joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434844
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x434875
je 0x4348cf
sub eax, 7
je 0x434896
dec eax
je 0x4348c0
sub eax, 0x17
je 0x434974
jmp 0x4349b2
add eax, 0xffffff00
sub eax, 9
jb 0x434960
add eax, 0xffffff09
sub eax, 0xb
jb 0x434928
jmp 0x4349b2
mov eax, ebx
call fcn.00446b00
mov edi, eax
test edi, edi
je 0x434a12
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x434a1b
jmp 0x434a12
test byte [ebx + 0x44], 0x20
jne 0x434a1b
jmp 0x434a12
mov edx, esi
mov eax, ebx
call fcn.00431e44
cmp dword [esi + 0xc], 0xffffffff
jne 0x434a1b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407700
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00430918
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043471c
test eax, eax
je 0x434a1b
mov dword [esi + 0xc], 1
jmp 0x434a1b
mov edx, esi
mov eax, ebx
call fcn.004347b0
test al, al
je 0x434a12
cmp dword [esi + 0xc], 0
jne 0x434a1b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00436eac
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x434a1b
mov eax, ebx
call fcn.004314e0
test al, al
jne 0x434a1b
jmp 0x434a12
mov eax, ebx
call fcn.00436eac
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x434a12
cmp dword [0x48c82c], 0
je 0x434a12
mov eax, dword [0x48c82c]
cmp ebx, dword [eax + 0x24]
jne 0x434a12
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x48c82c]
call fcn.00431d78
jmp 0x434a12
mov eax, dword [0x48e750]
cmp byte [eax + 0x20], 0
je 0x434a12
mov eax, dword [0x48e750]
cmp dword [eax + 0x1c], 0
je 0x434a12
mov eax, dword [esi]
mov edx, dword [0x48e750]
cmp eax, dword [edx + 0x1c]
jne 0x434a12
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00446a44
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.004030dc
jmp 0x434a1b
mov edx, esi
mov eax, ebx
call fcn.00431e44
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434edc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x434ef8
cmp dword [esi + 4], 0
je 0x434f25
test byte [ebx + 0x45], 1
jne 0x434f17
mov eax, ebx
call fcn.00433e14
test eax, eax
jne 0x434f17
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x435035
mov edx, esi
mov eax, ebx
call fcn.00434b54
jmp 0x435035
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43502e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00436eac
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00431d78
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00434edc
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00436eac
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435035
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ee24
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403c0c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ee73
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403e3c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44681c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48e7e8
cmp dword [edi], 0
jne 0x446898
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48e7e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48c9c0
mov ecx, 2
call fcn.0040285c
mov edx, 0x4467f4
lea eax, [esi + 5]
call fcn.00446814
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00446814
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x44686d
mov dword [0x48e7e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4469b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446a04]
test si, 4
je 0x4469c8
or bl, 1
test si, 8
je 0x4469d2
or bl, 4
test si, 1
je 0x4469dc
or bl, 8
test si, 2
je 0x4469e6
or bl, 0x10
test si, 0x10
je 0x4469f0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4469ff
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x446a08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446a40]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446a21
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446a30
or bl, 4
test esi, 0x20000000
je 0x446a3b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44cbe8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44cbfa
add esp, 0xfffffff0
call fcn.00403200
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004161b0
mov eax, ebx
call fcn.0044cf34
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x44cbb8
push eax
push 0
push 0
mov eax, dword [0x48d06c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x417678]
call fcn.00418bb0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x417678]
call fcn.00418bb0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x417678]
call fcn.00418bb0
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0044d3a4
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d278
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d278
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d278
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44cd09
call fcn.00403258
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44d05c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d207
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x44d1e8
mov dl, 1
mov eax, dword [0x40f790]
call fcn.00402ed0
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403c0c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44d1d7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043b478
test al, al
je 0x44d1ca
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44d218
lea eax, [ebp - 0x254]
call fcn.00409838
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44d1ca
xor eax, eax
push ebp
push 0x44d1c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44d250
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d1ac
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403e3c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44d1ac
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1ca
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44d0cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00412dd4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d20e
lea eax, [ebp - 0x260]
call fcn.00403c0c
ret

