 0x5c
jne 0x4293a8
mov ecx, esi
call fcn.004292ce
test byte [esi + 0x50], 0x80
je 0x42939c
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x429384
push 4
lea ecx, [esi + 0x24]
call fcn.00429545
mov ecx, esi
call fcn.004292ce
jmp 0x429443
cmp eax, 0x42
jne 0x42939c
push 4
lea ecx, [esi + 0x24]
call fcn.00429545
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x429378
mov ecx, esi
call fcn.00429d12
jmp 0x42943c
cmp eax, 0x5b
jne 0x4293c8
mov ecx, esi
call fcn.004292ce
mov ecx, esi
call fcn.00429cc6
cmp dword [esi + 0x4c], 0x5d
je 0x429347
push 4
jmp 0x429463
cmp eax, 0x28
jne 0x4293e5
mov ecx, esi
call fcn.004292ce
mov ecx, esi
call fcn.00429df9
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x429461
jmp 0x429431
cmp eax, 0x5e
jne 0x4293ee
push 2
jmp 0x429370
cmp eax, 0x24
jne 0x4293fa
push 3
jmp 0x429370
cmp eax, 0x2a
je 0x42945d
cmp eax, 0x2b
je 0x42945d
cmp eax, 0x3f
je 0x42945d
cmp eax, 0x7b
je 0x42945d
cmp ecx, 0x7d
jne 0x429418
test dword [esi + 0x50], ebx
je 0x429459
cmp ecx, 0x5d
jne 0x429422
test dword [esi + 0x50], ebx
je 0x4293c1
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00429fc9
mov bl, 1
mov ecx, esi
call fcn.004292ce
test bl, bl
je 0x429443
mov ecx, esi
call fcn.00429efe
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x42930e
pop esi
mov al, dl
pop ebx
pop ecx
ret
push 6
jmp 0x429463
push 0xa
jmp 0x429463
push 5
call fcn.00428955
int3
Function at 0x4355de
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffff
push edx
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push 2
pop edi
cmp edx, edi
jae 0x435621
cmp ecx, 1
je 0x43561f
cmp ecx, edi
jne 0x435621
mov eax, edi
cmp eax, 0x3f2
je 0x43566c
cmp eax, 0x3fa
je 0x43566c
cmp eax, 6
je 0x43566c
test eax, eax
jne 0x43566c
cmp ecx, edi
je 0x435641
cmp ecx, 1
jne 0x43564d
shr edx, 1
xor ecx, ecx
mov word [esi + edx*2 - 2], cx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ebp + 0x10]
cmp ecx, edx
je 0x43566c
sub ecx, 1
je 0x435666
sub ecx, 1
jne 0x43566a
cmp edx, 1
jne 0x43566a
jmp 0x43566c
cmp edx, edi
je 0x43566c
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4356c4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x697e0c
call fcn.0064cfe4
mov ebx, ecx
test ebx, ebx
jne 0x4356dd
xor eax, eax
jmp 0x435871
and dword [ebp - 0x18], 0
mov eax, 0x6dfd18
xor edx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
or dword [ebp - 0x10], 0xffffffff
sub esp, 0x20
mov esi, ebx
push 8
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
call fcn.00435674
mov esi, eax
cmp esi, 0xffffffff
je 0x435804
push ecx
push 0x829ab8
lea ecx, [ebp - 0x44]
call fcn.00422bbb
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], 1
jmp 0x43579e
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebx]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 2
mov dword [ebp - 0x10], eax
jae 0x43575c
cmp dword [ebp - 0x18], 1
je 0x435756
cmp dword [ebp - 0x18], 2
jne 0x43575c
push 2
pop eax
mov dword [ebp - 0x10], eax
cmp eax, 0x3f2
je 0x43576f
cmp eax, 0x3fa
je 0x43576f
cmp eax, 6
jne 0x4357dc
mov eax, dword [ebx + 0x10]
movzx eax, word [eax + 6]
and eax, 0x1f
shl eax, 4
cmp byte [ebp - 0x20], 0
mov dword [eax + 0x816b40], edi
je 0x435797
cmp dword [ebp - 0x24], 0
je 0x435797
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], 1
push ecx
mov byte [ebp - 4], 1
push dword [ebx + 0x18]
mov edx, dword [ebx + 0x10]
push esi
push ecx
