joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cb74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43cba5
je 0x43cbff
sub eax, 7
je 0x43cbc6
dec eax
je 0x43cbf0
sub eax, 0x17
je 0x43cca4
jmp 0x43cce2
add eax, 0xffffff00
sub eax, 9
jb 0x43cc90
add eax, 0xffffff09
sub eax, 0xb
jb 0x43cc58
jmp 0x43cce2
mov eax, ebx
call fcn.0044fea8
mov edi, eax
test edi, edi
je 0x43cd42
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x43cd4b
jmp 0x43cd42
test byte [ebx + 0x44], 0x20
jne 0x43cd4b
jmp 0x43cd42
mov edx, esi
mov eax, ebx
call fcn.0043a0ec
cmp dword [esi + 0xc], 0xffffffff
jne 0x43cd4b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00408c28
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00438bc8
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043ca4c
test eax, eax
je 0x43cd4b
mov dword [esi + 0xc], 1
jmp 0x43cd4b
mov edx, esi
mov eax, ebx
call fcn.0043cae0
test al, al
je 0x43cd42
cmp dword [esi + 0xc], 0
jne 0x43cd4b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0043f298
push eax
call fcn.0040858c
jmp 0x43cd4b
mov eax, ebx
call fcn.00439788
test al, al
jne 0x43cd4b
jmp 0x43cd42
mov eax, ebx
call fcn.0043f298
mov edi, eax
call fcn.004086ac
cmp edi, eax
jne 0x43cd42
cmp dword [0x7008c0], 0
je 0x43cd42
mov eax, dword [0x7008c0]
cmp ebx, dword [eax + 0x24]
jne 0x43cd42
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x7008c0]
call fcn.0043a020
jmp 0x43cd42
mov eax, dword [0x732750]
cmp byte [eax + 0x20], 0
je 0x43cd42
mov eax, dword [0x732750]
cmp dword [eax + 0x1c], 0
je 0x43cd42
mov eax, dword [esi]
mov edx, dword [0x732750]
cmp eax, dword [edx + 0x1c]
jne 0x43cd42
lea eax, [ebp - 0x110]
push eax
call fcn.00408754
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0044fdec
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00403300
jmp 0x43cd4b
mov edx, esi
mov eax, ebx
call fcn.0043a0ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d20c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43d228
cmp dword [esi + 4], 0
je 0x43d255
test byte [ebx + 0x45], 1
jne 0x43d247
mov eax, ebx
call fcn.0043c0bc
test eax, eax
jne 0x43d247
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43d365
mov edx, esi
mov eax, ebx
call fcn.0043ce84
jmp 0x43d365
push 0
call fcn.004086ec
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call fcn.0040815c
mov dword [ebp - 8], eax
push edi
push 0
call fcn.004089c4
push 0
call fcn.00408164
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004083dc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43d35e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043f298
push eax
call fcn.004084cc
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043a020
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043d20c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call fcn.0040812c
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043f298
push eax
call fcn.00408654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d365
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004083dc
mov eax, dword [ebp - 4]
push eax
call fcn.004081dc
mov eax, dword [ebp - 8]
push eax
call fcn.004081ec
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x447700
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403ec4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call fcn.00408924
shl eax, 0x10
test eax, eax
je 0x44774f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call fcn.00408734
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44fbc4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x7327e8
cmp dword [edi], 0
jne 0x44fc40
push 0x40
push 0x1000
push 0x1000
push 0
call fcn.004080bc
mov esi, eax
mov eax, dword [0x7327e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x700a60
mov ecx, 2
call fcn.0040296c
mov edx, 0x44fb9c
lea eax, [esi + 5]
call fcn.0044fbbc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0044fbbc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x44fc15
mov dword [0x7327e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44fd5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44fdac]
test si, 4
je 0x44fd70
or bl, 1
test si, 8
je 0x44fd7a
or bl, 4
test si, 1
je 0x44fd84
or bl, 8
test si, 2
je 0x44fd8e
or bl, 0x10
test si, 0x10
je 0x44fd98
or bl, 0x20
push 0x12
call fcn.0040873c
test ax, ax
jge 0x44fda7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44fdb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44fde8]
push 0x10
call fcn.0040873c
test ax, ax
jge 0x44fdc9
or bl, 1
push 0x11
call fcn.0040873c
test ax, ax
jge 0x44fdd8
or bl, 4
test esi, 0x20000000
je 0x44fde3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x456338
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45634a
add esp, 0xfffffff0
call fcn.00403464
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b014
mov eax, ebx
call fcn.00456684
push 0
call fcn.00408744
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x70], eax
push 0
call fcn.004086ec
mov esi, eax
push 0x5a
push esi
call fcn.00408294
mov dword [ebx + 0x34], eax
push esi
push 0
call fcn.004089c4
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x452e28
push eax
push 0
push 0
mov eax, dword [0x730b88]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c51c]
call fcn.0041db18
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x41c51c]
call fcn.0041db18
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x41c51c]
call fcn.0041db18
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.00456a64
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456980
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456980
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456980
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x456459
call fcn.004034bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x456764
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45690f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4568f0
mov dl, 1
mov eax, dword [0x412474]
call fcn.004030f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403ec4
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.0040874c
dec eax
test eax, eax
jl 0x4568df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004439dc
test al, al
je 0x4568d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x456920
lea eax, [ebp - 0x254]
call fcn.0040b3bc
push eax
push 0x80000002
call fcn.00407d6c
test eax, eax
jne 0x4568d2
xor eax, eax
push ebp
push 0x4568cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456958
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407d7c
test eax, eax
jne 0x4568b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x4568b4
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4568d2
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407d34
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4567d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00416158
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456916
lea eax, [ebp - 0x260]
call fcn.00403ec4
ret