Function at 0x44da9c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48e7d8]
cmp byte [eax + 0x95], 0
jne 0x44db0d
cmp dword [0x48e7f4], 0
jne 0x44dace
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44da58
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48e7f4], eax
cmp dword [0x48e7f0], 0
jne 0x44dae9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x48e7f0], eax
cmp dword [0x48e7f8], 0
jne 0x44db0d
push esp
push 0
push 0
push 0x44d9fc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x48e7f8], eax
pop edx
ret
Function at 0x44dc04
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44dc1b
add esp, 0xfffffff0
call fcn.00403200
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004161b0
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40f264]
call fcn.00402ed0
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x418008]
call fcn.0041f544
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x44dd90
mov eax, dword [0x48cf68]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041f914
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f74c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48cf68]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c7a8
test eax, eax
je 0x44dd0e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004091ac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c7d0
test eax, eax
je 0x44dd22
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e3c
mov eax, dword [0x48ce0c]
cmp byte [eax], 0
jne 0x44dd53
mov eax, ebx
call fcn.0044de7c
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44dd85
call fcn.00403258
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e0ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48e7d8]
cmp dword [eax + 0x24], 0
je 0x44e18f
cmp dword [ebx + 0x84], 0
jne 0x44e189
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e07c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x44e189
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e152
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e189
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00410c18
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e161
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44eb9c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x44ebd1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cf4
jmp 0x44ebdb
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403c60
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44fac0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x44faf8
mov eax, esi
call fcn.004371a8
test al, al
je 0x44faf8
mov eax, dword [ebx + 0x74]
call fcn.00436eac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44faf8
push 0
mov eax, dword [ebx + 0x74]
call fcn.00436eac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x455df4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
mov eax, dword [0x48d0f0]
mov eax, dword [eax]
call fcn.0044ef0c
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x455e2c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x455e05
mov esp, ebp
pop ebp
ret

Function at 0x455e98
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00455e30
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x455eb9
xor eax, eax
call fcn.00455e68
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x455ed3
mov al, 1
call fcn.00455e68
mov esp, ebp
pop ebp
ret
Function at 0x457218
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457381
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403ca4
mov eax, dword [ebp - 0x10]
call fcn.00456e68
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45726a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004040d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00457600
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45733f
xor eax, eax
push ebp
push 0x457338
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00457014
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00457390
test al, al
je 0x457316
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403cf4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x457316
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404050
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x457310
mov eax, dword [ebp - 0x14]
call fcn.00404050
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403dc4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00457218
dec ebx
cmp ebx, 0xffffffff
jne 0x4572c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45733f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00457014
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404050
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00457000
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457388
lea eax, [ebp - 0x3c]
call fcn.00403c0c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403c30
ret
Function at 0x45733f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457381
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403ca4
mov eax, dword [ebp - 0x10]
call fcn.00456e68
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45726a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004040d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00457600
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45733f
xor eax, eax
push ebp
push 0x457338
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00457014
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00457390
test al, al
je 0x457316
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403cf4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x457316
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404050
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x457310
mov eax, dword [ebp - 0x14]
call fcn.00404050
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403dc4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00457218
dec ebx
cmp ebx, 0xffffffff
jne 0x4572c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45733f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00457014
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404050
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00457000
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457388
lea eax, [ebp - 0x3c]
call fcn.00403c0c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403c30
ret

Function at 0x457390
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402bb0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x48d288]
cmp byte [edx + 8], 0
je 0x4573f4
mov edx, dword [0x48d27c]
cmp dword [edx], 2
jne 0x4573f4
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x457514
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00456e7c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404050
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x457572
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x48d074]
mov dl, 1
mov eax, dword [0x456d08]
call fcn.0040bbcc
call fcn.00403658
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45757c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404050
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4575d4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x48d294]
mov dl, 1
mov eax, dword [0x456d08]
call fcn.0040bbcc
call fcn.00403658
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00456eac
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8