lea ecx, [ebp - 0x38]
call fcn.00434ef7
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push eax
call fcn.00437595
lea ecx, [ebp - 0x34]
call fcn.00438188
cmp dword [ebp - 0x10], 0
je 0x43572c
jmp 0x4357e0
test eax, eax
je 0x43581a
cmp byte [ebp - 0x20], 0
je 0x4357f5
cmp dword [ebp - 0x24], 0
je 0x4357f5
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00422b96
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
cmp eax, str.AccessChangeInstallLanguage
jne 0x4356ee
jmp 0x43583a
cmp byte [ebp - 0x20], 0
je 0x43582f
cmp dword [ebp - 0x24], 0
je 0x43582f
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
call fcn.00422b96
mov edx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
jne 0x435866
cmp dword [ebp - 0x18], 2
je 0x43584f
mov al, byte [ebx + 0x14]
and al, 0xf
cmp al, 2
jne 0x43586f
cmp edx, 0x82
jae 0x43585e
mov edx, 0x208
jmp 0x43586f
add edx, 0x104
jmp 0x43586f
mov ecx, ebx
call fcn.00431fb1
mov edx, eax
mov eax, edx
call fcn.0064cfad
ret
Function at 0x435e3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x697d52
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov ebx, ecx
and dword [ebp - 0x14], 0
mov eax, 0x6dfd18
mov dword [ebp - 0x18], eax
sub esp, 0x20
mov esi, ebx
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
push 8
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
call fcn.00435674
mov esi, eax
cmp esi, edx
je 0x435fd0
push ecx
push 0x829ab8
lea ecx, [ebp - 0x44]
call fcn.00422bbb
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
push ecx
push dword [ebx + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push esi
push ecx
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x28], eax
call fcn.00434ef7
push eax
lea ecx, [ebp - 0x2c]
call fcn.00437595
lea ecx, [ebp - 0x34]
call fcn.00438188
cmp dword [ebp - 0x10], 0
jne 0x435fb0
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push dword [ebp - 0x1c]
mov dword [edi], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp eax, 0x3f2
je 0x435f19
cmp eax, 0x3fa
je 0x435f19
cmp eax, 6
jne 0x435f84
mov eax, dword [ebx + 0x10]
movzx eax, word [eax + 6]
and eax, 0x1f
shl eax, 4
and dword [eax + 0x816b40], 0
cmp byte [ebp - 0x20], 0
je 0x435f42
cmp dword [ebp - 0x24], 0
je 0x435f42
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
push ecx
push dword [ebx + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push esi
push ecx
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x28], eax
call fcn.00434ef7
push eax
lea ecx, [ebp - 0x2c]
call fcn.00437595
lea ecx, [ebp - 0x34]
call fcn.00438188
cmp dword [ebp - 0x10], 0
je 0x435ee8
jmp 0x435fb0
test eax, eax
jne 0x435fb0
movzx ecx, word [ebx + 0x14]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x14], eax
je 0x435ffa
cmp dword [ebp - 0x14], 3
jne 0x435fa9
cmp dword [edi], 4
jne 0x435fa9
and cl, 0xf
cmp cl, 4
je 0x435ffa
mov dword [ebp - 0x10], 2
cmp byte [ebp - 0x20], 0
je 0x435fc5
cmp dword [ebp - 0x24], 0
je 0x435fc5
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
call fcn.00422b96
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 0x18], eax
cmp eax, str.AccessChangeInstallLanguage
jne 0x435e74
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp - 0x20], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
je 0x436018
cmp dword [ebp - 0x24], 0
je 0x436018
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
call fcn.00422b96
xor eax, eax
jmp 0x435fe6