Function at 0x45715c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x7327d8]
cmp byte [eax + 0x95], 0
jne 0x4571cd
cmp dword [0x7327f4], 0
jne 0x45718e
call fcn.00407e94
push eax
push 0
mov eax, 0x457118
push eax
push 3
call fcn.00408ad4
mov dword [0x7327f4], eax
cmp dword [0x7327f0], 0
jne 0x4571a9
push 0
push 0
push 0
push 0
call fcn.00407dbc
mov dword [0x7327f0], eax
cmp dword [0x7327f8], 0
jne 0x4571cd
push esp
push 0
push 0
push 0x4570bc
push 0x3e8
push 0
call fcn.00407dd4
mov dword [0x7327f8], eax
pop edx
ret
Function at 0x4572c4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4572db
add esp, 0xfffffff0
call fcn.00403464
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b014
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x411f48]
call fcn.004030f4
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41cf4c]
call fcn.0042563c
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x457450
mov eax, dword [0x730640]
mov eax, dword [eax]
push eax
call fcn.004088fc
mov edx, eax
mov eax, esi
call fcn.00425a0c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458e90
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x730640]
mov eax, dword [eax]
push eax
call fcn.00407eec
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call fcn.00408954
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e9b4
test eax, eax
je 0x4573ce
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040ad18
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e9dc
test eax, eax
je 0x4573e2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call fcn.004084bc
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
mov eax, dword [0x72fe50]
cmp byte [eax], 0
jne 0x457413
mov eax, ebx
call fcn.0045753c
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457445
call fcn.004034bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4577ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x7327d8]
cmp dword [eax + 0x24], 0
je 0x45784f
cmp dword [ebx + 0x84], 0
jne 0x457849
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45773c
call fcn.0040866c
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x457849
push 3
mov eax, dword [esp + 4]
push eax
call fcn.00408804
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.0040881c
test al, 8
je 0x457812
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457849
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00413be4
push eax
call fcn.00408abc
dec esi
cmp esi, 0xffffffff
jne 0x457821
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x45825c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x458291
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call fcn.0040883c
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fac
jmp 0x45829b
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403f18
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x459204
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x45923c
mov eax, esi
call fcn.0043f594
test al, al
je 0x45923c
mov eax, dword [ebx + 0x74]
call fcn.0043f298
push eax
call fcn.004088d4
test eax, eax
je 0x45923c
push 0
mov eax, dword [ebx + 0x74]
call fcn.0043f298
push eax
call fcn.00408b04
pop esi
pop ebx
ret

Function at 0x45edd4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ef3d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403f5c
mov eax, dword [ebp - 0x10]
call fcn.0045e93c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45ee26
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040438c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045f52c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45eefb
xor eax, eax
push ebp
push 0x45eef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0045eae8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0045ef6c
test al, al
je 0x45eed2
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403fac
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x45eed2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404308
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00407d54
test eax, eax
jne 0x45eecc
mov eax, dword [ebp - 0x14]
call fcn.00404308
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040407c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0045edd4
dec ebx
cmp ebx, 0xffffffff
jne 0x45ee85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eefb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045eae8
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00407d34
ret
mov eax, dword [ebp - 0x10]
call fcn.00404308
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0045ead4
push eax
call fcn.00407d44
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef44
lea eax, [ebp - 0x3c]
call fcn.00403ec4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x45ef6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402cd8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call fcn.00407d74
test eax, eax
sete al
mov edx, dword [0x7317d4]
cmp byte [edx + 8], 0
je 0x45efd0
mov edx, dword [0x731788]
cmp dword [edx], 2
jne 0x45efd0
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x45efd4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45f08c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045ef6c
test al, al
je 0x45f06e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403fac
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x45f06e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404308
push eax
push esi
mov eax, dword [edi + 4]
push eax
call fcn.00407d54
mov eax, dword [ebp - 0xc]
call fcn.00404308
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040407c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x45f027
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f093
lea eax, [ebp - 0x2c]
call fcn.00403ec4
lea eax, [ebp - 0xc]
call fcn.00403ec4
ret
Function at 0x45f09c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45f154
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045ef6c
test al, al
je 0x45f136
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403fac
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x45f136
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404308
push eax
push esi
mov eax, dword [edi + 4]
push eax
call fcn.00407d5c
mov eax, dword [ebp - 0xc]
call fcn.00404308
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040407c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x45f0ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f15b
lea eax, [ebp - 0x2c]
call fcn.00403ec4
lea eax, [ebp - 0xc]
call fcn.00403ec4
ret

Function at 0x45f440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0045e950
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404308
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.00407d84
test eax, eax
je 0x45f49e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x730bcc]
mov dl, 1
mov eax, dword [0x45e72c]
call fcn.0040dd68
call fcn.004038bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45f4a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404308
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.00407d7c
test eax, eax
je 0x45f500
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x731804]
mov dl, 1
mov eax, dword [0x45e72c]
call fcn.0040dd68
call fcn.004038bc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045e980
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8